other mobile unit in the service area. Exhibit I, see supra, illustrates how a wireless call is transmitted. If a subscriber travels beyond the home carrier's geographic area and makes calls on his/her wireless phone, the local carrier in that market will provide the service. This is known as roaming. Wireless carriers allow their customers to use each other's service by executing carrier-to-carrier roamer agreements. These agreements mainly specify which services each carrier will offer roamers, and how the carriers will exchange information to permit timely and concise billing for services rendered on each carrier's system. The billing information exchanged between carriers passes through a series of industry standardized edits, ensuring that billing information which appears on a subscriber's bill is consistently timely, error-free and easy to understand. Each carrier submits it's own figures for revenue owed and due through a central bank, which in turn performs a net financial settlement process. CIBERNET Corporation, a subsidiary of CTIA, administers this program of net settlements for the industry. Roaming connections are more challenging than calls made within the home system. But today, thanks to roaming agreements and the IS-41 signaling protocol, subscribers can use their telephones throughout the nation. The IS-41 technology is particularly important in a law enforcement context because it permits systems to send data to each other regarding a specific call. Exhibit II illustrates how, when a wireless phone is turned on and registered in a roaming market, an IS-41 message is automatically sent to the home system. This message asks if it is okay to provide service to the phone and what special services or features the subscriber uses. The IS-41 message then permits the home MTSO to route calls to the subscriber in the roaming market. III. WIRELESS INDUSTRY SUPPORT OF LAW ENFORCEMENT The wireless telecommunications industry is relatively young, and one which has experienced explosive growth after its "start from scratch." No less an expert than AT&T, the developer of cellular technology, forecast that by the year 2000 there would be only 900,000 cellular subscribers. In its early years, the challenge was to survive and make the technology work. The wireless industry's pervasive impact on society is a relatively new development which has brought with it uses for ill, as well as innumerable uses for good. With such an impact on society goes responsibility, in this case the responsibility to look beyond survival and technology to the role of the industry in the community. This includes the responsibility to support law enforcement's ability to lawfully intercept wireless communications. The wireless industry has assumed its responsibility to law enforcement. Cellular carriers were utilized in the execution of nearly 25 percent of the FBI's estimated 976 electronic surveillance court orders executed at the federal and state levels throughout the nation in 1993.2 Twenty-five percent of all wiretaps is illustrative of how the wireless industry has been responsive in the manner m which it has supported law enforcement. Unfortunately, for security reasons law enforcement typically asks carriers not to discuss their success in call interdiction. Thus, it is difficult to portray the many successful instances of joint cellular-law enforcement efforts which exist. Occasionally, however, one story does find its way into the press and, then, can be discussed. One such story is how a cellular company's prompt action saved a life and resulted in a special citation from the FBI. Working with law enforcement, Cellular One in New York, used wireless intercept technology to assist the FBI in apprehending the kidnappers of Harvey Weinstein, the New York clothier who was kidnapped for ransom and buried alive. The cellular carrier was able to determine where the victim was located after his captors forced him at knife point to make a short cellular telephone call to his family to demand ransom money. Cellular One was not only able to record the call detail, but was also able to determine from where the call was placed. During the two-week investigation, critical investigatory information was obtained by the FBI through the cellular network. This information led to the rescue of the kidnap victim, the arrest of the kidnappers, and the recovery of the ransom money. Exhibit III is a reproduction of a news article reporting on this story, including an award of recognition presented by the FBI. COMLINE → A Publication of McCaw Cellular Communications, Inc. October 1993 Cellular Plays by Robin Susan Traum Federal and local law enforce ment agencies used cellular technol ogy and the expertise of Cellular One employee Joe Radicella to solve a recent kidnapping case in New York. Harvey Weinstein, president of a New York tuxedo company, was abducted at knife point in early August while on his way to pick up his daughter at the airpont k was when the kidnappers forced Weinstein to make a cellular phone call to his family demanding ransom that the FBI contacted Cellular One for assis Lance ЕАНІЫТ 111 FBI Special Agent Hal Switzer (second from left) formally Ism which re- In addition to their more routine waily uses of cellular teleplus enforcement agencies in the New York/New Jersey market y path make 25 to 30 requests each year for specialized technical stance in cm. investigations It is not only right that wireless providers should assist law enforcement in this way, it is the law. In a 1970 amendment to Title III of the Omnibus Crime Control and Safe Streets Act of 1968, Congress enacted a provision specifying that a "com 2 Source: Administrative Office of the United States Court, Wiretap Report, January 1-December 21, 1993. See attachment A. munication common carrier shall furnish the government applicant for courtordered electronic surveillance with all information, facilities, and technical assistance necessary to accomplish the interception."3 While the current law is clear, unambiguous and working, the wireless industry fully understands the concerns expressed by the FBI of the need to keep law enforcement agency capabilities current with new technology in the rapidly evolving telecommunications industry. The telecommunications industry, including the wireless industry, has continued to work closely with the law enforcement community to resolve technical and electronic surveillance problems. As further evidence of this cooperation, in March 1993, the Board of Directors for the Alliance for Telecommunications Industry Solutions, (ATIS), formerly the Exchange Carrier Standards Association, (ECSA), approved a request from the industry and law enforcement agencies to sponsor a committee to identify those technical and associated operational issues related to lawfully authorized electronic surveillance and to develop resolutions to such issues for voluntary implementation by the industry. That committee is the Electronic Communications Service Provider (ECSP) Committee. ATIS is a not-for-profit corporation, established for the purpose of promoting timely resolutions of national and international issues involving telecommunications standards and the development of operational guidelines. ATIS initiates and maintains open industry forums to address technical and operating issues affecting the nation's telecommunications facilities and services, and the development of innovative technologies. ATIS serves as an information resource to its members, its forum participants and other interested parties. It promotes industry progress and harmony with minimal regulatory or legislative intervention. This government/industry group had been meeting for more than a year prior to its request for ATIS sponsorship. In order to continue the group's momentum, there was a period of transition to full ATIS sponsorship. The first meeting of the ECSP Committee under ATIS auspices occurred on September 1, 1993. The committee has adopted a set of Operating Principles, and selected Committee co-chairpersons; one from the industry and the other representing law enforcement. Membership in the ECSP Committee is open to all providers of electronic communications services, as defined in Section 2510, Title 18 of the U.S. Code, U.S. law enforcement agencies that are empowered to perform lawfully authorized intercepts of communications, telecommunications equipment manufacturers, and others, such as trade associations, subject to ECSP Committee approval. Due to the sensitive nature of the information that is discussed at ECSP Committee meetings, attendance and access to ECSP Committee information is limited to ECSP Committee members and invited guests who have signed a nondisclosure agreement. Industry membership presently includes all of the major local exchange carriers, (LECs), interexchange carriers (JC's), major equipment manufacturers such as AT&T, Northern Telecom and Siemens Stromberg Carlson, cellular service providers, and industry trade associations such as United States Telephone Association (USTA), and the Cellular Telecommunications Industry Association (CTIA). Law enforcement membership comes from many city, county, state and federal law enforcement organizations. The Committee operates through Action Teams, which study specifically identified and designated issues. These issues focus on sophisticated communications technology, identified by the Committee, which impact on the ability of federal, state and local law enforcement agencies to conduct court-approved electronic surveillance. The Action Teams identify potential solutions, which are made available to the participants for voluntary implementation in their networks. The efficacy of this kind of government-industry cooperation and coordination should not be discounted in determining how to legislatively address electronic surveillance issues in a timely and cost-efficient manner. IV. HOW WIRELESS WIRETAPS WORK In order to fully understand the issues involved in this debate, it is necessary to understand how a wireless system works to facilitate a lawful wiretap. As described previously, when a subscriber places a call from a mobile unit, the call comes to the MTSO. The MTSO, or switch, is a sophisticated computer that processes the call and routes it where it needs to go (Section II, supra). Each switch contains several "ports," as do most computers, which allow access to the programs and processes that take place internally and are essential to conducting maintenance. It is at this point, using an available port, that the call content and call detail information can be intercepted. 818 U.S.C. §2518(4). 89-499-95 - 6 While switches, usually in the major markets, have sufficient port capacity, a particular MTSO may need additional port capacity because of heavy wiretap demands in that market. Such additional port capacity can be added, within the limits of the physical surroundings of the switch. Typically, such capacity increase comes in banks of 24 ports which costs around $200,000 per bank with associated software. When a wireless user roams, the tap occurs in the same way at the MTSO in the distant market. The IS-41 network, discussed above in Section II, alerts law enforcement that the suspect has moved and identifies the new location. With this information, a lawful warrant can be obtained from the proper court and the tap can be put on the MTSO at the new site. [It should be noted that this capability is switch-dependent and some in-service switches will need to be upgraded. The cost of such upgrades will vary depending on the type and quality of switch in service, but can be quite expensive.] There are two types of information which law enforcement seeks through wiretaps. One is the information regarding the call, that is, the number dialed and other "call setup" information. The other information is the content of the call itself (the conversation or the data transmitted during the call). Call setup information is the MTSO's resident internal data that is used to establish a link to the cellular subscriber. This information contains: (1) call destination (dialed digits); (2) identity of the location of the incoming call; (3) date, time, and duration of the call; and (4) first and/or last cell site used to deliver the call. All cellular switches provide call setup information. The only issue is how quickly it is available. As a call is completed, the call detail information is stored in the switch's billing records data element and every 24 hours those records are transferred into a data base, at which time the call detail information can be withdrawn. Thus, any cellular system today can provide call detail in an average time of 12 hours. Recognizing law enforcement's desire for immediate call detail information, software has been developed which can pull the call detail immediately upon completion of the call. This capability has been developed without legislation and is now available on switches made by three of the four major switch manufacturers. The average cost for such capability is $50,000. Dialed digits can be obtained pursuant to what is called a "pen register" warrant. However, pen register warrant authority does not grant law enforcement access to call content. Pursuant to a Title III warrant, law enforcement may obtain call content information on a real-time basis. In order to obtain call content information, law enforcement must simply access a port on the MTSO that processes the call. V. PROPOSED LEGISLATION The House and Senate Judiciary Committees and their professional staffs are to be congratulated for the substantial revisions that have been made to the original draft proposal put forth by the FBI entitled "The Digital Telephony and Communications Privacy Act of 1994". On the whole it is a much improved statement of the needs of law enforcement and of the obligations imposed upon the telecommunications industry to meet those needs. We would call your attention to several specific provisions of the legislation. A. Cellular Fraud-Importantly, in addressing law enforcement's electronic surveillance needs, another criminal activity has been addressed in this revised legislation as well. We've all heard the stories of someone receiving a cellular bill for thousands of dollars for calls they did not place. Criminals are utilizing techniques such as "cloning" and "tumbling" electronic serial numbers ("ESN's") to obtain service fraudulently. Cellular companies are presently losing a million dollars a day to fraudulent tampering and alteration of the mobile telephone unit. The proliferation of the fraudulent use of wireless telephones through such techniques is not just a business dilemma, however. If law breakers can make one wireless phone impersonate another with impunity and without fear of punishment, then lawful wiretaps can be compromised since neither a wireless carrier's switch nor law enforcement will know right away which is the "real" number and user. Today, fraudulent alteration of a wireless phone can be accomplished relatively easily. Each phone is originally programmed with a unique electronic serial number (ESN) at the time of manufacture. When a customer purchases the phone and subscribes to a particular carrier's service, a separate mobile identification number ("MIN") is programmed into the phone. This ESN/MIN combination becomes the wireless system's means of verifying the identity of the subscriber (it is this information, for instance, which is hauled over the 1541 network to allow tracing of a mobile phone to a foreign market). The ESN/MIN is transmitted continuously to a wireless carrier's switch while the subscriber's phone is in the "on" position. The switch verifies that the ESN/MIN combination is a legitimate account and then processes the call. Utilizing scanner equipment and off-the-shelf software and hardware, a person desiring a cloned phone can capture the subscriber's ESN/MIN off the air and reprogram another phone with that same ESN/MIN combination. Often, the first time there is an awareness that the ESN/MIN has been cloned is when a subscriber reports to his carrier that a bill has been received with charges for calls to points around the country or world that the subscriber did not make. The carrier then must program the switch to discontinue processing calls from that ESN/MIN combination and the subscriber is given a new combination. There are currently over 16 million subscribers using analog wireless phones and it will be many, many years, if ever, before all analog phones are phased out of service and all subscribers are converted to digital. While the introduction of digital technology may slow the pace of cloning temporarily, it can be expected that creative criminal elements and "phone hackers” will soon be able to alter these devices as well. Altering or reprogramming a wireless phone's ESN or MIN can seriously impact the constitutional and statutory limitations of wiretap procedures as well. A suspect who is using a cloned phone is actually using a wireless communications system's electronic identification of another person without their consent. It is possible then that government will inadvertently intercept one person's private conversations when it thinks it is intercepting another. In addition to such privacy concerns, the evidentiary ramifications are equally alarming. Because of the existence of cloning, law enforcement may not be able to guarantee that the content and call detail information it intercepts originates from the suspect who is the target of the wiretap. Thus, it can result in the government being unable to establish the requisite link between the tapped suspect and the intercepted call content/call detail needed to incriminate the suspect. Even when it becomes apparent that a suspect is using à cloned phone and counter-measures are taken, such as giving the legitimate subscriber a new phone with a different ESN/MIN, there is nothing to prevent the target suspect from merely reprogramming his phone with yet another stolen ESN/MIN of another legitimate subscriber. In fact, today's wireless pirates have the ability to reprogram a phone every time a call is made. The hardware and software necessary for such alterations are readily available and by themselves are not illegal to possess. The use of these unauthorized counterfeit phones is not clearly a crime either. Section 1029 of Title 18, entitled "Fraud and related activity in connection with access devices," enacted primarily to address credit card fraud, has been the only statutory provision available to the Secret Service and U.S. Attorneys to prosecute these acts. Some federal district courts, and recently the 10th Circuit Court of Appeals, have determined that this statute does cover the possession of cloning equipment or the use of cloned phones even when it is clear from the facts that such possession and use are for fraudulent purposes. This dilemma can only be remedied by Congressional initiative to clearly make such acts illegal, and then by a concerted effort from law enforcement to work with industry to curtail such activity and the proliferation of the paraphernalia utilized in association with such acts. The wireless industry is pleased to see that this revised legislation does contain such an initiative. B. Capacity Determinations-The manner in which law enforcement makes a determination of its wiretap capacity must be a very cost-efficient mechanism to ensure that federal funds are not being unwisely or unnecessarily expended. An area where the legislation could be strengthened is the linkage between wiretap capacity and cost. The amount of the bill presented to the taxpayers will be determined by the size of the wiretap capacity wish list developed by law enforcement. Human nature being what it is, one party will want it to be as large as possible while the other will seek just the opposite. As presently drafted, there is no mediation among these conflicts, save for a unilateral determination by the Attorney General. We urge you to include in the capacity determination, a notice and comment rulemaking which affords the parties the opportunity to build a record. The 10th Circuit Court of Appeals recently ruled that Section 1029 does not apply to cellular "tumbling" fraud. United States v. Brady, No. 934085, slip op. at 13-14 (Dec. 21, 1993) (“Although Congress, without question, has the power to criminalize the use of or trafficking in cellular telephones altered to allow free riding on the cellular telephone system, even when such telephones do not access valid identifiable accounts, Congress did not do so when it enacted § 1029"). |