C. Roaming-The revised legislation addresses the concerns that the wireless industry expressed over the cost and complexity to add capability to retrieve content in a roaming environment. Wireless technology, fortunately, has the capacity to advise law enforcement when a target has traveled outside the home market, and to identify this roaming market in which the target may be using his or her cellular phone. This then, enables a tap to be put on the switch in the distant market.

One of the great improvements made in the legislation was a recognition of how this capability can be used effectively and at lower cost than previously proposed alternatives.

D. Cost Reimbursement-The revised legislation provides that the government reimburse industry service providers for the reasonable costs incurred in establishing the capabilities deemed necessary to ensure the ability to continue to conduct lawful electronic surveillance, as well as to reimburse costs incurred to expand capacity to meet the projected demands. It remains, however, an open question as to what will ultimately be the full extent of those costs. Until each carrier examines its system status in light of these legislated capability requirements, and until the capacity requirements of law enforcement agencies at the state and federal level have been quantified, and until price quotes are obtained from manufacturers and suppliers on the necessary changes and additions to these systems, an accurate projection of costs cannot be known.

We would urge the Congress to delay implementation or compliance dates until it has determined these cost elements. There is a Catch-22 in the offing if Congress does not first make such factual determinations. Carriers will be required to provide capacity and suffer penalties for the failure to do so and the taxpayers will be required to fund the capacity without either party knowing the extent or nature or cost of that capacity. What this legislation could end up creating, therefore, is a requirement (and penalties) for the carriers and insufficient funding-simply because the capacity requirement was a wish list, not an optimal solution.

For instance, there are just over 1,100 cellular switches in operation covering 1,529 systems nation-wide. However, a review of the wiretap data reveal that of the 225 wiretaps executed on cellar systems, 50 percent were performed in only two states. 80 percent of the total were executed in only six states (see attachment A]. While the data doesn't reveal the cities in each state where the taps occurred, it is likely that only one major city in each state was the principal location.

This kind of information coupled with accurate cost data, can enable the Congress to make an informed decision as to whether or not it is a wise use of tax-payer dollars to require outlays for many wireless systems in the nation to meet the capability requirements, or whether it would be better to establish a method to prioritize necessary system upgrades in relation to wiretap demands over a longer period of time. This would avoid imposing unreasonable demands upon the federal treasury, and avoid the potential imposition of lengthy delays in the reimbursement of such costs to the telecommunications carriers, where unreimbursed outlays can have a substantial impact on operations, particularly for the smaller and newer carriers.

VI. CONCLUSION

The testimony presented today is intended to illustrate that the wireless telecommunications industry's history of supporting the lawful needs of the FBI and other law enforcement agencies around the country as regards surveillance requirements. It is the industry's intention to continue to work closely with law enforcement to maintain that compliance.

To the extent that the Congress deems this additional legislation necessary to fully ensure future capacity and capability of both industry and law enforcement, a careful and reasoned approach to the many issues and the costs attendant thereto is vital, with meaningful input from the affected industry and public interests that have appeared before the Committees.

Finally, there a major criminal activity which is addressed in this revised legislation by the Congress the fraudulent cloning of wireless technology that impedes law enforcement, intrudes on consumer privacy and defrauds wireless service providers. We strongly endorse this measure and urge its adoption in full.

Thank you for the opportunity to appear today. I will be happy to respond to any questions that you may have.

Source: Administrative Office of the United States Court Wiretap Report. For the period January 1, 1993 to December 21, 1993.

Representative EDWARDS. Thank you, Mr. Wheeler.

I am sure that you all can count on the Congress, both in the House and in the Senate, working closely in the years ahead as these problems develop. We are pretty resilient around here, especially where something as important as this is concerned, so I hope we can handle that in the future.

The last member of the panel is Jerry Berman, who for many years has worked both with the Senate committees and the House committees and has always been a trusted expert on privacy. Mr. Berman is Director of the Electronic Frontier Foundation. Welcome, Mr. Berman.

STATEMENT OF JERRY BERMAN, DIRECTOR OF POLICY, ELECTRONIC FRONTIER FOUNDATION

Mr. BERMAN. Thank you, Chairman Edwards, and thank you, Chairman Leahy, for allowing me to testify today.

Like the other witnesses, I really want to commend both of you and your staffs and Senator Biden's staff and Ken Mendelson with Chairman Brooks for having really done an incredible job in transforming a bill which we saw as a potential privacy nightmare into a bill which is carefully crafted to protect privacy, not only as industry is required to meet and continue to deliver a wiretap capability subject to court authorization, but in recognizing that technology is a two-way street.

When technology hampers law enforcement, law enforcement makes a case that it requires legislation or redress. They have

made that case. We might believe that it could have been done with a funding bill or some other vehicle, but we are beyond that. But I think that what you have crafted here is a bill that is very narrow in scope. It leaves out information services, the Internet, the manipulators of content on the information highway, which were included in the last bill, and that was a very troubling thing. They are not here.

You have set up an open standards process, allowed industry to make standards, allowed privacy interests to be taken into account in the design feature, and also allowed privacy advocates to intervene in this process if security interests are at stake.

I think that subject to resolving the cost issue, which I will come back to at the end of my statement, in the legislative process as we go forward, I think that if we are going to pass a digital telephony bill, this is the bill to pass.

I must also point out that the other side of the technology street is that when technology advances, privacy can also be impaired and undermined and eroded. This legislation, unlike previous drafts, as the FBI Director has pointed out, deals with some of those privacy problems that have been created by the evolving technology and which Senator Leahy's task force in 1991 identified and which the presence of a Digital Telephony bill gave us an opportunity to look at the other side of the issue.

I really want to point out that in addition to the changes that were made for cordless phones and so forth, that significant advances have been made here for privacy in the kind of electronic world we are going to be and increasingly living in.

This legislation requires that the FBI get a court order, based on reasonable suspicion and articulable facts, that in order to get the transactional information that is generated in electronic messages and E-mail messaging. In many ways, it looks like just addressing information which in other regimes is subject to a subpoena. Here, a court order is being imposed because of the recognition that the richness of these transactions, the fact that it really, on a minuteby-minute basis, can tell you who you are talking to, what you are doing, what you are interested in, it reveals content. So the committee and the Congress is recognizing, and the FBI is agreeing, that it deserves higher scrutiny, and that is an important protection that is in this bill.

It is also important that one of the requirements that the committee has imposed is a requirement not to design ongoing location features into the electronic technology for communications. We do not want to turn our cellular and radio-based communication systems into nationwide tracking systems for persons who may be of interest to law enforcement and who are not subject to a warrant. It is important that the legislation also says that the additional information which is gained by pen registers, because it captures more digits than just that which reveal the telephone number, has to be stripped off and they have to move toward technology which strips it off, because more and more content is coming through the touch-tone phone over a pen register.

It is also important that this legislation says that carriers have no responsibility to decrypt any communications, so that people using encryption technology for their privacy, you have to move

those communications across this network, which is very important and, of course, is the subject of another ongoing debate which Senator Leahy has been working on and which I am sure we will return to again next year.

As the Director points out, it is also important that this technology can be designed so that you can have an on/off switch at the central office that will allow the FBI to turn on taps from a remote site. This legislation says they cannot do that.

I have already pointed out that there are privacy protections built into the requirements process, so as a whole package, I think that these are significant advances for privacy and make the whole package a balanced approach, and if legislation is going to happen, it ought to be this vehicle. We are hoping to work with you to ensure that it stays together and is improved and perfected, and I think we can do maybe more clarifying language on the reasonableness test. I don't want to bother you with a minimization issue that we have, but we will come back to that in the discussion process. I want to come back to the cost issue. There is a letter which the Electronic Frontier Foundation as an advocacy organization has signed along with long-distance carriers and the telephone industry to both of you, to the chairs of the committee and to the committee, saying that we need to resolve this cost issue.

The estimates of $500 million on the one hand and several billion dollars on the other hand from the telephone industry, with GAO saying it is a complicated issue, we think needs to be nailed down, not only for us to know where we are diverting dollars from one priority, like law enforcement, or taking from innovation or expansion of the information highway, but it is a significant privacy issue.

The whole point of this bill turns on there being a compliance process which is reasonable and we need to have a cost on the top of the table and they need to be capped in some way, both to force the FBI and law enforcement to do what they want to do, which is set priorities, but also let industry know that they are going to be paid.

If those issues are not addressed, there is the possibility of skimping on costs which could present privacy problems, or on the other hand, building more capacity into the network because the Government doesn't have to pay for it and they ask for more than they may need because they want to take care of law enforcement. There, we have more capacity than we need and that presents a privacy threat at that level.

So I think that that is an issue which we did not resolve in the negotiating process and I think it is important to nail down in the legislation.

Again, I appreciate the efforts that you have gone through. We have been working with you in a spirit of cooperation, along with the whole coalition. We hope to continue as the process goes forward. Thank you very much.

[Mr. Berman submitted the following:]

PREPARED STATEMENT OF JERRY J. BERMAN ON BEHALF OF THE ELECTRONIC FRONTIER FOUNDATION

Chairman Leahy, Chairman Edwards and Members of both subcommittees: I want to thank you for the opportunity to testify today on your new version of the

Digital Telephony bill (H.R. 4922, S. 2375). The Electronic Frontier Foundation (EFF) is a public interest membership organization dedicated to achieving the democratic potential of new communications and computer technology and works to protect civil liberties in new digital environments. EFF also coordinates the Digital Privacy and Security Working Group (DPSWG), a coalition of more than 50 computer, communications, and public interest organizations and associations working on communications privacy issues. am testifying today, however, only on behalf of EFF.

Since 1992, the Electronic Frontier Foundation has opposed a series of FBI Digital Telephony proposals, each of which would have forced communications companies to install wiretap capability into every communications network. However, earlier this year, when it became apparent that some version of the bill would pass the Congress, the Subcommittees asked EFF along with computer and communications industry groups to participate in a process that would yield a narrow bill that both met law enforcement needs and had strong privacy protections. The result of that process is the bill we have before us today. EFF remains deeply troubled by the prospect of the federal government forcing communications networks to be made wiretap ready,' but we believe that this legislation is substantially less intrusive that the original FBI proposals.

The bill is significantly more narrow than the original proposals in that it exclude a number of electronic communications service providers including online information services, Internet access providers, electronic bulletin board systems, PBX's, and private networks-from any compliance obligation. In particular, the Leahy/Edwards version contains a number of important changes from earlier proposals, including:

• A narrow Scope,

• Open standard-setting process with public right of intervention,

• Technical requirements standards developed by industry instead of the Attorney General,

• Right to deploy untappable services.

In my testimony today, however, I would like to review what I believe to be the most important privacy protections of this bill, and to discuss the areas which EFF still believes require more attention before a bill is passed.

A. NEW PRIVACY PROTECTIONS

The Digital Telephony legislation before us includes significant recognition that new communication technologies, and new patterns of technology use, require new privacy protections. Thanks to the work of Senator Leahy and Representative Edwards and Senator Biden, the bill contains a number of significant privacy advances, including enhanced protection for the detailed transactional information records generated by on line information services, email systems, and the Internet. 1. Expanded protection for transactional records sought by law enforcement

Chief among these new protections is an enhanced protection for transactional records from indiscriminate law enforcement access. Many online communication and information systems create detailed records of users' communication activities as well as lists of the information that they have accessed. Provisions in the bill recognize that this transactional information created by new digital communications systems is extremely sensitive and deserves a high degree of protection from casual law enforcement access which is currently possible without any independent judicial supervision.

EFF commends Senator Leahy, Representative Edwards, and Senator Biden for declaring that law enforcement access to transactional records in online communication systems (everything from the Internet to AOL to hobbyist BBS's) threatens privacy rights. Privacy interests are implicated because:

• The records are personally identifiable,

• They reveal the content of people's communications, and,

• The compilation of such records makes it easy for law enforcement to create a detailed picture of people's lives on line.

Based on this recognition, the draft bill contains the following provisions:

• Court order required for access to transactional records instead of mere subpoena

In order to gain access to transactional records, such as a list of to whom a subject sent email, which online discussion group one subscribes to, or which movies you request on a pay-per view channel, law enforcement will have to prove to a court,