government lacks thu linancial resources to mouemize its cummunicatuins equipment or to fund the costs of lawful interceptions that it initiates.

Since the total number of content wiretaps in 1991 authorized by Federal | and State courts was only 856 laps (and almost 60% of these were at the State level, 356 Federal versus 500 Slate), and since the call-set-upar pen register tap orders for 1991 at the Federal level were only 2.445. (thus, implying a national total under 7.000), it appears the costs may be better targeted to the specific lines or ports necessary, instead of burdening all lines of ports existing in the network

By comparis.mn, there were over 138 million access lines as of December 31, 1990 according to the United States Telephone Association, and this does not include ports used for cellular ur many other network accesses. (We under stand the current FBI budget provides for $9 million for new digital telephony interception equipment.) Thus, although there is valid reason to be concerned that changes in technology will challenge law enforcement agencies to find and adopt new techniques, there is no immediate crisis requiring swift action.

Broad Scope of the Current Proposal.
The FBI proposal covers all providers of "électronic communications services
and all private branch exchange operators (PBXs). These days, that means
just about everybody, including every business that has its own phone switch
and every company that operates its own local or wide area computer
network. The Electronic Communications Privacy Act defines "electronic
communications services to include electronic mail, file transfers over a local
Area Network (LAN) and, indeed, every form of transmission of a message
other than voice telephone calls (which are also covered by the proposal as
"Wire" communications, and sound waves in the open air (the only form of
communication not covered by the proposal). (See 18U.S.C.2510(12), (15).) AU
"providers" of such services would be affirmatively required, within three
years, to provide law enforcement officials with the capability and capacity
iu intercept communications. This capability would have to be provided
"concurrently with the communication, without detection (apparently with-
out regard to the target of the wiretap possibly employing sophisticated
wiretap detection capabilities), exclusive of any communications between
other parties, regardless of the nobility of the target, and without degradation
of service

These absolute requirements might not be capable of being met, as a technical matter, in some contexts, regardless of costs. The proposal is redundant, in the sense that it requires the ability to access communications at all points during their transmission, even though access at one point is all that is needed in any given circumstance. Although current wiretap law requires "minimization and use of wiretaps as a last resort," the proposal imposes obligations on all communications systems as if preserving the ability to wiretap at any point should be the system designer's highest priority. The application of these requirements would have substantially different costs and other implications depending upon where in a communications pathway they were actually applied. In uny event, they dramatically expand the nature and reach of current law – which requires cooperation but does not grant the government a right to redesign the communications network or the equip ment used by large numbers of businesses.

The FBI has defended its proposal on the ground that it is only seeking to "preserve the status quo," by preventing changes in technology from taking away capabilities that Congress meant to assure when it passed the 1968 and 1986 wiretap statutes. But that nischaracterizes the "status quo. The current wiretap statutes take the communications networks as they find them and do not require any provider of communications service to redesign the system, or to refrain from using any particular technology, solely on the ground that such a technology would make interception more difficult. While there may well be

(The proposal) greatly expands the

jurisdiction of the Attorney General and would represent a giant step beyond

current law and congressional intent

going back to 1968.

sound reasons for all concerned to cooperate to seek to preserve for the government a practical ability to engage in authorized wiretapping there is simply no cristing legal authority for law enforceanent officials to mandate the we a particular technologies and, thus, contrary to the claims made by the FBI, the proposal doce nor simply maintain the status quo, but greatly expands the jurisdiction of the Adorney General and would represent a glant step beyond current law and congressional Intent going back to 1968.

While the proposal impoves rubstantial uncertainties, there is no question that, as drafted, I would have an extremely brand reach. As a result, it could complicate the development of various new technologies. Even though the language of the proposal would extend to cable information systems and Au.onated Teller Machines ("ATMS), the FBI has stressed in its proposal that various systems might be exempted by executive action. But the exemption authority is vague and standardlea - to the net effect is that every system provider has to worry on a continuing basis about whether or not iis system b covered. Moreover, the proposal is clearly designed to cover any system facilitating two-way conversation, regardless of the size of the communicaHomsservice provider. In consequence any small business that installs its own local PBX system for forwarding calls from customers could be required to replace its equipanent with new switches that meet the law's requirements. If current online information services do not track the "services and features used by those who send messages through thetr electronic mail channels, then expensive modifications might be mandated. Because these electronk mail systems are all being poined together, and soune function as links that forward messages between other systems, all night have to be designed to allow 'real ting interception by retransmission to a remote site -- even though delayed searches of stored files would seem to anake a lot more sense in the context of electronic mall.

Costs Likely to Be Imposed by the Proposal.
The costs imposed by this proposal would be passed on to consumers and all
subscribers to eletronic communications services. The total costs, including
costs imposed by its potentially disruptive impact on planning for new
computer and communication technologies, cannot be fully assessed - but
would be very substantial. In its report on the FBI's proposal, the General
Accounting Office ("CAO), page 1. stated: “INJeither the FBI mor the telecom-
munications industry has systematically identified the alternatioes, or coaluated their
costs, benefits, or feasibility." And further at page 4 of the GAO Report: (The
(FBI"s) Mey proposal does not address what the telecommunications industry would
need to do to be in fill compliance with the proposal in the event it is enacted, the
maming of certain technical terms, or who would pay for the cost of wiretapping

The proposal mandates compliance with very brondly stated functional standards and contemplates the exemptions (available from the Attorney General, without the benefit of any specific standards or criteria) will be granted only after this broad new governmental authority has been enacted Into law. The most recent proposal assumes that the costs of compliance will becoane a cost of doing busineu imposed on all communications service providers and passed on to telephone ratepayers and other subscribers to dectronic communications services. (The current law's provision that the government will pay reasonable expenses incurred in cooperating with a spadfc request for interception has not been expressly applied to this new requirement to provide the capability and capacity to respond to such requests) Communication service providers and computer equipment manu. facturers could suffer major lowes as a result of delays, mandatory redesigns, and even prohibition of certain technological options. There has been no opportunity as yet to compare (1) the costs the rol would incur to modernize its approach to interception (especially given the data on the small number of taps performed annually) with (2) the costs that would be incurred by

Although there is valid reason to be concerned that changes

in technology will challenge law enforcement agencies

to find and adopt new techniques, there is no immediate crisis requiring swift action.

consumers as a result of mandatory limitations on new technology design applied to all technologies nationwide.

Uncertainties Created by the Proposal.
By attempting to establish openended duties, broadly defined, in statutory
language, the current proposal creates substantial uncertainties and could
cause controversy to supplant cooperation. For example, although current
interception orders predominantly relate to voice communications, the draft
proposal covers all forms of communication. This approach could sweep up
systems ranging from the cellular pager to the high-speed network designed
to transfer digital data between supercomputers. It raises a wide variety of
questions:

What exactly are the boundaries of the "public switched network to
which the proposal relers?
On what basis would the Atomey General choose, or be required, to
provide exemptions?
How would the proposal affect systems that regularly encode mes
sages at the point of origin?
Does the required provision of capacity to intercept "concurrent with
the transmission to the recipient" mean that an electronic mailor voice
mail or facsimile mail system must be designed to signal the system
operator every time a message from a target of an investigation is
accessed by the person to whom that message might have been
addressed?
Will it be technically leasible to detect and separate just those parts of
a communication signal coming from a particular residence or other
source, that "exclusively represent the content coming from a par-
ticular individual?
What is meant by the new, broad requirement that the government be
told what "services, systems, and features have been used by the
subject of the interception?
Does the required provision of interception capacity "notwithstand-
ing ... the use by the subject ... of any features of the ... system have
the effect of requiring the system provider to offer to defeat any
encryption mechanism it may provide to subscribers?
Does the requirement to provide interception despite the barret's
mobility mean that systems that inherently allow users to send and
receive from multiple points, without notice, cannot be used at all?
Will it be physically possible or economically feasible to prevent
"degradation of services" is the functional requirement for real time
tracking of any target means that some central database must be
checked by the service provider's computers every time a comanund
cation is made?

As drafted, the proposal appears to threaten U.S.

interests in international trade and competitiveness.

We don't know the answers to these questions, despite their importance. More importantly, the answers to key policy questions may differ substantially depending on what particular technology and interception need (and minimization goal) is being addressed. And we don't even know by what means providers of electronic communications services and designers and users of electronic communications and computing equipment will find out how the requirements will be applied to their systems. In short, the FBI's proposal, as currently drafted, may generate new and unnecessary contro versy. despite its legitimate goals, by attacking perceived problems at the wrong level of generality.

Threat to Security and Privacy.
Ironically, in addition to creating uncertainty and imposing costs, the proposal
would itsell create new and serious security risks and undermine the privay
of eiectronic communicates Ilckertronk communications service providers
must design I'vis systems tuwi.cw and ensure FBI access, then the resulting
mar:(nori "X6! dora' ::..; 0:20n-e known loand be exploited by criminals.
Bus.** Startly airpting to achieve greater security in its communice-
Im... wronter te!resu pod by unaut.turizet access, computer viruses,
ani miectroni Hafi. A prepikal the FBI seeks to hostly in terms of law
er. c:1991 mua mbioni the effect of facilitating violations of lar and
reducirs or protein chective security measures
Thiea: io International Trade and Security Interests.
As drafted, the proposal appears to threaten U.S. interests in international
trade and competitiverers. Potential purchasersabrsad onaynor buy products
a systems that they know have a "trap door" the United State Government
can easily open. IFU.S. minifacturers of communications systems and equip.
went and computer software have to go through a bureaucratic certifiction
or clearance process that is not applicable to their foreign competitors, their
rue to the market with new technologies will be slowed and their products
and designs will be disadvantaged.

Legitimate Law Enforcement Concerns Should Be Served. Thwre is no doubt that authorized wiretapping to an inportant weaton properly used by the FBI to fight serious critne. And there is generaicgrcearcni anong communications service providen, and the makers of communkra. tions and computing equipmetel, that the FBI is entitled mful cooperation la its efforts to exercise the powers granted to it in the wiretap statute. If new technologies require changes in police tactia, then acroar.modations may be needed on all sides to make sure that new tactics that do not threaten the effectiveness or safety of law enforcement for unreasonably threaten privacy Interests) are available. The FBI proposal has served a valuable purpose in drawing attention to the need for adequate planning and ratnubled coopera tive efforts

It Is Too Soon to Know if Legislation Will Be Necessary.
Despite the good intentions underlying the FB2, proposal, there le certainly no
demonstrated need to haw.per U.S. technologicaladvancus, tarm the compers
tiveness of the US communications or computea industries, or hinda eliorts
by business to increase mapalm security, hisi to make sure that law enforte
ment officials can cortirue indefinitely to we the um egutenent and
procedures tut were appropriate for an earlier techniogy. There has as yet
been no clear showing that the design of new bad:norogins will not permit
reasonable, affordable and effative techniques to be wed for onthorized
Interception. There has been no showing that the industry will not or commut
woperate fully, share bechnical informatior under appropriate proxections,
and even design and supply iw equipment at reasonable cosi, Irsofar as !
there steps prove necessary for the FBI is rccompitah is mission. There has
beer. no riear showing that any capacity limitations could not readily be
remedied with the prortaion of adequate financing for govermanent low
enforcronent operations

Congress shoaid reject the FBI proposal

and encourage continuing discussions....

The Proposal Is Premature in light of Industry Efforts.
Aand hoc coalition an interested paniec hos poisond together to study the issues
pored by the FBI's proposal and to begin decussions tavolving various
business interests, public interest groups, the law enforcemer: coaanurity. I
legislative stafi, and representatives of tive Adorinistration. All involved
recognize that the foi o entitied to have adequate tools to fulfil the sw
enforordnent objectives. For its part, the FBI has recognised the value of
Industry cooperation and the need for a more robust exchange of technical
Information. Once the technical issues come into incus, particular posicy issues ....---

may be ripe for decision, in a context in which the costs and implications of such decisions for trade, security and privacy concerns will be much more clear. Technical Working Groups representing both the telephone companies and the computer industry are hard at work — but the issues are coinplex and even the first stage of identifying serious potential problems for law enforcement will take some time. Consideration of proposed solutions should await the results of these detailed and technical discussions.

Conclusion. As the broad collaboration that accompanied consideration of the 1986 amendments to the wiretap statute showed, the public interest in sound law enforcement, and public expectations of privacy and security, are best served by encouraging a constructive exchange of views among industry, concerned citizens and government before any new legislation is enacted. Congress should reject the FBI proposal and encourage continuing discussions that will lead to more specific identification of any problems and to concrete, ecsteffective solutions.

For further information contact:

John Podesta, Coalition Legislative Counsel (202) 514-6906
David Johnson, Coalition Counsel (202) 663-6722
Jerry Berman, EFF Washington Office Director (202) 544-9237

Prepared by:

Electronic Frontier Foundation

Washington Office
666 Pennsylvania Avenue, SE,

Suite 303
Washington, DC 20000

202) 344-9237 tel
(202) 547-5481 fax