Images de page

society is a relatively new development which has brought with it uses for ill, as well as innumerable uses for good.

With such an impact on society goes responsibility, in this case the responsibility to look beyond survival and technology to the role of the industry in the community. This includes the responsibility to support law enforcement's ability to lawfully intercept wireless communications. The wireless industry has assumed its responsibility to law enforcement. Cellular carriers were utilized in the execution of nearly 25 percent of the FBI's estimated 976 electronic surveillance court orders executed at the federal and state levels throughout the nation in 1993.2

Twenty-five percent of all wiretaps is illustrative of how the wireless industry has been responsive in the manner m which it has supported law enforcement. Unfortunately, for security reasons law enforcement typically asks carriers not to discuss their success in call interdiction. Thus, it is difficult to portray the many successful instances of joint cellular-law enforcement efforts which exist. Occasionally, however, one story does find its way into the press and, then, can be discussed. One such story is how a cellular company's prompt action saved a life and resulted in a special citation from the FBI. Working with law enforcement, Cellular One in New York, used wireless intercept technology to assist the FBI in apprehending the kidnappers of Harvey Weinstein, the New York clothier who was kidnapped for ransom and buried alive. The cellular carrier was able to determine where the victim was located after his captors forced him at knife point to make a short cellular telephone call to his family to demand ransom money. Cellular One was not only able to record the call detail, but was also able to determine from where the call was placed. During the two-week investigation, critical investigatory information was obtained by the FBI through the cellular network. This information led to the rescue of the kidnap victim, the arrest of the kidnappers, and the recovery of the ransom money. Exhibit III is a reproduction of a news article reporting on this story, including an award of recognition presented by the FBI.

[merged small][graphic][merged small][merged small]

Cellular Plays Key Role In Kidnapping Case

by Robin Susan Traum

Federal sad local law enfone ment agencies used cellular Iechnol. ogy and the expense of Cellular One employee Joe Radicella to setve a recent kidnapping case in New York.

Harvey Weinstein. president of a New York tuxedo company, was abducted at knife point in early Auguse while on his way to pick up his daugher at the airport. I was when the kidnappers forced Weinstein 10 make a cellular phone call to his family demanding ransom that the FBI conuaed Cellular One for assis uance

Raduell... - Sencor Swinch Techno inedis atten:
cian in lew Turk New Jersey. soned tion in the kat
through words of records and rem ler. Radaella's
chata kushing de wormation on the efforts were cka
sin cellular cell Weinstein mack to scribed
his lumili Aner hours of research. yielling meny
Raducella ketemuned the call was significant in
placed from a counterlek cellular tele. vestigative in
phone Over the nen several days. formation and
Radicella provided the FBI with other instrumental in
informatan critical to their investiga. the successful

esclution on
Wiltus und Atm. suthorien's the Harvey
* ere able to kucale Weinstein aher he Weinstein Kiel
had been lich captive for neady mo napping case.
aeeks in a deep pis alongside one of li recognized

FBI Special Agent Hal Switzer (second from left) formally Siew York City's busiest highways. Radicetha for his thanked Senior Switch Technician Joe Radicella (second Shonly thereaher. The police arrested exemplary

from right) for his assistance in the investigation of the his kidnappers and recovered the work positive August kidnapping of New York tuxedo company president ransom money

altitude and Harvey Weinstein. Cellular One Vice President of Network At a cerernuns a Celular Ones professional Operations and Engineering Jack Hart (lett) and Manager ol

Loss Prevention Bill Thorne (right) were also on hand Paramus. Juflices. Two specialagenus ism which re. presenich Radicella nich a special net most favorably upon Cellular Oru kter ol cuinmendation from the FBI In addkion to their more rowine cially uxs it cclloshar ickplunes les and US Department of Justice for his enforcement agencies in the New York New Jersey market !! paulli muke! invaluable assistance in helping solve 10 30 requests each year for specialızed icchanallsssime in the hialnapping that drew national investigations I



It is not only right that wireless providers should assist law enforcement in this way, it is the law. In a 1970 amendment to Title III of the Omnibus Crime Control and Safe Streets Act of 1968, Congress enacted a provision specifying that a "com

2 Source: Administrative Office of the United States Court, Wiretap Report, January 1-December 21, 1993. See attachment A.

munication common carrier * * * shall furnish the government applicant for courtordered electronic surveillance with all information, facilities, and technical assistance necessary to accomplish the interception.”3 While the current law is clear, unambiguous and working, the wireless industry fully understands the concerns expressed by the FBI of the need to keep law enforcement agency capabilities current with new technology in the rapidly evolving telecommunications industry.

The telecommunications industry, including the wireless industry, has continued to work closely with the law enforcement community to resolve technical and electronic surveillance problems. As further evidence of this cooperation, in March 1993, the Board of Directors for the Alliance for Telecommunications Industry Solutions, (ATIS), formerly the Exchange Carrier Standards Association, (ECSA), approved a request from the industry and law enforcement agencies to sponsor a committee to identify those technical and associated operational issues related to lawfully authorized electronic surveillance and to develop resolutions to such issues for voluntary implementation by the industry. That committee is the Electronic Communications Service Provider (ECSP) Committee.

ATIS is a not-for-profit corporation, established for the purpose of promoting timely resolutions of national and international issues involving, telecommunications standards and the development of operational guidelines. ATIS initiates and maintains open industry forums to address technical and operating issues affecting the nation's telecommunications facilities and services, and the development of innovative technologies. ATIS serves as an information resource to its members, its forum participants and other interested parties. It promotes industry progress and harmony with minimal regulatory or legislative intervention.

This government/industry group had been meeting for more than a year prior to its request for ATIS sponsorship. In order to continue the group's momentum, there was a period of transition to full ATIS sponsorship. The first meeting of the ECSP Committee under ATIS auspices occurred on September 1, 1993. The committee has adopted a set of Operating Principles, and selected Committee co-chairpersons; one from the industry and the other representing law enforcement.

Membership in the ECSP Committee is open to all providers of electronic communications services, as defined in Section 2510, Title 18 of the U.S. Code, U.S. law enforcement agencies that are empowered to perform lawfully authorized intercepts of communications, telecommunications equipment manufacturers, and others, such as trade associations, subject to ECSP Committee approval. Due to the sensitive nature of the information that is discussed at ECSP Committee meetings, attendance and access to ECSP Committee information is limited to ECSP Committee members and invited guests who have signed a nondisclosure agreement.

Industry membership presently includes all of the major local exchange carriers, (LECs), interexchange carriers (JC's), major equipment manufacturers such as AT&T, Northern Telecom and Siemens Stromberg Carlson, cellular service providers, and industry trade associations such as United States Telephone Association (UŚTA), and the Cellular Telecommunications Industry Association (CTIA). Law enforcement membership comes from many city, county, state and federal law enforcement organizations.

The Committee operates through Action Teams, which study specifically identified and designated issues. These issues focus on sophisticated communications technology, identified by the Committee, which impact on the ability of federal, state and local law enforcement agencies to conduct court-approved electronic surveillance. The Action Teams identify potential solutions, which are made available to the participants for voluntary implementation in their networks.

The efficacy of this kind of government-industry cooperation and coordination should not be discounted in determining how to legislatively address electronic surveillance issues in a timely and cost-efficient manner.

IV. HOW WIRELESS WIRETAPS WORK In order to fully understand the issues involved in this debate, it is necessary to understand how a wireless system works to facilitate a lawful wiretap. As described previously, when a subscriber places a call from a mobile unit, the call comes to the MTSO. The MTSO, or switch, is a sophisticated computer that processes the call and routes it where it needs to go (Section II, supra). Each switch contains several "ports,” as do most computers, which allow access to the programs and processes that take place internally and are essential to conducting maintenance. It is at this point, using an available port, that the call content and

call detail information can be intercepted.

818 U.S.C. 82518(4).

89-499 - 95 - 6

While switches, usually in the major markets, have sufficient port capacity, a particular MTSO may need additional port capacity because of heavy wiretap demands in that market. Such additional port capacity can be added, within the limits of the physical surroundings of the switch. Typically, such capacity increase comes in banks of 24 ports which costs around $200,000 per bank with associated software.

When a wireless user roams, the tap occurs in the same way at the MTSO in the distant market. The IS-41 network, discussed above in Section II, alerts law enforcement that the suspect has moved and identifies the new location. With this information, a lawful warrant can be obtained from the proper court and the tap can be put on the MTSO at the new site. [It should be noted that this capability is switch-dependent and some in-service switches will need to be upgraded. The cost of such upgrades will vary depending on the type and quality of switch in service, but can be quite expensive.]

There are two types of information which law enforcement seeks through wiretaps. One is the information regarding the call, that is, the number dialed and other "call setup” information. The other information is the content of the call itself (the conversation or the data transmitted during the call).

Call setup information is the MTSO's resident internal data that is used to establish a link to the cellular subscriber. This information contains: (1) call destination (dialed digits); (2) identity of the location of the incoming call; (3) date, time, and duration of the call; and (4) first and/or last cell site used to deliver the call.

All cellular switches provide call setup information. The only issue is how quickly it is available. As a call is completed, the call detail information is stored in the switch's billing records data element and every 24 hours those records are transferred into a data base, at which time the call detail information can be withdrawn. Thus, any cellular system today can provide call detail in an average time of 12 hours. Recognizing law enforcement's desire for immediate call detail information, software has been developed which can pull the call detail immediately upon completion of the call. This capability has been developed without legislation and is now available on switches made by three of the four major switch manufacturers. The average cost for such capability is $50,000.

Dialed digits can be obtained pursuant to what is called a “pen register" warrant. However, pen register warrant authority does not grant law enforcement access to call content. Pursuant to a Title III warrant, law enforcement may obtain call content information on a real-time basis. In order to obtain call content information, law enforcement must simply access a port on the MTSO that processes the call.

V. PROPOSED LEGISLATION The House and Senate Judiciary Committees and their professional staffs are to be congratulated for the substantial revisions that have been made to the original draft proposal put forth by the FBI entitled "The Digital Telephony and Communications Privacy Act of 1994". On the whole it is a much improved statement of the needs of law enforcement and of the obligations imposed upon the telecommunications industry to meet those needs. We would call your attention to several specific provisions of the legislation.

A. "Cellular Fraud—Importantly, in addressing law enforcement's electronic surveillance needs, another criminal activity has been addressed in this revised legislation as well. We've all heard the stories of someone receiving a cellular bill for thousands of dollars for calls they did not place. Criminals are utilizing techniques such as "cloning" and "tumbling electronic serial numbers (“ESN's") to obtain service fraudulently. Cellular companies are presently losing a million dollars a day to fraudulent tampering and alteration of the mobile telephone unit. The proliferation of the fraudulent use of wireless telephones through such techniques is not just a business dilemma, however. If law breakers can make one wireless phone impersonate another with impunity and without fear of punishment, then lawful wiretaps can be compromised since neither a wireless carrier's switch nor law enforcement will know right away which is the “real” number and user.

Today, fraudulent alteration of a wireless phone can be accomplished relatively easily. Each phone is originally programmed with a unique electronic serial number (ESN) at the time of manufacture. When a customer purchases the phone and subscribes to a particular carrier's service, a separate mobile identification number (“MIN”) is programmed into the phone. This ESN/MIN combination becomes the wireless system's means of verifying the identity of the subscriber (it is this information, for instance, which is hauled over the 1541 network to allow tracing of a mobile phone to a foreign market). The ESN/MIN is transmitted continuously to a wireless carrier's switch while the subscriber's phone is in the "on" position. The

switch verifies that the ESN/

MIN combination is a legitimate account and then processes the call.

Utilizing scanner equipment and off-the-shelf software and hardware, a person desiring a cloned phone can capture the subscriber's ESN/MIN off the air and reprogram another phone with that same ESN/MIN combination. Often, the first time there is an awareness that the ESNMIN has been cloned is when a subscriber reports to his carrier that a bill has been received with charges for calls to points around the country or world that the subscriber did not make. The carrier then must program the switch to discontinue processing calls from that ESN/MIN combination and the subscriber is given a new combination.

There are currently over 16 million subscribers using analog wireless phones and it will be many, many years, if ever, before all analog phones are phased out of service and all subscribers are converted to digital. While the introduction of digital technology may slow the pace of cloning temporarily, it can be expected that creative criminal elements and “phone hackers” will soon be able to alter these devices as well.

Altering or reprogramming a wireless phone's ESN or MIN can seriously impact the constitutional and statutory limitations of wiretap procedures as well. A suspect who is using a cloned phone is actually using a wireless communications system's electronic identification of another person without their consent. It is possible then that government will inadvertently intercept one person's private conversations when it thinks it is intercepting another.

In addition to such privacy concerns, the evidentiary ramifications are equally alarming. Because of the existence of cloning, law enforcement may not be able to guarantee that the content and call detail information it intercepts originates from the suspect who is the target of the wiretap. Thus, it can result in the government being unable to establish the requisite link between the tapped suspect and the intercepted call content/call detail needed to incriminate the suspect.

Even when it becomes apparent that a suspect is using a cloned phone and counter-measures are taken, such as giving the legitimate subscriber a new phone with a different ESN/MIN, there is nothing to prevent the target suspect from merely reprogramming his phone with yet another stolen ESN/MIN of another legitimate subscriber. In fact, today's wireless pirates have the ability to reprogram a phone every time a call is made.

The hardware and software necessary for such alterations are readily available and by themselves are not illegal to possess. The use of these unauthorized counterfeit phones is not clearly a crime either. Section 1029 of Title 18, entitled “Fraud and related activity in connection with access devices,” enacted primarily to address credit card fraud, has been the only statutory provision available to the Secret Service and U.S. Attorneys to prosecute these acts. Some federal district courts, and recently the 10th Circuit Court of Appeals, have determined that this statute does cover the possession of cloning equipment or the use of cloned phones even when it is clear from the facts that such possession and use are for fraudulent purposes.

This dilemma can only be remedied by Congressional initiative to clearly make such acts illegal, and then by a concerted effort from law enforcement to work with industry to curtail such activity and the proliferation of the paraphernalia utilized in association with such acts. The wireless industry is pleased to see that this revised legislation does contain such an initiative.

B. Capacity Determinations—The manner in which law enforcement makes a determination of its wiretap capacity must be a very cost-efficient mechanism to ensure that federal funds are not being unwisely or unnecessarily expended. An area where the legislation could be strengthened is the linkage between wiretap capacity and cost.

The amount of the bill presented to the taxpayers will be determined by the size of the wiretap capacity wish list developed by law enforcement. Human nature being what it is, one party will want it to be as large as possible while the other will seek just the opposite. As presently drafted, there is no mediation among these conflicts, save for a unilateral determination by the Attorney General.

We urge you to include in the capacity determination, a notice and comment rulemaking which affords the parties the opportunity to build a record.

*The 10th Circuit Court of Appeals recently ruled that Section 1029 does not apply to cellular "tumbling" fraud. United States v. Brady, No. 934085, slip op. at 13-14 (Dec. 21, 1993) (“Although Congress, without question, has the power to criminalize the use of or trafficking in cellular telephones altered to allow free riding on the cellular telephone system, even when such telephones do not access valid identifiable accounts, Congress did not do so when it enacted 8 1029").

C. Roaming—The revised legislation addresses the concerns that the wireless industry expressed over the cost and complexity to add capability to retrieve content in a roaming environment. Wireless technology, fortunately, has the capacity to advise law enforcement when a target has traveled outside the home market, and to identify this roaming market in which the target may be using his or her cellular phone. This then, enables a tap to be put on the switch in the distant market.

One of the great improvements made in the legislation was a recognition of how this capability can be used effectively and at lower cost than previously proposed alternatives.

D. Cost Reimbursement–The revised legislation provides that the government reimburse industry service providers for the reasonable costs incurred in establishing the capabilities deemed necessary to ensure the ability to continue to conduct lawful electronic surveillance, as well as to reimburse costs incurred to expand capacity to meet the projected demands. It remains, however, an open question as to what will ultimately be the full extent of those costs. Until each carrier examines its system status in light of these legislated capability requirements, and until the capacity requirements of law enforcement agencies at the state and federal level have been quantified, and until price quotes are obtained from manufacturers and suppliers on the necessary changes and additions to these systems, an accurate projection of costs cannot be known.

We would urge the Congress to delay implementation or compliance dates until it has determined these cost elements. There is a Catch-22 in the offing if Congress does not first make such factual determinations. Carriers will be required to provide capacity and suffer penalties for the failure to do so and the taxpayers will be required to fund the capacity without either party knowing the extent or nature or cost of that capacity. What this legislation could end up creating, therefore, is a requirement (and penalties) for the carriers and insufficient funding-simply because the capacity requirement was a wish list, not an optimal solution.

For instance, there are just over 1,100 cellular switches in operation covering 1,529 systems nation-wide. However, a review of the wiretap data reveal that of the 225 wiretaps executed on cellar systems, 50 percent were performed in only two states. 80 percent of the total were executed in only six states (see attachment A). While the data doesn't reveal the cities in each state where the taps occurred, it is likely that only one major city in each state was the principal location.

This kind of information coupled with accurate cost data, can enable the Congress to make an informed decision as to whether or not it is a wise use of tax-payer dollars to require outlays for many wireless systems in the nation to meet the capability requirements, or whether it would be better to establish a method to prioritize necessary system upgrades in relation to wiretap demands over a longer period of time. This would avoid imposing unreasonable demands upon the federal treasury, and avoid the potential imposition of lengthy delays in the reimbursement of such costs to the telecommunications carriers, where unreimbursed outlays can have a substantial impact on operations, particularly for the smaller and newer carriers.

VI. CONCLUSION The testimony presented today is intended to illustrate that the wireless telecommunications industry's history of supporting the lawful needs of the FBI and other law enforcement agencies around the country as regards surveillance requirements. It is the industry's intention to continue to work closely with law enforcement to maintain that compliance.

To the extent that the Congress deems this additional legislation necessary to fully ensure future capacity and capability of both industry and law enforcement, a careful and reasoned approach to the many issues and the costs attendant thereto is vital, with meaningful input from the affected industry and public interests that have appeared before the Committees.

Finally, there a major criminal activity which is addressed in this revised legislation by the Congress—the fraudulent cloning of wireless technology that impedes law enforcement, intrudes on consumer privacy and defrauds wireless service providers. We strongly endorse this measure and urge its adoption in full.

Thank you for the opportunity to appear today. I will be happy to respond to any questions that you may have.

« PrécédentContinuer »