Internet-based text message apps are one of the most common means of communicating today. But when it comes to this relatively new technology, surveillance law is behind the times in important ways, and as is so often the case when the law lags technology, our privacy suffers as a result.
Text messages have for some time been a cash cow for the wireless carriers鈥攂ack in 2007, annual global SMS revenue was estimated to be . Charging consumers 25 cents per 140 character text message is a great way to make money, but when those same consumers are already paying for internet connectivity to their smartphones, the market was . In recent years, a number of internet companies have . In some cases, they have offered low-cost or free SMS services that interoperate with the carriers鈥� existing SMS system. In other cases, large companies like Facebook, Apple and WhatsApp have offered closed text message services to their smartphone using customers. Often seeking to reduce their monthly telephone bills, millions of consumers have migrated from smartphone text message services provided by the wireless carriers to smartphone text message services provided by internet companies.
As this massive switch takes place, there are significant questions about the process that the government is following in order to compel these internet companies to disclose records about their customers鈥� text message conversations. The reason these questions exist is that US law has different standards for the surveillance of telephone and internet records.
Two separate standards under existing surveillance law
provides different levels of legal protection to different types of data. Communications content, the 鈥渨hat鈥� you say, generally receives a greater deal of protection than associated 鈥渕etadata鈥� records, which is the 鈥渨ho鈥� you say it to (as well as the when and where you say it). Although there are many things to dislike about our out-of-date surveillance laws, there is something to be said for the fact that the law is largely neutral with respect to particular technologies.
Thus emails, Facebook messages, private Twitter Direct Messages, and SnapChat photos sent between loved ones are all considered communications content, and receive the same degree of legal protection. This is how it should be.
But while the law is technology-neutral when it comes to communications content, it is not when it comes to metadata, where communications that flow over the telephone network and on the internet are treated differently.
Under one section of the law, , the government can compel the production of internet communications metadata, such as the 鈥渢o鈥� and 鈥渇rom鈥� information associated with emails, with either a search warrant or another type of court order (commonly described as a 鈥渄鈥� order). This means that in order to obtain records about emails or Facebook messages, government agents need to convince a judge to issue an order compelling the production of those records.
Another part of the law, , however, permits the government to obtain local and long distance toll billing records associated with the account with a mere subpoena.
In other words, the government can obtain a list of the numbers (and names) that you call with a subpoena, but finding out the names or email addresses of the people that you email requires a court order.
I suppose it鈥檚 conceivable that different standards for metadata surveillance of internet and phone communications made sense in the past, when telephone calls and emails were conducted with different devices, connected to different networks, and using services provided by companies in different industries. However, today, everything is transmitted over the same device (typically a smartphone), and all kinds of data flow over the same network (the internet).
Given these two separate legal standards, the question arises: is a cellular text message more like a telephone call or an email? Text message services are typically provided by phone companies, and records of those messages (including the numbers of the sender and recipient) appear on monthly telephone bills. Does that mean that records of text messages should be treated like phone billing records, and not receive the higher protection afforded to email and other internet communications? The wireless carriers seem to think so: AT&T鈥檚 permits the government to request SMS metadata. It is likely that the other carriers follow similar policies.
What about a Facebook instant message sent from an app on a smartphone? Well, if the message is transmitted over the internet, from the user鈥檚 iPhone to Facebook鈥檚 servers, surely it should receive the higher protections for communications metadata, even if the iPhone and the internet connection used by the device are provided by a telephone company.
What if the SMS service on a smartphone isn鈥檛 provided by the wireless carrier, but rather, through a third party app? What if the SMS messages are transmitted over the internet to a 3rd party鈥檚 servers (perhaps even the same 3rd party that provides email and IM services) rather than servers provided by the wireless carrier? In such a scenario, are the text messages more like a telephone service, or an electronic communications service like email? Who knows?
Surveillance standards vary for Google鈥檚 many different text messaging services
Google includes (or distributes) at least four different text messaging applications and services for its Android mobile operating system:
- The built-in Android Messaging app, which is an interface to the SMS and MMS services provided by the users鈥� wireless carrier.
- The built-in Google Talk app, which provides text instant messaging, audio chat and video chat services with other users of Google Talk. These messages are transmitted over the internet connection to Google鈥檚 servers.
- The Google+ app, which includes the ability to engage in text-based conversations with other Google+ users. These messages are transmitted over the internet to Google鈥檚 servers.
- The Google Voice app, which provides text messaging to other telephone numbers via an internet connection to Google鈥檚 servers. When the recipients of the text messages are also users of Google Voice, the messages will be delivered by Google鈥檚 servers to the app on their device via the internet. However, if the recipient is not using Google Voice, then Google鈥檚 servers will transmit the message to them as an SMS via their wireless carrier鈥檚 telephone network. Regardless of whether or not the recipient uses Google Voice or not, all data transmitted between the Google Voice app on the sending user鈥檚 phone and Google鈥檚 servers is transmitted over the internet.
The Google+ and Talk apps are clearly internet-based communication services. Therefore, just as with government surveillance of email communications, records associated with Google+ or Talk conversations are clearly protected by 18 USC 2703(c)(1), and their disclosure requires a court order.
It is much more difficult to draw clear lines regarding Google Voice. Messages between two Google Voice subscribers using the Google Voice app on their smartphones are transmitted over the internet and do not use the SMS functionality provided by the wireless carriers. However, since Google Voice is interoperable with the wireless carriers鈥� SMS system, messages sent to people not using Google Voice will be transmitted by Google through the SMS system.
Google Voice is truly a hybrid system, and as such, it is very tough, just by reading the law, to figure out what the legal standard should be for the government to obtain metadata records.
The government is in fact obtaining Google Voice records without a court order
Although the law is anything but clear, court records from a 2012 federal drug case make it clear that Google is in fact turning over records to the government of SMS messages sent via Google Voice with a mere subpoena. In support of a criminal search warrant, a postal inspector in Ohio referenced a previously submitted subpoena to Google, and the Google Voice text message records that Google provided in response.
When I contacted Google to get some clarification regarding their law enforcement policy regarding Google Voice, they gave me the same, PR statement that they to journalist a story:
Like all law-abiding companies, we comply with valid legal process. We take user privacy very seriously, and whenever we receive a request we make sure it meets both the letter and spirit of the law before complying. When possible and legal to do so, we notify affected users about requests for user data that may affect them. And if we believe a request is overly broad, we will seek to narrow it.
I鈥檝e spoken to several surveillance law experts who represent internet and telecommunications companies, and the consensus seems to be that Google is in a tough position. Our out-of-date surveillance law treats telephone and internet communications differently, and so hybrid services that communicate over both internet and communications networks are stuck in a legal grey area.
While I cannot blame Google for adopting this particular reading of an out-of-date law, I do think that the company is worthy of criticism for its complete refusal to discuss its surveillance policies regarding Google Voice. If, as it seems, Google turns over Google Voice text message metadata with a mere subpoena but will insist on a court order before providing Google Talk or Google+ text message metadata to police, this seems like a pretty important bit of information to share with its customers.
Google鈥檚 customers should be free to vote with their feet (or their data), and to use services that offer them the greatest degree of privacy protection, both via technology and the law. Google鈥檚 total failure to be transparent on this issue robs its customers of the ability to take reasonable steps to protect their own communications from warrantless government surveillance.
Finally, while Google鈥檚 lawyers hid behind the non-answer provided by their PR team, Google鈥檚 competitors were far more transparent. Twitter and Facebook both to their mobile users via SMS, including the ability to private to their friends. In response to queries from me, both Twitter and Facebook confirmed that the companies treat communications metadata the same regardless of whether users鈥� messages are transmitted to the companies鈥� servers via SMS or the internet. No court order? No metadata. Not only have these companies apparently adopted a more pro-privacy reading of the law than Google, but they鈥檙e also willing to talk about it.
It doesn鈥檛 make sense to have different legal standards for phone and Internet metadata
Civil liberties groups from both sides of the political spectrum, academics, and companies have to update the Electronic Communications Privacy Act. Congress has made some progress on this, and the Senate Judiciary Committee . However, none of the existing legislative proposals would in any way improve the privacy protections for metadata, either internet or telephone.
As the recent Petraeus scandal demonstrated, metadata is king. The subpoena standard for basic subscriber records (including telephone billing records) mean that obtaining these sensitive records are typically the first step in any investigation, long before the police would be able to convince a judge to sign an order compelling the production of other forms of data.
When Congress first passed ECPA, and permitted the government to obtain communications metadata with a subpoena, the phone companies didn鈥檛 store vast amounts of customer data, and the police didn鈥檛 make a huge number of requests. Today, that has changed. The low-cost of digital storage (as well as pressure from law enforcement agencies) has among the wireless carriers. Likewise, law enforcement agencies now have a for telephone records. Sprint, the 3rd largest wireless carrier alone receives , many of which likely request historical call detail records for text messages.
As the next Congress dusts the cobwebs off of our aging privacy laws, we can only hope that they will also reexamine the merit of having different standards for telephone and Internet metadata.
Learn More 老澳门开奖结果 the Issues on This Page
-
Press ReleaseDec 2024
Free Speech
National Security
老澳门开奖结果 and Partners Urge Supreme Court to Block TikTok Ban老澳门开奖结果 and Partners Urge Supreme Court to Block TikTok Ban
WASHINGTON 鈥� Today, the 老澳门开奖结果, the Electronic Frontier Foundation (EFF), and the Knight First Amendment Institute at Columbia University filed an amicus brief urging the Supreme Court to block the enforcement of a law that would effectively ban people in America from using TikTok as soon as January 19, 2025. Earlier this month, the U.S. Court of Appeals for the D.C. Circuit rejected TikTok鈥檚 challenge to the law. TikTok has asked the Supreme Court for a temporary injunction to prevent the app from being banned while the court considers whether to take the case, saying that unless the justices intervene, the law will 鈥渟hutter one of America鈥檚 most popular speech platforms the day before a presidential inauguration.鈥� 鈥淭he Constitution imposes an extraordinarily high bar on this kind of mass censorship,鈥漵aid Patrick Toomey, deputy director of 老澳门开奖结果鈥檚 National Security Project. 鈥淭he Supreme Court should take up this important case and protect the rights of millions of Americans to freely express themselves and engage with others around the world.鈥� The brief argues that the D.C. Circuit failed to fully address the law鈥檚 profound implications for the First Amendment rights of the 170 million Americans who use TikTok. While the lower court鈥檚 decision correctly recognized that the statute triggers First Amendment scrutiny, it barely addressed users鈥� First Amendment interests in speaking, sharing, and receiving information on the platform. The court also perplexingly attempted to cast the government鈥檚 ban on TikTok as a vindication of users鈥� First Amendment rights, which it is not. The rights groups also explain that the law was intended to suppress certain content and viewpoints that many legislators believe could be amplified on TikTok, including the risk of foreign 鈥減ropaganda.鈥� But under the First Amendment, the government must meet a very high bar to restrict speech based on concerns about its 鈥渕otivating ideology鈥� or 鈥減erspective,鈥� and the government has not come close to meeting that bar here. 鈥淭he government should not be able to restrict speech, especially to the extent here, based on guessing about the mere possibility of uncertain future harm,鈥� said David Greene, civil liberties director at EFF. 鈥淭he Supreme Court should put the TikTok ban on hold while it considers the DC Circuit鈥檚 erroneous ruling.鈥� Finally, the brief underscores that the government can鈥檛 impose this type of sweeping ban unless it鈥檚 necessary to prevent extremely serious and imminent harm to national security. But the government has not provided evidence of impending harm, or evidence that banning TikTok is the only available way to address its concerns. As the brief explains, the D.C. Circuit improperly treated the government鈥檚 invocation of 鈥渘ational security鈥� as a trump card and failed to hold the government to its burden. 鈥淩estricting citizens鈥� access to foreign media is a practice that has long been associated with repressive regimes, and we should be very wary of letting the practice take root here,鈥� said Jameel Jaffer, executive director at the Knight First Amendment Institute at Columbia University. 鈥淚t would do lasting damage to the First Amendment and our democracy if the Supreme Court let this ban go into effect even temporarily.鈥� You can find the brief online here: https://www.supremecourt.gov/DocketPDF/24/24A587/335380/20241217144322392_24A587%20TikTok%20v%20Garland%20Amicus%20Brief%20pdfa.pdf -
Press ReleaseDec 2024
National Security
Religious Liberty
老澳门开奖结果 Statement on New White House Strategy to Counter Islamophobia老澳门开奖结果 Statement on New White House Strategy to Counter Islamophobia
WASHINGTON 鈥� The Biden administration today released the first-ever national strategy to counter Islamophobia and related forms of bias and discrimination, including hate against Arab, Sikh, and South Asian Americans. In advance of the strategy, 老澳门开奖结果 and its partners had urged the administration to overhaul government programs that reflect anti-Muslim discrimination. In particular, we have called for urgent action to constrain governmental agencies from continuing to exercise their authorities and technology to wrongly surveil and investigate, watchlist, and question and detain Muslims at the border, as well as deny immigration benefits to people from Muslim-majority countries. While the White House raised expectations that many of these issues would be addressed, the final strategy ended up falling far short. The following is a statement from Hina Shamsi, director of the 老澳门开奖结果鈥檚 National Security Project: 鈥淲hile this strategy acknowledges discrimination and its harms, it does little to end them and is a squandered opportunity. For decades, American officials have invoked national security to pass laws and implement programs that disproportionately harm Muslims and people perceived to be Muslim. A serious anti-discrimination strategy would concretely address multiple bias-infused government practices that deny our communities equal participation in civic life and our democracy, like federal watchlisting, surveillance, and investigation. We鈥檙e profoundly frustrated that the administration didn鈥檛 take even the basic, overdue step of recognizing that anti-Muslim discrimination is uniquely normalized and embedded in government policies.鈥� -
VirginiaDec 2024
National Security
Trabelsi v. Crawford, et al. 鈥� Lawsuit Challenging Unlawful Detention and Inhumane Treatment of Acquitted ManTrabelsi v. Crawford, et al. 鈥� Lawsuit Challenging Unlawful Detention and Inhumane Treatment of Acquitted Man
Our client, Nizar Trabelsi, is in the United States against his will. The federal government brought him here from Belgium more than a decade ago and charged him with terrorism-related crimes. At trial, the government鈥檚 case failed: a federal jury found Mr. Trabelsi not guilty. But instead of allowing Mr. Trabelsi to return to Belgium after his acquittal, the United States placed him in highly restrictive immigration detention and began an ongoing effort to force him to Tunisia, where he was born and where he will very likely be tortured. Mr. Trabelsi鈥檚 detention violates the Constitution, immigration law, and the extradition treaty between the United States and Belgium. Through this lawsuit, he seeks to return to Belgium, and he demands an immediate improvement of his detention conditions. -
Press ReleaseDec 2024
National Security
Immigrants' Rights
Federal Judge Rejects Acquitted Man鈥檚 Argument That His Immigration Detention Is UnlawfulFederal Judge Rejects Acquitted Man鈥檚 Argument That His Immigration Detention Is Unlawful
ALEXANDRIA, Va. 鈥� This week, the U.S. District Court for the Eastern District of Virginia ruled that the court does not have jurisdiction to decide whether the government can continue to detain Nizar Trabelsi, a Tunisian national who was brought to the United States against his will for prosecution and was cleared of all charges last year. The ruling means the United States will be able to continue to detain Mr. Trabelsi while it attempts to deport him to Tunisia, where he was born and where, as an immigration judge ruled earlier this year, he will likely face torture. The court also concluded that even if it did have jurisdiction over Mr. Trabelsi鈥檚 case, his claims challenging the government鈥檚 detention of him would fail. 鈥淩eviewing claims that the government is holding someone unlawfully is at the core of the judicial function, and we鈥檙e heartbroken for our client that the court got this so wrong,鈥� said Brett Max Kaufman, senior staff attorney with the 老澳门开奖结果鈥檚 Center for Democracy. 鈥淭he government鈥檚 arguments in defense of Mr. Trabelsi鈥檚 detention makes a hash of the Constitution, immigration laws, and its own extradition treaty.鈥� In 2013, the United States forcibly extradited Mr. Trabelsi from Belgium to face criminal charges in the United States. In July 2023, after almost 10 years of highly restrictive pretrial detention, a federal jury cleared Mr. Trabelsi of all charges. But instead of releasing Mr. Trabelsi or returning him to Belgium, the U.S. transferred him to immigration detention, wrongly treating him as an applicant for admission and placing him in the deportation process. Over the years, the Belgian government has issued multiple formal diplomatic requests asking the U.S. to facilitate his return, but the U.S. has refused to send him back. Mr. Trabelsi filed a lawsuit challenging the government's authority to detain him. He also sought immediate improvements to his detention conditions. Those claims were not part of the court鈥檚 ruling today, and will continue to be litigated on a separate track. 鈥淢r. Trabelsi only wants to return to Belgium after being illegally extradited to the United States, held for ten years, and then acquitted by a jury of any crimes,鈥� said Nicole Hallett, clinical professor of law and director of the Immigrants鈥� Rights Clinic at the University of Chicago Law School. 鈥淗e cannot be held indefinitely and we will continue to fight to make sure that justice ultimately prevails.鈥� Mr. Trabelsi is represented by the 老澳门开奖结果, the University of Chicago Law School鈥檚 Immigrants鈥� Rights Clinic, the 老澳门开奖结果 of Virginia, and Professor Jonathan Hafetz of Seton Hall Law School. The complaint in Trabelsi v. Crawford was filed against Jeffrey Crawford, warden of the Farmville Detention Center where Mr. Trabelsi is being held; Liana Castano, ICE field office director for the Washington Field Office; Alejandro Mayorkas, secretary of the Department of Homeland Security; and Merrick Garland, U.S. attorney general.