Which US Act restricts the information the federal government can collect and regulates what they can do with the information?

Collecting and Preserving Digital Evidence

Littlejohn Shinder, Michael Cross, in Scene of the Cybercrime (Second Edition), 2008

Privacy Laws

The U.S. Privacy Protection Act (PPA) covers search and seizure of items that fall under the First Amendment (freedom of speech and freedom of the press) protections. The Privacy Act was intended to protect journalists, publishers, and other such people who might have evidence of criminal activity but are not suspected of having committed any criminal act. This law applies to materials that are created for the purpose of disseminating information to the public (which could apply to writings intended to be posted to Web sites, because this is a form of publishing to a public forum).

If there is reason to suspect that the person who has the materials is committing the crime that the materials pertain to, or if there is a danger to some person of physical injury or death that could be prevented by seizing the evidence, the search and seizure are not a violation of the Privacy Act. Violation of the act is a civil rather than a criminal matter. Violators of the act are subject to civil lawsuit, but a violation does not mean that the evidence will be thrown out of court, as is the case with a violation of constitutional rights.

The Electronic Communications Privacy Act (ECPA) was passed to protect the privacy rights of customers of ISPs when their personal information is disclosed. Penalties for violation include civil damages and, in some cases, criminal charges. The ECPA provisions are laid out in Title 18 of the U.S. Code. However, the passage of the U.S. Patriot Act made changes to some of the provisions of the ECPA, which we discuss in the next section.

Note

Some states have their own privacy statutes that can be applicable in specific cases in addition to the federal Privacy Protection Act. Furthermore, special rules under both federal and state laws govern information held to be confidential or privileged by statute, such as that arising from the physician/patient, attorney/client, or clergy/parishioner relationship. These are called legally privileged documents.

Read full chapter

URL: https://www.sciencedirect.com/science/article/pii/B9781597492768000157

Statutory and Regulatory GRC

Leighton Johnson, in Security Controls Evaluation, Testing, and Assessment Handbook, 2016

ECPA – 1986

The Electronic Communications Privacy Act (ECPA) was passed in 1986 – Public Law 99-508, Statute 1848 – and extends the government restrictions on wiretaps from telephone calls to include transmissions of electronic data by computer. The ECPA updated the Federal Wiretap Act of 1968, which addressed interception of conversations using “hard” telephone lines, but did not apply to interception of computer and other digital and electronic communications. Several subsequent pieces of legislation, including the USA PATRIOT Act, clarify and update the ECPA to keep pace with the evolution of new communications technologies and methods, including easing restrictions on law enforcement access to stored communications in some cases. The ECPA provisions are as follows:

Title I of the ECPA, which is often referred to as the Wiretap Act, prohibits the intentional actual or attempted interception, use, disclosure, or “procure[ment] [of] any other person to intercept or endeavor to intercept any wire, oral, or electronic communication.” Title I also prohibits the use of illegally obtained communications as evidence.

Title II of the ECPA, which is called the Stored Communications Act (SCA), protects the privacy of the contents of files stored by service providers and of records held about the subscriber by service providers, such as subscriber name, billing records, or IP addresses.

Title III of the ECPA, which addresses pen register and trap and trace devices, requires government entities to obtain a court order authorizing the installation and use of a pen register (a device that captures the dialed numbers and related information to which outgoing calls or communications are made by the subject) and/or a trap and trace (a device that captures the numbers and related information from which incoming calls and communications coming to the subject have originated). No actual communications are intercepted by a pen register or trap and trace. The authorization order can be issued on the basis of certification by the applicant that the information likely to be obtained is relevant to an ongoing criminal investigation being conducted by the applicant’s agency. [1]

Read full chapter

URL: https://www.sciencedirect.com/science/article/pii/B9780128023242000038

Scientific Ethics

Thomas W. Edgar, David O. Manz, in Research Methods for Cyber Security, 2017

Electronic Communications Privacy Act29

The Electronic Communications Privacy Act (ECPA)is a law that specifies it is illegal to tap, or capture communication, over wires. In addition to the ECPA there are also state laws that cover wiretapping legality. For researchers the important thing to understand about these laws is consent. To legally capture electronic communication requires consent. Whose consent depends upon which legal jurisdiction under which your research falls. Some states require dual consent, which means that all communicating parties must consent to the data capture, but others only require single consent, where only one of the communicating parties has to consent. As a lot of cyber security research includes electronic communications it is important to be aware of these laws.

Read full chapter

URL: https://www.sciencedirect.com/science/article/pii/B9780128053492000157

Privacy

Sharon K. Black Attorney-at-Law, in Telecommunications Law in the Internet Age, 2002

Mixed Communications

Although the ECPA does not define “mixed communications,” the term is frequently used to describe communications that are partly electronic and partly wire communications. For example, a telephone call containing some voice communications and some data communications over the same circuit would be considered an electronic communication for the data portion and a wire communication for the voice portion.60

Similarly, closed-circuit television systems frequently are mixed communications, since the television picture, transmitted over either wire or wireless systems without the voice or “oral” portion, would be considered an “electronic communication.” This is often the case with video surveillance cameras. Since such transmissions have no oral portion, they are not considered wire communications, even though they might be carried over wire. Also, without an oral portion, viewers cannot be guilty of intercepting or wiretapping the communications. Hence, surveillance cameras are not covered by the ECPA. As such, providing closed-circuit television pictures of a meeting is not “illegal interception” under the ECPA because no wire communications were intercepted. On the other hand, if voice were transmitted with the picture, the ECPA would apply to the audio portion as an interception of an oral communication.61 Thus, video cameras typically do not qualify as surveillance devices under the law.62

Paging systems also vary. The ECPA acknowledges three types of paging: tone only, voice, and display pagers. Tone only pagers are not covered by the ECPA because they provide no oral or stored communication to be intercepted and users have no reasonable expectation of privacy for the tone. Voice pagers, on the other hand, are addressed in Title 1 as a continuation of the original wire communications,63 and display pagers are covered as electronic communications since they have no oral portion. Acquiring the telephone number from a digital pager also does not constitute interception under the ECPA because no separate device is used and because transmission over this system is considered to have ceased and the number stored.64

Read full chapter

URL: https://www.sciencedirect.com/science/article/pii/B9781558605466500302

Layer 8: The People Layer

In Hack the Stack, 2006

Electronic Communication Privacy Act of 1986

This Electronic Communication Privacy Act (ECPA) prohibits the interception, disclosure, or use of wire, oral, or electronic communications. The act also makes it illegal to manufacture, distribute, possess, or advertise a device whose primary use is the surreptitious interception of such communications. Furthermore, it is illegal to obtain stored communications by unauthorized means. The content of such communication cannot be used as evidence in court or any other government authority. The Attorney General’s office may authorize an application to a Federal judge to grant an order authorizing the FBI to intercept communications. The act also makes it illegal to make an unauthorized disclosure of an individual’s video rentals or purchases. A court order is required to install a pen register or a trap and trace device, unless the provider of the communication service is installing the device.

Read full chapter

URL: https://www.sciencedirect.com/science/article/pii/B9781597491099500137

Statutory and regulatory GRC

Leighton Johnson, in Security Controls Evaluation, Testing, and Assessment Handbook (Second Edition), 2020

ECPA—1986

The Electronic Communications Privacy Act was passed in 1986—Public Law 99-508, Statute 1848 and extends the government restrictions on wire taps from telephone calls to include transmissions of electronic data by computer. The ECPA updated the Federal Wiretap Act of 1968, which addressed interception of conversations using “hard” telephone lines but did not apply to interception of computer and other digital and electronic communications. Several subsequent pieces of legislation, including the USA PATRIOT Act, clarify and update the ECPA to keep pace with the evolution of new communication technologies and methods, including easing restrictions on law enforcement access to stored communications in some cases. The ECPA provisions are as follows:

“Title I of the ECPA, which is often referred to as the Wiretap Act, prohibits the intentional actual or attempted interception, use, disclosure, or ‘procure[ment] [of] any other person to intercept or endeavor to intercept any wire, oral, or electronic communication.’ Title I also prohibits the use of illegally obtained communications as evidence.

Title II of the ECPA, which is called the Stored Communications Act (SCA), protects the privacy of the contents of files stored by service providers and of records held about the subscriber by service providers, such as subscriber name, billing records, or IP addresses.

Title III of the ECPA, which addresses pen register and trap and trace devices, requires government entities to obtain a court order authorizing the installation and use of a pen register (a device that captures the dialed numbers and related information to which outgoing calls or communications are made by the subject) and/or a trap and trace (a device that captures the numbers and related information from which incoming calls and communications coming to the subject have originated). No actual communications are intercepted by a pen register or trap and trace. The authorization order can be issued on the basis of certification by the applicant that the information likely to be obtained is relevant to an ongoing criminal investigation being conducted by the applicant's agency.”1

Read full chapter

URL: https://www.sciencedirect.com/science/article/pii/B9780128184271000033

Content Filtering

Pete F. Nicoletti, in Computer and Information Security Handbook (Third Edition), 2013

Federal Law: ECPA

The Electronic Communications Privacy Act (ECPA)8 allows companies to monitor employees' communications when one of three provisions are met: one of the parties has

An Agenda for Action for Implementing Content-Control Filtering Software

Social networking sites and nonsocial networking sites are organized into between 10 and 90 various categories. Typical subjects of content-control software include (check all tasks completed):

_____1.

Illegal content with reference to the legal domain being served by that company.

_____2.

Promote, enable, or discuss system cracking, software piracy, criminal skills, or other potentially illegal acts.

_____3.

Sexually explicit content, such as pornography, erotica, nudity, and erotic discussions of sexual topics such as sexuality or sex. Promote, enable, or discuss promiscuity, lesbian, gay, bisexual, transsexual, sexual activity outside of marriage, or other lifestyles seen to be immoral or alternative.

_____4.

Contain violence or other forms of graphic or “extreme” content.

_____5.

Promote, enable, or discuss bigotry or hate speech.

_____6.

Promote, enable, or discuss gambling, recreational drug use, alcohol, or other activities frequently considered to be vice.

_____7.

Are unlikely to be related to a student's studies, an employee's job function, or other tasks for which the computer in question may be intended, especially if they are likely to involve heavy bandwidth consumption.

_____8.

Are contrary to the interests of the authority in question, such as websites promoting organized labor or criticizing a particular company or industry.

_____9.

Promote or discuss politics, religion, health, or other topics.

_____10.

Prevent people who are hypochondriacs from viewing websites related to health concerns.

_____11.

Include social networking opportunities that might expose children to predators.

_____12.

Potentially liable: Drug abuse, folklore, hacking, illegal or unethical, marijuana, occult, phishing, plagiarism, proxy avoidance, racism and hate, violence, Web translation.

_____13.

Controversial: Abortion, adult materials, advocacy groups/organizations, alcohol, extremist groups, gambling, lingerie and swimwear, nudity, pornography, sex education, sport hunting and war games, tasteless, tobacco, weapons.

_____14.

Potentially nonproductive: Advertising, brokerage and trading, digital postcards, freeware, downloads, games, instant messaging, newsgroups and message boards, Web chat, Web-based email.

_____15.

Potentially bandwidth consuming: Internet radio and TV, Internet telephony, multimedia download, peer-to-peer file sharing, personal storage.

_____16.

Potential security risks: Malware, spyware.

_____17.

General interest: Arts and entertainment, child education, culture, education, finance and banking, general organizations, health and wellness, homosexuality, job search, medicine, news and media, personal relationships, personal vehicles, personal websites, political organizations, real estate, reference, religion, restaurants and dining, search engines, shopping and auction, society and lifestyles, sports, travel.

_____18.

Business oriented: Armed forces, business, government and legal organizations, information technology, information/computer security.

_____19.

Others: Content servers, dynamic content, miscellaneous, secure websites, Web hosting.

given consent, there is a legitimate business reason or the company needs to protect itself.

If your company has no content access policy in place, an employee could argue that he or she had a reasonable expectation of privacy. However, if the company has implemented a written policy whereby employees are informed about the possibility of website monitoring and warned that they should not have an expectation of privacy, the company is protected from this type of privacy claim.

Read full chapter

URL: https://www.sciencedirect.com/science/article/pii/B9780128038437000879

Content Filtering

Pete Nicoletti CISSP, CISA, CCSK, in Computer and Information Security Handbook (Second Edition), 2013

There are many legal issues to consider in content filtering. And once you think you have a handle on your particular organizational requirements and have ensured that they are legal, a court will make a ruling that changes the game. A number of Internet technology issues and related challenges have not yet been fully addressed by legislatures or courts and are subject to a wide range of interpretation. For example, virtual child pornography, pornographic images and text delivered by SMS messages, sexual age-play in virtual game worlds, the soft porn Manga genre of Lolicon and Rorikon are all challenges to current laws and issues that will need to be addressed as our society comes to grips with the Internet and what is “out there.” The following discussion centers on the most relevant laws in the content-filtering space.

Federal Law: ECPA

The Electronic Communications Privacy Act (ECPA)8 allows companies to monitor employees’ communications when one of three provisions are met: one of the parties has given consent, there is a legitimate business reason, or the company needs to protect itself.

If your company has no content access policy in place, an employee could argue that he or she had a reasonable expectation of privacy. However, if the company has implemented a written policy whereby employees are informed about the possibility of Web site monitoring and warned that they should not have an expectation of privacy, the company is protected from this type of privacy claim.

CIPA: The Children’s Internet Protection Act

CIPA provisions have both the “carrot and the stick.” The U.S. government will pay you for equipment to access the Internet, but you have to play by its rules to get the money! Having been rebuffed by the courts in its previous efforts to protect children by regulating speech on the Internet, Congress took a new approach with the Children’s Internet Protection Act (CIPA). See, for example Reno v. ACLU, 521 U.S. 844 (1997) (overturning the Communications Decency Act of 1996 on First Amendment grounds). With CIPA, Congress sought to condition federal funding for schools and libraries on the installation of filtering software on Internet-ready computers to block objectionable content.

CIPA is a federal law enacted by Congress in December 2000 to address concerns about access to offensive content over the Internet on school and library computers. CIPA imposes certain types of requirements on any school or library that receives funding for Internet access or internal connections from the E-rate program, which makes certain communications technology more affordable for eligible schools and libraries. In early 2001, the FCC issued rules implementing CIPA. CIPA made amendments to three federal funding programs: (1) the Elementary and Secondary Education Act of 1965, which provides aid to elementary and secondary schools; (2) the Library Services Technology Act, which provides grants to states for support of libraries; and (3) the E-Rate Program, under the Communications Act of 1934, which provides Internet and telecommunications subsidies to schools and libraries. The following are what CIPA requires9 :

Schools and libraries subject to CIPA may not receive the discounts offered by the E-Rate Program unless they certify that they have an Internet safety policy and technology protection measures in place. An Internet safety policy must include technology protection measures to block or filter Internet access to pictures that (a) are obscene, (b) are child pornography, or (c) are harmful to minors (for computers that are accessed by minors).

Schools subject to CIPA are required to adopt and enforce a policy to monitor online activities of minors.

Schools and libraries subject to CIPA are required to adopt and implement a policy addressing: (a) access by minors to inappropriate matter on the Internet; (b) the safety and security of minors when using electronic mail, chat rooms, and other forms of direct electronic communications; (c) unauthorized access, including so-called “hacking,” and other unlawful activities by minors online; (d) unauthorized disclosure, use, and dissemination of personal information regarding minors; and (e) restricting minors’ access to materials harmful to them. Schools and libraries are required to certify that they have their safety policies and technology in place before receiving E-Rate funding, as follows:

CIPA does not affect E-Rate funding for schools and libraries receiving discounts only for telecommunications, such as telephone service.

An authorized person may disable the blocking or filtering measure during any use by an adult to enable access for bona fide research or other lawful purposes.

CIPA does not require the tracking of Internet use by minors or adults.

“Harmful to minors” is defined under the Act as: Any picture, image, graphic image file, or other visual depiction that (i) taken as a whole and with respect to minors, appeals to a prurient interest in nudity, sex, or excretion; (ii) depicts, describes, or represents, in a patently offensive way with respect to what is suitable for minors, an actual or simulated sexual act or sexual contact, actual or simulated normal or perverted sexual acts, or a lewd exhibition of the genitals; and (iii) taken as a whole, lacks serious literary, artistic, political, or scientific value as to minors.

Court Rulings: CIPA from Internet Law Treatise

On June 23, 2003, the U.S. Supreme Court reversed a District Court’s holding in United States v. American Library Ass’n, 539 U.S. 194 (2003).10 It held that the use of Internet filtering software does not violate library patrons’ First Amendment rights. Therefore, CIPA is constitutional and a valid exercise of Congress’s spending power.

The Court held, in a plurality opinion, that libraries’ filtering of Internet material should be subject to a rational basis review, not strict scrutiny. It explained that, because collective decisions regarding printed material have generally only been subject to a rational basis review, decisions regarding which Web sites to block should likewise be subject to the same test. It reasoned that libraries are no less entitled to make content-based judgments about their collections when they collect material from the Internet than when they collect material from any other source.

Further, it reasoned that heightened judicial scrutiny is also inappropriate because “Internet access in public libraries is neither a ‘traditional’ nor a ‘designated’ public forum” (Id. at 2304). Therefore, although filtering software may overblock constitutionally-protected speech and a less restrictive alternative may exist, because the government is not required to use the least restrictive means under a rational basis review, CIPA is nonetheless constitutional.

Moreover, the Court held that Congress did not exceed its spending power by enacting CIPA because, when the government uses public funds to establish a program, it is entitled to define its limits. By denying federal funding, the government is not penalizing libraries that refuse to filter the Internet, or denying their rights to provide their patrons with unfiltered Internet access. Rather, it “simply reflects Congress’ decision not to subsidize their doing so”(Id. at 2308).11

The Trump Card of Content Filtering: The “National Security Letter”

The FBI, CIA, or DoD can issue an administrative subpoena to ISPs for Web site access logs, records, and connection logs for various individuals. Along with a gag order, this letter comes with no judicial oversight and does not require probable cause. In 2001, Section 505 of the PATRIOT Act powers were expanded for the use of the NSL. There are many contentious issues with these laws, and the Electronic Frontier Foundation and the American Civil Liberties Union (ACLU) are battling our government to prevent their expansion and open interpretation.12

State of Texas: An Example of an Enhanced Content-Filtering Law

Texas state law requires all Texas ISPs to link to blocking and filtering software sites. In 1997, during the 75th Regular Session of the Texas Legislature, House Bill 1300 was passed. HB 1300 requires ISPs to make a link available on their first Web page that leads to Internet “censorware” software, also known as “automatic” blocking and screening software. The two most important portions of the law are shown here:

Sec. 35.102. SOFTWARE OR SERVICES THAT RESTRICT ACCESS TO CERTAIN MATERIAL ON INTERNET.

(a) A person who provides an interactive computer service to another person for a fee shall provide free of charge to each subscriber of the service in this state a link leading to fully functional shareware, freeware, or demonstration versions of software or to a service that, for at least one operating system, enables the subscriber to automatically block or screen material on the Internet.

(b) A provider is considered to be in compliance with this section if the provider places, on the provider’s first page of world wide Web text information accessible to a subscriber, a link leading to the software or a service described by Subsection (a). The identity of the link or other on-screen depiction of the link must appear set out from surrounding written or graphical material so as to be conspicuous.

Sec. 35.103. CIVIL PENALTY.

(a) A person is liable to the state for a civil penalty of $2,000 for each day on which the person provides an interactive computer service for a fee but fails to provide a link to software or a service as required by Section 35.102. The aggregate civil penalty may not exceed $60,000.13

(b) The attorney general may institute a suit to recover the civil penalty. Before filing suit, the attorney general shall give the person notice of the person’s noncompliance and liability for a civil penalty. If the person complies with the requirements of Section 35.102 not later than the 30th day after the date of the notice, the violation is considered cured and the person is not liable for the civil penalty.

The following are international laws involving content filtering:

UK: Data Protection Act

EU: Safer Internet Action Plan

Many other countries have also enacted legislation

Additionally, the United Kingdom and some other European countries have data retention policies. Under these policies ISPs and carriers are obliged to retain a record of all their clients’ Web browsing. The data retention period varies from six months to three years. In the U.K. this retained data is available to a very wide range of public bodies, including the police and security services. Anyone who operates a proxy service of any kind in one of these countries needs to be aware that a record is kept of all Web browsing through their computers. On March 15, 2006, the European Union adopted Directive 2006/24/EC, which requires all member states to introduce statutory data retention. The United States does not have a statutory data retention specifically targeting information in this area, though such provisions are under consideration.

Read full chapter

URL: https://www.sciencedirect.com/science/article/pii/B9780123943972000933

Legal

John Sammons, in The Basics of Digital Forensics (Second Edition), 2015

The Electronic Communications Privacy Act

The purpose of the Electronic Communications Privacy Act (ECPA) was to ban a third party from intercepting and/or disclosing electronic communications without prior authorization. This federal statute was passed originally in 1968 as an amendment to the Wiretap Act of 1968. The ECPA underwent its first change in 1994, when it was amended by the Communications Assistance to Law Enforcement Act (CALEA). It was modified once again after the 9-11 attacks by the USA Patriot Act. The Patriot Act was authorized again in 2006 (TechTarget, 2005).

Read full chapter

URL: https://www.sciencedirect.com/science/article/pii/B9780128016350000073

Collecting Legally Defensible Online Evidence

Todd G. Shipley, Art Bowker, in Investigating Internet Crimes, 2014

Electronic Communications Privacy Act

ECPA is actually referring to two laws, the Electronic Communications Privacy Act and the Stored Wire Electronic Communications Act. ECPA “…protects wire, oral, and electronic communications while those communications are being made, are in transit, and when they are stored on computers.” There are three provisions of ECPA, which are commonly referred to as: Title I (Wiretap Act)13; Title II Stored Communications Act (SCA); and Title III (The Pen/Trap Statute). The below is a brief ECPA synopsis and the reader is encouraged to review the statute as well as The ECPA, ISPs & Obtaining Email: A Primer for Local Prosecutors (American Prosecutors Research Institute) and Searching and Seizing Computers and Obtaining Electronic Evidence in Criminal Investigations (U.S. DOJ).

Wiretap Act (18 U.S.C. § 2510-22)

This provision prohibits the interception of “real-time” communication (wire, oral, or electronic) by someone not a party to the communication. There are exceptions to the prohibition, such as providers engaging in actions to render their service, court authorization, and consent. Many states also have their own version of this federal statute.

Court authorization requires a finding of probable cause and such authorization can only be granted for specific enumerated felony offenses (18 U.S.C. § 2516). Additionally, such authorization is limited to a particularly time frame, 30 days, after which the monitoring must stop or a new authorization obtained.

As noted above, one of the exceptions to interception is consent. However, there are two kinds of consent. The first is one-party consent, which is contained in the federal law and 38 state statutes. The other type is called two-party consent. This means that both parties to the communication have to consent to the monitoring for it to qualify for this exception. There are 12 states (CA, CN, FL, IL, MD, MA, MI, MO, NV, NH, PA, and WA) that require two-party consent(Reporters Committee for Free Press).

Generally, this will not impact an online investigation, unless there is a recording of real-time communication, such as might occur during undercover investigations involving instant message or chatroom interactions. In O’Brien v. O’Brien, Case No. 5D03-3484 (2005) a Florida appellate court ruled that computer monitoring was governed by the state’s wiretap statute, which was patterned after the federal law (18 U.S.C. § 2501). In this case, software captured chats, instant messages, and web browsing by an individual without his knowledge. The trial judge in a divorce proceeding ruled the captured ESI was inadmissible as it violated state law. In short, monitoring software use, depending upon the jurisdiction and how it is used, may violate wiretap statutes.

Stored Communications Act (18 U.S.C. §§ 2701-12)

The SCA protects the privacy of a subscriber’s file contents, which are stored by service providers (ISP) and subscriber records, such as their name, billing information, or IP address, maintained by the ISP (18 U.S.C. §§ 2701-12). SCA places restrictions on the release of this information and provides civil and criminal penalties for improper access to protected information. Like the Wiretap Act mentioned previously there are exceptions to these restrictions. However, these exceptions can be rather complicated, hinging on a variety of circumstances, such as whether the service provider is public or nonpublic; what kind of information is being sought (subscriber details vs. contents); whether the content has been accessed or not by the subscriber (email opened); and how long the content has been in storage unopened (less then 180 days). Compelled disclosure can occur, the method of which must be matched to the type of information requested (subscriber records vs. file content), based upon the circumstances noted above.

It is noteworthy that the legal method, i.e., a subpoena, court order, or search warrant, frequently requires a different and greater standard of proof before its issuance. The more “private” the information the greater the standard of proof must be met for the legal compulsion method. For instance, obtaining nonopened email, in storage less then 180 days, requires a search warrant, which can only be issued upon probable cause. Additionally, depending upon the compelling process, SCA may require the subscriber be notified. Deutchman and Morgan (2005) note:

Three types of legal process are available under the ECPA to obtain content and records information: ECPA warrants, 2703(d) court orders and subpoenas. In addition, depending upon the type of information sought, 2703(d) court orders and subpoenas may require notice to the subscriber. Generally, the more personal the information sought, e.g., email content, the higher the burden of proof for law enforcement to obtain the requisite legal process. The ECPA warrant must be supported by probable cause, the 2703(d) court order by ‘specific and articulable facts,’ and a subpoena typically by relevance (p. 13).

SCA also provides a mechanism for law enforcement to request an ISP maintain records for 90 days, subject to a renewal for another 90 days (Preservation of Evidence, 18 U.S.C. § 2703(f)). This allows investigators time to obtain the proper legal compulsion method (search warrant or subpoena) without concern the records will be deleted by the provider. However, the U.S. Department of Justice (DOJ) (2009) notes there are some caveats:

First, § 2703(f) letters should not be used prospectively to order providers to preserve records not yet created. If agents want providers to record information about future electronic communications, they should comply with the electronic surveillance statutes discussed in Chapter 4. A second limitation of § 2703(f) is that some providers may be unable to comply effectively with § 2703(f) requests, or they may be unable to comply without taking actions that potentially could alert a suspect. In such a situation, the agent must weigh the benefit of preservation against the risk of alerting the subscriber. The key here is effective communication: agents should communicate with the network service provider before ordering the provider to take steps that may have unintended adverse effects (p. 140).

A variable resource for ISP contact information for sending preservation requests or serving the various legal compulsion methods is maintained by SEARCH.ORG at http://www.search.org/programs/hightech/isp/. It is also worth noting that many larger ISP also provide law enforcement guides that are quite useful in understanding what records they maintain, including how long and in what format.

The Pen/Trap Statute (18 U.S.C. §§ 3127-27)

The Pen/Trap Statute provides that a government attorney may seek a court order to approve the installation of a device (pen register) that records outgoing addressing information and another device (trap and trace) to recording incoming addressing information. These devices can either be hardware or software based. The legal threshold for obtaining such an order is “…the information likely to be obtained is relevant to an ongoing criminal investigation” (18 U.S.C. § 3122(b)(2)). These orders may authorize the installation and use of the devices for up to 60 days, which may be extended for additional 60-day periods (18 U.S.C. § 3123(c)).

Historically, these devices were used to determine who a suspect was telephoning (receiving and making calls). The devices only record the addressing information and do not capture the actual communication. However, the statute also covers communication between two computers, such as the IP addresses or Internet headers in an email (both “to” and “from” minus the subject line). The statute does not authorize the capture of the actual content of a “real-time” message, which can only be approved by a Wiretap order. A Pen/Trap order would typically be sought when it is difficult to determine where communication is originating. U.S. Department of Justice (DOJ) (2009) reflects:

…a federal prosecutor may obtain an order to trace communications sent to a particular victim computer or IP address. If a hacker is routing communications through a chain of intermediate pass-through computers, the order would apply to each computer in the United States in the chain from the victim to the source of the communications (p. 155).

There are of course exceptions under this statute’s provisions, such as an ISP can install such a device with their consumer’s consent. This statute does not prohibit an individual recording the ISP address from which they are communicating with, such as during a chat session.

Read full chapter

URL: https://www.sciencedirect.com/science/article/pii/B9780124078178000047

Which act restricts what information the federal government can collect?

The Privacy Act of 1974, as amended, 5 U.S.C. § 552a, establishes a code of fair information practices that governs the collection, maintenance, use, and dissemination of information about individuals that is maintained in systems of records by federal agencies.
Copyright is the legal protection afforded intellectual property, such as a song, book, or video game.

Which clause is the source of implied powers under the US Constitution quizlet?

The constitutional source for implied powers is the last clause of Article I, Section 8, which is often referred to as the necessary and proper clause. Reasonably done to carry out the expressed powers.

Is a feature of law governed society and involves having laws that are known?

Due process is a related feature of law-governed societies and is a process in which laws are known and understood and there is an ability to appeal to higher authorities to ensure that the laws are applied correctly.