wiretaps

Copyright 2005 - 2009: Hi Tech Criminal Justice, Raymond E. Foster

Police TechnologyPolice TechnologyChapter FourteenChapter Fourteen

WiretapsWiretaps


Learning ObjectivesLearning Objectives

Context and value of gathering covert Context and value of gathering covert informationinformation

Difference between device-identifying Difference between device-identifying information and call-content informationinformation and call-content information

Impact of Communications Assistance for Impact of Communications Assistance for Law Enforcement Agencies (CALEA)Law Enforcement Agencies (CALEA)

Legal and practical aspects of wiretapsLegal and practical aspects of wiretaps PEN registries, traps, traces and the InternetPEN registries, traps, traces and the Internet The Patriot ActThe Patriot Act


What is Electronic Surveillance?What is Electronic Surveillance?

Intercepting Intercepting information by information by electronic means electronic means from:from: Telephone calls.Telephone calls. Private Private

conversationsconversations Internet Internet

communicationscommunicationsPhotograph provided by Robert Eplett, California Photograph provided by Robert Eplett, California Governor’s Office of Emergency ServicesGovernor’s Office of Emergency Services


Legal History of WiretapsLegal History of Wiretaps

1928 Olmstead v United States – not 1928 Olmstead v United States – not illegal unless trespass is involved.illegal unless trespass is involved.

1934, Congressional Communications Act 1934, Congressional Communications Act – although it said that wiretaps were – although it said that wiretaps were essentially illegal, it was still interpreted – essentially illegal, it was still interpreted – no trespass, not illegalno trespass, not illegal

1967 court decisions provided telephone 1967 court decisions provided telephone communications with the full protection of communications with the full protection of the Fourth Amendment – No warrant no the Fourth Amendment – No warrant no tap.tap.



1968 Omnibus Crime Control and Safe 1968 Omnibus Crime Control and Safe Streets Act - specified rules state and Streets Act - specified rules state and federal organizations must follow.federal organizations must follow. Required both prosecutorial and judicial Required both prosecutorial and judicial

reviewreview 1994 Communications Assistance for 1994 Communications Assistance for

Law Enforcement Act (CALEA) - Law Enforcement Act (CALEA) - required commercial carriers required commercial carriers cooperation.cooperation.



1986 Electronic Communications 1986 Electronic Communications Privacy Act (ECPA) – Established a Privacy Act (ECPA) – Established a lower threshold of judicial review for lower threshold of judicial review for capturing device identifying capturing device identifying information.information.

2001 USA PATRIOT Act – reduced 2001 USA PATRIOT Act – reduced threshold for some federal wiretaps threshold for some federal wiretaps and, in some instances, for “roving” and, in some instances, for “roving” taps.taps.


Wiretap DefinitionsWiretap Definitions

Call content is the substance of the Call content is the substance of the call – the conversation.call – the conversation. For internet communications this would For internet communications this would

be the subject line and body of the be the subject line and body of the message in an email communication.message in an email communication.

Device identifying information is the Device identifying information is the commonly the telephone number of commonly the telephone number of the callers.the callers. For internet communications it would be For internet communications it would be

the to and from lines of an email the to and from lines of an email message.message.


Wiretap DefinitionsWiretap Definitions

Operational Security refers to Operational Security refers to the concept that the target, the concept that the target, or unauthorized persons, or unauthorized persons, should not have knowledge of should not have knowledge of the wiretap during the the wiretap during the investigation.investigation. Both the agency conducting the Both the agency conducting the

wiretap and the service provider wiretap and the service provider have responsibilities.have responsibilities.

Primarily, the service provide Primarily, the service provide must ensure transparency – that must ensure transparency – that is a tapped call sounds no is a tapped call sounds no different to the target.different to the target.

Typical wiretap hardware.Typical wiretap hardware.Photograph provided by ADACS Corp.Photograph provided by ADACS Corp.


General Wiretap RulesGeneral Wiretap Rules

Generally requires both prosecutorial Generally requires both prosecutorial and judicial review.and judicial review.

Wiretaps require probable cause like Wiretaps require probable cause like any search warrant.any search warrant.

Must focus on gaining specific Must focus on gaining specific information about a crime – not just information about a crime – not just general investigative informationgeneral investigative information



To obtain court order, investigators To obtain court order, investigators must show that the information cannot must show that the information cannot be obtained in another manner.be obtained in another manner.

Investigators must provide the court Investigators must provide the court with:with: Articulate specific offense.Articulate specific offense. Specific place to be tapped.Specific place to be tapped. Types of conversations believed to be Types of conversations believed to be

overheard. overheard.



Because wiretaps require judicial and Because wiretaps require judicial and prosecutorial review (and significant prosecutorial review (and significant technology and personnel resources) technology and personnel resources) it is likely the process will require it is likely the process will require significant bureaucratic review within significant bureaucratic review within their organization. their organization.

Intercepted conversations must be Intercepted conversations must be recorded and protected from editing, recorded and protected from editing, alteration or deletion.alteration or deletion.



Investigators must Investigators must protect the Rights of protect the Rights of non-involved persons.non-involved persons. Generally, a Generally, a

conversation is conversation is monitored for a limited monitored for a limited time and if it is not time and if it is not criminal in nature the criminal in nature the tap is discontinued – a tap is discontinued – a single call may be single call may be checked periodically to checked periodically to determine if a relevant determine if a relevant conversation has begun.conversation has begun.



In most states, only investigator’s In most states, only investigator’s with specialized training can with specialized training can overhear live conversations. overhear live conversations. However, once a conversation has However, once a conversation has been recorded it is considered been recorded it is considered evidence and anyone with access to evidence and anyone with access to the evidence can listen to the the evidence can listen to the conversations.conversations.


General Wiretap RulesGeneral Wiretap Rules Every five days the investigators must Every five days the investigators must

provide the judicial authority with a provide the judicial authority with a thorough review of the conversations.thorough review of the conversations.

In addition to five day review, at the end In addition to five day review, at the end of the tap, the investigator’s must of the tap, the investigator’s must provide both the judicial and provide both the judicial and prosecutorial authority with a complete prosecutorial authority with a complete review.review.

Thirty days after the conclusion of the Thirty days after the conclusion of the tap, tap, each personeach person whose conversations whose conversations were recorded must be notified in writing.were recorded must be notified in writing.


Conducting a WiretapConducting a Wiretap

Generally, wiretaps are expensive Generally, wiretaps are expensive and technology intensive operations and technology intensive operations – the service provider intercepts the – the service provider intercepts the call and forwards it to a wire room.call and forwards it to a wire room.

Because of the investment required Because of the investment required many jurisdictions use regional wire many jurisdictions use regional wire rooms – locations specifically rooms – locations specifically designed and dedicated to wiretaps.designed and dedicated to wiretaps.


Conducting a WiretapConducting a Wiretap

Technology has Technology has made compliance made compliance much simpler. For much simpler. For instance, software instance, software can now be used to can now be used to record conversations record conversations and provide the and provide the necessary reporting. necessary reporting.

Screen Capture provided by Pen-LinkScreen Capture provided by Pen-Link™™


Wiretap SoftwareWiretap Software

As investigators As investigators monitor telephone monitor telephone conversations they conversations they have the ability to have the ability to connect to other connect to other databases and databases and begin to integrate begin to integrate the information.the information.Screen Capture provided by Pen-LinkScreen Capture provided by Pen-Link™™


Pens, Traps and TracesPens, Traps and Traces

A Pen register A Pen register refers to capturing refers to capturing call-identifying call-identifying information with information with the content…who the content…who is calling who, but is calling who, but not what they are not what they are taking about. This taking about. This is an device is an device connected to a connected to a local junction box local junction box and retrieved later.and retrieved later.

Photograph provided by Dianatek Corp.Photograph provided by Dianatek Corp.



In compliance with with In compliance with with CALEA, cellular and CALEA, cellular and hard-wired telephone hard-wired telephone identifying information identifying information is now routed to law is now routed to law enforcement via secure enforcement via secure TCP/IP connection.TCP/IP connection.

With Cellular With Cellular information, the cell site information, the cell site can be known and the can be known and the target’s general target’s general location determined.location determined.

Indicates cell Indicates cell receptionreception

Screen Capture provided by Pen-LinkScreen Capture provided by Pen-Link™™



Device identifying information may Device identifying information may establish co-conspirators or draw a establish co-conspirators or draw a link between the target and a crime.link between the target and a crime.

TRAPS and TRACES are very much TRAPS and TRACES are very much like the caller identification like the caller identification information commercially available information commercially available to consumers. These devices let to consumers. These devices let investigator’s who is calling – investigator’s who is calling – typically used in stalking or annoying typically used in stalking or annoying telephone call investigations.telephone call investigations.


Internet CommunicationsInternet Communications

Through email, chat Through email, chat and websites, the and websites, the internet has internet has become a form of become a form of criminal criminal communications.communications.

Like wire taps, Like wire taps, identifying identifying information and information and content information content information have different have different judicial thresholds.judicial thresholds.


Internet CommunicationsInternet Communications

Network diagnostic tools called packet Network diagnostic tools called packet sniffers are used to inspect data as it flows sniffers are used to inspect data as it flows across the Internet.across the Internet.

These software programs can “sniff” for These software programs can “sniff” for addressees, addressors and content in addressees, addressors and content in email communications.email communications.

Recently, the Federal Bureau of Recently, the Federal Bureau of Investigation has not used its own “sniffer” Investigation has not used its own “sniffer” Carnivore, but another commerical Carnivore, but another commerical product.product.


Magic LanternMagic Lantern There are any number There are any number

of software programs of software programs that can be loaded onto that can be loaded onto a computer to record a computer to record keystrokes. This is a keystrokes. This is a way to surreptitiously way to surreptitiously gain passwords.gain passwords.

Most recent referred to Most recent referred to as Keylogger software, as Keylogger software, commercially available commercially available and used on home as and used on home as well as commercial PCs.well as commercial PCs.


Telephone and InvestigationsTelephone and Investigations

More than just More than just receiving and receiving and sending information, sending information, the telephone is an the telephone is an investigative tool.investigative tool. Miranda requires Miranda requires

detention and detention and accusatory questionsaccusatory questions

If the target is free to If the target is free to hang-up they are not hang-up they are not detained and detained and therefore no Miranda therefore no Miranda protectionprotection

Photograph provided by Robert Eplett, California Photograph provided by Robert Eplett, California Governor’s Office of Emergency ServicesGovernor’s Office of Emergency Services


USA PATRIOT ActUSA PATRIOT Act

Several sections are expiring and up for Several sections are expiring and up for renewal in 2005.renewal in 2005.

Judicial review threshold lowered for “roving” Judicial review threshold lowered for “roving” warrants.warrants. A roving warrant means the target is the subject, A roving warrant means the target is the subject,

not the telephone. If the target changes telephones not the telephone. If the target changes telephones the investigators can continue to monitorthe investigators can continue to monitor

Made telephone and Internet intercepts Made telephone and Internet intercepts similar.similar.

Changed threshold on use of FISA courts and Changed threshold on use of FISA courts and domestic surveillance.domestic surveillance.


Police TechnologyPolice Technology

Explore Explore leadershipleadership at at

www.pokerleadership.comwww.pokerleadership.com

wiretaps

Business

telephone communications

tech criminal justice

thefor internet communications

tofor internet communications

federal wiretaps

patriot actthe patriot

electronic surveillance

telephone number