It’s Too Complicated: How the Internet Upends Katz, Smith, and Electronic Surveillance Law

by Steven M. Bellovin, Matt Blaze, Susan Landau

For more than forty years, electronic surveillance law in the United States has drawn a strong distinction between the protections afforded to communications “content” and those afforded to the“non-content”—also known as “metadata”—associated with it. The legal framework for surveillance law was developed largely in the context of the mid-twentieth century telephone system, which itself treated content and metadata as cleanly distinct technical concepts. In an era of relative stability in telephone services and technologies, the constitutional and statutory legal principles, once established, were usually straightforward to apply to individual cases, even as the technology incrementally improved.

The Internet, a great disrupter in so many ways, challenges bed-rock assumptions on which several principles of modern surveillance law rest. The network’s open and dynamic architecture creates a communication environment where an individual unit of data may change its status—from content to non-content or vice versa—as it travels across the Internet’s layered structures from sender to recipient. The unstable, transient status of data traversing the Internet is compounded by the fact that the content or non-content status of any individual unit of data may also depend upon where in the network that unit resides when the question is asked. In this digitized, Internet Protocol (“IP”)-based communications environment, the once stable legal distinction between content and non-content has steadily eroded to the point of collapse, decimating in its wake any meaningful application of the third-party doctrine. Simply put, the world of Katz, Smith, the corresponding statutes that codify the content/non-content distinction, and the third-party doctrine are no longer capable of accounting for and regulating law enforcement access to data in an IP-mediated communications environment.

This Article examines why and how we now find ourselves bereft of the once reliable support these foundational legal structures provided and demonstrates the urgent need for the development of new rules and principles capable of regulating law enforcement access to Internet communications data.

101 pages, ebook

Published September 1, 2016

About the author

Dr. Steven Michael Bellovin (PhD, Computer Science, University of North Carolina at Chapel Hill; M.S., Computer Science, UNC@CH; B.A., Columbia University) is the Percy K. and Vida L.W. Hudson Professor of Computer Science, Columbia University.

While a graduate student, he helped create Netnews (USENET); for this, he "and the other perpetrators" were given the 1995 Usenix Lifetime Achievement Award (The Flame). He was a member of the Internet Architecture Board from 1996-2002; he was co-director of the Security Area of the Internet Engineering Task Force (IETF) from 2002 through 2004. In 2012 he was appointed Chief Technologist for the United States Federal Trade Commission.

Reviews

[Keith · Rating 4 out of 5]

I do not quite have enough background to fully comprehend both the technical and the legal aspects of this lengthy paper—and neither does much of anyone else beyond the authors, I suspect, which is a large part of why they wrote it—but I do have just enough understanding of both to be fascinated by the interplay between them.

Touching as it does on matters of privacy and the not-at-all-simple 4th Amendment, wiretap law is notoriously convoluted at the best of times, and is rooted in the comparatively simple era of wired telephone communications. As such, the authors make the argument that it is utterly unsuited to the multi-layered nature of the modern, networked IP-communications paradigm for numerous reasons. These reasons are correspondingly difficult to summarize, which is among the reasons why their argument goes on for a hundred pages, another reason being an attempt to lay out the basics of both the legal and technological frameworks, past and present, to more clearly demonstrate what has changed and how.

It has been five years since this was published, and as far as I know little has been done to update the law to match the new realities. Given that Congress is now somewhere between being incapabale of and unwilling to legislate, it would seem to fall on the courts to rectify matters via precedent, which necessarily happens in a piecemeal manner. It remains to be seen if we'll ever get this right, but in the meantime it would seem best to presume that nothing you do on a mobile phone or a computer is offered very much functional legal protection against incursions by the state. However, see also Digital Privacy at the U.S. Border for some more favorable outcomes in related domains.