7/27/00- Updated 02:06 PM ET

Search warrants for online data soar By Will Rodger, USATODAY.com

Discuss: Online search warrants The number of search warrants seeking citizens' online data has soared during the past several years, a USATODAY.com study shows.

The findings, based on an examination of search warrants served on the nation's largest Internet service provider, America Online, came as a surprise to federal lawmakers and civil libertarians and are prompting calls for legal reforms.

The warrants, served by state and local investigators from across the nation, were aimed at discovering the identity and activities of AOL subscribers. In 1997, AOL was served with 33 search warrants, according to court logs in Loudoun County, Va., where AOL is based. That number jumped to 167 in 1998 and 301 in 1999  an increase of more than 800% since 1997.

This year, state and local investigators had served 191 warrants on AOL through July 17, the logs show. Congressional leaders informed of USATODAY.com's findings said they will examine legal standards applied to Internet investigations. At a minimum, House Majority Leader Richard Armey, R-Texas, said police need to tell Congress when, why and how they perform electronic searches.

Critics are concerned because they believe that electronic surveillance of all types is a highly powerful tool that, if not tightly controlled, violates rules against unreasonable police searches.

"We do have reports on wiretaps," Armey said. "Why shouldn't people have a right to know what the government is doing to access personal correspondence in any media?"

House criticizes Carnivore

Armey's displeasure echoes the criticism members of a House subcommittee expressed this week over the FBI's new "Carnivore" Internet wiretapping device. Members say the FBI may be intercepting too much e-mail when it tries to nab messages still in transit from one Net user to another.

But privacy advocates say that while official Washington occupies itself with the legality of Carnivore's real-time e-mail interception, it is ignoring another, possibly more important point. The e-mail stored in online accounts after messages have been delivered has only a fraction of the protections afforded an ordinary telephone call or e-mail still in transit.

Searches for online data typically involve cases ranging from harassment and child pornography to violent crime and fraud.

As Congress moves to deal with controversies over online communications, the White House is already rushing to address the issue.

White House chief of staff John Podesta addressed government searches in a speech July 17 at the National Press Club. He pledged then that the White House would move soon to protect electronic data.

"Data transmitted over networks is not afforded the full privacy protection we give to traditional phone calls," he said. "Considering the extent to which our electronic correspondence contains our most sensitive thoughts and information, shouldn't they count, as Louis Brandeis foreshadowed more than 70 years ago, as the papers and effects mentioned in the Fourth Amendment?

FBI officials say there is little reason for concern, contending that stored e-mail and other online records are not as confidential as a personal telephone call.

"It is hard to understand why information in Internet accounts is any more sacrosanct than any other electronic document," FBI Assistant General Counsel Thomas Gregory Motta said.

So far, Motta said, the law has treated stored records like e-mail the same way it treats other documents like letters and diaries, which can be seized from a home with a simple search warrant. "What about records of my transactions at a bank?" he asked. "I can get that with a subpoena from a grand jury."

Andrew Grosso, a Washington-based attorney who specializes in computer law, said police inquiries at AOL probably are being repeated at other Internet service providers (ISPs) and Web mail providers throughout the USA.

"All ISPs have experienced a significant increase in the number of search warrants and subpoenas," he said.

Police goals vary

What authorities are looking for can vary by case. In some instances, the logs show, police ask for and get limited information from AOL, such as subscriber identity, billing data and payment history.

Other times police request all such information, plus e-mail; the online "handles" and names of people cataloged in members' "buddy lists"; all files attached to e-mail; and all other information contained about the subscriber in the America Online databases.

To comply with the more extensive order, experts say, AOL must be handing over a great deal.

"They can get all information," said Mark Rasch, a former federal prosecutor and vice president for cyber law at Global Integrity in suburban Washington, D.C. "They can get your credit card data and everything you've filed with them. They can get a record of what times you dialed in, where you dialed in from, how long you were online, what activities you were engaged in, what Web sites you visited, what chat sessions you were in and what you said there."

"Why shouldn't people have a right to know what the government is doing to access personal correspondence in any media?"

-- House Majority Leader Richard Armey, R-Texas. Internet service companies are privy to everything their members do online. But ISPs vary greatly in their record retention policies, said Mark Rorabaugh, president of Internet provider Two Radical Technologies Inc. Some ISPs may keep e-mail for two years or more. Others may throw the messages away after a few weeks. And that will affect authorities' ability to get what they want in criminal investigations.

For instance, Rorabaugh said, companies that host Web sites often keep records of the numeric Internet addresses that hit their sites for years, yet only the visitor's ISP can disclose which subscriber is behind that number. And in many cases, Rorabaugh said, that information may never be recorded.

Chat sessions, likewise, are usually discarded as quickly as they are generated. But news reports have said AOL has kept chat sessions for days after the chats are over.

"AOL is the only company I've heard of that supposedly keeps chat," Rorabaugh said.

America Online spokesman Nicholas Graham said the company had no comment on law enforcement's growing interest in subscriber records.

Court Chief Deputy Clerk Mari Hommel said there was no guarantee the logs recorded every single search warrant served on AOL. Still, she said, clerks note AOL warrants as a matter of "customary practice" in order to track their progress once they are returned to the courthouse.

Warrant logs 'extremely accurate'

Data contained in Loudoun County search-warrant logs are "extremely accurate," said Ron Horak, the county investigator whose sole job is to help state and local police from around the country serve warrants for AOL user records.

"I'm estimating the process is climbing at about 100-150 warrants per year," Horak said.

So what do the police want from AOL?

A random sample of 14 such warrants over the last 18 months showed that 10 asked for all data the service had on targeted subscribers. In every case, legal experts say, the law requires that investigators show that the information sought relates to an investigation. Still, they say, the standard falls far short of legal protections required to obtain conventional wiretaps.

As with all warrants, in these cases police had to show "probable cause" that a crime had been committed. But their job would have been a lot harder if they had to clear the same hurdles as agents who seek wiretaps.

For the FBI to get permission to tap a phone or live e-mail transmission, for instance, agents must first conclude that no other technique can get the information they need without ruining the investigation.

Once they are sure a wiretap is the only way to get what they want, agents must then run the proposal past their legal staff. From there, requests go to the bureau's Washington office, where the bureau's Office of General Counsel examines the legality of the request. If the General Counsel's office approves the request, it passes it to the Justice Department, where law clerks examine the request before passing it on to senior management. The attorney general or one of the top dozen or so officials there must sign the order.

Only then can it go to a judge, who may approve the order for no more than 30 days at a stretch. Many years judges approve all of the 1,000 or more requests they receive.

Armey: Burden of proof should be higher

Though Armey stopped short of saying all Internet investigations should face the same hurdles, he did say police must face a higher burden of proof than they do now when they want access to Internet data. "It seems to me someone is being reckless in issuing broad reaching warrants under (current) standards," he said.

Justice Department spokeswoman Chris Watney said there are no statistics on how often federal officers get Internet users' data for crime investigations because there are no reporting requirements for the online activity.

Privacy advocates say they will press the federal government to bring rules for electronic searches closer to the ones used for wiretaps.

"It is clear the law is not adequate to protect people's privacy," said David Banisar, senior fellow at the Electronic Privacy Information Center. "There does need to be changes in the law so a person's e-mail is given the same legal protection as their phone calls. It is also clear there needs to be oversight of this because what has gone on so far has not been made public."

The lack of record-keeping "is a huge oversight failure," said James Dempsey, senior staff counsel to the Center for Democracy and Technology, a Washington, DC, public interest group that gets most of its funding from high-tech companies. "There's no one even in the Justice Department who knows what the scope of monitoring of electronic communications is. That's a serious problem in and of itself."

Indeed, as more Americans choose to keep their calendars, bank accounts, diaries and more online, they become more susceptible to police search than ever before, Dempsey said.

No legal experts contacted for this article could name a case in which data other than e-mail or chat sessions had been seized in a criminal prosecution. Still, they said, it is only a matter of time before such a case surfaces.

"The scary thing is so much of your life is going to be accessible on the Internet, not just e-mail," Global Integrity's Rasch said. "What sites I logged into, what I bought on those sites, my calendar, all those things I typed in  there's a trail."

Sen. Patrick Leahy, D-Vt., said Congress needs to weigh those factors.

"The law has not caught up with the fact that we are storing more and more personal information not on our PCs but on network-based files," he said. "That means it gets exponentially easier to snoop on our finances and schedules and doctor's appointments, not to mention the messages we send and the products we buy and the sites we visit. We need clear rules of the road on privacy to be followed by the government and also by commercial and other private users of the Web."

The FBI's Motta conceded that people store more data than ever on the Internet. Even so, he said, that growth will harm police if they must face higher obstacles to seizing it than they would in other settings.

"Say I'm a drug dealer," he said. "Why would I keep my information at home when I can keep it on (another site)?"

http://ad.usatoday.com/RealMedia/ads/click_nx.cgi/www.usatoday.com/life/cyber/tech@Special1

-- Martin Thompson (mthom1927@aol.com), July 28, 2000