May 11, 2009 Golden Gate University EFF 2009 Bootcamp 2.0 Best Practices for OSPs: Law Enforcement Information Requests Kurt Opsahl, Senior Staff Attorney

May 11, 2009Golden Gate University

EFF 2009Bootcamp 2.0

Best Practices for OSPs:Law Enforcement

Information Requests

Kurt Opsahl, Senior Staff AttorneyKevin Bankston, Staff Attorney



What kind of best practices?

• Intermediaries that enable online speech can also become chokepoints to cut off that speech

• Best practices for responding to – Law enforcement information requests– Civil subpoenas

in a manner that protects ISPs and users



Overview: Responding to Legal Information Requests

• How is your ISP classified under the law?

• What information does your ISP have and what may be sought?

• What legal process must be provided?

• What procedures should your ISP employ in responding to requests?



Best PracticesBest practices:

– Require proper legal process – minimize logging– develop policy for user notice– establish record retention policy– internal training



What type is your ISP under ECPA?

• The Electronic Communications Privacy Act defined two types of ISPs:

• Electronic Communications Service to the extent you permit users to communicate with each other

• Remote Computing Service to the extent you permit users to store communications or other information



What Information Do You Have?

• Some things are obvious like Log Files, but not what they contain

• May also store Email, User ID, Connection Info, Search Queries, URLs, Cookies, Unique Identifiers and IP Addresses

• Other things?



Do You Need the Logs?

• If you don’t have it, you can’t be forced to produce it

• Can reduce compliance costs by minimizing information retained

• Keep minimum logs for needs, and regularly delete unneeded information



Background: ECPA, SCA, Title III and FISA

• Electronic Communications Privacy Act

• Stored Communications Act• Title III is the Wiretap Act • Foreign Intelligence Surveillance

Act



Background: ECPA

• Electronic Communications Privacy Act amended the Wiretap Act to cover electronic communications (i.e. email)– SCA is part of ECPA



Background: SCA• The Stored Communications Act, regulates

when an electronic communication service provider may disclose the contents of or other information about a customer’s emails and other electronic communications to third parties.– Contents of communications may not be disclosed

to civil litigants even when presented with a civil subpoena.



Background: Title III• Title III makes it unlawful to listen

to or observe the contents of a private communication without the permission of at least one party to the communication and regulates real-time electronic surveillance in federal criminal investigations. – Many states require all party consent



Background: FISA• The Foreign Intelligence

Surveillance Act authorizes federal agents to conduct electronic surveillance, as part of a foreign intelligence or counterintelligence investigation, without obtaining a traditional, probable-cause search warrant



Classification of Information

• Basic Subscriber Information (name, address, equipment identifier such as temporary IP address, and means and source of payment)

• Other Information (clickstream, location)

• Wiretap, Pen Register or Trap and Trace• Content - Real Time and Stored



Records of Videos Watched

• The most highly protected piece of personal information under the law:– “information which identifies a person as

having requested or obtained specific video materials or services from a video tape service provider”

• Not limited to “tapes”, includes a/v material• Must be destroyed “as soon as practicable, but no

later than one year from the date the information is no longer necessary”

• Contact your legal counsel before disclosure pursuant to legal process



Location Information• Majority of courts require probable

cause warrants for disclosure of real-time or prospective location information– DOJ asserts a lower standard

• Contact your legal counsel before disclosure



Legal Standards• Basic Subscriber Information: Subpoena or

better (Gov’t may not use civil subpoena)• Other Information: 2703(d) order or better• Dialed digits: Pen Register or better• Real Time Content: Title III order• Stored Content < 180 days: search warrant• Stored Content > 180 days: subpoena or better• Video records: Warrant or court order



Exception: Emergency Cases

• Customer Information/Content Standard: ISP reasonably believes that an emergency involving immediate death or serious physical injury to any person requires disclosure of contents or justifies disclosure of records– Get the justification in writing



National Security Letters

• FBI may compel the production of "subscriber information and toll billing records information, or electronic communication transactional records" through National Security Letters. – Generally NSLs must be kept secret– May contact legal counsel.



FISA Orders

• Pursuant to FISA, the gov’t may provide FISA court order or other process under the FISA Amendments Act – Contact legal counsel– EFF would love to challenge the FAA



A visit by Suits with Shades

• If you get a personal visit from Law Enforcement, call your company’s lawyer.– Often, just an informal request for

assistance– Safest course is to get legal counsel

early



Provide Notice to Users

• Best practice is to provide notice where possible - let user move to quash

• LEAs need an order to prevent notice on subpoenas

• Notice may be delayed under ECPA



Backup Preservation

• Any LEA can request by any means• Notify LEA, but do not deliver info• LEA notifies user - starts 14 day

clock for user objection• Absent objection, must provide

data upon receipt of proper process



Reimbursement

• Yes for subpoenas• Yes for technical assistance (not

required to redesign, just help)• Yes for special requirements,

backup preservation, etc• Yes for all civil requests



Provider Exception

• Provider exception grants service providers the right "to intercept and monitor [communications] placed over their facilities in order to combat fraud and theft of service."



Accessible to Public• Privacy laws have an exception for

electronic communication made through a system "that is configured so that . . . [the] communication is readily accessible to the general public.”– If information sought by LEA is publicly

available, you can tell them to get it themselves

– In some cases authentication may be required



Penalties and Safe Harbors

• May face lawsuits for improper disclosure

• You are protected from civil actions if you rely in “good faith” upon appropriate legal process

• Do not disclose information without being sure you have the right process



Parting Thoughts

• Always get it in writing to preserve immunities

• Your ISP is not the agent of an LEA • State and Local rules may be more

strict• If in doubt, ask the lawyers



Help Us Help You• Let us know when you receive

questionable over-reaching requests

[email protected]

http://www.eff.orghttp://ilt.eff.org

Documents

May 11, 2009 Golden Gate University EFF 2009 Bootcamp 2.0 Best Practices for OSPs: Law Enforcement Information Requests Kurt Opsahl, Senior Staff Attorney