Almost every day we hear in the news about allegations centered on communications privacy being violated either by employers or law enforcement agencies.
Perhaps a measure of explanation will allay some misconceptions.
Protection of Belongings and Privacy
Important aspects of intercepted communications rest with the individuals or organizations intercepting them and what they intend to do with them. Governmental entities, federal, state and local, in the United States, are governed by the Fourth Amendment to the U.S. Constitution and subsequent laws. They protect an individual, their belongings and privacy from unwarranted search and seizure. In this vein, protection is extended to oral and electronic communications. Most countries have similar laws protecting property and communication privacy.
To obtain a search warrant for a person or their belongings, the law enforcement agency files a sworn affidavit before a judicial authority, declaring there is probable cause to believe a criminal act has been committed and that fruits or instruments of that crime are currently found at a specified location.
However, intercepting oral or electronic communications intended for use in judicial proceedings is more complicated and requires more stringent adherence to specific steps. In the absence of a consenting party, 'live' oral and electronic interceptions are accomplished by a court order supported by a sworn affidavit describing the nature of the criminal violation, the person(s) involved in the crime, and description of their unlawful activities. The weight of evidence is the measure of the probable cause. In other words, are the facts and circumstances described in the affidavit reliable and probable? (18 U.S.C. Section 2518)
In many countries, the measure is one of investigative need, where the law enforcement agency describes a suspected criminal activity and petitions for an order or warrant to intercept the suspect's communications.
Before the matter may be presented before a U.S. court, administrative reviews and approvals must be performed and usually involve the law enforcement agency's head, the prosecutor and his or her head-of-agency and the Department of Justice. All must agree to the use of this intrusive technique, the merit of the investigation, and the substance and reliability of the affidavit's information. These levels of approval occur before the interception court order application may be presented to the district court judge.
One of the key elements of an application and order intercepting live communications is the government's statement that all other logical steps have been taken or will logically be unsuccessful. Due to the extremely invasive nature of intercepting communications, this technique is legally deemed the last resort in many countries in Asia, Europe and the United States.
Only after accomplishing all the administrative and legal approvals can a law enforcement agency install equipment or software to intercept communications. Even after the application and order are approved and the interceptions completed, the usual duration of the interception activity is 30 days, but may be extended in 30-day increments upon the establishment of further probable cause.
Affidavits may be subsequently challenged in judicial hearings and, if the affidavit or interception processes are found to be faulty, the intercepted communications may be excluded from any other proceedings.
Oral and electronic communications collected without a court order or one consenting party may be deemed to be unlawful, and could be excluded as evidence. Interceptions of this nature could also include criminal and civil recourse against the government and its agents as part of allegations of outrageous conduct.
It is important to note that there are countries and jurisdictions that preclude the recording of oral and electronic communications even if there is a consenting party. In these cases, without a court order, the intercepted communications will likely be excluded from introduction at judicial proceedings.
Some countries require an application to be submitted to the Secretary of State or other high-ranking government official. In these jurisdictions, the interception of communications may only be accomplished in matters of national security, specified criminal activities, or prevention of serious criminal acts. It is important to note that in many countries, the interception warrant targets the individuals' oral and electronic communications ignoring specific locations and devices. In other countries, the warrant applies strictly to oral and electronic communications taking place at a specific physical location.
Interception by Private Organizations
So now the next question that arises: How do these laws affect private organizations and individuals? According to recent polls, many employers are monitoring their employees' email and Internet activities. How is this legal? It is likely that the employees waive their rights to communications privacy as a condition of employment. If the organization has a telephone and electronic communications monitoring policy and their employees waive their rights to communications privacy, then it is likely to be within the law. These policies may take a variety of forms: signed acknowledgements, sign-in banners, employee policy statements, etc.
In fact, some employers have adopted the practice of videotaping their employees. If there isn't a reasonable expectation of privacy, as in an open work area, they are likely within the law. However, under this concept, employers may not invade areas where there is a reasonable expectation of privacy, such as a restroom. {this term is a little puzzling to Europeans!}
Interception Devices
Plainly stated, installing devices that will intercept telephone calls emanating from hardwire, cellular or cordless telephones, without a court order, knowledge and/or consent/waiver of one of the parties, may constitute a criminal act (18 U.S.C. Section 2511).
Today's technology allows the installation of software and hardware devices that record keystrokes and 'sniff' transmitted data. Be mindful of laws applying to recording electronic communications; they likely apply here in that waivers, warrants and court orders may be necessary before these recording mechanisms can be installed. Caution is advised as there are very few court cases defining conduct in these matters.
In the case of a business, computer users may have waived their rights to privacy as a condition of their employment. In the case of a residence, sharing a computer may dissolve the argument of reasonable expectation of privacy.
Individuals who haven't legitimately entered a communications system don't have a reasonable expectation of privacy, so the interception and disclosure of their communications is lawful and within the definition of the network administrator's routine duties.
It is important to remember that none of the current legislation is intended to inhibit the legitimate administration of communications networks. These laws require law enforcement officials to obtain administrative and judicial approvals, based upon probable cause or consent, before intercepting communications. In the case of non-governmental organizations, laws require employees and associated persons to waive their rights to reasonable privacy before their communications may be intercepted.
In recent days, there has been some concern about the surreptitious installation of wireless video equipment monitoring the activities of people at home. If the equipment is installed without the knowledge and consent of appropriate parties, it is an unlawful act. The act of entering the residence without authorization is breaking, entering and trespassing. Criminal prosecution is possible and civil action may follow.
Conclusion
Anyone thinking that law enforcement is monitoring their oral and electronic communications should understand this task is not one that is accomplished easily or without significant administrative review and judicial approval. Organizations may monitor communications as long as the requirement of a reasonable expectation of privacy has been waived. In the case of a residence, a private party entering a private residence and secreting a wireless video device, without authorization, may trigger prosecution and a monetary settlement.
This information is not intended to be inclusive, rather it is merely an overview. Before monitoring oral or electronic communications, or monitoring activities via video equipment, consult with competent legal counsel.
Alan B. Sterneckert, CISSP, CISA, CFE, CCCI, is a retired special agent, Federal Bureau of Investigation. He is an information security consultant, lecturer and author. He may be contacted at [email protected].
