Return to Privacy Module IV


Introduction to Government Investigations[1]


            In previous Modules we explored how private sector actors in the U.S. utilize technology to monitor use of cyberspace.  In Modules IV and V, we turn to the more complex question of government surveillance of cyberspace.  In Module IV we take as our task the description of the basic constitutional and statutory rules that govern cyberspace surveillance by the government.  In Module V we take up the complicated question of how the new USA Patriot Act --enacted post-September 11--allows greatly expanded surveillance of cyberspace.


These two Modules are substantially more complex than the earlier ones for several reasons--largely having to do with the fact that the U.S. recognizes multiple sources of positive law.  First, the United States follows a federal system in which not only Congress, but also most of the 50 individual states has enacted regulations to govern cyberspace.  However, because federal statutes are much more significant, and preempt conflicting state laws, these Modules focus primarily upon federal legislation and the U.S. Constitution. 


Second, as technology has evolved over time, Congress has enacted many statutes that govern different aspects of cyberspace. For example, different surveillance rules might apply depending on whether the target of governmental surveillance accesses the internet using a cell phone, telephone, or cable modem.  Different rules might also apply depending on whether the type of cyberspace use involves email, instant-messaging, telephone, or websurfing. A recently-enacted federal statute, known as “USA Patriot,” attempts to moderate some of these conflicts, but issues linked to the different technologies remain.  In this Module, we will attempt to set forth the principal federal statutory frameworks.


Third, different rules apply depending on the nature of the government’s surveillance.  Does the government desire to know the contents of every email sent to or from a particular computer?  Does the government intend to search widely for communications by a particular author?  Or, does the government merely desire to know the name and email address of the sender of email to a particular address?


 Finally, because all legislation must satisfy judicial interpretations of the U.S. Constitution, many statutes that appear to authorize certain surveillance practices might be held to be unconstitutional.  Therefore, even a cursory introduction to government surveillance issues must identify some of the key constitutional cases that affect the interpretations of the statutes.





A.  Definitions (note that USA Patriot [discussed in Module V] will apply analogous definitions to cyberspace surveillance)


·        Pen Register


·        Trap and Trace Order


o       Wiretaps are used for ongoing surveillance of a telephone line or other electronic communications line. It allows interception of content (i.e. conversations or other data) passed over the line. Note that this is more information than is gathered by a Pen Register or Trap and Trace Orders – neither of these intercept content - rather, they simply collect numbers dialed/received.


B. Four Levels of Government Search Authority


(1)   Subpoena

The requirements for obtaining a subpoena are minimal. There is no ‘relevancy standard’ - no requirement that the information sought be relevant to an ongoing criminal investigation. Subpoenas can be issued by a prosecutor (sometimes through a grand jury investigation) without judicial intervention. However, a subpoena may not be used to obtain information or evidence protected by the Fourth Amendment unless Fourth Amendment requirements are satisfied.


(2)   Pen Registers and Trap and Trace Order

A judge who independently evaluates the request of the government must grant pen Register Orders. The standard for granting a Pen Register Order is that the order must be relevant to an ongoing criminal investigation. An order is valid for 60 days and may be renewed for 60 day increments. The courts have held that the Fourth Amendment does not apply to Pen Register and Trap and Trace Orders, and therefore the government need not show “probable cause.”


Title III of the Omnibus Crime Control and Safe Streets Act of 1968 dictates requirements for Trap and Trace Orders. For more information about Title III, see below.


(3)   Warrants

A warrant is required if the target has a reasonable expectation of privacy in the targeted material (Fourth Amendment requirement;  see below).  Requirements for obtaining a warrant are more stringent than those for obtaining a trap/trace order. E.g., the government must show “probable cause.”  A warrant must describe the place to be searched or thing to be seized with specificity. See, e.g.,



(4)   Wiretaps

Title III dictates requirements for wiretaps. Wiretaps are used for ongoing listening and invasion, and require a more comprehensive showing of need than a warrant. Title III also mandates court supervision and minimal intrusion for ongoing wiretaps.


II.  Summary of U.S. Constitutional Requirements


          A.  The Fourth Amendment to the United States Constitution


The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.



          B.  Supreme Court Interpretations of the Fourth Amendment


The U.S. Constitution ordinarily grants individuals rights against the government (and not private parties). Since government agents are usually the ones who are engaging in a claimed invasion, the U.S. legal system relies upon an independent judiciary to enforce these Constitutional rights.  Often--though not always--such cases arise in the context of a criminal trial in which a defendant seeks to exclude certain evidence from the trial record on account the government obtained the information in violation of the Fourth Amendment.


In early 20th Century decisions, the U.S. Supreme Court relied on a “property-based” rationale for interpreting the Fourth Amendment. For example, in Olmstead v. United States[2], the Court held that wiretapping was not covered by the Amendment because the government had not physically invaded the defendant's premises.  In a 1967 decision, however, Katz v. United States[3], the Court rejected this approach, holding that the government could not electronically eavesdrop on a telephone conversation held by a person in a public telephone booth by attaching a listening device to the outside of the booth without complying with the Fourth Amendment.  The Court rejected the government’s argument that since the speaker had no property interest in the booth his Fourth Amendment rights weren’t violated. As the Court said in another case decided the same year:


''The premise that property interests control the right of the Government to search and seize has been discredited. . . . We have recognized that the principal object of the Fourth Amendment is the protection of privacy rather than property, and have increasingly discarded fictional and procedural barriers rested on property concepts.'' [4]


Katz concluded in a famous tag line that the Amendment ''protects people, not places.''[5] Henceforth, electronic surveillance was made subject to the Amendment's requirements.


After Katz, the Court developed a two-pronged test to determine if an individual had a reasonable expectation of privacy against intrusions by the government that triggered the Fourth Amendment.  First, an individual had to believe a given communication is private.  This was a subjective test of the individual’s belief.  Second, for an expectation of privacy to be deemed reasonable, a disinterested observer (i.e., a court) would have to agree that the individual’s expectation of privacy was reasonable. This is supposedly an objective test.  If these two factors are satisfied, then the government must comply with the Fourth Amendment.  As recently put by the Court:


 "[A] Fourth Amendment search occurs when the government violates a subjective expectation of privacy that society recognizes as reasonable." Conversely, "a Fourth Amendment search does not occur--even in the explicitly protected location of a house-- unless the individual manifested a subjective expectation of privacy in the object of the challenged search, and society [is] willing to recognize that expectation as reasonable."[6]


The two-part test ostensibly guides the Supreme Court and lower courts in its decisions, but interpreting such a vague standard leaves substantial room for judgment.  The first requirement, the ''subjective expectation'' of privacy, has in practice eroded as a workable standard, because, as Justice Harlan concluded in a later case, ''our expectations, and the risks we assume, are in large part reflections of laws that translate into rules the customs and values of the past and present.''[7]  In short, the Supreme Court sets the standards, and those standards in turn become the future reference points for individuals’ “expectations” of privacy against the governmental intrusions.


Accordingly, the second part of the test, whether one has a ''legitimate'' expectation of privacy that society finds ''reasonable'' to recognize, has become the default touchstone of what “privacy” means under the Fourth Amendment.  That is, the ''capacity to claim the protection of the Amendment depends . . . upon whether the area was one in which there was reasonable expectation of freedom from governmental intrusion.'' (emphasis added) [8]  In answering this question, the Court has said that ''[l]egitimation of expectations of privacy by law must have a source outside of the Fourth Amendment, either by reference to concepts of real or personal property law or to understandings that are recognized and permitted by society.'' [9] 


Note that, despite the rejection of the “property” rationale in Katz, the Court re-embraces the same concept via a backdoor description of “expectations.” The problem, of course, is that when these concepts of realspace are applied to cyberspace (or even telephonic communications) an individual owns no “property” in the mechanisms of transmission (e.g., the wires that carry the dataflow) that would support her claim of privacy in the communication.  In sum, although the Fourth Amendment protects a person’s privacy, not her property, owning the property in which transmissions occur has become the surest means of protecting privacy.


In specific terms, the Court has given the most protection to an individual’s home[10], while other “places” an individual frequents (e.g., automobile[11]) or information about his activities are given little protection. Revealing information about one’s activities to another person has become a surefire road to the no privacy destination.  In United States v. Miller, for example, the Court gave a restrictive reading to “reasonable expectations” in a case involving a bank depositor who claimed the government was required to satisfy Fourth Amendment standards in order to obtain his financial records from his bank. The Miller Court held that the depositor had no "legitimate 'expectation of privacy' in financial information "voluntarily conveyed to . . . banks and exposed to their employees in the ordinary course of business."[12]


Similarly, in a key case posing the question of whether the government was required to obtain a warrant before installing a pen register, the Supreme Court held that an individual targeted in pen register monitoring does not have a reasonable expectation of privacy in the telephone numbers dialed from his home telephone.  According to Smith v. Maryland, an individual is assumed to know that in dialing, he "convey[s] numerical information to the phone company” and that the phone company “record[s] this information for a variety of legitimate business purposes." The Court rejected strong dissents that argued that the numbers dialed consisted of communication “content”.  Therefore, the Court held that the installation and use of a pen register "was not a 'search,' and no warrant was required."[13]  


The Court has not yet held that the content of those communications may be revealed without violating the Fourth Amendment.  One could imagine, for example, an extension of the Smith rationale that the user knows when he dials he “conveys numerical information to the phone company” because he is using the phone company’s switching systems.  Presumably, the user also knows that when he speaks, he is using the phone company’s lines and switching stations since the user must speak using the communication devices of his telephone service provider.  However, The key distinction between (1) the “content” of the communication and (2) the telephone numbers dialed, time, length and date of call, has led one commentator to coin the phrase “communication attributes” to describe the latter.[14]  We will rely on this distinction as we consider the treatment of cyberspace communications.


As a general matter, without necessarily intending to do so, the Court has developed a balancing approach to the question of what constitutes an individual’s “reasonable expectations” under the Fourth Amendment.  This approach assesses “the nature of a particular practice and the likely extent of its impact on the individual's sense of security balanced against the utility of the conduct as a technique of law enforcement.'' [15]


What are the factors that guide the “balance?”  That a person has taken precautions to maintain her privacy, that is, precautions customarily taken by those seeking to exclude others, is usually a significant factor in determining legitimacy of expectation. As indicated above, property interests in the thing or information are also relevant, and in the recent Kyllo[16] case, apparently determinative.  However, because the “needs” of law enforcement are weighed against these interests, it is difficult to determine in advance how much weight a court will give to any factor.[17]



III.  Key Statutes: Title III of the Omnibus Crime Control and Safe Streets Act of 1968. and the Electronic Communications Privacy Act of 1986 (ECPA)


            Title III of the Omnibus Crime Control and Safe Streets Act of 1968[18] attempted to codify the Fourth Amendment principles set forth by Katz. Title III proscribes the interception of oral and wire communications, "while making provision for law enforcement to intercept these communications for use in criminal investigations."[19]


            The Electronic Communications Privacy Act of 1986 ("ECPA") amended Title III when it became clear that Title III was not adequate to deal with developing technologies in the field of electronic communication. The ECPA was designed to align Title III with new innovations such as "cellular telephones, computer-to-computer transmissions, and electronic mail systems . . . ."[20]


            Title I of the ECPA prohibits unauthorized interception of electronic communications.[21] “Unauthorized” includes communications obtained without the authority of an appropriate court order. Title II proscribes the unauthorized access to stored wire and electronic communications.[22] However, although the ECPA was designed to update Title III, it did not resolve conflicting understandings of what would be protected under the “reasonable expectation of privacy” standard.  While the privacy standard still governs communications obtained by the government, the standard is difficult to apply because it is not obvious whether a user’s hope of privacy is one a court will protect as “reasonable.”


Note:  A detailed summary of Title III of the Omnibus Crime Control and Safe Streets Act of 1968 and the Electronic Communications Privacy Act of 1986 (ECPA) will be found in the Statutory Assignment following the Introduction.  Follow the link below to the Module IV Homepage.



[return to Module IV Homepage]

[1]  This Introduction and Module draws upon research papers authored by Cory Bragar (HLS 2002) and Emily Terrell (Loyola Law School, Los Angeles, 2004).


[2] 277 U.S. 438  (1928). See also Goldman v. United States, 316 U.S. 129  (1942) (detector placed against wall of adjoining room; no search and seizure); Silverman v. United States, 365 U.S. 505 (1961) (spike mike pushed through a party wall until it hit a heating duct).


[3] Katz v. United States, 389 U.S. 347, 353 (1967). Justice Harlan, concurring, 389 U.S. at 353, authored what became the two pronged test for determining whether the Fourth Amendment protects a given privacy interest: ''first that a person have exhibited an actual (subjective) expectation of privacy and, second, that the expectation be one that society is prepared to recognize as 'reasonable.''' Id. at 361.


[4] Warden v. Hayden, 387 U.S. 294, 304 (1967).


[5] Katz, 389 U.S. at 351.


[6] Kyllo v.United States, 121 S. CT. 2038, 2042 (2001).


[7] United States v. White, 401 U.S. 745, 786 (1971). See also Smith v. Maryland, 442 U.S. 735, 740 n.5 (1979) (government could not establish ''subjective expectations'' by announcing that henceforth all homes would be subject to warrantless entry, and thus destroy the ''legitimate expectation of privacy'').


[8] Mancusi v. DeForte, 392 U.S. 364, 368 (1968) (official had a reasonable expectation of privacy in an office he shared with others, although he owned neither the premises nor the papers seized).


[9] Rakas v. Illinois, 439 U.S. 128, 144 n.12 (1978).


[10] E.g., Kyllo v.United States, 121 S. CT. 2038 (2001)(where government used a thermal imaging device pointed at home to detect pattern of heat, “the surveillance is a 'search' and is presumptively unreasonable without a warrant");  Payton v. New York, 445 U.S. 573 (1980). 468 U.S. 705, 708-10 (1984). In United States v. Karo, a beeper signal was used to determine if a container holding a radio-controlled “beeper” was still in a house. The Court found the intrusion required compliance with the Fourth Amendment.  "(P)rivate residences are places in which the individual normally expects privacy free of governmental intrusion not authorized by a warrant, and that expectation is plainly one that society is prepared to recognize as justifiable." In contrast, the Court in United States v. Knotts, 460 U.S. 276 (1983), agents installed a beeper in a container of chloroform and followed the beeper signal as the container was transported. The Court found that the beeper had been monitored while on public streets, and thus no search had resulted because there could be no legitimate expectation of privacy on public streets.


[11] One has a diminished expectation of privacy in automobiles. E.g., United States v. Ross, 456 U.S. 798 (1982); Arkansas v. Sanders, 442 U.S. 753, 761 (1979) (collecting cases). See also Rakas v. Illinois, 439 U.S. 128 (1978) (passengers in automobile passengers who had no legitimate expectation of privacy in areas searched).


[12] 425 U.S. 435, 442 (1976).


[13] 442 U.S. 735, 743, 746 (1979).


[14] Susan Freiwald, Uncertain Privacy: Communication Attributes After the Digital Telephony Act, 69 S. CAL. L. REV. 949 (1996).


[15] United States v. White, 401 U.S. 745, 786-87 (1971) (Justice Harlan dissenting).


[16] See Note 9.


[17] E.g., United States v. Miller, 425 U.S. 435 (1976) (no warrant required to obtain bank records from bank); Smith v. Maryland, 442 U.S. 735 (1979) (Fourth Amendment doesn’t protect numbers dialed from one's telephone); Hudson v. Palmer, 468 U.S. 517 (1984) (prison cell); Illinois v. Andreas, 463 U.S. 765 (1983) (shipping container opened and inspected by customs agents and resealed and delivered to the addressee); California v. Greenwood, 486 U.S. 35 (1988) (individual held to have abandoned privacy interest in papers placed in sealed plastic bags left at curb for garbage collection).


[18] 18 U.S.C. § §  2510-2520 (1968).


[19] 18 U.S.C. §  2510.


[20] Michelle Skatoff-Gee, Changing Techologies and the Expectation of Privacy: A Modern Dilemma, 28 Loy. U. Chi. L.J. 189, 201 (1996). 


[21] 18 U.S.C. § §  2701-2711 (1994).  Section  2701(a) provides:

  “[W]hoever (1) intentionally accesses without authorization a facility through which an electronic communication service is provided; or (2) intentionally exceeds an authorization to access that facility; and thereby obtains, alters, or prevents authorized access to a wire or electronic communication while it is in electronic storage in such system shall be punished …”


[22] See 18 U.S.C. § §  2510-2521.