By Jane Black In the old days, tapping a phone was as easy as one-two-three. All calls ran over Ma Bell's copper wires. To listen in, law-enforcement agents simply requested that the phone company isolate the suspect's wire and record any calls made or received. One phone company. One network. One flip of a switch.
That was eons ago by techno-standards, however. The new world of telecommunications has made it much harder for the FBI to thwart evildoers -- and for privacy advocates to ensure that the agency doesn't overstep its bounds. Today, dozens of new technologies need to be monitored, such as packet voice and cellular text messaging. And thousands of new service providers are now in business. "Every time the technology moves ahead, you have all these pitfalls -- all these potential points where we can creep away from the status quo to a far more intrusive type of surveillance," says Lee Tien, a senior attorney at San Francisco-based advocacy group the Electronic Frontier Foundation.
The job of sorting out the mess falls in large part to Les Szwajkowski, the director of the FBI's CALEA surveillance policy and planning unit. (CALEA is an acronym for Communications Assistance for Law Enforcement Act, which was passed in 1994 and granted the FBI the right to conduct surveillance on any new technologies that arise.) With his staff of 50 engineers, lawyers, and surveillance experts, Szwajkowski's most pressing task is finding a way to tackle the challenge of packetized voice, better known as VOIP (for voice over Internet protocol), which is steadily gaining a foothold in the U.S. market. VOIP provider Vonage in Edison, N.J., alone has lured 15,000 customers since it launched in April, 2002.
"SHORT ONE PLAYER." Last month, law-enforcement officials and telecom providers such as Vonage gathered at a closed-door meeting in Chicago to plan for the digital future. The technology makes for some tough issues for policymakers. Unlike a traditional phone call, where a line is dedicated between two parties, VOIP slices each call into millions of tiny digital packets, each of which can take a discrete route over the Internet. That means surveillance equipment must either be installed permanently on a network or calls must be routed through FBI surveillance equipment before being delivered to the caller, which experts say can create a suspicious delay.
"Our tactical people are trying to plug every hole. But it's like playing the field short one player," says Szwajkowski. "A call that is not [able to be intercepted] is a major public-safety and security dilemma."
This isn't the first time the FBI has faced such a challenge. As early as the 1980s, new features such as call forwarding and conference calling created loopholes for crafty criminals. If the FBI tapped a suspect's office phone, that person could forward the call to a home line if he or she smelled a wiretap -- outfoxing the FBI. Conference calls also thwarted so-called pen register and trap-and-trace orders, which allow law-enforcement agencies to record all the calls made or received on a particular line.
WHO YA GONNA CALL? To trick the feds, one untapped person could call another and then conference in the suspected wrongdoer, without the call being registered by law enforcement. From 1992 to 1994, a total of 183 federal, state, and local law-enforcement cases were impeded by advances in digital technology, according to congressional testimony by then-FBI Director Louis Freeh.
Szwajkowski's job is all the more complicated because of the explosion of new communications providers since the 1996 Telecommunications Act. Today, it's not just the phone company that completes calls. It could be an Internet service provider, a VOIP startup, or both. In rural areas, it's not uncommon for startups, such as Paul Bunyon Telecom in Bemidji, Minn., or CBeyond Communications in Atlanta, to serve just a few thousand customers apiece.
"The number of new players is staggering to us," Szwajkowski says. "It was hard enough before to balance technology and economics. Today we have to negotiate with a whole new set of entrants with a range of demands and circumstances."
HUNGRY CARNIVORE. Therein lies a danger, say privacy advocates. They worry that the FBI will use the rise of the packet technology and the expanding number of players as an excuse to expand its all-seeing, all-knowing surveillance power.
Here's why: VOIP travels across the Internet the same way that e-mail does. Address information (the number dialed or the e-mail address) is contained in the same packet as the content (what is said or written). The FBI's solution for e-mail is the notorious Carnivore technology, which sucks up all data that passes its way. The FBI claims that Carnivore filters traffic and delivers to investigators only packets that they're lawfully authorized to obtain. But because the details remain secret, the public must trust the FBI's characterization of the system and -- more significant -- that it's complying with legal requirements.
Carnivore has been highly controversial, and privacy advocates fear the FBI will develop a similar system for VOIP. "The very nature of packet technology means that whether it's an e-mail or a voice call, [the FBI] can get more and more information that allows them to be more and more privacy-invasive," says the EFF's Tien.
A NEW ERA. The sheer number of players could put privacy at an even greater disadvantage. In the old days, the FBI went head-to-head with the likes of AT&T (T) or Verizon (VZ), each of which has an army of lawyers to fight off any onerous requirements. In an emerging area such as VOIP, however, small companies are on the cutting edge, and they have no money to staff a huge legal department.
Szwajkowski plays down these fears. "I'm a citizen too. I don't want to be surveilled without law enforcement having built up a serious case in front of a judge," he says. "All we want is the ability to intercept, whatever technology they use to communicate."
Figuring out just how to do that will be tough -- even with the best of intentions. Compromises between law enforcement and carriers over the coming year will usher in a new era of government surveillance. To avoid another Carnivore, privacy advocates must stay alert. Black covers privacy issues for BusinessWeek Online in her twice-monthly Privacy Matters column