Page 48 - pclob usa freedom

TOP SECRET//SI//NOFORN

It questions whether the CDR program is “similar enough” to Smith for that case to control,
citing facts about the most recent incarnation of the CDR program. 235 Specifically, it notes that,
in Smith, “the police collected the numbers the defendant dialed . . . but did not collect
information about the duration of the defendant’s calls or whether the calls were completed”;
that, in Smith, the police did not “collect information about incoming calls to the defendant’s
telephone line”; and that “Smith involved a short duration of use of a pen register (no more than
2 days) and the dialing information of just one person.” 236

(U) The apparent implication of reciting these differences is that Smith should be strictly
limited to those types of dialing information collected by the relatively primitive pen register
available in the late 1960s. But if that is right, the USA Freedom Act CDR authority would be
just one casualty among many: the Pen Register Statute 237 and the Stored Communications
Act, 238 which are used every day in criminal cases, would be similarly vulnerable. So would the
FISA business records provision, which allows the government to obtain non-content records
based on reasonable, articulable suspicion rather than a probable-cause warrant. 239 Accepting
the statement’s narrow view of Smith would destabilize criminal and national-security
investigations across the United States.

(U) Our colleagues note the potential that CDRs might allow for information about a
user’s location in a way that would undermine Smith’s applicability and bring the program “into
an intermediate area between Smith and Carpenter.” 240 Yet—and as the prior Board pointed out
in discussing the bulk telephony program it found constitutional—telephony metadata will often
provide general insights into location. For example, area codes and telephone prefixes offer
some indicia of location. The possibility our colleagues raise would not appear to be
categorically distinct from these well-understood and expected indicia. For example, the mere
fact that a subscriber of company A roams into company B’s network would not trigger the
creation of a CDR; rather, the subscriber would have to place or receive a call. And even then,
doing so would indicate only that they were in a company B coverage area, not which area.

235 (U) Statement of Ed Felten and Travis LeBlanc at 74.
236 (U) Statement of Ed Felten and Travis LeBlanc at 73.
237 (U) The Pen Register Statute authorizes the collection of both numbers dialed and incoming calls for a duration
of 60 days, with the possibility of further 60-day extensions. 18 U.S.C. § 3123 (c); see also § 3127(3)–(4) (“pen
register” obtains “dialing, routing, addressing, or signaling information”; “trap and trace device” “captures the
incoming electronic or other impulses which identify the originating number or other dialing, routing, addressing,
and signaling information reasonably likely to identify the source of a wire or electronic communication”).
238 (U) 18 U.S.C. § 2073(c)–(d) (court order to obtain non-content information about subscribers and “electronic
communication service or remote computing service” to issue upon a showing of “specific and articulable facts
showing that there are reasonable grounds to believe that the contents of a wire or electronic communication, or the
records or other information sought, are relevant and material to an ongoing criminal investigation”).
239 (U) 50 U.S.C. § 1861.

240 (U) Statement of Ed Felten and Travis LeBlanc at 75.

45

TOP SECRET//SI//NOFORN