NEW YORK -- Verizon Wireless turned over personal cellphone records for Associated Press journalists without giving them a chance to challenge subpoenas as part of an extraordinary Department of Justice national security leak investigation, the New York Times reported on Tuesday.
But there was nothing extraordinary about what Verizon Wireless apparently did. Hundreds of thousands of times every year, cellphone companies turn over personal call records to law enforcement with neither a warning nor a judge's involvement. Privacy activists said it's no way for carriers to treat paying customers. They said they hope the AP controversy will force the big cell companies to change their ways.
"This is the phone companies putting the interest of law enforcement before their customers, and that's wrong," said Christopher Soghoian, principal technologist for the American Civil Liberties Union. "None of them tell users. They all suck."
Verizon Wireless spokeswoman Debi Lewis said, "We comply with legal processes when dealing with requests from law enforcement, and don't comment, can't comment on any specific individual request or customer." But the Times reported that an AP employee said "at least two of the journalists’ personal cellphone records were provided to the government by Verizon Wireless without any attempt to obtain permission to tell them so the reporters could ask a court to quash the subpoena."
That should come as no surprise for cellphone users. Since the 1970s, the Supreme Court has ruled that information recorded by third parties like cellphone carriers is not protected by the Constitution's Fourth Amendment safeguards against unreasonable searches. So law enforcement need not obtain a warrant from a judge to gain access to records of who we call and when. (A full wiretap, recording the actual calls, would require a judge's approval.)
A judge likely never saw the Justice Department's request. Instead, Deputy Attorney General James Cole signed the subpoena, most likely stating simply that the information was needed for an investigation, before it was presented to Verizon Wireless.
The phone company probably had no idea who was the investigation target, or why. The Associated Press only found out that its reporters' phone records had been subpoenaed because of Justice Department regulations written in response to Watergate-era abuses.
Similar user data requests fly at the big wireless carriers fast and furiously. In 2011, Verizon Wireless received about 130,000 subpoenas amid 260,000 total requests for customer information. Requests for user data had increased by 15 percent a year for the five years before.
That information was provided to Rep. Ed Markey (D-Mass.) as part of an investigation he conducted into cellphone privacy last year. Markey discovered the big cell carriers received a stunning 1.3 million requests for customer data in 2011. Sprint had a team of 226 workers dedicated to fulfilling all the requests.
“If carriers receive a lawful request, they must honor it," Michael Altschul, the general counsel for CTIA, the wireless industry association, wrote in a written statement. He added that if user data was "illegally obtained, the courts will suppress it and not allow it in the case, which provides the incentive for law enforcement to abide by the rules."
But all of the carriers' legal manpower, privacy activists said, could be applied more often to give users an opportunity to protect their privacy before they are charged with federal crimes. None of the big carriers have a stated policy that they will tell users targeted by a subpoena, or that they will ask a judge to approve a records search.
"The FBI doesn't tell you what they're investigating -- you just get a subpoena, so the only way you get to stick up for your good customers is by having a policy of always telling your users," said Soghoian.
By contrast, several big Internet companies have aggressively fought for users' privacy. Twitter, for example, went to a judge who quashed a subpoena issued for information on activists associated with the transparency activist group WikiLeaks.
The Electronic Frontier Foundation, a San Francisco-based privacy organization, produces an annual scorecard of how companies protect users' data from the government. Many Internet companies, including Google and Twitter voluntarily disclose government requests for user data.
The Electronic Frontier Foundation has had no problem gaining the attention of tech companies located in Silicon Valley, near its San Francisco office. But despite entreaties, said staff attorney Nate Cardozo, the big phone companies have shown no signs of following suit.
"It might just be generational," said Cardozo. "Phone companies come from an earlier era of business -- and they're monopolies."
Altschul of the wireless association did not respond to a question about how difficult it would be for carriers to follow Twitter's example of asking a judge to review law enforcement subpoenas. Lewis of Verizon Wireless said she was not aware of any plans for her company to create a transparency report or new privacy policies.
But Soghoian is adamant that implementing strict, broad policies would create "very little additional work for the phone companies." The subpoenas targeting the Associated Press, he said, show the crucial importance of trying to give users a chance to fight for their rights.
"This AP incident should be a wakeup call to everyone about the scale of the warrantless, judgeless requests that he phone companies are receiving," he said. "Surveillance happens without any neutral magistrate. Our constitutional system has the presence of this third branch, the judiciary, and their purpose is to make sure the executive is not abusing the law."
Before You Go
