TRANSACTION SURVEILLANCE BY THE GOVERNMENT

FILE:C:\WINDOWS\DESKTOP\MYBRIE~1\SLOBOGIN.WP 12/13/05 Tue 12:53PM Dec TRANSACTION SURVEILLANCE BY THE GOVERNMENT Christopher Slobogin * Many important aspects of our lives are inscribed in written and digitized records, housed in private businesses, government agencies and other institutions. These records include all sorts of information about us: reports on our medical status and financial condition; data about our purchases, rentals, real estate holdings, licenses, and memberships; logs listing the destination of our emails and our Internet wanderings; and countless other bits of individual descriptors, ranging from salary levels to college grades to driver's license numbers. Whether the information memorializes our own version of personal activities or is created by the record-holder itself, there is often an explicit or implicit understanding that the information will be used or viewed by a limited number of people for circumscribed purposes. In other words, we consider the contents of many of these records private, vis-a-vis most of the world. Thus, it may be surprising that law enforcement officials can, perfectly legally, gain access to all of this information much more easily than they can search our houses or even our cars. While the latter types of actions require probable cause, government can obtain many of the records just described simply by asking (or paying) for them. 1 And, at most, all the S te p h e n C. O 'C o n n e ll P r o fe s s o r o f L a w, U n iv e r s ity o f F lo r id a F r e d r ic G. L e v in C o lle g e o f L a w. F o r th e ir c o m m e n ts o n th is p a p e r, I w o u ld lik e to th a n k J e r o ld Is r a e l, S c o tt S u n d b y, P e te r S w ir e, G e o r g e T h o m a s, a n d p a r tic ip a n ts in w o r k s h o p s o r sym p o s ia a t th e fo llo w in g s c h o o ls : M is s is s ip p i, D e P a u l, F lo r id a S ta te, O h io S ta te, a n d H a s tin g s. 1 S e e g e n e r a lly D a n ie l J. S o lo v e, A c c e s s a n d A g g r e g a tio n : P u b lic R e c o r d s, P riv a c y a n d th e C o n s titu tio n, 8 6 M. L. R E V. 1 1 3 7 (2 0 0 2 ). 139

F IL E :C : \ S L O B O G IN.D T P D e c 1 2 / 1 3 / 0 5 T u e 1 2 :5 3 P M 1 4 0 M IS S IS S IP P I L A W J O U R N A L [V o l. 7 5 government needs to show in order get any of these records is that they are Arelevant@ to a government investigationba much lower, and much more diffuse, level of justification than probable cause. 2 This state of affairs might make sense when the records sought are truly public in nature. It might also be justifiable when the records involve an entity such as a corporation, professional service provider, or government department and are sought in an effort to investigate the entity and its members. But today, facilitated by the computerization of information and communication, government routinely obtains personal medical, financial and email records, in connection with investigations that have nothing to do with business or governmental corruption. 3 That practice is much more questionable. This article explores the scope and regulation of what I will call Atransaction surveillance@ by the government. That term is meant to distinguish the subject of this article from both Aphysical surveillance@ and Acommunications surveillance.@ Physical surveillance is real-time observation of physical activities, using either the naked eye or enhancement devices such as binoculars or video cameras. Communications surveillance is real-time interception of the content of communications, relying on wiretapping, bugging, hacking, and various other methods of intercepting oral statements and wire and electronic transmissions. Transaction surveillance, in contrast, involves accessing already-existing records, either physically or through computer databanks. It also encompasses accessing, in real-time or otherwise, the identifying signals of a transaction (such as the address of an email recipient). 4 2 S e e x t a c c o m p a n g n o s 3 5-3 7. 3 S e e S o v e, s u p r a n o 1. 4 T h a r d n o f s u r v e n c e w a s d e v e p e d b y e A m e r a n B a r A s s o c n T a s k F o r c e o n L a w E n r c e m e n t a n d T e c h n o g y a n d e x p a d r e r C h p h e r S b o g, T e c h n o g a - A s s d P h y s a l S u n c e : T h e A m e r a n B a r A s s o c n T e n e D r a S n d a r d s, 1 0 H A R V. J. L. & T E C H. 3 8 3, in fra te yin te lo te is trip tite ivis io illa lo th ic ia tio 's fo lo is lic te fu th in ris to lo in lo ic lly is te ic rveilla ic ia tio 's ta tiv ft ta

FILE:C:\SLOBOGIN.DTP Dec 12/13/05 Tue 12:53PM 2005] TRANSACTION SURVEILLANCE 141 Like physical and communications surveillance, transaction surveillance is a potent way of discovering and making inferences about a person's activities, character and identity. Yet, despite a bewildering array of statutorily created authorization requirements, transaction surveillance by the government is subject to far less regulation than either physical surveillance of activities inside the home or communications surveillance. 5 My principal argument is that transaction surveillance should be subject to much more legal monitoring than it is. To get to that conclusion, this article proceeds in four parts. Part I explains why government, and in particular law enforcement, finds transaction surveillance so attractive, and why it is so easy to carry out in this digital age. Part II describes the current law regulating transaction surveillance. Not only is this regulation minimal, it is confusing and contradictory; beyond the traditional subpoena, challengeable by the target of the investigation, current law recognizes a number of subpoena mutations that seem to have little rhyme or reason. If it contributes nothing else, this article should at least clarify the nature of today's regulatory framework. Part III criticizes this framework and outlines a more promising approach. The proposed reform recognizes, as does the current regime, that different sorts of records merit different levels of protection. But, in contrast to current law, the proposal would significantly increase the degree of protection in a number of situations, to the probable cause level for personal records held by private and public entities and to the 3 8 7-8 8 (1 9 9 7 ). 5 A s d is c u s s e d in fra te x t a c c o m p a n yin g n o te s 3 8-8 2, tra n s a c tio n s u r v e illa n c e n e v e r r e q u ir e s p r o b a b le c a u s e. In c o n tra s t, c o m m u n ic a tio n s s u r v e illa n c e r e q u ir e s a w a r r a n t,, w h ic h m a y b e is s u e d o n ly if th e r e is p r o b a b le c a u s e a n d o th e r m e th o d s o f o b ta in in g th e in fo r m a tio n h a v e fa ile d. S e e 1 8 U.S.C. ' 2 5 1 8 (3 ). P h ysic a l s u r v e illa n c e o f th e h o m e r e q u ir e s a w a r r a n t u n le s s it c a n ta k e p la c e w ith th e n a k e d e ye fr o m a la w fu l v a n ta g e p o in t u s in g te c h n o lo g y th a t o n ly re p lic a te s s u c h n a k e d e ye v ie w in g o r it in v o lv e s te c h n o lo g y th a t is in g e n e r a l p u b lic u s e. K yllo v. U n ite d S ta te s, 5 3 3 U. S. 2 7, 3 4-3 5 (2 0 0 1 ).

F IL E :C : \ S L O B O G IN.D T P D e c 1 2 / 1 3 / 0 5 T u e 1 2 :5 3 P M 1 4 2 M IS S IS S IP P I L A W J O U R N A L [V o l. 7 5 reasonable suspicion level for personal records readily available to the public. Part IV concludes by examining alternatives to the proposal (and to the current regime). It rejects both an approach that requires probable cause for all records searches and, at the other extreme, an approach that would allow suspicionless records searches on condition that anything discovered is subject to strict limitations on disclosure. It also criticizes an approach that relies on the legislature, rather than the courts and the Fourth Amendment, to establish fundamental regulatory requirements. Not all recorded information warrants the maximum refuge from government intrusion. But much of it deserves much more protection than it receives today. I. THE CURRENT REACH OF TRANSACTION SURVEILLANCE Transaction surveillance comes in many forms. This article divides it into two types: target-based and event-based. Using these categorizations, the following discussion relies on hypotheticals to flesh out the various ways transaction surveillance can assist law enforcement in investigating street crime.

FILE:C:\SLOBOGIN.DTP Dec 12/13/05 Tue 12:53PM 2005] TRANSACTION SURVEILLANCE 143 A. Target-Based Transaction Surveillance Assume that I'm a federal agent, and that I'm suspicious of you for some vague reasonbperhaps you often pay for your airplane tickets with cash, 6 or you have been observed with accessories you shouldn't be able to afford, 7 or you are a young, Arab male who goes to the local mosque on a daily basis. 8 Under these types of circumstances, I clearly do not have sufficient suspicion for an arrest. 9 On the other hand, I feel I would be neglecting my obligation as a law enforcement official if I did not investigate you a bit further. So how do I find out more about you? I could confront you directly, either on the street or through a grand jury. 10 But neither approach is likely to net much information, and both will tip you off that I'm checking you out. Ditto with respect to going to your acquaintances and neighbors; they will probably not be complely forthcoming and they might let you know I've been nosing around. I could try the undercover agent approachbthere might be rich payoffs if I or one of my informants can weasel into your good graces. But success at that endeavor is rare, and spending so much effort 6 C f. F lo r id a v. R o ye r, 4 6 0 U.S. 4 9 1, 4 9 3 n.2 (1 9 8 3 ) (n o tin g th a t p a y in g fo r a n a irlin e tic k e t w ith c a s h is o fte n a n e le m e n t o f d r u g c o u r ie r p r o file s u s e d b y th e D r u g E n fo r c e m e n t A d m in is tra tio n ). 7 C f. S ta te v. C o o k s o n, 3 6 1 S.W.2 d 6 8 3, 6 8 4 (M o. 1 9 6 2 ) (in fo r m a n t, w h o a l- le g e d th a t d e fe n d a n ts h a d r o b b e d a ta v e r n, re p o r te d th a t At h e y h a d a la r g e s u m o f m o n e y a n d w e r e s p e n d in g fr e e ly@). 8 C f. M ic h a e l J. W h id d e n, U n e q u a l J u s tic e : A r a b s in A m e r ic a a n d U n ite d S ta te s A n tite r r o r is m L e g is la tio n, 6 9 F O R D H A M L. R E V. 2 8 2 5, 2 8 6 5 (2 0 0 1 ) (rec o u n t in g F B I s u r v e illa n c e o f a B r o o k lyn m o s q u e ). 9 A n a r r e s t o r p r o lo n g e d q u e s tio n in g in th e s ta tio n h o u s e r e q u ir e s p r o b a b le c a u s e. C H A R L E S H. W H IT E B R E A D & C H R IS T O P H E R S L O B O G IN, C R IM IN A L P R O C E D U R E : A N A N A L Y S IS O F C A S E S A N D C O N C E P T S 7 2-7 6 (4 th e d. 2 0 0 0 ). 1 0 N o te fu r th e r th a t e v e n q u e s tio n in g in th e fie ld th a t la s ts lo n g e r th a n a fe w m in u te s r e q u ir e s r e a s o n a b le s u s p ic io n, w h ic h e x is ts o n ly if th e r e a r e s p e c ific a n d a r tic u la b le fa c ts th a t th e p e r s o n is o r h a s b e e n e n g a g in g in c r im in a l a c tivity. Id.

F IL E :C : \ S L O B O G IN.D T P D e c 1 2 / 1 3 / 0 5 T u e 1 2 :5 3 P M 1 4 4 M IS S IS S IP P I L A W J O U R N A L [V o l. 7 5 on someone about whom I'm merely suspicious would usually be a waste of time. I could also surreptitiously follow you around for awhile, but that tactic is unlikely to produce much, especially if you make most of your contacts through technological meansbphones, emailbrather than physical travel. Of course, I could tap your phone and intercept your emails, but that requires a warrant based on probable cause, which I do not have. Thankfully there are other, much more efficient ways I can covertly acquire information about you, many of which I can carry out without leaving my desk and most of which, as the next section describes, require no or little legal authorization. The easiest way to get useful data is to contact one of the many companies, usually called commercial data brokers (CDBs), that use computers and the Internet to dig up Adirt@ from public and not-so public records. 11 One such company is LexisNexis, the legal research bohemoth, which operates Accurint, a program that allows Aorganizations to quickly and easily extract valuable knowledge from... tens of billions of data records on individuals and businesses,@ armed with no more than a name, address, phone number, or social security number. 12 Through this process, I can obtain information about a wide array of your transactions, including: bankruptcies and corporate filings, criminal convictions and criminal and civil court data (including marriage and divorce information), driver's licenses and motor vehicle information, firearms, hunting, fishing and professional licenses and permits, Internet domain names, property deeds and assessments, and 1 1 c e w e b s r o n e o f e s e c o m p a n s c a n b e u n d a t d o m T h e s e r v e s a r e o f u n e v e n q u a S e e P r e s n G r a, D l G u m s h o e s, a v a b a t h / w w w c m a g o m / a r 2 / 0 1 4 9 0 1 4 8 0 s p o v. 1 3, 2 0 0 1 ) e c o u n g e f r u s e v a r u s s e r v e s, c d g d d w m e d r e s u F o r p r e s e n t p u r p o s e s, h o w e v e r, e p o t a t e p o n l r n s a c n s u r v e n c e e n o r m o u s. 1 2 S e e A c c u r t W e b s, a v a b a t w w w c c u r o m / a o u s t m l s t a c c e s s e d o n S e p 1 3, 2 0 0 5 L e x N e x b o u g h t A c c u r t m S e t 2 0 0 5. In fa t, th ite fo th ie fo Ad ig irt.c @. ic lity. to lia ig ita ila le ttp :/.p.c tic le,4,2,0.a (N (r tin fo ts to io ic in lu in ig irt, ith ix lts ). th in is th th ir te tia fo tra tio illa is in ite ila le.a in t.c tu.h (la t. ). is is in fro is In in

FILE:C:\SLOBOGIN.DTP Dec 12/13/05 Tue 12:53PM 2005] TRANSACTION SURVEILLANCE 145 voter registration information. 13 For some states, the information held in Apublic records@ by government bureaucracies and available via computer is immensely broader: some types of medical records, Social Security numbers, crime victim's names, credit card and account numbers, psychiatric evaluation reports, tax returns, payroll information, and family profiles. 14 For a time, all of this was made even more easily accessible to state law enforcement officials through MATRIX (Multi-State Anti-Terrorist Information Exchange), a multistate consortium that allowed police to use Accurint for investigative purposes until its federal funding was discontinued in 2005. 15 The FBI and other federal agencies rely on equally powerful commercial data brokers, with perhaps the most popular being Choicepoint. 16 Under its contract with the federal government, Choicepoint can provide me, as a federal agent, with Acredit headers@ (information at the top of a credit report which includes name, address, previous address, phone number, social security number and employer); pre-employment screening information (including financial reports, education verification, reference verification, felony check, motor vehicle record and professional credential verification); Aasset location services@; information about neighbors and family members; licenses (driver's, pilot's and professional); business information compiled by state bureaucracies; and Aderogatory informa- 1 3. 1 4 R o b e E S m, H e r e W h y P e o p A r e M a d, 2 9 P R A C Y J. 7, 7 a n. 2 0 0 3 ) g S p h e n G e s, a d m r o f e J u d l R e c o r d s C e n r R h o d e n d a v a b a t h / w w w r u r n a e. 1 5 S e e F. D e p L a w E n r c e m e n M A T R P t P r o c t C o n c d e s p 1 4, 2 0 0 5 a v a b a t h / w w w s r e s s _ r e a s e s / 2 0 0 5 0 4 1 5 _ m a _ p r o c t o g, h o w e v e r, a t F r a a n d s e v e r a l o e r s s m a y c o n u e n d g e p r o g r a m 1 6 S e e C h J a y H o o a g, B B r o e r L H e e r s : H o w C h o e P o t a n d O e r C o m m e r c l D a B r o k e r s C o c t a n d P a c k a g e Y o u r D a r L a w E n r c e m e n t, 2 9 N. J. I N T ' L & C O M M. R E 5 9 5, 6 1 7-1 8 e s c r g e F B e c r e c s s d c o n c w C h o e p o Id rt llis ith 's le IV (J (c itin te rim in is tra to th ic ia te in Is la ), ila le ttp :/.p ivacyjo l.n t/ la 't fo t, IX ilo je lu (A ril ), ila le ttp :/.fd le.s ta te.fl.u.p le trix je (n tin th lo id th ta te tin fu in th ). ris fn le ig th 's ittle lp ic in th ia ta lle ta fo fo.c G. (d ib in th I's As t, la ifie tra t@ ith ic in t).

F IL E :C : \ S L O B O G IN.D T P D e c 1 2 / 1 3 / 0 5 T u e 1 2 :5 3 P M 1 4 6 M IS S IS S IP P I L A W J O U R N A L [V o l. 7 5 tion@ such as arrests, liens, judgments and bankruptcies. 17 If you think I wouldn't bother requesting such a check, think again; between 1999 and 2001, Choicepoint and similar services ran between 14,000 and 40,000 searches per month for the United States Marshall's Service alone. 18 The one drawback to the type of information I get from CDBs is that it is pretty general. I may want to know more about what you do on a daily basis. Fortunately, there are a number of services that can help me out. For instance, advances in data warehousing and data exchange technology in the financial sector allow very easy access to a virtual cornucopia of transaction-related information that can reveal, among other things, Awhat products or services you buy; what charities, political causes, or religious organizations you contribute to;... where, with whom, and when you travel; how you spend your leisure time;... whether you have unusual or dangerous hobbies; and even whether you participate in certain felonious activities.@ 19 If I jump through some pro forma legal hoops (detailed in Part II), I can also get records of all the phone numbers you dial and receive calls from, 20 and from your Internet Service Provider (ISP) I can get every website address you have visited (so-called Aclickstream data@) and 1 7 Id. a t 6 0 1-0 2. N o te a ls o th a t o n c e a s o c ia l s e c u r ity n u m b e r a n d o th - e r id e n tifyin g in f o r m a tio n is o b ta in e d, o th e r p e r s o n a l in fo r m a tio n m ig h t b e c o m e m u c h m o r e e a s ily a c c e s s ib le. S e e L y n n M. L o P u c k i, H u m a n Id e n tific a tio n T h e o r y a n d th e Id e n tity T h e ft P r o b le m, 8 0 T E X. L. R E V. 8 9, 1 0 8-1 4 (2 0 0 1 ) (p o in tin g o u t th a t s c h o o ls, fin a n c ia l in s titu tio n s a n d o th e r e n titie s m a k e p e r s o n a l in fo r m a tio n a c c e s s ib le b y a n y o n e w ith th e r ig h t S o c ia l S e c u rity n u m b e r, a d d r e s s, a n d m o th e r 's m a id e n n a m e ). 1 8 Id. a t 4-6. In 2 0 0 1, th e Im m ig r a tio n a n d N a tu r a lizatio n S e rvic e c o n d u c te d a p p r o x i m a te ly 2 3,0 0 0 s u c h s e a r c h e s a m o n th. Id. a t 1 1. 1 9 J a n e t D e a n G e rtz, T h e P u rlo in e d P e r s o n a lity: C o n s u m e r P r o filin g in F in a n c ia l S e rvic e s, 3 9 S A N D IE G O L. R E V. 9 4 3, 9 4 4-4 5, 9 5 1 (2 0 0 2 ). 2 0 T h e E le c tro n ic C o m m u n ic a tio n s P rivacy A c t, 1 8 U.S.C. ' 3 1 2 1 a llo w s p r o s e c u to r s to o b ta in th is in fo r m a tio n b y certifyin g to a c o u r t th a t it is Ar e le v a n t@ to a n o n g o in g in v e s tig a tio n. S e e in fra te x t a c c o m p a n yin g n o te s 4 3-4 7.

FILE:C:\SLOBOGIN.DTP Dec 12/13/05 Tue 12:53PM 2005] TRANSACTION SURVEILLANCE 147 every email address you have contacted. 21 The latter information can be particularly revealing to the extent you transact your business over the Internet. Recently some ISPs, like America OnLine, have stopped maintaining clickstream data, precisely so they won't have to answer such law enforcement requests. 22 No worries. All I have to do is invest in something called Asnoopware.@ Bearing names like BackOrifice, Spyagent, and WinWhatWhere, 23 snoopware is to be distinguished from adware and spyware. The latter software tells the buyer of the program how to contact people who visit the buyer's website. Snoopware, in contrast, allows its buyer to track the target well beyond a single website; it accumulates the addresses of all the Internet locations the target visits, as well as the recipients of the target's emails. The FBI has developed a similar program, once dubbed Carnivore, now called DCS-1000, that filters all emails that pass through a particular server. 24 Although some transaction snoopware 2 1 T h e E le c tro n ic C o m m u n ic a tio n s P rivacy A c t a t m o s t req u ir e s a s h o w in g o f r e le v a n c e fo r th is in fo r m a tio n. S e e 1 8 U.S.C. ' 3 1 2 1 ; in fra n o te s 6 9-7 7 a n d a c c o m p a n yin g te x t; s e e a ls o G a vin S k o k, E s ta b lis h in g a L e g itim a te E x p e c ta tio n o f P rivacy in C lic k s tre a m D a ta, 6 M IC H. J. T E L E C O M M. & T E C H. L. R E V. 6 1, 6 8-6 9 (2 0 0 0 ) (d e ta ilin g th e typ e o f in fo r m a tio n g o v e r n m e n t c a n o b ta in th r o u g h c lic k s tre a m d a ta ). 2 2 C o n v e r s a tio n w ith P e te r S w ir e, P r o fe s s o r, O h io S ta te S c h o o l o f L a w, S e p te m b e r 2 0, 2 0 0 4. T h e E le c tro n ic F r o n tie r F o u n d a tio n s h a s r e c o m m e n d e d th a t IS P s o n ly k e e p p e r s o n a lly id e n tifia b le c o m m u n ic a tio n s lo g s fo r As o lo n g a s it is o p e r a - tio n a lly n e c e s s a r y, a n d in n o e v e n t fo r m o r e th a n a fe w w e e k s.@ E le c tro n ic F r o n tie r F o u n d a tio n, B e s t D a ta P r a c tic e s fo r O n lin e S e rvic e P rovid e r s, fr o m th e E le c tro n ic F r o n tie r F o u n d a tio n a t h ttp :/ / w w w.e ff.o r g / o s p / 2 0 0 4 0 8 1 9 _ O S P B e s tp r a c tic e s. p d f2 (J u n e 2 9, 2 0 0 5 ). 2 3 S e e C a d e M e tz, S p yw a r e : It's L u r k in g o n Y o u r M a c h in e, P C M A G., A p r. 2 2, 2 0 0 3, a t 8 5, 8 8. 2 4 J e r e m y C. S m ith, T h e U S A P A T R IO T A c t: V io la tin g R e a s o n a b le E x p e c ta tio n s o f P rivacy P r o te c t e d b y th e F o u r th A m e n d m e n t W ith o u t A d v a n c in g N a - tio n a l S e c u rity, 8 2 N.C. L. R E V. 4 1 2, 4 4 8-4 9 (2 0 0 3 ). R e c e n tly, th e F B I a n n o u n c e d th a t it w o u ld n o lo n g e r u s e D C S - 1 0 0 0, b u t in s te a d r e ly o n Au n s p e c ifie d c o m m e r c ia l s o ftw a r e to e a v e s d r o p o n c o m p u te r tra ffic.@ F B I C u ts C a r n iv o r e In te r n e t P r o b e, a t h ttp :/ / w w w.c n n.c o m / 2 0 0 5 / T E C H / in te r n e t/ 0 1 / 1 8 / fb i.c a r n iv o r e.a p / in d e x.h tm l (o n file w ith th e M is s is s ip p i L a w J o u r n a l).

F IL E :C : \ S L O B O G IN.D T P D e c 1 2 / 1 3 / 0 5 T u e 1 2 :5 3 P M 1 4 8 M IS S IS S IP P I L A W J O U R N A L [V o l. 7 5 requires access to the server or computer to install, other types, called Trojan Horses, can electronically worm their way onto the system disguised as something useful. 25 In short, even if you stay at home and conduct all your business and social life via phone, email and surfing the `Net, I can construct what one commentator has called Aa complete mosaic@ of your characteristics. 26 And I can do all of this without you having a clue I'm doing it. It is also possible that I could surreptitiously obtain an even wider array of transactional informationbon matters ranging from medical treatment to financial decisionsbwith very little effort. But further discussion of that possibility, as well as of the huge amount of transactional information that government can obtain if it is willing to proceed overtly, will have to await Part II's explanation of the current legal regime. 2 5 M e tz, s u p r a n o te 2 3, a t 8 5. S o m e s n o o p w a r e, u s in g Ak ey lo g g e r@ te c h n o lo g y, c a n e v e n te ll th e u s e r th e c o n te n t o f o n e 's c o m p u te r s c r e e n. Id. D C S - 1 0 0 0 c a n a ls o b e p r o g r a m m e d to a c c e s s c o n te n t a s w e ll a s id e n tifyin g in fo r m a tio n. J o s e p h F. K a m p h e r s te in, In te r n e t P riv a c y L e g is la tio n a n d th e C a r n iv o r e S y s te m, 1 9 T E M P. E N V T L. L. & T E C H. J. 1 5 5, 1 6 7 (2 0 0 1 ). B o th fu n c tio n s a r e fo r m s o f c o m m u n ic a tio n s s u r v e illa n c e th a t a r e b e yo n d th e s c o p e o f th is a r tic le. 2 6 A n th o n y P a u l M ille r, T e le in fo r m a tic s, T r a n s b o r d e r D a ta F lo w s a n d th e E m e r g in g S tru g g le fo r In fo r m a tio n : A n In tro d u c tio n to th e A rriv a l o f th e N e w In fo r m a tio n A g e, 2 0 C O L U M. J. L. & S O C. P R O B S. 8 9, 1 1 1 (1 9 8 6 ).

FILE:C:\SLOBOGIN.DTP Dec 12/13/05 Tue 12:53PM 2005] TRANSACTION SURVEILLANCE 149 B. Event-Based Transaction Surveillance Now consider an entirely different type of scenario, one in which government has no suspicion of or even interest in a specific individual, but rather possesses information about a particular crime that has been or will be committed. Government efforts to obtain transactional data in this situation is not target-based, but event-based. Say, for instance, that the police know that a sniper-killer wears a particular type of shoe (thanks to mudprints near a sniper site), that he owns a particular type of sweater (because of threads found at another site), and that he reads Elmore Leonard novels (because of allusions to those books made in his communications to the police). Law enforcement understandably might want to peruse the purchase records of local shoe, clothing, and book stores as part of their investigation. Once police obtain the credit card numbers of those who bought, say, the type of sweater found at the murder scene, they can trace other purchases made with the same card, to see if the relevant type of shoe or book was bought by any of the same people. Of course, if there is a match on two or three of the items, the surveillance may then turn into a target-based investigation. Or say that a CIA informant reports that he believes Al Qaeda is considering blowing up a major shopping mall, using skydivers jumping from rental planes. 27 The FBI might want to requisition the records of all companies near major metropolitan areas that teach ski-diving and that rent airplanes, as well as the Acookie@ logs (records of cyberspace visitors) of all websites that provide information about manufacturing explosives, to see if there are any intersections between these three categories of data, in particular involving men with 2 7 T h a g a r y s c e n a r b o r r o w e d o m e s e c o n d M a r k R e p o M a r k F o u n d a n, C r e a t g a T r u s d N e o r k r H o m e n d S e c u r S e c o n d R e p o o f e M a r k F o u n d a n T a s k F o r c e, a p p. D a t 1 2 1-3 3 0 0 3 a v a b a t h / w w w a r k s k r c e r g /. is im in io is fr th le rt. le tio in te tw fo la ity: rt th le tio (2 ), ila le ttp :/.m le ta fo.o

F IL E :C : \ S L O B O G IN.D T P D e c 1 2 / 1 3 / 0 5 T u e 1 2 :5 3 P M 1 5 0 M IS S IS S IP P I L A W J O U R N A L [V o l. 7 5 Arab-sounding names. If there are then, again, further targetbased surveillance investigation might take place. Although the first type of event-based surveillance is backward-looking and the second is forward-looking, both law enforcement efforts are a form of what has been called Adata mining@ or Aprofiling,@ that is, an attempt to look through transaction information to find patterns of behavior that permit police to zero in on possible suspects. 28 If the information sought is not digitized, which is likely with respect to records kept by ski-diving companies, for instance, then law enforcement may have to rely on good old-fashioned human snooping. In this day and age, however, a significant amount of data mining can be carried out using technology. For example, the Defense Department's Total Information Awareness program, before it was severely limited by Congress, would have used software developed by private companies Ato sift through virtual mountains of data of everyday transactions, such as credit card purchases, e-mail and travel itineraries, in an attempt to discover patterns predictive of terrorist activity.@ 29 Whether it relies on computers or humans, event-based data mining, like transaction surveillance of particular individuals, can easily be conducted unbeknownst to those whose records are surveilled. 2 8 F o r a g e n e r a l d e s c r ip tio n o f d a ta m in in g a n d its p r e v a le n c e, s e e A n d r e w J. M c C lu r g, A T h o u s a n d W o r d s A r e W o r th a P ic tu r e : A P rivac y T o r t R e s p o n s e to C o n s u m e r D a ta P r o filin g, 9 8 N W. U. L. R E V. 6 3, 7 1-8 8 (2 0 0 3 ). 2 9 Id. a t 6 4 ; s e e a ls o in fra n o te 1 2 2.

FILE:C:\SLOBOGIN.DTP Dec 12/13/05 Tue 12:53PM 2005] TRANSACTION SURVEILLANCE 151 C. Summary Technology has made transaction surveillance a particularly powerful law enforcement tool. Given the potential that transaction surveillance provides the government for creating personality mosaics and linking people to crime, it could well be even more useful than visual tracking of person's activities (physical surveillance) and eavesdropping on or hacking into a person's communications (communications surveillance). But the real beauty of transaction surveillance for the government is that, compared to physical surveillance of activities inside the home and communications surveillance, it is so lightly regulated. As Part II explains, under today's regulatory regime it is much easier for government to obtain information about our most intimate transactions, including medical and financial matters, than it is to intercept our communications about those transactions.

w F IL E :C : \ S L O B O G IN.D T P D e c 1 2 / 1 3 / 0 5 T u e 1 2 :5 3 P M 1 5 2 M IS S IS S IP P I L A W J O U R N A L [V o l. 7 5 II. CURRENT LEGAL REGULATION OF TRANSACTION SURVEILLANCE Under the Fourth Amendment, the government usually cannot conduct a search of houses, persons, papers and effects without probable cause, 30 a relatively high level of certainty akin to a more-likely-than-not standard (which, in non-exigent situations, must be found by a magistrate pursuant to an application for a warrant). 31 For some less invasive actions (a frisk, for instance), police only need reasonable suspicion, which is a lower level of certainty than probable cause but still requires Aspecific and articulable facts@ that Acriminal activity may be afoot,@ to quote from the famous case of Terry v. Ohio. 32 Finally, in some Aspecial needs@ situations (searches of school children or employees; drug testing; health and safety inspections; roadblocks), the police need only act Areasonably,@ but that test still usually requires reasonable suspicion, 33 or at least a showing that those conducting the government action are pursuing some end other than criminal law enforcement. 34 3 0 S e e U. C O N S T. a m e n d.. 3 1 S e e W H E B R E A D & S L O B O G, s u n o 9, a t 1 3 7-4 2. 3 2 3 9 2 U. 1, 2 1, 3 0 9 6 8 3 3 S e e O o n n o r O g a, 4 8 0 U. 7 0 9, 7 2 4 9 8 7 ) h e d e y c o r r e c g e e m p y e e m c o n d u c t c a u s e d b y e n e e d r p r o b a b c a u s e r a e r a n r e a s o n a b s u s p n w b e n s d n g a n d o n r e p a r a b d a m a g e e a g e n c w o r k, a n d u a e p u b r e s ; N e w J e r s e y v. T 4 6 9 U. 3 2 5, 3 4 1-4 2, 3 4 4 9 8 5 ) o g a t s e a r c h o f a s d e n t b y a a c h e r o r o e r s c h o o l o l w b e s d a t c e p n ' w h e n e r e a r e r e a s o n a b g r o u n d s r s u s p e c g a t e s e a r c h w r n u p e v e n c a n d d g a t s n d a r d w a s m e t c a s e b e c a u s e e r e w a s r e a s o n a b s u s p n 3 4 S e e B d. o f E d u c. E a r, 5 3 6 U. 8 2 2, 8 2 9 0 0 2 ) p h o g.s IV IT IN pra te.s (1 ). 'C v. rte.s (1 (AT la in tin th lo is th fo le th th le ic io ill tra la te in to ta ib le fte ir le to th y's ltim te ly to th lic in te t.@).l.o.,.s (1 (h ld in th Aa tu te th ffic ia ill `ju tifie its in tio th le fo tin th th ill tu id e@ fin in th th is ta in th is th le ic io ). v. ls.s (2 (u ld in a r r a n tle s s, s u s p ic io n le s s s c h o o l d r u g te s tin g, n o t in g th a t Ain th e c o n te x t o f s a fe ty a n d a d m in is trativ e r e g u la tio n s, a s e a r c h u n s u p p o r te d b y p r o b a b le c a u s e m a y b e r e a s o n a b le w h e n `s p e c ia l n e e d s, b e yo n d th e n o r m a l n e e d fo r la w e n fo r c e m e n t, m a k e th e w a r r a n t a n d p r o b a b le - c a u s e r e q u ir e m e n t im p r a c tic a b le '@) ; C ity o f In d ia n a p o lis v. E d m o n d, 5 3 1 U.S. 3 2, 4 1 (2 0 0 0 ) (AW e h a v e n e v e r a p p r o v e d a c h e c k p o in t p r o g r a m

FILE:C:\SLOBOGIN.DTP Dec 12/13/05 Tue 12:53PM 2005] TRANSACTION SURVEILLANCE 153 In contrast, transaction surveillance, whether it is eventbased or target-based, never requires probable cause or reasonable suspicion, even when conducted by government agents whose primary goal is criminal investigation. At most, government agents seeking transactional information need a subpoenabeither a subpoena duces tecum issued by a grand jury, or an Aadministrative subpoena@ issued by a government agencybwhich is valid as long as the information it seeks is Arelevant@ to a legitimate (statutorily-authorized) investigation. Relevance, as defined by the Supreme Court, is an extremely low standard. In the grand jury context, a subpoena may be quashed on irrelevancy grounds only when the court Adetermines that there is no reasonable possibility that the category of materials the Government seeks will produce information relevant to the general subject of the grand jury's investigation.@ 35 The relevancy standard in the administrative subpoena context is even lower, with the Supreme Court holding that A[e]ven if one were to regard the [subpoena] as caused by nothing more than official curiosity, nevertheless law-enforcing agencies have a legitimate right to satisfy themselves that corporate behavior is consistent with the law and the public interest.@ 36 In short, the link between the information a subpoena commands and the investigation the government is pursuing can be very tenuous indeed. Although a subpoena w h o s e p r a r y p u r p o s e w a s d e c t e v e n c e o f o r d a r y c r a l w r o n g d o g. R a e r, o u r c h e c k p o t c a s e s h a v e r e c o g n e d o n e d e x c e p n s e g e n e r a l a t a s e u r e m u s t b e a c c o m p a n d b y s o m e m e a s u r e o f d u a e d s u s p n. 3 5 U n d S s v. R. E n r s c 4 9 8 U. 2 9 2, 3 0 1 9 9 1 ) m p h a s a d d e d 3 6 U n d S s v. M o r n S a C o 3 3 8 U. 6 3 2, 6 5 2 9 5 0 s e e a o U n d S s v. P o w e 3 9 7 U. 4 8, 5 7-5 8 9 6 4 ) o g a t a d m e s u b p o e n a s a r e v a e r e c o r d s s o u g h t a r e e v a n a n v e s a n c o n d u c d r a g a p u r p o s ; U n d S s v. H u n n & W m s, 9 5 2 F. S u p p. 8 4 3, 8 5 4. 1 9 9 7 ) o g a t e P o w e q u m o r e d e r e n l a n e r b r y a n d c a p r i c u s n d a r d o f w r a g e n c y a c n u n d e r e A d m e P r o c e d u r e A c im to te id in im in in th in iz ly lim it tio to th rule th iz ie in ivid liz ic io.@) ite ta te te., In.,.S (1 (e is ). ite ta te to lt.,.s (1 ); ls ite ta te ll,.s (1 (h ld in th in is trativ lid if th Ar le t@ to in tig tio te fo Ale itim te e@) ite ta te to illia (D.D.C (h ld in th th ll in iry is fe tia th th Aa itra io s@ ta revie fo tio th in is trativ t).

F IL E :C : \ S L O B O G IN.D T P D e c 1 2 / 1 3 / 0 5 T u e 1 2 :5 3 P M 1 5 4 M IS S IS S IP P I L A W J O U R N A L [V o l. 7 5 may be challenged before it is executed, a successful challenge is exceedingly rare, whether the subpoena is issued by a grand jury or an administrative agency. 37 Furthermore, as we shall see, the law does not require even a traditional subpoena for most types of transaction surveillance. Instead, the government, in particular Congress, has either invented new forms of authorization that are even easier to obtain or has simply permitted unrestrained law enforcement access to transactional information. The following account of this incredibly weak regulatory regime starts with the law regarding transaction surveillance of identifying information, conducted in real-time, then describes regulation of government attempts to obtain public records, and finally describes transaction surveillance of records held by private entities. A. Interception of Transaction Information Real-time government interception of the content of communications (what I am calling communications surveillance) is prohibited unless authorized by a warrant based on probable cause. 38 In contrast, interception of the identifying features of the communicationbthe names of the communicators, their phone numbers or email addresses, and the addresses of websites visitedbcan take place on a much lesser showing. The Fourth Amendment does not apply at all to this type of transaction surveillance, and statutory law places virtually no restrictions on it. 3 7 S e e W A Y N E R. L A F A V E, J E R O L D H. I S R A E L & N A N C Y J. K IN G, 3 C R IM IN A L P R O C E D U R E 1 3 4 (2 d e d. 1 9 9 9 ) (AC o u rts g e n e r a lly g iv e g r a n d ju rie s c o n s id e r a b le le e w a y in ju d g in g r e le v a n cy.@) ; J A C O B A. S T E IN, G L E N N A. M IT C H E L L & B A S IL J. M E Z IN E S, 3 A D M IN IS T R A T IV E L A W 2 0-5 9 (2 0 0 2 ) (A[ S ]u b p o e n a s w ill b e e n fo r c e d a s to a n y d o c u m e n ts th a t `a r e n o t p la in ly im m a te ria l o r irrele v a n t to th e in v e s tig a tio n.'@). 3 8 1 8 U.S.C. ' 2 5 1 8 (3 ). T h e c o u r t m u s t a ls o fin d th a t An o r m a l in v e s tig a tiv e p r o c e d u r e s h a v e b e e n trie d a n d h a v e fa ile d o r r e a s o n a b ly a p p e a r to b e u n lik e ly to s u c c e e d if trie d o r to b e to o d a n g e r o u s.@ Id.' 2 5 1 8 (3 )(c ).

FILE:C:\SLOBOGIN.DTP Dec 12/13/05 Tue 12:53PM 2005] TRANSACTION SURVEILLANCE 155 The Fourth Amendment's justification requirementsbprobable cause and the likebonly apply if government engages in a Asearch or seizure.@ Although one might reasonably label government efforts to track down a person's phone and email correspondents a search, the Supreme Court has held that a Fourth Amendment search occurs only when a government action infringes a reasonable expectation of privacy. 39 More importantly for present purposes, the Court has determined, in Smith v. Maryland, 40 that we do not have a reasonable expectation in the phone numbers we dial because we know or should know that phone companies keep a record of these numbers, and thus Aassume the risk@ that the phone company will decide to disclose this information to the government. 41 Because it is generally known that Internet service providers monitor, if only temporarily, our emails and Internet surfing, the Court would probably also say that we assume the risk these providers will become government informants. Although Universal Resource Locators (URLs) can be more informative than a mere phone number, both because they are addresses (e.g., www.amazon.com/kidneydisease) and because they allow access to the website and thus permit government to ascertain what the user has viewed, the lower courts applying Smith appear to see no difference between the two types of routing information. 42 Accordingly, the government can proba- 3 9 K v. U n d S s, 5 3 3 U. 2 7, 3 3 0 0 1 ) A ] F o u r A m e n d - m e n t s e a r c h o c c u r s w h e n e g o v e r n m e n t s a s u b c e e x p e c n o f p r a t s o c c o g n e s a s r e a s o n a b g K a U n d S s, 3 8 9 U. 3 4 7, 3 6 1 9 6 7 ) a r n, J c o n c u r g 4 0 4 4 2 U. 7 3 5 9 7 9 4 1. a t 7 4 4 P n e r v o n r c o n v e y e d n u m e r a l r m a n e p h o n e c o m p a n y a n d x p o s e d ' a t r m a n e q u m e n t e o r d n a r y c o u r s e o f b u s e s s... e r e b a s s u m g ] e r k a t e c o m p a n y w o u r e v e a l p o e e n u m b e r s h e d d 4 2 C T h e s o n v. U. B a n c r o N o. C U - 0 3-4 6 7 - S T 2 0 0 4 W L 2 0 6 6 7 4 6. O S e p 1 5, 2 0 0 4 ) W e n e r m a n d e n d a n c o c t e d w a s o n e w e b s a d d r e s s e s, e r a n e a c a l c o n n t o f e w e b s s T h e s o n v e d, e s u r v e n c e ] a n a g o u s a p e n r e g s e a r c h, w h e r e yllo ite ta te.s (2 (A[ th th vio la te je tiv ta tio ivacy th ie ty re iz le.@) (c it in tz v. ite ta te.s (1 (H la., rin ))..S (1 ). Id (A[ ]e titio lu ta ily ic in fo tio to th te le `e th in fo tio to its ip in th i- in [th y] [in th is th th ld to lic th ia le.@) f. yg.s ft, (D r. t. (A[ ]h th in fo tio fe ts lle ly th ite ra th th th tu te th ite yg is it [th illa is lo to is try in

F IL E :C : \ S L O B O G IN.D T P D e c 1 2 / 1 3 / 0 5 T u e 1 2 :5 3 P M 1 5 6 M IS S IS S IP P I L A W J O U R N A L [V o l. 7 5 bly ignore the Fourth Amendment when intercepting phone numbers and Internet addresses. Congress has imposed some statutory restraints on this type of surveillance, but nothing approaching the usual Fourth Amendment protections. In the Electronic Communications Privacy Act of 1986 (ECPA), it created a new, streamlined type of authorization process for use of pen registers (technology which intercepts outgoing phone numbers) and trap and trace devices (technology which intercepts incoming numbers), a process that can be initiated by either a federal government attorney or a state law enforcement officer. All the government agent must do is certify to a court facts that show the information is Arelevant to an ongoing investigation@ and is Alikely to be obtained by [the surveillance].@ 43 If that certification is made, the court must issue the order. 44 The USA Patriot Act of 2001 expanded the definition of pen registers and trap and trace devices to include all devices e F o u r A m e n d m e n t c o n x c o u r h a v e h e a t d e n d a n h a v e n o r e a s o n a b e x p e c n o f p r e p h o n e n u m b e r s e y d l b e c a u s e e n u m b e r s a r e c o n v e y e d e p h o n e c o m p a n ; U n d S s v. K e n n e d 8 1 F. S u p p. 2 d 1 1 0 3, 1 1 1 0. K a n. 2 0 0 0 ) h e n d e n d a n t e n r e d a n a g r e e m e n t w R o a d R u n n e r r r n e t s e r v e, h e k n o w g v e a d a r m a n c o n - n e c d e a d d r e s s.... ; s e e a o n o 4 6. B g r e c o r d s o f P s m a y a o b e u n p r o c d b y e F o u r A m e n d m e n U n d S s v. H a m b r k, 2 2 5 F d 6 5 6 C 2 0 0 0 ) n p u b h e d o p n ) o g a t p e r s o n d o e s n o t h a v e a r e a s o n a b e x p e c n o f p r e a c c o u n t r m a n g e n e P o r d e r e s b h e e - m a a c c o u n e c a u s e n o n - c o n n t r m a d c s u r e o f w h h o a d p a r d e s y s t h e p r a c y e x p e c t n a t m h t h a v e e x d p r e v u s, a v a b a t 2 0 0 0 U. A p p. L E X 1 8 6 6 5, a t * 1 2. d e e d, s o m e c o u r h a v e h e a t e c o n n t o f e m a m e s s a g e s, o n c e e y a r e o p e n e d, d e s e r v e n o F o u r A m e n d m e n t p r o c n b e c a u s e o n e a s s u m e s e r k e r e c n t w r e v e a l o e r s. U n d S s v. C h a r b o n n e a u, 9 7 9 F. S u p p. 1 1 7 7, 1 1 8 4. O h 1 9 9 7 S m v. P b u r y, 9 1 4 F. S u p p. 9 7, 1 0 1. P a. 1 9 9 6 U n d S s v. M a x w e 4 5 M. 4 0 6, 4 1 7-1 8. 1 9 9 6 4 3 1 8 U. 3 1 2 3 ) 0 0 0 4 4 U n d S s v. F r e g o s o, 6 0 F d 1 3 1 4, 1 3 2 0 C 1 9 9 5 ) e d l r o a p p r o v g u s e o f p a n d c e d e v e s m r l n a. th th te t, ts ld th fe ts le ta tio ivacy in th te le th ia th to th te le y.@) ite ta te y, (D (AW fe te in to ith fo In te ic in ly re le ll in fo tio te to th IP @) ls in fra te illin IS ls te te th th t. ite ta te ic.3 (4 th ir. (u lis in io (h ld in th le ta tio ivacy Ain th in fo tio iv to th IS in to ta lis th il t, [b it] is te in fo tio n@ is lo ic At th ir ty tro iv ta io th ig is te io ly@) ila le.s IS In ts ld th th te il th th te tio th is th ip ie ill it to th ite ta te (S.D io ); yth ills (E.D ); ite ta te ll,.j (C.A.A.F )..S.C ' (a )(1 (2 ). ite ta te.3 (8 th ir. (th Aju ic ia le in in tra tra ic is in is te ia in ture@)

FILE:C:\SLOBOGIN.DTP Dec 12/13/05 Tue 12:53PM 2005] TRANSACTION SURVEILLANCE 157 that obtain Adialing, routing, addressing, or signaling information utilized in the processing and transmitting of wire or electronic communications... @ 45 Thus, to use snoopware, DCS- 1000, and other means of ascertaining a person's email correspondents and favorite websites, the government need only certify the relevance of this information to a current investigation. 46 Again, if this certification is made, the court must issue an order. Those of us who teach Fourth Amendment law sometimes joke about supposedly Aneutral and detached@ magistrates rubberstamping warrant applications, but we also assume that judicial independence is theoretically possible. 47 Here, in contrast, Congress has legislatively invented mandatory rubberstamping. It is tempting to call this type of authorization a Arubberstamp order,@ but I will instead use the more measured term certification order. Whatever one calls the authorization process, it amounts to minimal limitation on interception of transaction information. 4 5 1 8 U. 3 1 2 1 ) 0 0 0 4 6 M o s t c o u r h a v e h e a t c o m p a n s a t a c q u e k s a m d a - a b o u t w h e r e a n r n e t u s e r g o e s o n e r n e t d o n o t E C P A b e c a u s e e w e b s s v d b y e u s e r h a v e a u o r e d e c o m p a n s a c c e s s r - m a n. S e e D o u b C k, c P a c y L 1 5 4 F. S u p p. 2 d 4 9 7, 5 2 6. 2 0 0 1 C h a n c e A v e. A, c 1 6 5 F. S u p p. 2 d 1 1 5 3, 1 1 6 3. W a s h. 2 0 0 1 T o R U s, c P a c y L N o. C 0 0-2 7 4 6 2 0 0 1 U. D L E X 1 6 9 4 7, a t * 2 8. C a O c 9, 2 0 0 1 T h u s, g o v e r n m e n t c o u a o o b r o u t g r m a n o m e s e p r a c o m p a n s, w o u t u s g s n o o p w a r e. H o w e v e r, s o m e c o u r m h t c o n s e r a t a p p r o a c h b e a c c e s s g r e r m a n. S e e, e U n d S s v. S e r, 3 1 8 F d 1 0 3 9, 1 0 5 0 1 C 2 0 0 3 s o, g o v e r n m e n t m a y h a v e o b a s u b p o e n a. S e e x t a c c o m p a n g n o s 6 5-6 8. 4 7 S e e R H A R D V A N D U E N D, L. P A U L S U T T O N & C H A R L O T T E A. C A R T E R, T H E S E A R C H W A R R A N T P R O C E S S : P R E C O N C E P T N S, P E R C E P T N S A N D P R A C T E S 4 7-4 8 9 8 5 ) e s c r g s d y o f w a r r a n t p r o c e s s d a g v a r y g d e g r e e s o f d l r u b b e r s m p g a c r o s s r d n s.s.c ' (c (2 ). ts ld th ie th ir Ac lic tre ta@ In te th In te vio la te th ite is ite th th iz th ie to th is in fo tio In re le lic In., riv itig., (S.D.N.Y ); v. In., (W.D ); In re ys In., riv itig.,.s is t. IS (N.D l. t. ). ld ls ta in in in fo tio fr th iv te ie ith in ts ig id th to in As to d@ in fo tio.g., ite ta te te ig.3 (1 th ir. ). If to ta in in fra te yin te IC IZ IO IO IC (1 (d ib in tu in ic tin in ju ic ia ta in ju is ic tio ).

F IL E :C : \ S L O B O G IN.D T P D e c 1 2 / 1 3 / 0 5 T u e 1 2 :5 3 P M 1 5 8 M IS S IS S IP P I L A W J O U R N A L [V o l. 7 5 B. Access to Publicly-held Records Most transaction surveillance does not involve real-time interception of information, but rather contemplates accessing already-existing records, held either by public or private institutions. Information in public records is particularly easy to secure. Under current law, law enforcement officials do not need even a certification order to use MATRIX, Choicepoint and similar vehicles for perusing public records. In fact, law enforcement officials need consult no other entity (certainly not a court, and not even a prosecutor) before obtaining such information. Again, the Fourth Amendment's ban on unreasonable searches and seizures might appear to apply here, because looking for and through records is a search in the usual meaning of the word. But, as already noted, the Supreme Court has made clear that one cannot reasonably expect privacy in connection with information voluntarily given to third parties. Even more important than Smith in this regard is United States v. Miller, 48 decided three year earlier. There the Court held that once a person surrenders information to an agency or institution, he or she assumes the risk the third party will hand it over to the government. 49 The key declaration in Miller is worth quoting in full: A[T]he Fourth Amendment does not prohibit the obtaining of information revealed to a third party and conveyed by him to Government authorities, even if the information is revealed on the assumption that it will be used only for a limited purpose and the confidence placed in the third party will not be betrayed.@ 50 The Privacy Act, enacted by Congress in 1974, does bar or limit access to public records when they are sought by private individuals, and even when most government officials want 4 8 4 2 5 U.S. 4 3 5 (1 9 7 6 ). 4 9 M ille r, 4 2 5 U.S. a t 4 4 3. 5 0 Id. a t 4 4 3 (e m p h a s is a d d e d ).

FILE:C:\SLOBOGIN.DTP Dec 12/13/05 Tue 12:53PM 2005] TRANSACTION SURVEILLANCE 159 them. 51 But when law enforcement officials are after the records, the Act merely requires a letter from the head of the agency that is seeking the information, detailing the law enforcement reasons a particular person's records are needed. 52 No court is involved, and neither individualized suspicion or even a relevance showing is required, just the sayso of the law enforcement department. I will call this kind of authorization an extrajudicial certification. Not even this level of authorization is necessary for government access to most public records, however. The Privacy Act only applies to federal documents. Unless there is similar legislation at the state level, law enforcement access to state public records is unrestricted. 53 Furthermore, the federal government takes the position that when it obtains information from a commercial data broker like Choicepoint, the Privacy Act does not apply at all, because the Act literally only refers to law enforcement efforts to get records from other government agencies and from private companies that are adminis- 5 1 S e e 5 U. 5 5 2 a ) 0 0 0 ) o a g e n c y s h a d c s e a n y r e c o r d w h h c o n e d a s o f o r d s... u n s s g 1 2 e x c e p - n s. 5 2. 5 5 2 a ) e r m g d c s u r e o a n o e r a g e n c y o r a n s e n o f a n y g o v e r n m e n l d n w o r u n d e r e c o n l o f e U n d S s r a c o r c r a l w e n r c e m e n t a c e a c a u - o r e d b y w, a n d e h e a d o f e a g e n c y o r s e n h a s m a d e a w n r e q u e s t e a g e n c y w h h m a s e o r d s p e c g e p a r u r p o r n d e s e d a n d e w e n r c e m e n t a c r w h h e r e c o r d s o u g h. 5 3 S e e P a u l M. S c h w a r P a c y a n d P a a n : P e r s o n a l r m a n a n d P u b S e c r R e g u n e U n d S s, 8 0 I O W A L. R E 5 5 3, 6 0 5 9 9 5 ) o s t s s c k m n u s d a p r o c n w s b u t e r h a v e c a r e d w s a p r o v e o n d p r o c n s r p e r s o n a l r m a n e p u b s e c. O n e r e a s o n F r a a n a c e p c e b a s e a n o p e r a n e M A T R a t p u b r e c o r d s w q u e x n s e. S e e F L S T A T. 1 1 9 1 e t s e q. t e p o y o f s a t a s, c o u n a n d m u n a l r e c o r d s s h a b e o p e n r p e r s o n a l s p e c n b y a n y p e r s o n. R e c o g n g p r o b m, e F a S u p r e m e C o u c e n o r d e r e d a m o r a r m o n e d a n o f F r a p u b o r d s. J a s o n K r a u s e, T o o M u c h r m a n? C o u n C r k s T u s s w N e r v o u s S O O P o s g C o u R e c o r d s O n e, A. J., A p 2 0 0 4, a t 2 4..S.C ' (b (2 (AN ll is lo ic is ta in in ystem rec le [lis tin tio ].@) Id ' (b )(7 (p ittin is lo At th to in trum ta lity ta ju ris ic tio ith in th tro th ite ta te fo ivil im in la fo tivity if th tivity is th iz la if th th in trum ta lity ritte to th ic in ta in th rec ifyin th tic la tio ir th la fo tivity fo ic th is t@) tz, riv rtic ip tio In fo tio lic to la tio in th ite ta te V. (1 (m ta te la Ao ib ta te tio la,@ ra th As tte la [th t] id ly lim ite te tio fo in fo tio in th lic tor.@) lo id is ttra tiv la to tio lik IX is th its lic la is ite te iv A. '.0 (AI is th lic th is ta te th ll ta te ty ic ip ll fo in tio.@) izin th is le th lorid rt re tly to iu th ig itiz tio lo id 's lic rec In fo tio ty le le ith ta te ffic ia ls ver tin rt lin.b.a ril

F IL E :C : \ S L O B O G IN.D T P D e c 1 2 / 1 3 / 0 5 T u e 1 2 :5 3 P M 1 6 0 M IS S IS S IP P I L A W J O U R N A L [V o l. 7 5 tering a system of records for the government. 54 Under this interpretation, the only obstacle to complete government access to all the data maintained by commercial brokers is the price of the information. 55 C. Access to Privately-held Records Compared to the meager limitations on intercepting transactional information and accessing public records, the restrictions on government access to the contents of records held by nominally private entities, such as hospitals and banks, phone companies and Internet providers, have more teeth, but the teeth are blunt. Again, the Fourth Amendment is pretty much irrelevant here. The notion that one assumes the risk that third parties will be, or turn into, government informants applies to private entities as well as public agencies. The Supreme Court has specifically so held with respect to phone companies (in Smith) 56 and banks (in Miller). 57 It has wavered in its willingness to declare private entities untrustworthy confidants only in the medical context, where it has stated, in dictum, that the Fourth Amendment or the due process clause might place constitutional limitations on law enforcement access. 58 Although there are also statutory constraints on gov- 5 4 5 U. 5 5 2 a 5 5 S e e H o o a g, s u p r a n o 1 6, a t 6 2 3 A ] d a b a s e o f r m a n a t o r a s a t a C D B w o u n o t g e r e r e q u e m e n o f e P A c t u s a w g C D B s ] a m a s s h u g e d a b a s e s a t e g o v e r n m e n t g a p r o h d o m g. 5 6 S m, 4 4 2 U. a t 7 4 4. 5 7 M r, 4 2 5 U. a t 4 4 3. 5 8 C F e r g u s o n v. C o f C h a s n, 5 3 2 U. 6 7, 7 8 0 0 1 ) h e r e a s o n a b e x p e c n o f p r a c y e n d b y e a l p a n t u n d e r g o g d g n o s s a h o s p l a t e r e s u o f o s e s w n o t b e s h a r e d w n o n m e d c a l p e r s o n n e l w o u t h e r c o n s e n ; J a e v. R e d m o n d, 5 1 8 U. 1, 1 5 9 9 6 ) ( e c a u s e w e a g r e e w e d g m e n t o f e s g r e s a n d e A d C o m m e a t a p s y c h o e r a p t - p a n t p r g e w s e r v e a p u b g o o d n - s c e n d g e n o r m a o m a n t p r c o f u g a r a n a l m e a n s r a s c e r -.S.C ' (m ). fn le te (A[ ta in fo tio th ig in te ld trig th ir ts th rivacy [, th llo in to ta th th is le lly ib ite fr crea tin.@) ith.s ille.s f. ity rle to.s (2 (AT le ta tio iv jo ye th typ ic tie in ia tic te ts in ita is th th lts th te ts ill ith i- ith t.@) ffe.s (1 AB ith th ju th ta te le is la tu th visory itte th th is tie ivile ill lic tra in th lly pred in in ip le tilizin ll tio fo

FILE:C:\SLOBOGIN.DTP Dec 12/13/05 Tue 12:53PM 2005] TRANSACTION SURVEILLANCE 161 ernment accessing of privately-held records, they are extremely weak. Medical records receive the most protection. Even here, however, neither probable cause or reasonable suspicion is required. Rather, pursuant to rules promulgated under the Health Insurance Portability and Accountability Act (HIPAA), the government can obtain medical records from HMOs and hospitals with a simple subpoena. A subpoena, it will be recalled, merely requires a finding that the information sought is relevant to a law enforcement investigation (although the target is entitled to notice and thus has the opportunity to challenge the subpoena on relevance or privilege grounds). 59 Given the limited scope of the Privacy Act described above, even that obstacle is removed if, as is true in some states, medical and similar information is maintained as a Apublic record@ and the government receives it through a commercial data broker. Financial records receive similarly minimal protection. To get detailed information from credit agencies, a regular subpoena is required under the Fair Credit Reporting Act. 60 Howta in in g tru th,... w e h o ld th a t c o n fid e n tia l c o m m u n ic a tio n s b e tw e e n a lic e n s e d p s y c h o th e r a p is t a n d h e r p a tie n ts in th e c o u r s e o f d ia g n o s is o r tre a tm e n t a r e p r o te c te d fr o m c o m p e lle d d is c lo s u r e u n d e r R u le 5 0 1 o f th e F e d e r a l R u le s o f Evid e n c e.@) ; W h a le n v. R o e, 4 2 9 U.S. 5 8 9, 6 0 5 (1 9 7 7 ) (r e c o g n izin g, in th e c o n te x t o f a c a s e in v o lvin g d is c lo s u r e o f m e d ic a l in fo r m a tio n, th a t a As ta tu to r y o r r e g u la tory d u ty to a v o id u n w a r r a n te d d is c lo s u r e s... in s o m e cir c u m s ta n c e s... a r g u a b ly h a s its r o o ts in th e C o n s titu tio n@). 5 9 4 5 C.F.R. ' 1 6 4.5 1 2 (f)(1 )(ii)(b ) (2 0 0 5 ) (d is c lo s u r e o f m e d ic a l r e c o r d s u n d e r H IP A A is p e r m is s ib le w ith o u t p e r m is s io n o f th e ir s u b je c t if in fo r m a tio n is s o u g h t fo r la w e n fo r c e m e n t p u r p o s e s th r o u g h a g r a n d ju r y s u b p o e n a ). S o m e c o u r ts h a v e r e q u ir e d a g r e a te r s h o w in g to o b ta in m e d ic a l r e c o r d s. S e e, e.g., D o e v. B r o d e r ic k, 2 2 5 F.3 d 4 4 0, 4 5 0-5 1 (4 th C ir. 2 0 0 0 ) (fin d in g M ille r in a p p lic a b le to m e d ic a l rec o r d s ); H a w. P s y c h ia t ric S o c., D is t. B r a n c h o f A m e r ic a n P s y c h ia t ric A s s 'n v. A riyo s h i, 4 8 1 F. S u p p. 1 0 2 8 (D. H a w. 1 9 7 9 ); K in g v. S ta te, 5 3 5 S.E.2 d 4 3 2, 4 9 5 (G a. 2 0 0 0 ); T h u r m a n v. S ta te, 8 6 1 S.W.2 d 9 6, 9 8 (T e x. C t. A p p. 1 9 9 3 ). 6 0 1 5 U.S.C. ' 1 6 8 1 b (a )(1 ). N a m e, a d d r e s s e s, a n d p la c e s o f e m p lo ym e n t c a n b e o b ta in e d s im p ly u p o n a r e q u e s t. Id.' 1 6 8 1 f.

F IL E :C : \ S L O B O G IN.D T P D e c 1 2 / 1 3 / 0 5 T u e 1 2 :5 3 P M 1 6 2 M IS S IS S IP P I L A W J O U R N A L [V o l. 7 5 ever, analogous to the situation with medical records, no law governs government requests for similar information from database companies and other companies that have obtained it from credit agencies. 61 As a result, the government routinely gets the financial information it wants directly from a commercial data broker, without bothering with a subpoena. 62 Bank records are also easily accessible. The Right to Financial Privacy Act generally requires only a traditional subpoena to obtain financial records from a bank. It also recognizes a significant variation to the traditional subpoena process: notification of the seizure may be delayed for up to 90 days if there is concern that service of the subpoena will tip off a suspect, result in loss of evidence, endanger witnesses or in some other way compromise the government's investigation. 63 In these circumstances, in contrast to the typical subpoena process, the target of a financial investigation will not find out that the government has the information until well after it is obtained. I will call this type of authorization a delayed-notice subpoena. Outside of situations covered by the Right to Financial Privacy Act and the Internal Revenue Code, a government agency that is authorized to use administrative subpoenas to obtain financial and business information from third party 6 1 D a n l J. S o v e, D l D o s s r s a n d e D s a n o f F o u r A m e n d m e n t P a c y, 7 5 S. C A L. L. R E 1 0 8 3, 1 1 4 6 0 0 2 6 2 C h H o o a g h a s m a d e e a r g u m e n t a t a b o b r m a n r o u g h a p r a a g e n c y c u m v e n e P A c w h h p r o h g o v e r n m e n t m c o c g s u c h r m a n u n s s e r e a s p e c n e e d r H o o a g, s u p r a n o 1 6, a t 1 8. 6 3 1 2 U. 3 4 0 9. F u r e r m o r e, w h e n s u b p o e n a p o w e r n o t a v a b e g o v e r n m e n n e e d o n s u b m a r m a l w n r e q u e s t r e - r m a n, a p r o c e s s a r c a e x d l c e r a n. 3 4 0 8. d e e d, a p p a r e n b a n k s s o m e e s s s p h a n d o v e r r m a n u p o n r e q u e s S e e D A V F. L O W E P R A C Y A M E R A : I S Y O U R P R A T E L E T H E P U B L E Y E? 1 0 6-1 0 8 9 8 9 ) e s c r g a n u m b e r o f c a s e s w h h b a n k s s u r r e n d e r e d a c c o u n t r m a n w e n r c e m e n t o e r s s p u p o n r e q u e s t a n d d e s c r g a s u r v e y d g a t s e v e n u r p e r c e n t o f b a n k s d n o t r m e c u s m e r s o f e r o u - e d c s u r e s w e n r c e m e n ie lo ig ita ie th is ip tio th riv V. (2 ). ris fn le th th th is ility to ta in in fo tio th iv te cir ts th rivacy t, ic ib its fro lle tin in fo tio le th is ific fo it. fn le te.s.c ' th is ila le to th t, it ly it fo ritte fo th in fo tio th is tic le lls tra ju ic ia tific tio ' In tly tim till im ly in fo tio t. ID IN S, IV IN IC IV IF IN IC (1 (d ib in in ic in fo tio to la fo ffic im ly ib in fin in th ty- fo id in fo th ir to th ir tin is lo to la fo t).

FILE:C:\SLOBOGIN.DTP Dec 12/13/05 Tue 12:53PM 2005] TRANSACTION SURVEILLANCE 163 entities need not give any notice to the customer whose records are sought. 64 This practice recognizes still another subpoena mutation, which I will call an ex parte subpoena. This label is meant to distinguish between third party subpoenas that allow the target to contest the demand for production and those that don't. The term Aex parte subpoena@ emphasizes that the customer is outside the process entirely, thus removing, in most cases, the only meaningful inhibition on fishing expedition-by-subpoena. Transaction surveillance of communications-related information is regulated in a similarly weak fashion. Under ECPA, real-time interception of the content of phone and email communications requires a warrant based on probable cause. 65 But if email has sat on a server for longer than 180 days without being opened, or the recipient of email or voicemail accesses it and stores it on an outside server for any length of time, then a subpoenabdelayed if necessarybis all that is needed to obtain the content of the communication. 66 Apparently, the rationale behind permitting easy access to unopened mail that is stored for 180 days is that it is, in effect, abandoned. 67 The 6 4 E L L E N S. P O D G O R & J E R R Y H. I S R A E L, W H E C O L L A R C R E A N U T S H E L L 2 6 9 0 0 4 6 5 1 8 U. 2 5 1 8 ) 0 0 0 6 6 1 8 U. 2 7 0 3 ) 0 0 0 2 7 0 3 F u r e r, a s u b p o e n a o n u e d w h e n e r m a n s o u g h t m a e m o c o m p u r s e r v a s e r v e a v a b e g e n e r a l p u b, e A O L e r m a n s r e d w a s e r v e n o t a v a b e g e n e r a l p u b o n e r u n b y a n e m p r e n E C P A d o e s n o t a p p a t a a n d g o v e r n m e n t m a y o b e s r e d r m a n o n n t o r e n g ) s p u p o n a r e q u e s S e e 1 8 U. 2 7 0 3-3 s e e a o 1 8 U. 2 7 1 1 ) 0 0 0 ) e g r e m o c o m p u g s e r v e U. D e p o f J u s e, S e a r c h g a n d S e g C o m p u r s a n d O b g E c n E v e n c e C a l v e s a n s 8 9 u 2 0 0 2 a v a b a t h / w w w y b e r c r e o v / s & s m a n u a 0 0 2. 6 7 S e e P a L. B e, S u r v e n c e L a w T h r o u g h C e r w L e n s, 7 2 G E W A S H. L. R E 1 3 7 5, 1 4 2 1 0 0 4 T h a r a n e x m e h e l r o a d m a p a n d a n a o f E C P A w h h, u n r n a I d c o v e r e d o n a r w a d g r o u g h e s m y s e. IT IM IN (2 )..S.C ' (3 (2 )..S.C ' (a (2 ); (b )(1 )(B ). th is ly req ir th in fo tio is fro Ar te te ic e@ (e.g., ic ila le to th lic lik ). If th in fo tio is to ith ic ila le to th lic (e.g., lo ye ), th ly ll ta in th to in fo tio (c te id tifyin im ly t..s.c ' (a )(1 ); ls.s.c ' (2 (2 (d fin in te tin ic );.S 't tic in izin te ta in in le tro ic id in rim in In tig tio (J ly ), ila le ttp :/.c im.g l2.h tm tric ia llia illa yb la 's O. V. (2 ). is tic le is tre ly lp fu lysis ic fo tu te ly, is ly fte in th th ta tu te lf. Id

F IL E :C : \ S L O B O G IN.D T P D e c 1 2 / 1 3 / 0 5 T u e 1 2 :5 3 P M 1 6 4 M IS S IS S IP P I L A W J O U R N A L [V o l. 7 5 rationale for permitting access on less than probable cause to opened email and other communications stored by a third party is that it becomes akin to a business record. 68 ECPA also gives the government easy access to business records held by phone companies and Internet service providers. Under Title II of ECPA, as amended by the Patriot Act of 2001, basic subscriber informationbname, address, session times and durations, length and type of service, means and source of payment (including credit card numbers), and the identity of Internet users who use a pseudonymbcan be obtained pursuant to an ex parte subpoena, the type of authorization that requires no customer notice. 69 If the government seeks additional transactional informationbsuch as account logs and email addresses of other individuals with whom the account holder has correspondedbit still need not alert the subscriber, but must allege Aspecific and articulable facts showing that there are reasonable grounds to believe that... the records or other information sought, are relevant and material to an ongoing criminal investigation.@ 70 Apparently, this latter standard, found in ' 2703(d) of ECPA, is meant to be more demanding than the relevance standard normally required for a subpoena. Yet it is not clear that it is much different. Although the Aspecific and articulable@ language sounds like it requires reasonable suspicion, note that the specific and articulable facts need only support a finding that the information is relevant and material 6 8 S e e C L F O R D S. F H M A N & A N N E T. M C K E N N A, W E T A P P G A N D E A V E D R O P P G 2 6 d e d. 1 9 9 5 ) x p g a t C o n g r e s s a t w h e n a n e - m a s y s o n a s e r v e r n g e r a n 1 8 0 d a y s t h e s e r v e p r o v e r s s e a P o s t O e a n d m o r e e a s r a g e c 6 9 1 8 U. 2 7 0 3 ) 0 0 1 ) e s c r g r m a n a t c a n b e o b e d 2 7 0 3 ) ( A g o v e r n m e n l e n e g r e c o r d s o r r m a n u n d e r s u b s e c n n o t q u e d p r o v e n o e a s u b s c r e r o r c u s m -. 7 0 2 7 0 3 ) e s c r g r e q u e n r a c o u r t o r d e r o b c o r d s c o n c e r n g e c n c o m m u n a n s e r e o r r e m o c o m p u g s e r -. IF IS IR IN S- IN ' :9 (2 (e la in in th fe lt th il ta lo th ic id is le lik ffic lik to fa ility)..s.c ' (c )(1 )(E (2 (d ib in in fo tio th ta in ); ' (c )(3 ta tity rec ivin in fo tio th is tio is re ir to id tic to ib to er.@) ' (c (d ib in irem ts fo to ta in A[ r]e in le tro ic ic tio vic te tin vic e@)

FILE:C:\SLOBOGIN.DTP Dec 12/13/05 Tue 12:53PM 2005] TRANSACTION SURVEILLANCE 165 to an ongoing investigation. Even if the latter highlighted word is meant to augment the former, it does not add much; materiality, in evidence law, merely means that the evidence be logically related to a proposition in the case. 71 Furthermore, whereas Terry contemplated that reasonable suspicion exist with respect to the targeted individual, a ' 2703(d) order, like a subpoena, allows accessing any records that might be relevant to an investigation, not just the target's. Finally, it is not clear that the Arelevant and material@ language can be meaningfully enforced. The statute seems to say that the only ground on which an order issued pursuant to ' 2703(d) may be challenged is burdensomeness, which eliminates a challenge on relevance grounds. 72 Post-9/11, government access to some sorts of privatelyheld records is even easier when a significant purpose of the investigation is to nab terrorists or spies. In such cases, Section 215 of the Patriot Act authorizes the FBI to demand the production of Aany tangible things (including books, records, papers, documents and other items)@ if it follows a simple twostep process. 73 First, the Director or his or her designee must certify to a court that the items sought are Afor an investigation to protect against international terrorism or clandestine intelligence activities,@ and that the investigation does not focus Asolely@ on activities protected by the First Amendment. 74 Second, the court must find that the investigation meets these conditions; if so, it Ashall@ issue a Section 215 order authorizing 7 1 M C C O R M IC K O N E V ID E N C E ' 1 8 5 a t 2 7 6-7 8 (J o h n W. S tro n g e d., 5 th e d. 1 9 9 9 ) (AM a teria lity... lo o k s to th e r e la tio n b e tw e e n th e p r o p o s itio n s th a t th e evid e n c e is o f fe r e d... a n d th e is s u e s in th e c a s e.... A fa c t th a t is `o f c o n s e q u e n c e ' is m a te ria l.... It is e n o u g h if th e ite m c o u ld r e a s o n a b ly s h o w th a t a fa c t is s lig h t ly m o r e p r o b a b le th a n it w o u ld a p p e a r w ith o u t th a t evid e n c e.@). 7 2 ' 2 7 0 3 (d ) (p r o v id in g c o u r t m a y q u a s h o r m o d ify o r d e r if th e r e q u e s t is Au n u s u a lly vo lu m in o u s in n a tu r e o r c o m p lia n c e w ith s u c h o r d e r o th e r w is e w o u ld c a u s e a n u n d u e b u r d e n o n s u c h p r o v id e r@). 7 3 5 0 U.S.C. ' 1 8 6 1 (2 0 0 1 ). 7 4 ' 1 8 6 1 (a ) & (b ).

F IL E :C : \ S L O B O G IN.D T P D e c 1 2 / 1 3 / 0 5 T u e 1 2 :5 3 P M 1 6 6 M IS S IS S IP P I L A W J O U R N A L [V o l. 7 5 the seizure. 75 In other words, a variant of the certification order discussed in connection with use of pen registers and trap and trace devices will suffice in this situation. In an additional twist, however, not only is the target unable to challenge such orders, but the third party record-holder is prohibited from telling the target the order has been issued. 76 In counter-terrorist investigations, this procedure is all that is required to obtain customer records of Internet service providers, libraries, video stores, schools and other private entities (including, possibly, medical providers). Further, the records that may be obtained in this way are not just those of suspected terrorists, but those of anyone who might be Arelevant@ to the investigation. 77 Finally, even a Section 215 order is not needed when the FBI is seeking a particular subset of Atangible items@ (electronic or communication records, financial records or credit records) in connection with a national security investigation. Rather, all it must do is issue a form of administrative subpoena, known as a ANational Security Letter,@ in which a Special Agent (in other words, a field agent) certifies that the information sought is relevant to a national security investiga- 7 5 ' 1 8 6 1 (c ). T h is p r o v is io n a ls o in d ic a te s th a t th e ju d g e m a y m o d ify th e g o v e r n m e n t's o r d e r. A p p a r e n tly, th e m o d ific a tio n p o w e r is m e a n t to p r o te c t a g a in s t F irst A m e n d m e n t a n d o v e r b r e a d th c o n c e r n s. B u t, a s s u m in g n o s u c h c o n - c e r n s, th e ju d g e m u s t is s u e th e o r d e r w h e n th e ta n g ib le ite m s s o u g h t a r e Af o r a n a u th o r iz e d in v e s tig a tio n... to o b ta in fo r e ig n in te llig e n c e in fo r m a tio n.@ ' 1 8 6 1 (b ). C f. P a u l R o s e n zw e ig, C ivil L ib e r ty a n d th e R e s p o n s e to T e r roris m, 4 2 D U Q. L. R E V. 6 6 3, 6 9 4-9 5 (2 0 0 4 ) (a r g u in g th a t th e p r o v is io n fo r ju d ic ia l m o d ific a tio n, to g e th e r w ith th e r e q u ir e m e n ts th a t th e g o v e r n m e n t s w e a r th e c e r tific a tio n is c o r r e c t a n d th a t th e A tto r n e y G e n e r a l r e p o r t to C o n g r e s s o n th e u s e o f S e c tio n 2 1 5, p r o v id e m o r e s a fe - g u a r d s th a n th o s e a s s o c ia te d w ith a s u b p o e n a r e vie w a b le o n ly a fte r c h a lle n g e ). 7 6 1 8 U.S.C. ' 2 7 0 9 (c ) (2 0 0 1 ); 5 0 U.S.C. ' 1 8 6 1 (d ). 7 7 P e te r P. S w ir e, T h e S ystem o f F o r e ig n In te llig e n c e S u rveilla n c e L a w, 7 2 G E O. W A S H. L. R E V. 1 3 0 6, 1 3 3 1-3 3 (2 0 0 4 ); s e e a ls o 1 8 U.S.C. ' 2 7 0 9 (b ) (w ir e o r e le c tro n ic s e r v ic e p r o v id e r s ); 2 0 U.S.C. ' 1 2 3 2 g (j)(a ) (s c h o o l rec o r d s ); K a th r y n M a r tin, T h e U S A P a trio t A c t's A p p lic a tio n to L ibrary P a tro n s R e c o r d s, 2 9 J. L E G IS. 2 8 3 (2 0 0 3 ) (d is c u s s in g lib r a r y r e c o r d s ).

FILE:C:\SLOBOGIN.DTP Dec 12/13/05 Tue 12:53PM 2005] TRANSACTION SURVEILLANCE 167 tion to protect against international terrorism or clandestine intelligence activities. 78 This type of authorization is akin to the extrajudicial certification discussed in connection with law enforcement efforts to seek public documents under the Privacy Act, but with the same gag order proviso that exists with Section 215 orders. 79 The Patriot Act allowed this extrajudicial process with respect to financial information only when it was held by banks. However, in December, 2003, that power was expanded by the Intelligence Authorization Act of 2003, which was enacted by Congress as part of an appropriations bill, with no vetting by the Judiciary Committee and no debate on the floor or in the media. 80 The 2003 Act allows the FBI to use extrajudicial certification to obtain statements and records from any financial institution Awhose cash transactions have a high degree of usefulness in criminal, tax or regulatory matters,@ including banks, stockbrokers, car dealers, casinos, credit card companies, insurance agencies, jewelers, pawn brokers, travel agents and airlines. 81 All of this information is the government's simply on its sayso. 82 7 8 1 2 U. 3 4 1 4 ) 0 0 3 A g a, e r e c o r d - h o e r p r o h d o m g e r g e t o f e r e q u e s 3 4 1 4 7 9 S w e, s u p r a 7 7, a t 1 3 3 2-3 3. 8 0 K O o w d, C o n g r e s s H a n d s F B I a t S n o o p g P o w e r, 2 8 F e b. C H A M P. 1 8 0 0 4 ) 8 1 3 1 U. 5 3 1 2 9 9 6 8 2 T h e P a t A c N a n a l S e c u r L e r S L ) p r o v n w a s d e c r e d u n c o n s n a l D o e v. A s h c r o 3 3 4 F. S u p p. 2 d 4 7 1 0 0 4 b e c a u s e o f e c k o f d l w a n d e g a g p r o v n. H o w e v e r, e d e c n d n o t d u w e e r e r e v a n c e s n d a r d o r e c t a t r s c a n b e s u e d b y a s p e c l a g e n d e e d, e c o u r t s d h e s n d a r d o f w r a d m e s u b p o e n a s s r N S L s s o m a l a t m o s t s u c h N S L s w o u e b e u p h e c o u r. a t 5 0 2. R e c e n t p r o p o s e d a m e n d m e n a t m o s t a r e e c o d D o e. L h u, C o n g r e s s N e a r s D e a l R e n e w A n r r o r L a w, N. T E N o v. 1 7, 2 0 0 5, a t A 1, A 2 1. e m e a n e, e F B I s u e s r o u g h 3 0 0 0 N S L s a a r, m a s a e r e c o r d s e r e b y o b e d v e n w h e n n o t k e d r r o r m a n d a s o f w g h a d s n o t s p o n d e d a a r - o c o n g r e s s n a l r e q u e s t r.s.c ' (a )(5 )(A (2 ). in th ld is ib ite fr in form in th ta th t. ' (a )(5 )(D ). ir yle 'D AP trio II@ in (2.S.C ' (1 ). trio t's tio ity tte (N is io la titu tio in ft, (2 ), th la ju ic ia revie th is io th is io id fin fa lt ith ith th le ta th fa th le tte is ia t. In th ta te At ta revie fo in is trativ im ila to is in im th ld lik ly ld in t.@ Id ts lik ly to ify Eric ic tb la to tite.y IM S, In th tim th is ly,0 ye in ta in ll th th ta in (e lin to te is ), th is ritin till re to ye ld io fo

F IL E :C : \ S L O B O G IN.D T P D e c 1 2 / 1 3 / 0 5 T u e 1 2 :5 3 P M 1 6 8 M IS S IS S IP P I L A W J O U R N A L [V o l. 7 5 D. Summary of Transaction Surveillance Law Transaction surveillance has spawned a wide array of new regulatory schemes, which are usefully summarized by locating them within the standard Fourth Amendment hierarchy. As noted earlier, the most protective type of authorization is the warrant, based on probable cause. Although intercepting the content of communications and physical surveillance of the home both require a warrant, 83 no type of transaction surveillance requires this most demanding form of authorization. The next type of authorization in the hierarchy, at least in theory, is an order based on reasonable suspicion, or what could be called a Terry order, after Terry v. Ohio, 84 which required this degree of justification for a stop and frisk. Again, none of the statutory provisions I have described (or any other regulatory regime for that matter) mandates this type of order; I include it both for the sake of comprehensiveness and because it is important to the regulatory scheme I propose below. After a Terry order comes the traditional subpoena, issued upon a judicial finding of relevance and challengeable by the target. This is the first type of authorization that plays a role in transaction surveillance; subpoenas are required to access most medical, financial and stored email records. Below the traditional subpoena is the delayed-notice subpoena, which authorizes, temporarily, unobstructed access to financial records and stored email when a traditional subpoena might frustrate the investigation. Next is the ex parte subpoena (unchallengeable by the target), which allows access to many types of customer records held by third party entities, including phone and ISP account records. 85 The certification r m a n a b o u t e u s e. B a r n G e a n, T h e F B S e c r e t S c r u y, W A S H. P O S T o v. 6, 2 0 0 5 a t A 1. 8 3 S e e s u p n o 5. 8 4 3 9 2 U. 1 9 6 8 8 5 A r g u a b e p e c a n d a r u b c e x p a r s u b p o e n a in fo tio th ir to llm I's tin (N ), ra te.s (1 ). ly, th As ific tic la le fa ts@ te

FILE:C:\SLOBOGIN.DTP Dec 12/13/05 Tue 12:53PM 2005] TRANSACTION SURVEILLANCE 169 (judicial rubberstamp) order follows in the hierarchy; it authorizes the use of pen registers, trap and trace devices and other forms of transaction-oriented snoopware, as well as tangible items other than financial records thought to be relevant to national security investigations. 86 At the bottom of the authorization totem pole there is the extrajudicial certification, which permits access to public records, and to financial and other records relevant to national security investigations. However, even this type of authorization is not needed to access public records that come from a state with no privacy statute or that are accumulated by a commercial data broker. All of the authorization mechanisms described in this paragraph are statutory inventions, and are particularly punchless given the lack of a remedy in the unlikely event government is found to have abused them. 87 The chart below depicts the foregoing summary, consisting of eight levels of authorization: CURRENT LAW OF TRANSACTION SURVEILLANCE Transaction Auth'zation Req'd Certainty Level r e q u ir e d b y 1 8 U.S.C. ' 2 7 0 3 (d ) is m o r e d iffic u lt to o b ta in th a n a n o r d in a r y s u b p o e n a (a n d a p p a r e n tly C o n g r e s s s o b e lie v e d ), b u t fo r th e r e a s o n s s u g g e s te d a b o v e, s e e s u p r a n o te s 6 9-7 2 a n d a c c o m p a n yin g te x t, it is c la s s ifie d h e r e a s le s s p r o te c tiv e th a n a r e g u la r s u b p o e n a, a t le a s t o n e th a t n o tifie s th e ta r g e t. 8 6 P e o p le w h o h a v e w o r k e d a t th e D e p a r tm e n t o f J u s tic e s ta te th a t, in p r a c tic e, a c e r tific a tio n o r d e r m a y b e h a r d e r to o b ta in th a n a s u b p o e n a. P e r s o n a l c o n v e r s a tio n s w ith O rin K e rr (F e b. 1 7, 2 0 0 5 ) a n d P a u l O h m (J a n. 2 0, 2 0 0 5 ). B u t I r a n k th e c e r tific a tio n o r d e r lo w e r in th e h ie r a r c h y o f p r o te c tio n b e c a u s e th e ju d g e p la y s s u c h a m in im a l r o le ; a t le a s t w ith a s u b p o e n a th e ju d g e is p e r m itte d to fin d a s e iz u r e in v a lid o n r e le v a n c e g r o u n d s, a lth o u g h h e m a y ra r e ly d o s o. 8 7 F o r in s ta n c e, th e r e is n o e x c lu s io n a r y s a n c tio n u n d e r E C P A, o r u n d e r th e R ig h t to F in a n c ia l P rivacy A c t. W H IT E B R E A D & S L O B O G IN, s u p r a n o te 9, a t 3 4 4-4 5 ; U n ite d S ta te s v. K in g to n, 8 0 1 F.2 d 7 3 3, 7 3 4 (5 th C ir. 1 9 8 6 ). N o r a r e d a m a g e s a c tio n s a s ig n ific a n t d e te r r e n t, g iv e n th e in ta n g ib le n a tu r e o f th e h a r m in v o lv e d. C f. D o e v. C h a o, 3 0 6 F.3 d 1 7 0, 1 7 7 (4 th C ir. 2 0 0 2 ) (h o ld in g th a t, u n d e r E C P A, Aa p e r s o n m u s t s u s ta in a c tu a l d a m a g e s to b e e n title d to th e s ta tu tory m in i- m u m d a m a g e s a w ard@ o f $ 1,0 0 0 ).

F IL E :C : \ S L O B O G IN.D T P D e c 1 2 / 1 3 / 0 5 T u e 1 2 :5 3 P M 1 7 0 M IS S IS S IP P I L A W J O U R N A L [V o l. 7 5 CCC- Warrant Probable cause CCC- Terry Order Reasonable suspicion Medical, financial & tax records; stored email Financial records and stored email if notification poses risks Billing records and logs of phone companies & ISPs; most customer records Interception of catalogic information re calls & email; tangible items re terrorism Federal public records; financial records re terrorism State public records not protected by law or that are acquired by a CDB Subpoena Delayed-notice Subpoena Ex Parte Subpoena Certification Order Extrajudicial Certification None Relevance, challengeable by target Relevance, challengeable by target only after records obtained Relevance, challengeable only by third party recordholder Relevance (determined by government), issued by court, challengeable only by third party record-holder Relevance (determined by government), not challengeable by any party(?) 88 None 8 8 S e e s u p ra n o te 8 2 a n d a c c o m p a n yin g te x t.

FILE:C:\SLOBOGIN.DTP Dec 12/13/05 Tue 12:53PM 2005] TRANSACTION SURVEILLANCE 171 III. A PROPOSAL FOR REGULATION OF TRANSACTION SURVEILLANCE The differences between the various types of authorization outlined above are sometimes subtle, but one thing is certain: their number goes well beyond (and below) the traditional three-tiered approach of probable cause, reasonable suspicion, and special needs/reasonableness determinations, all challengeable by the target of the investigation. As a conceptual matter, a system that recognizes more than three authorization levels may make sense. In previous work, for instance, I have argued for application of a proportionality principle, which specifically requires that the certainty required for a search be roughly proportionate to its intrusiveness, and which suggests that the traditional probable cause/reasonable suspicion dichotomy is insufficient as a means of implementing that idea. 89 My disagreement with current law is not with the general approach, but with the order and substance of the hierarchy. The degree to which transaction surveillance is regulated should not depend on whether the information sought is intercepted in real-time or is stored, or on whether it may be related to terrorist actions or some other crime. Rather, the key variables should be the type of information sought and the type of transaction surveillance (target-based or event-based) that is at issue. I propose recognizing three types of distinctions based on the type of records sought: (1) the content of personal records would be entitled to more protection than the content of organizational records; (2) the content of personal records held by private entities would be entitled to more protection than the content of personal records held by public 8 9 C h p h e r S b o g, L e N o t B u T e r A C a r R e v e n a n o f e P r o p o r n a P c, 7 2 S T. J O H N ' S L. R E 1 0 5 3, 1 0 8 1-8 2 9 9 8 C h - p h e r S b o g, T h e W o r W o u t A F o u r A m e n d m e n t, 3 9 U C L A L. R E 1, 6 8-7 5 9 9 1 ris to lo in t's ry ry: ll fo ju tio th tio lity rin ip le V. (1 ); ris to lo in ld ith th V. (1 ).

F IL E :C : \ S L O B O G IN.D T P D e c 1 2 / 1 3 / 0 5 T u e 1 2 :5 3 P M 1 7 2 M IS S IS S IP P I L A W J O U R N A L [V o l. 7 5 entities for public consumption; and (3) the content of records, regardless of their subject or who holds them, would presumptively be entitled to more protection than records memorializing what I call Acatalogic data@ (information that simply identifies the nature of a communication or links a person to an activity). With catalogic data, however, the second variable mentioned abovebthe government's motivation in carrying out the surveillancebis also important. If the information is sought in connection with target-based, as opposed to event-based, surveillance it should receive heightened protection. More specifically, I propose that government should have to obtain: (1) a warrant based on probable cause when it seeks the content of personal records, or seeks catalogic data in connection with target-based surveillance; (2) a Terry order based on reasonable suspicion when it seeks the content of records that are Apublic@ in nature; (3) a traditional subpoena based on relevancebor when there is concern about tipping off a suspect, a delayed-notice subpoena based on relevance 90 Bto access the content of organizational records and to access catalogic data in connection with event-based transaction surveillance. Ex parte subpoenas, certification orders and extrajudicial certifications should never be sufficient authority to carry out nonconsensual searches and seizures for personal transaction information, except in emergencies, and then only if quickly subject to judicial review. The following chart represents my proposal: PROPOSED LAW OF TRANSACTION SURVEILLANCE 9 0 O rin K e r r n o te s th a t, g iv e n th e e a s e w ith w h ic h s u b p o e n a - s e r v ic e d e - la y s c a n b e o b ta in e d, th e g o v e r n m e n t c a n u s e s u b p o e n a s Aw ith o u t m e a n in g fu l n o - tic e.@ O rin S. K e rr, S ym p o s iu m, A U s e r 's G u id e to th e S to r e d C o m m u n ic a tio n s A c t, a n d a L e g is la to r 's G u id e to A m e n d in g It, 7 2 G E O. W A S H. L. R E V. 1 2 0 8, 1 2 3 4 (2 0 0 4 ). H e a ls o a r g u e s th a t th e n in e ty- d a y d e la y p e r io d As e r v e s n o le g itim a te p u r p o s e,@ a n d in s te a d p r o p o s e s a th irty- d a y d e la y, p e r m itte d o n ly u p o n ju d ic ia l a u th o r izatio n, w ith (r a r e ) fu r th e r e x te n s io n s o n ly a fte r fu r th e r ju d ic ia l revie w. Id. a t 1 2 3 5. T h is reg im e s e e m s s e n s ib le.

FILE:C:\SLOBOGIN.DTP Dec 12/13/05 Tue 12:53PM 2005] TRANSACTION SURVEILLANCE 173 Transaction Auth'zation Req'd Certainty Level Content of privately-held personal records Warrant Probable Cause Content of publicly-held personal records Content of organizational records Catalogic Data Target-based surveillance Event-based surveillance Terry Order Subpoena Warrant Subpoena Reasonable Suspicion Relevance Probable Cause Relevance Under this scheme, again, the contents of Apersonal@ records are distinguished from the contents of Aimpersonal,@ organizational records, with acquisition of the former requiring something more than mere relevance. Within the Apersonal@ record category, Aprivately-held@ records are distinguished from Apublicly-held@ records, with acquisition of the former requiring probable cause and of the latter reasonable suspicion. Finally, Acontent@ is distinguished from Acatalogic data@ that simply describes the nature of a transaction, with the authorization level for the latter dependent on whether it is sought in connection with event-based surveillance of the type involved in data mining and profiling, where only relevance is required, or target-based surveillance which requires probable cause. The reasoning behind these proposals, and definitions of the key terms, follow, beginning with the all-important distinction between organizational and personal transactions.

F IL E :C : \ S L O B O G IN.D T P D e c 1 2 / 1 3 / 0 5 T u e 1 2 :5 3 P M 1 7 4 M IS S IS S IP P I L A W J O U R N A L [V o l. 7 5 A. Organizational v. Personal Content

FILE:C:\SLOBOGIN.DTP Dec 12/13/05 Tue 12:53PM 2005] TRANSACTION SURVEILLANCE 175 In a previous article, Subpoenas and Privacy, I canvassed several possible justifications for the current relaxed state of transaction surveillance regulation. 91 Although I discussed six such justifications, they all fit within one of two categories: they either minimize privacy concerns associated with transactional information or rest on an assertion that law enforcement could not function if transaction surveillance were subject to significant regulation. I also concluded that these rationales are not unpersuasive in the context in which subpoenas first flourishedbgovernment efforts to obtain documentary evidence of crimes committed by or within a business or other regulated organization. As the Supreme Court has recognized on numerous occasions, records of businesses and similar entities are associated with a minimal degree of privacy, given their impersonal nature and the high degree of state regulation to which organizations are subject. 92 The Court has also pointed out in several cases that investigation of economic crimes and regulatory violations would be extremely difficult without ready access to documents detailing business activity. 93 But my previous analysis also concluded that neither the 9 1 C h p h e r S b o g, S u b p o e n a s a n d P y, 3 4 D E P A U L L. R E 8 0 5 0 0 5 9 2 H a v. H e n k e 2 0 1 U. 4 3 9 0 6 e a d g S u p r e m e C o u c a s e o n g r a n d r y d o c u m e n t s u b p o e n a s, e C o u s d a t w h a c o r p o r a n a c r e a r e o f e s... p r e s u m e d b e c o r p o r a d r e b e n e o f e p u b n d ] e c e e s c e r s p e c l p r g e s a n d a n c h e s, a n d h o s e m s u b c t e w s o f e s a n d e n s o f c h a r w h a n d u a l w e s n o s u c h d u e s, s c e h e r e c e e s n o g e r e o m, b e n d e p r o c n o f h a n d p r o p e r. a t 7 4. U n d S s v. M o r n S a C o., 3 3 8 U. 6 3 2 9 5 0 o n e o f e C o u a d g a d m e s u b p o e n a c a s e s, w a s e v e n m o r e r h C r p o r a n s c a n c n o e q u a w d u a e e n y m e n t o f a r h t p r. a t 6 5 2. 9 3 S e e, e U n d S s v. W h, 3 2 2 U. 6 9 4, 7 0 0 9 4 4 ) h e s c o p e a n d n a r e o f e e c o n o m a c s o f c o r p o r a d a n d u n c o r p o r a d o r g a n n s a n d e r e p r e s e n e s d e m a n d a t e c o n s n a l p o w e r o f e d e r a l a n d s g o v e r n m e n r e g u o s e a c s b e c o r r e s p o n d g e c - e. ris to lo in rivac V. (2 ). In le l,.s (1 ), th le in rt ju th rt ta te th ile tio Ais tu th ta te [it] is to in te fo th fit th lic [a Ar iv ta in ia ivile fr is ld th je to th la th ta te th lim ita tio its ter,@ ile in ivid Ao ty to th ta te in iv th in th fr yo th te tio is life ty.@ Id In ite ta te to lt.s (1 ), th rt' le in in is tra tiv it fo th rig t: A[ ]o tio la im lity ith in ivid ls in th jo ig to ivacy.@ Id.g., ite ta te ite.s (1 (AT tu th ic tivitie in te in te izatio th ir ta tiv th th titu tio th fe ta te ts to la te th tivitie in ly ffe tiv.@)

F IL E :C : \ S L O B O G IN.D T P D e c 1 2 / 1 3 / 0 5 T u e 1 2 :5 3 P M 1 7 6 M IS S IS S IP P I L A W J O U R N A L [V o l. 7 5 diminished-privacy rationale or the heightened-need justification applies when the records sought are personal. The diminished-privacy rationale, as applied to personal records, is both descriptively and normatively flawed. When such records are retained by the individual, they are thought to be, and ought to be, as private as anything else in one's home. Even when maintained by a third party, records about an individual are, and should be, considered similarly private if, as is usually the case, the transfer or collection of the information occurred because the third party requires it in order to carry out an important societal service. Hospitals, banks, Internet service providers and public agencies usually only have personal data because we must provide it (or allow it to be accumulated) in order to receive the services these entities provide. Stated another way, most third party record-holders possess information about us because we cannot otherwise realistically function in the modern world. Thus, contrary to the Supreme Court's assertion in Miller, the surrender of personal information to these third parties is hardly Avoluntary.@ Nor does it, or should it, lead us to Aassume@ that the third party will function as an institutional undercover agent, a conduit for any information the government wants. 94 The argument that more rigorous regulation of transaction surveillance would unduly hinder the government's law enforcement efforts is also weak when applied to personal records. There is no doubt that requiring probable cause to 9 4 E m p a l r e s e a r c h c o n s a t m o s t p e o p v w a s e a r c h o f r e c o r d s c o n g e p e r s o n a l r m a n b e a t a s t a s s e a s a s e a r c h o f a c a r o r g g a g e. S e e C h p h e r S b o g & J o s e p h S c h u m a c h e r, R e a s o n a b E x p e c n s o f P a c y a n d A u n o m y F o u r A m e n d m e n t C a s e s : A n E m p a l L o o k a t n d e r s n d g s R e c o g n e d a n d P e r m d b y S o c 4 2 D U K E L. 7 2 7, 7 3 8-3 9 9 9 3 ) a b 1 ) d g a t a s a m p o f 2 1 7 d u a, o n a v e r a g e, r a n k e d e r u s g b a n k r e c o r d a s m o r e s a n s e a r c h e s o f e n k o f a c a r a n d a o c k e r a c a r s e e a o L r S h v A S o c l N e o r k s T h e o r y o f P a c y, 7 2 U. C H L. R E 9 1 9 0 0 5 ) r g u g a u n d e r s o c l n e o r k s e o r m a n r e v e a d s m a s o c l g r o u p s s h o u g e n e r a b e c o n s e r e d p r a u n s s e r g e a c n s o r s s r e m o v e s m o b s c u iric firm th le ie ta in in th ir in fo tio to le in tru iv lu ris to lo in le ta tio riv to in th iric AU ta in iz itte ie ty@,.j (1 (T le (fin in th le in ivid ls Ap in s@ Ain tru ive@ th th tru fo tlo in ); ls io tra ile itz, ia tw riv I. V. (2 (a in th t, ia tw th ry, in fo tio le to ll ia ld lly id iv te le th ta t's tio ta tu it fro rity).

FILE:C:\SLOBOGIN.DTP Dec 12/13/05 Tue 12:53PM 2005] TRANSACTION SURVEILLANCE 177 obtain records will make investigation of crime more difficult. But to convert that fact into a rationale for removing restrictions on government evidence-gathering makes a mockery of constitutional protections, for the warrant and probable cause requirements always have that effect. In this context as well, a viable distinction exists between investigations of organizational activity and investigation of street crime and the like. Evidence of organizational crime, particularly of the economic variety, is largely if not entirely documentary; indeed, without such evidence even the victims of such crime may not realize it has occurred. But the same is seldom true of other types of crime. Whereas Ait is a fact of life that agencies charged with regulating economic activity often cannot articulate probable cause or even reasonable suspicion that a violation has transpired without first examining documents reflecting a party's economic activity,@ 95 police engaged in investigating other types of criminal activity usually can develop some non-documentary lead, whether it is from the victim, a third party eyewitness, or physical surveillance of public movements. 96 If one accepts these arguments, then it is important to separate personal from organizational documents. Fortunately, as I explained in Subpoenas and Privacy, 97 the Supreme Court has already done much work in this regard, in the course of defining the concept of a Acollective@ entity and the notion of Arequired records@ for purposes of determining 9 5 P a rks v. F D IC, 6 5 F.3 d 2 0 7, * 1 1 (1 s t C ir. 1 9 9 5 ), w ith d r a w n 6 4 U S L W 2 1 6 6 (S e lya, J., d is s e n tin g ). 9 6 S A R A S U N B E A L E E T A L., 1 G R A N D J U R Y L A W & P R A C T IC E 6-3 (2 d e d. 2 0 0 2 ) (AO r d in a r ily, in v e s tig a tio n s o f s o - c a lle d `s tre e t crim e s ' s u c h a s m u r d e r, ra p e, r o b b e r y, a n d a s s a u lt, c a n b e c o n d u c te d e ffe c tiv e ly w ith o u t re s o r t to th e s u b p o e n a p o w er.@) ; K E N N E T H M A N N, D E F E N D IN G W H IT E C O L L A R C R IM E : A P O R T R A IT O F A T T O R N E Y S A T W O R K 2 3 3-3 4 (1 9 8 5 ) (n o tin g th a t th e e a s ie s t crim e s to h id e a r e th o s e w h e r e th e vic tim d o e s n o t re a liz e h e o r s h e h a s b e e n v ic tim iz e d, th o s e w h e r e th e lo c a t io n o f th e crim e is An o t a p p a r e n t@bm a k in g w it n e s s e s h a r d to id e n tifyba n d th o s e w h e r e th e Ain c u lp a tory in fo r m a tio n is e m b e d d e d in n o r m a l s o c ia l life,@ a ll fa c to r s m u c h m o r e lik e ly to b e a s s o c ia te d w ith o r g a n izatio n a l r a th e r th a n in d ivid u a l crim e ). 9 7 S lo b o g in, s u p r a n o te 9 1.

F IL E :C : \ S L O B O G IN.D T P D e c 1 2 / 1 3 / 0 5 T u e 1 2 :5 3 P M 1 7 8 M IS S IS S IP P I L A W J O U R N A L [V o l. 7 5 when there is a Fifth Amendment right to resist documentary subpoenas. Although the Court's reconceptualization of the Fifth Amendment in the mid-1970s has rendered these cases largely irrelevant for Fifth Amendment purposes, 98 they are directly pertinent to the current task of identifying which types of records are associated with minimal privacy. That is because these cases explicitly tried to demarcate when records are entitled to what the Court eventually called Aa zone of privacy.@ 99 In essence, in its collective entity cases the Court concluded that the records of any organization that has an identity separate from its individual members lie outside that zone. 100 In its required records cases, the Court similarly held that the government may force individuals to keep and disclose documents that are crucial for regulating their activities and Ahave assumed `public aspects' which render [the records] at least analogous to public documents.@ 101 Consistent with these two lines of cases, records that pertain to a collective entity or that fit the required-records criteria ought to be accessible on mere issuance of a subpoena. Other records, however, should receive more protection. 9 8 T h e c r u c ia l d e c is io n w a s F is h e r v. U n ite d S ta te s, 4 2 5 U.S. 3 9 1 (1 9 7 6 ), w h ic h d e c is ively m o v e d th e C o u rt's F ifth A m e n d m e n t ju r is prud e n c e fr o m a fo c u s o n p r ivacy to a fo c u s o n c o e r c io n. T h e r e t h e C o u rt h e ld th a t b e c a u s e a d o c u m e n t s u b p o e n a d o e s n o t c o m p e l th e c r e a tio n o f d o c u m e n ts, it o n ly im p lic a te s th e F ifth A m e n d m e n t w h e n th e a c t o f p r o d u c tio n it c o m p e ls p r o v id e s th e p r o s e c u tio n w ith u s e fu l in c r im in a tin g in fo r m a tio n. S e e a ls o A n d r e s e n v. M aryla n d, 4 2 7 U.S. 4 6 3 (1 9 7 6 ) (h o ld in g th a t a s e a r c h w a r r a n t c o m p e ls n e ith e r th e c r e a tio n o r p r o d u c tio n o f d o c u m e n ts ). 9 9 G ris w o ld v. C o n n e c tic u t, 3 8 1 U.S. 4 7 9, 4 8 4 (1 9 6 5 ). 1 0 0 S e e B e llis v. U n ite d S ta te s, 4 1 7 U.S. 8 5, 9 2, 9 4-9 5 (1 9 7 4 ) (h o ld in g th a t e v e n th o u g h a s m a ll la w firm Ae m b o d ie s little m o r e th a n th e p e r s o n a l le g a l p r a c tic e o f th e in d ivid u a l p a r t n e r s,@ it is a Af o r m a l in s titu tio n a l a r r a n g e m e n t o r g a n iz e d fo r th e c o n tin u in g c o n d u c t o f th e firm 's le g a l p r a c tic e,@ a n d th u s w a s Aa n in d e p e n d e n t e n tity a p a r t fro m its in d ivid u a l m e m b e r s@). 1 0 1 S e e G r o s s o v. U n ite d S ta te s, 3 9 0 U.S. 6 2, 6 7-6 8 (1 9 6 8 ) (d e s c r ib in g th e c o m p o n e n ts o f th e r e q u ir e d r e c o r d s d o c trin e e s ta b lis h e d in S h a p ir o v. U n ite d S ta te s, 3 3 5 U.S. 1 (1 9 4 8 )).

FILE:C:\SLOBOGIN.DTP Dec 12/13/05 Tue 12:53PM 2005] TRANSACTION SURVEILLANCE 179 The Fourth Amendment specifically speaks of searches of papers, as well as searches of persons, houses, and effects, and it usually requires probable cause for these searches. Accordingly, subpoenas demanding the contents of personal records should generally be invalid under the Fourth Amendment unless they are based on such a showing. The rest of this section discusses whether there should be any other exceptions to this rule outside of the organizational investigation setting. B. Private v. Public Records One distinction regarding personal records that could be made is between those records that are Aprivate@ and those that are in the public domain. As the required-records line of cases suggests, when the records fit in the latter category, the privacy associated with their content is considerably diminished. With truly public records, the information can no longer be said to be Aowned@ solely by the individual and the recordholder. In that instance, reasonable suspicionbthe justification level that falls between probable cause and relevancebought to be sufficient justification for permitting government access. Public records and records held by a public entity are not synonymous however. The word Apublic@ can apply to functionally Aprivate@ institutions such as hospitals, schools and libraries, as well as to courthouses and government agencies. And even government agencies can house records that are more personal than public. 102 How can we determine when public records are not really public and therefore deserving of full Fourth Amendment protection? Once again, statutory law and litigation in other contexts have already ploughed this ground. In particular, provisions in the federal Freedom of Information Act and similar state statutes are directly on point. While these laws es- 1 0 2 S e e D A N IE L J. S O L O V E, T H E D IG IT A L P E R S O N : T E C H N O L O G Y A N D P R IV A C Y IN T H E I N F O R M A T IO N A G E 1 2 7 (2 0 0 2 ) (d e s c r ib in g Aa s ystem w h e r e th e g o v e r n m e n t e x tra c ts p e r s o n a l in fo r m a tio n fr o m th e p o p u la c e a n d p la c e s it in th e p u b lic d o m a in @).

F IL E :C : \ S L O B O G IN.D T P D e c 1 2 / 1 3 / 0 5 T u e 1 2 :5 3 P M 1 8 0 M IS S IS S IP P I L A W J O U R N A L [V o l. 7 5 tablish a presumption in favor of disclosure of records held by government agencies, primarily as a means of increasing government transparency and facilitating social transactions such as business deals, 103 they usually exempt from disclosure a wide array of Apersonal@ records. Thus, under the federal statute, government agencies must resist a FOIA request for Acommercial or financial information obtained from a person and privileged or confidential,@ 104 Apersonnel and medical files and similar files the disclosure of which would constitute a clearly unwarranted invasion of personal privacy,@ 105 and law enforcement records to the extent they include information that Acould reasonably be expected to constitute an unwarranted invasion of personal privacy.@ 106 State FOIA stat- 1 0 3. a t 1 4 0. 1 0 4 5 U. 5 5 2 M a n y c u h a v e h e a t n r s u b - m d r m a n w b e d e e m e d o n e n r e p u r p o s e o f e x e m p n o f a k d a t w o u c u s m a r n o t b e r e a s e d e p u b b y e p e r s o n o m w h o m h a s o b e d r e c o r d s. S e e, e C a l M a s s E n e r g y P r o c t N u c a r R e g u C o m m, 9 7 5 F 2 d 8 7 1, 8 7 2. C 1 9 9 2 c e r d e n d, 5 0 7 U. 9 8 4 9 9 2 S e e g e n e r a W h a t C o n s s r a d e S e c r e a n d C o m m e r c l o r F a n c l r m a n O b e d o m P e r s o n a n d P r g e d o r C o n e n E x e m p t o m D c s u r e u n d e r F r e e d o m o f r m a n A c t U. 5 5 2 O ), 1 3 9 A. F E D. 2 2 5 0 0 4 1 0 5. 5 5 2 T h e S u p r e m e C o u h a s d e e d r b r o a d - c d e e d G o v e r n m e n t c o r d s o n a n d u a l w h h c a n b e e n d a s a p p g a t d u a U. D e p o f S v. W a s h g n P o s t C o 4 5 6 U. 5 9 5, 6 0 2 9 8 2 a o u g h h a s a o m a d e c a r a t s u c h s c a n n o t b e w h e s p b e c a u s e s u c h e n a n c a n n o t b e g u a r a n e d, a n d a t d a c n o f e n g n a m e s m a y b e s u n D e p a r e n t o f A F o r c e v. R o s e, 4 2 5 U. 3 5 2, 3 8 1-8 2 9 7 6 S e e g e n e r a A n n o n, W h e n A r e G o v e r n m e n t R e c o r d s r F E x e m p t m D c s u r e u n d e r F r e e d o m o f r m a n A c t P n U. 5 5 2 E x e m p t g, C e P e r s o n n e M e d a a n d F s, 1 0 6 A. F E D. 9 4 0 0 4 1 0 6. a t 5 5 2 T h u s, r s n c e, a p e r s o n r a p s h e e t m a y b e e x e m p t m d c s u r e. S e e U. D e p o f J u s e v. R e p o r C o m m. r F r e e d o m o f P r e s s, 4 8 9 U. 7 4 9, 7 7 4 9 8 9 S e e g e n e r a J a m e s O. P e a r s o n, A n n o n, W h a t C o n s s n w a r r a n d n o f P e r s o n a l P a c r P u r p o s e s o f L a w E n r c e m e n t v e s a R e c o r d s E x e m p n o f F r e e d o m o f r m a n A c t Id.S.C (b )(4 ). cir its ld th vo lu ta ily itte in fo tio ill `'c fid tia l@ fo th th is tio if it is in th ld to ily le to th lic th fr it ta in.g., ritic je v. le la tory 'n (D.C ir. ), t. ie.s (1 ). lly titu te AT ts ia in ia In fo tio ta in fr ivile fid tia l,@ fr is lo In fo tio (5.S.C.A ' (b )(4 )) (F IA.L.R (2 ). Id ' (b )(6 ). rt fin As im ila file s@ ly, to in lu Ad ta ile re in ivid ic id tifie ly in to th in ivid l,@.s 't ta te in to.,.s (1 ), lth it ls le th file ith ld im ly id tific tio te th re tio id tifyin ffic ie t. tm ir.s (1 ). lly ta tio AS im ila ile s@ fro is lo In fo tio rovis io (5.S.C.A ' (b )(6 )) in rta in l, ic l, AS im ila r@ ile.l.r (2 ). Id (b )(7 )(c ). fo in ta 's fro is lo.s 't tic rte 's fo.s (1 ). lly ta tio titu te AU te Invas io riv y@ fo fo In tig tory tio In fo tio (5

FILE:C:\SLOBOGIN.DTP Dec 12/13/05 Tue 12:53PM 2005] TRANSACTION SURVEILLANCE 181 utes or interpretive caselaw protect various other types of records. For instance, Florida, which is known as the Sunshine State not only because of its weather but also because of the breadth of its public records disclosure law, nonetheless exempts from unrestricted disclosure some types of motor vehicle registration information, 107 identifying information relating to health care provided by the state, 108 credit information held by state agencies, 109 and educational records. 110 In many states, some types of licensing information are also exempt from disclosure. 111 When federal or state law indicates that information found in government records should be withheld despite the strong interest in freedom of information, it ought to be considered private for Fourth Amendment purposes as well. That should mean that law enforcement must demonstrate probable cause to obtain it. For other records held by public entities, reasonable suspicion is sufficient. Recall, however, that even this latter level of justification demands more than the current legal regime, which usually does not even require a subpoena in such situations, but rather permits law enforcement access to public records with a simple extrajudicial certification. A curious law enforcement officer should not be able to sift through the personal data found in divorce papers, real estate documents and court proceedings without articulating a specific need for it. That articulation should take place beforehand to a judge or, in the U. s e c. 5 5 2 5 2 A. F E D. 1 8 1 0 0 4 1 0 7 F L S T A T. 1 1 9 7 a 1 0 8. a t b c & h 1 0 9. a t d 1 1 0 F L S T A T. 1 0 0 2 2 1 1 1 S e e, e M a g e r v. S D e p o f P o e, 5 9 5 N d 1 4 2, 1 4 3 9 9 9 ) o g a t u n o w n e r s h r m a n o f a p e r s o n a l n a r e u g e x e m p n o m e s e e d o m o f r m a n a c s e e a o O R. R E S T A T. 6 5 6 0 2 ) e r e c o r d s o f e S A c c e n t s u r a n c e F u n d C o r p o n, e x c e p g e m p r a c c o u n t c o r d s a n d c a n t s, s h a b e o p e n p u b s p e c n m p h a s a d d e d.s.c.a (b )(7 )(C )),.L.R (2 ). A. '.0 (a ). Id (b ), (c ), (h ). Id (d ). A. '.2 (d )..g., ta te 't lic.w.2 (1 (h ld in th Ag ip is in fo tio tu '@ req irin tio fr th ta te fr in fo tio t); ls V. '.7 (1 (A[ t]h th ta te id In ratio tin lo ye re la im file ll to lic in tio.@) (e is ).

F IL E :C : \ S L O B O G IN.D T P D e c 1 2 / 1 3 / 0 5 T u e 1 2 :5 3 P M 1 8 2 M IS S IS S IP P I L A W J O U R N A L [V o l. 7 5 manner typical of a subpoena, after notification and challenge. 112 A common complaint about such an approach is that it places more limits on government officials than on members of the public, who can access public records at will and, with the advent of Google and other Internet search services, can do so more easily than ever before. But most of the time the public only seeks public information when it has a specific need for it (akin to the reasonable suspicion standard). 113 More importantly, government's resources and power are so much more significant, and its hunger for information so much more voracious, especially post-9/11, that its potential for abusing personal information far exceeds anything individuals or even corporations might do. 114 1 1 2 N o te th a t th is p r o c e d u r e is n o m o r e o n e r o u s, fr o m th e la w o ffic e r 's p e r s p e c tiv e, th a n th e c u r r e n t p e n r e g is te r r e g im e. S e e s u p ra n o te s 4 3-4 7 a n d a c - c o m p a n yin g te x t. 1 1 3 N o a h R o th b a u m, S p ie s L ik e U s, S M A R T M O N E Y (F e b. 2 0 0 5 ) a t 8 9-9 2 (d e s c r ib in g th e v a r io u s w a y s p e o p le m ig h t a n d d o u s e n e w s e a r c h e n g in e s, in c lu d in g in v e s tig a tin g jo b a p p lic a n ts a n d r e a l e s ta te fo r s a le ). 1 1 4 S e e in fra n o te s 1 4 2-4 6 a n d a c c o m p a n yin g te x t (d e s c r ib in g c o n c e r n s a b o u t g o v e r n m e n t's a b ility to o b ta in a n d a b u s e in fo r m a tio n ); s e e a ls o S O L O V E, s u p r a n o te 1 0 2, a t 1 6 8-7 5 (d e s c r ib in g c u r r e n t go v e r n m e n t e ffo r ts to o b ta in in fo r m a tio n a b o u t m illio n s o f c itiz e n s a n d c o n c lu d in g th a t Aw e a r e a lr e a d y c lo s e r to T o ta l In fo r m a tio n A w a r e n e s s th a n w e m ig h t th in k@) & 1 7 5-8 7 (d e s c r ib in g p o s s ib le a b u s e s o f in fo r m a tio n - g a th e r in g, in c lu d in g Ac r e e p in g to ta lita r ia n is m,@ in h ib itio n o f fr e e d o m o f a s s o c ia tio n, a n d J. E d g a r H o o v e r 's m is u s e o f s u r v e illa n c e a g a in s t a lle g e d c o m m u n is t p a r ty m e m b e r s a n d p e o p le lik e M a r tin L u th e r K in g ).

FILE:C:\SLOBOGIN.DTP Dec 12/13/05 Tue 12:53PM 2005] TRANSACTION SURVEILLANCE 183 C. Catalogic Data By Acatalogic data@ I mean information that classifies and describes a transaction, as distinguished from the content of the transaction. Catalogic data includes descriptors of communications and transmissions, such as phone numbers dialed, the addresses that route emails, and the duration of phone calls and Internet session times. This category of transactional information also includes membership lists; plane, train and ship passenger manifests; business records listing who purchased what and when; and other archives that describe the identities of those who have participated in a particular activity or communication. This listing overlaps with some of the information that ECPA permits the government to obtain with an ex parte subpoena or a certification order. However, I would not include within the rubric of catalogic data other types of personal information ECPA currently allows government to obtain with an ex parte subpoena, such as the URLs of websites visited or the identity of those using pseudonyms. 115 This kind of information is more akin to content: the URLs can be used to visit the same websites the target visits, and disclosure of the person behind the pseudonym will often allow government to link that person to particular messages. 116 So limited, catalogic data should not be entitled to as much protection as the content of communications, because it is not as personal as the substance of communications made during the transaction. That is not to say, as the Supreme Court has said, that the Fourth Amendment is irrelevant when something other than content is at issue. Smith v. Mary- 1 1 5 S e e s u p r a n o s 6 9-7 2 a n d a c c o m p a n y g x 1 1 6 S e e g e n e r a J o h n A n F a r m e r, N o, T h e S p e c r o f C - A n a R e g u g A n o n c g P e e r - - P e e r N e 7 2 F O R D H A M L. R E 7 2 5 0 0 3 te in te t. lly la te te ryp to rchy: la tin ym itycp rote tin to tw orks, V. (2 ).

F IL E :C : \ S L O B O G IN.D T P D e c 1 2 / 1 3 / 0 5 T u e 1 2 :5 3 P M 1 8 4 M IS S IS S IP P I L A W J O U R N A L [V o l. 7 5 land notwithstanding, 117 most of us would not expect the people who work at our phone company (or Internet service provider) to care who we call (or write to), an expectation that is undoubtedly correct. 118 But the evidence that catalogic data provides about content is, at best, circumstantial. Catalogic data is to the substance of the contact as the visage is to personality. Thus, while it is entitled to some protection, catalogic data should not be treated in the same way the associated content is. The analysis changes, however, when the government uses technologically-enhanced transaction surveillance to aggregate catalogic data. When information from pen registers, snoopware programs, and commercial data broker programs is combined, it can identify all of our surreptitious connections with the world, providing powerful evidence of our activities and beliefs. 119 To use the words of the commentator quoted earlier, law enforcement can construct a Acomplete mosaic of a person's characteristics@ through this type of transaction surveillance. Under these circumstances, the information the government accumulates is more akin to content than mere cataloguing. The visage analogy no longer applies. This distinction between aggregated and isolated catalogic data roughly maps onto the distinction between target-based and event-based transaction surveillance described earlier. When government has identified a target, it will tend to accumulate as much information as possible about the target. Under such circumstances, the transaction surveillance will 1 1 7 S e e s u p ra n o te s 4 0-4 1 a n d a c c o m p a n yin g te x t. 1 1 8 C f. W a yn e L a F a v e, T h e F o r g o tte n M o t to o f O b s ta P rin c ip is in F o u r th A m e n d m e n t J u r is prud e n c e, 2 8 A R IZ. L. R E V. 2 9 1, 3 0 2 (1 9 8 6 ) (b a n k o ffic ia ls d o n o t h a v e Ad ir e c t, s ig n ific a n t c o n ta c t w ith th e u n d e r lyin g tra n s a c tio n a l in fo r m a tio n@ in th e s a m e w a y la w e n fo r c e m e n t o ffic e r s w h o c o lle c t a ll o f a n in d ivid u a l's fin a n c ia l in fo r m a tio n w o u ld ) (q u o tin g N o te, 8 3 Y A L E L.J. 1 4 3 9, 1 4 6 3-6 4 (1 9 7 4 )). 1 1 9 S e e g e n e r a lly S ta n K a r a s, P rivacy, Id e n t ity, D a ta b a s e s, 5 2 A M. U. L. R E V. 3 9 3, 3 9 8 (2 0 0 2 ) (AW h a t w e b u y is h o w w e p r e s e n t o u r s e lv e s to th e o u ts id e w o r ld ; it r e p r e s e n ts h o w w e c h o o s e to in te r a c t w ith it.... T h e s e p r e fe r e n c e s a r e e x p r e s s iv e, rev e a lin g a n d p r iv a te.@).

FILE:C:\SLOBOGIN.DTP Dec 12/13/05 Tue 12:53PM 2005] TRANSACTION SURVEILLANCE 185 produce a personality Amosaic@ that is deserving of maximum protection. Event-based transaction surveillance of catalogic data is usually different. Recall the example given earlier of the sniper investigation in which police find a sweater thread and footprint they believe belong to the sniper, and also know that the sniper reads a particular type of detective novel. Law enforcement attempts to identify the sniper through accessing the records of local clothing, shoe and bookstores are likely to disclose the names of numerous innocent people who have purchased items similar to those thought to be owned by the criminal. But this information, while personal, is merely a piece of the mosaic, not nearly the complete picture that target-based surveillance is likely to produce. In this situation, a relevance showing should be enough, at least when the access does not infringe First Amendment interests. 120 However, ex parte subpoenas, certification orders and extrajudicial certifications, which are the current means of regulating access to catalogic data when there is any regulation at all, are insufficiently restrictive despite their reliance on the relevance standard. These devices leave the transaction surveillance decision about personal data entirely or almost entirely in the discretion of law enforcement even when no exigent circumstances exist, a notion that is antithetical to the Fourth Amendment. 121 Instead, in non-emergency situations 1 2 0 T h e S u p r e m e C o u h a s d a d a t u g a n d u a l e n g a g e d a d v o c a c y s u r r e n d e r a n o n w o u t g o o d c a u s e c a n g e F A m e n d m e n t r e s. S e e, e N A A C P A b a m a e P a r s o n, 3 5 7 U. 4 4 9, 4 6 2 9 5 8 ) t h a r d a n o v e l p e r c e p n a t o m p e d d c s u r e o f a f - n w g r o u p s e n g a g e d a d v o c a c y m a y c o n s n ] e c... t o n e e d o m o f a s s o c n ; S h e n v. T u c k e r, 3 6 4 U. 4 7 9, 4 9 0 9 6 0 ) r o h g c o m p e g a c h e r s d c s e g r o u p m e m b e r s h s 1 2 1 A s J u s e J a c k s o n s d J o h n s o n v. U n d S s, 3 3 3 U. 1 0, 1 3-1 4 9 4 8 T h e p o t o f e F o u r A m e n d m e n w h h o n n o t g r a s p e d b y a u s o e r s, n o t a t d e n s w e n r c e m e n t e s u p p o r t o f e u s u a l r e n c e s w h h r e a s o n a b m e n d r a w o m e v e n c e. p r o c n rt in ic te th req irin in ivid in to ym ity ith in frin irst in te ts.g., v. la x. re l. tte.s (1 (AI is ly tio th `c lle is lo filia tio ith in titu te [a ffe tive res tra in fr ia tio.'@) lto.s (1 (p ib itin llin te to is lo ip ). tic ta te in ite ta te.s (1 ): in th th t, ic fte is ze lo ffic is th it ie la fo th th in fe ic le fr id Its te tio

F IL E :C : \ S L O B O G IN.D T P D e c 1 2 / 1 3 / 0 5 T u e 1 2 :5 3 P M 1 8 6 M IS S IS S IP P I L A W J O U R N A L [V o l. 7 5 the government should be able to obtain catalogic data in connection with event-based surveillance only when a judge finds it is relevant to an investigation, an assertion the recordholder should have the opportunity to challenge unless notification would undermine the investigation. c o n s r e q u g a t o s e r e n c e s b e d r a w n b y a n e u l a n d d e c h e d m a g s a d o f b e g d g e d b y e o e r e n g a g e d e o n c o m p e e e n r p r e o f r r e g o u t e.... W h e n e r h t o f p r m u s t a s o n a b e r h t o f s e a r c h, a s a r u, b e d e c e d b y a d l o e r, n o t b y a p o e m a n o r G o e n t e n r c e m e n t a g e n t.... J a c k s o n e n w e n t o n t e x c e p n a l c c u m s n c e s w h h, o n b a n c g e n e e d r e c e w e n r c e m e n t a g a s t e r h t o f p r m a y b e c o n n d e d a t a m a g w a r r a n t r s e a r c h m a y b e d p e n s e d w : w h e n a u s p e c t w a s e g o r e k e h e s e a r c h w a s o f... a m o v a b v e h o r v e n c e o r c o n b a n d w a s r e a n e d w r e m o v a l o r d e s c n. a t 1 5. is ts in ir in th th in fe tra ta is tra te in te in ju th ffic in th fte titiv te is fe tin crim th ig ivacy re ly yie ld to th ig is le to id ju ic ia ffic lic vernm fo th to lis th Ae tio ir ta in ic la in th fo ffe tiv la fo in th ig ivacy, it te th is tra te 's fo is ith As fle in lik ly to ta flig t@; A[ t]h le ic le @; Ae id tra th te ith tru tio.@ Id

FILE:C:\SLOBOGIN.DTP Dec 12/13/05 Tue 12:53PM 2005] TRANSACTION SURVEILLANCE 187 D. Data Mining/Profile Information Data mining is event-based transaction surveillancebthe use of records searches to discern patterns of behavior that can be linked to past or future crime, without having a specific individual or individuals in mind. Several formal data mining programs exist. For instance, the Homeland Security Department runs something called the Electronic Surveillance System for Early Notification of Community-Based Epidemics (ESSENCE), which gathers personally identifiable information from emergency rooms, health plans, clinical laboratories, 911 calls, pharmacies, and veterinary clinics in an effort to discern unusual or suspicious symptoms and events. 122 The Enhanced Border Security and Visa Entry Reform Act of 2002 requires aircrafts and sea vessels to submit departure and arrival manifests indicating the names of all alien passengers, which can be combed for suspicious travel patterns. 123 The much more sophisticated Computer Assisted Passenger Prescreening System (CAPPS) purportedly combines airline passenger lists with travel reservations, rental car status, travel companions, and address. 124 Data mining comes in many forms, but all varieties have one thing in common: they rely on dragnet perusal of transaction information. One way of analyzing the Fourth Amendment implica- 1 2 2 S e e K a e r e M c e P e r s, P a r n R e c o g n n, S e p 1 9, 2 0 0 3, a v a b a t h / w w w o v e x e c o m / a r e s / 0 9 0 3 / 0 9 0 3 s 2 e - s c r g E S S E N C E E S S E N C E a m u c h r e d u c e d v e r s n o f e m a n e d T o l r - m a n A w e s s p r o g r a m, n o w b e d T e r r o r m r m a n P r a m, a t w a s d b y C o n g r e s s 2 0 0 2. 1 0 U. 2 2 4 1 g s c o p e a n d a p p r o p r - n s r l r m a n a w e s s p r o g r a m 1 2 3 8 U. 7 3 1 ) e q u g e e s b h m e n t o f a d a b a s e r a a a n d d e p a r r e s 1 2 4 S e e C h a r u A. C h a n d r a s e k h a r, F g W h B r o w n : F e d e r a l C R h R e m e d s P o s t - 9 / 1 1 A e R a c l P g o f S o u A s n s, 1 0 A S N L. 2 1 5, 2 2 1 0 0 3 ) e s c r g a p r o u s g r o u g h 4 0 m s w h h, a o u g h s e c r e a r e c d e o s e d th in In tir te tte itio t. ila le ttp :/.g.c fe tu.h tm (d ib in ). is io th lig ta In fo tio aren la le is In fo tio rog th res tric te in.s.c ' (lim itin ia tio fo to ta in fo tio aren )..S.C '1 (a )(2 (r irin th ta lis ta fo ll arriv ls tu ). lyin ile ivil ig ts ie to irlin ia rofilin th ia IA.J (2 (d ib in file in ly ite ic lth t, likely to in lu th lis te ).

F IL E :C : \ S L O B O G IN.D T P D e c 1 2 / 1 3 / 0 5 T u e 1 2 :5 3 P M 1 8 8 M IS S IS S IP P I L A W J O U R N A L [V o l. 7 5 tions of data mining would be to focus on the nature of the records that are mined. Under this approach, if ESSENCE accesses the contents of personally identified medical records for criminal investigation purposes, its algorithm ought to identify only people who are highly likely to be perpetrators of crime, while if all of its information comes from Apublic@ records or is composed of isolated catalogic sources, then its ability to identify criminals need not be as potent. A second way of analyzing data mining would be to look at the extent to which it aggregates information about the individuals it investigates and tags. If one accepts the concern about creation of Apersonality mosaics@ described earlier, data mining would need a high hit rate to the extent it accumulates a significant amount of identifiable data about individuals, even if, as with CAPPS, all of the information is catalogic in nature. Either way, data mining does not fare well. From what we know, the profiles used in the programs are very unlikely to identify even a small number of terrorists or other criminals. In other words, they may not even be successful enough to pass the relevance test (which requires that the investigative technique do better than chance), much less reach a level of success commensurate with reasonable suspicion or probable cause. Perhaps if such a data mining program relied only on a small amount of catalogic data to identify potential targets, it would be permissible under the interpretation of the Fourth Amendment put forward here. 125 But once government begins using multiple databases to put together detailed dossiers on the activities of its citizens, it would have to show more than 1 2 5 A r e c e n tly re le a s e d r e p o r t b y a D e p a r t m e n t o f D e fe n s e a d v isory c o m m itte e r e q u ir e s c o u r t a p p r o v a l o f d a ta m in in g th a t w ill o b ta in Ap e r s o n a lly id e n tifia b le in fo r m a tio n@ fr o m r e c o r d s n o t re a d ily a v a ila b le to th e p u b lic. S e e R e p o rt o f th e T e c h n o lo g y a n d P rivacy A d visory C o m m itte e, S a fe g u a r d in g P rivacy in th e F ig h t A g a in s t T e r r o r is m 4 9, 5 1 (M a r c h 2 0 0 4 ). H o w e v e r, it req u ir e s th e c o u r t to fin d o n ly th a t th e in fo r m a tio n o b ta in e d b e Ar e a s o n a b ly re la te d@ to th e in v e s tig a tio n p u r p o s eba r e le v a n c e s ta n d a r d?ba n d d o e s n o t o th e r w is e d is tin g u is h b e tw e e n typ e s o f rec o r d s. Id. a t 5 1-5 2. T h e r e p o r t m a k e s s e v e r a l g o o d s u g g e s tio n s r e g a r d in g Aa n o n ym izin g@ d a ta, re c o r d - k e e p in g a n d o th e r m e a n s o f m o n ito r in g d a ta m in in g. Id. a t 4 8-5 9.

FILE:C:\SLOBOGIN.DTP Dec 12/13/05 Tue 12:53PM 2005] TRANSACTION SURVEILLANCE 189 just a possibility that something useful might turn up. IV. COUNTER-PROPOSALS What does this set of proposals mean for our detective friend, described in Part I of this article? If he is investigating a particular person (the frequent flyer, the free-spender or the young Arab man), he needs a Terry order to access public records through Choicepoint or one of the other commercial data brokers. And he needs a warrant based on probable cause to access the contents of the suspect's financial, school, medical and similar personal records, as well as to obtain aggregated catalogic information such as addresses of the person's email messages. If instead he is engaging in event-based investigation, the nature of the records sought determines the justification needed. If, as in the hypotheticals described in Part I, the focus is store records (in an effort to track down a sniper-killer), or skydiving club membership lists and cookies of websites (in an effort to identify terrorists planning to bomb a mall), he would be on solid ground if this catalogic data is likely to increase the probability of identifying the perpetrators. If instead access is sought to the content of personal records or to catalogic data that implicates First Amendment interests, individualized suspicion would be required. 126 While this set of rules is not uncomplicated, it recognizes fewer types of authorizations than the current regime. The officer need merely make distinctions between personal and public records when conducting target-based transaction surveillance, and between content and catalogic data when con- 1 2 6 T h e a n a s h o u n o t c h a n g e g o v e r n m e n t s e e k s p e r s o n a l r m a n o m r e c o r d s a c q u e d b y a c o m m e r c l d a b r o k e r a t h a s o b e d e r m a n o m e o r a l r e c o r d - h o e r s. O e r w e, m u c h o f r e g u n c o u b e a v o e d. D a d o e s n o t b e c o m e s s p e r s o n a l s p b e c a u s e h a s b e e n s h d o m o n e e n a n o e r. T h e c r u c l q u e s n s a r e w h e e r c o n n t o r c a g / o r g a n a n a l r m a n, a n d w h e e r w a s o r a c o c d r p r o r p u b p u r p o s e s. lysis ld if in fo tio fr ir ia ta th ta in th in fo tio fr th ig in ld th is th is la tio ld id ta le im ly it ifte fr tity to th ia tio th it is te ta lo ic iz tio in fo tio th it ig in lly lle te fo ivate lic

F IL E :C : \ S L O B O G IN.D T P D e c 1 2 / 1 3 / 0 5 T u e 1 2 :5 3 P M 1 9 0 M IS S IS S IP P I L A W J O U R N A L [V o l. 7 5 ducting event-base surveillance. Moreover, since transaction surveillance should generally only proceed pursuant to court order, any confusion on the detective's part can be cleared up by a judge. One can imagine numerous alternative methods of regulating transaction surveillance. Professor Daniel Solove has put forth the most coherent alternative to current law and the proposal presented here. 127 He points out that technology has made it easier both to maintain information about people and to aggregate it. 128 Thus, he proposes that, rather than attempt to figure out a privacy hierarchy and match authorization requirements to it (the proportionality approach that informs this article), we should adopt a uniform regulatory regime for government access to any Asystem of records.@ 129 Specifically, Solove proposes that, outside of emergency situations, government should not be able to obtain information in recordsbwhether it is content or catalogic data, whether it is held by private or public agenciesbunless it can obtain what he calls a Aregulated subpoena.@ 130 To obtain such a subpoena the government would have to demonstrate it has probable cause to believe the person whose records are sought is involved in criminal activity, and that the specific records targeted are of Amaterial importance@ to the investigation, which he describes as a standard that is Aslightly more permissive than that of a warrant,@ though more demanding than the relevance standard required for a subpoena (and, presumably, the reasonable suspicion required for a Terry order). 131 As with traditional subpoenas, the regulated subpoena would be challengeable by the target. 132 1 2 7 D a n ie l J. S o lo v e, D ig ita l D o s s ie r s a n d th e D is s ip a tio n o f F o u r th A m e n d m e n t P riv a c y, 7 5 S. C A L. L. R E V. 1 0 8 3 (2 0 0 2 ). 1 2 8 Id. a t 1 0 9 0-9 5. 1 2 9 Id. a t 1 1 5 2-5 9. 1 3 0 Id. a t 1 1 6 4. 1 3 1 Id. a t 1 1 6 4-6 5. 1 3 2 Id. a t 1 1 6 5.

FILE:C:\SLOBOGIN.DTP Dec 12/13/05 Tue 12:53PM 2005] TRANSACTION SURVEILLANCE 191 Solove makes interesting arguments as to why his approach is superior to a proportionality approach. First, he points to the difficulty of differentiating between degrees of privacy and intimacy, 133 a difficulty illustrated by my attempts to distinguish content from catalogic information, personal from organizational records, and private from public records. Second, even if we could resolve these definitional problems, Solove believes that making privacy the linchpin of analysis is conceptually bankrupt. He notes, for instance, that we would never think of requiring the police to obtain a warrant in order to obtain a description of a suspect's genitals from his sexual partner, yet that information is probably as Aprivate@ as anything found in one's medical records. 134 Privacy, Solove argues, is a contextual concept that cannot form the basis for uniform regulation. 135 Rather, in the transaction surveillance setting, the focus should be whether the information is maintained in a system of records. 136 So, to return to his example, the police could interview the sexual partner without restriction, but would need a regulated subpoena to access the medical record of the suspect for the same information. I agree with the premise of both of Solove's arguments, but am less persuaded that they lead to his conclusion. Solove is right that making the subtle distinctions demanded by a proportionality approach is difficult and can result in over or under protection of information at the margins. But requiring a uniform standard of probable cause for all record searches, as Solove would, provides far too much protection for some types of information. For instance, data mining of any sort 1 3 3 I d. a t 1 1 5 2-5 3. 1 3 4. a t 1 1 5 4. 1 3 5. a t 1 1 5 3-5 4. S o v e d e v e p s p o t m u c h m o r e d e D a n l J. S o v e, C o n c e p a g P y, 9 0 C A L. L. R E 1 0 8 7, 1 0 8 8-9 9 0 0 2 1 3 6 S o v e, s u p r a n o 1 2 7, a t 1 1 5 7 o c u s g o n m s o f r e c o r d s ' r g e e e o f r m a n w a t e s c o n c e r n. B e c a u s e e p r o b m o f m o d e r n g o v e r n m e n t r m a n - g a e r g c a u s e d b y e c r e a s g d o s s r s m a e d p r a s e c r r e c o r d s y s m s, e a r c h c r e r g e o s e d p a r s a t s r e d a o r d s y s m s. Id Id lo lo th is in in ta il in ie lo tu lizin rivac V. (2 ). lo te (AF in `syste ta ts th typ in fo tio flo th ra is th le in fo tio th in is th in in ie in ta in in iv te to te th ite tu ta ts th th ir tie th to ta in rec te.@)

F IL E :C : \ S L O B O G IN.D T P D e c 1 2 / 1 3 / 0 5 T u e 1 2 :5 3 P M 1 9 2 M IS S IS S IP P I L A W J O U R N A L [V o l. 7 5 would be almost impossible; if probable cause were required, the sniper-killer and terrorist investigations described above would probably never get off the ground. Or imagine that police want to find out from the phone company who called a murder victim in the two weeks prior to the murder (a scenario often depicted on TV shows like Law & Order). While they would certainly be able to demonstrate the relevance of this catalogic data, they would not have probable cause with respect to any of the callers, and thus would not be able to obtain the regulated subpoena for the phone company's records that Solove would demand. Creating a hierarchy of privacy, as tricky as it is, is important as a means of enabling the balancing of government and individual interests that the Supreme Court has sanctioned since the 1960s. 137 I also agree that the extent to which we are willing to protect private information is contextual, as Solove's example of the sexual partner interview demonstrates. However, that conclusion does not mean that privacy should be discarded as the baseline consideration in determining the government's authority to obtain information about its citizens. The reason we should treat interviews differently from records requests is not because privacy somehow is irrelevant in the former situation, but because the target's interest in privacy is countered by an even stronger interestbthe third party's autonomy. Human information sources, such as the sexual partner, should have a right to decide what to do with the information they possess; in such cases, the subject's privacy interest is outweighed by the source's autonomy interest. 138 When the third party is an impersonal record-holder, on the other hand, concerns about denigrating Apersonhood@ through limitations on 1 3 7 S e e C a m a r a v. M u n. C t., 3 8 7 U.S. 5 2 3, 5 3 6-3 7 (1 9 6 7 ) (A[ T ]h e r e c a n b e n o r e a d y te s t fo r d e te r m in in g r e a s o n a b le n e s s o th e r th a n b y b a la n c in g th e n e e d to s e a r c h a g a in s t th e in v a s io n w h ic h th e s e a r c h e n ta ils.@). 1 3 8 M ary Ir e n e C o o m b s, S h a r e d P riv a c y a n d th e F o u r th A m e n d m e n t, o r T h e R ig h ts o f R e la tio n s h ip s, 7 5 C A L. L. R E V. 1 5 9 3, 1 6 4 3-4 4 (1 9 8 7 ).

FILE:C:\SLOBOGIN.DTP Dec 12/13/05 Tue 12:53PM 2005] TRANSACTION SURVEILLANCE 193 when information may be revealed are non-existent. 139 It is the absence of a legitimate third party interest in surrendering the target's private information, not the bare fact that the information happens to reside in a record, that distinguishes the records request scenario from the interview setting. These considerations lead me to conclude, contrary to Solove, that privacy concerns should be the fundamental consideration in analyzing transaction surveillance. While information generally should be accorded privacy protection when recorded, the extent of that protection should depend on the degree of privacy associated with the information, not simply on whether it exists in record form. Thus, some transactional informationbi.e., that found in truly public records and catalogic databshould be accessible on less than probable cause. Another alternative to the proportionality approach advanced here evades the issue of whether it is under or over protective of privacy by asserting that it focuses on the wrong sort of privacy invasion. Professor William Stuntz concedes that Asecret searches@ of our transactional information create risks that Aare worth worrying about.@ 140 But he contends that we would not be particularly bothered by easy government access to such information if we never find out it has occurred except in connection with prosecutions for serious crime. 141 In other words, covert access to and stringent control over use of 1 3 9 F o r fu r th e r d e v e lo p m e n t o f th is p o in t, s e e S lo b o g in, s u p r a n o te 8 9, a t 8 3 4-3 5. O f c o u r s e, th e e m p lo y e e s o f th e r e c o r d - h o ld e r m ig h t w a n t to r e v e a l p r iv a te in fo r m a tio n. S e e, e.g., S u s a n F r e iw a ld, U n c e r ta in P rivacy: C o m m u n ic a tio n A ttrib u te s A fte r th e D ig ita l T e le p h o n y A c t, 6 9 S. C A L. L. R E V. 9 4 9, 1 0 1 3 (1 9 9 6 ) ( A s th e p r e s id e n t o f th e U n ite d S ta te s T e le p h o n e A s s o c ia tio n p u t it in e x p la in in g th a t te le - p h o n e c o m p a n ie s a r e in te r e s te d in a c c e d in g to la w e n fo r c e m e n t re q u e s ts fo r a s s is ta n c e, th e c o m p a n ie s w a n t to b e `g o o d lo c a l c itiz e n [s ].'@). B u t lim itin g th a t a b ility is n o t d e n yin g th e e m p lo ye e 's Ap e r s o n h o o d,@ b e c a u s e th e in fo r m a tio n is m a in ta in e d b y th e in s titu tio n, n o t th e p e r s o n. 1 4 0 W illia m J. S tu n tz, L o c a l P o lic in g A fte r th e T e r r o r, 1 1 1 Y A L E L.J. 2 1 3 7, 2 1 8 1 (2 0 0 2 ). 1 4 1 Id. a t 2 1 8 4-8 5.

F IL E :C : \ S L O B O G IN.D T P D e c 1 2 / 1 3 / 0 5 T u e 1 2 :5 3 P M 1 9 4 M IS S IS S IP P I L A W J O U R N A L [V o l. 7 5 transaction information should permit relaxation of the rules as to how we obtain it. This ignorance-is-bliss notion is superficially attractive. But limiting information flow, which is essential to Stuntz' scheme, can be very difficult. The notion that data gathered by law enforcement will be restricted to a small group of government employees is particularly naive in the wake of 9/11, when literally hundreds of thousands of law enforcement officers are charged with fighting Aterrorism,@ an amorphous threat to say the least. 142 And ensuring that the information government officials acquire through covert surveillance is used only for the purpose of prosecuting serious crime could be equally difficult, precisely because the surveillance is covert. 143 Finally, abandoning all suspicion requirements, as Stuntz would do, virtually guarantees that data would be gathered about large numbers of innocent people, which in turn is likely to increase the chances of government files containing misleading information about its citizens. 144 Even if the information gathered is somehow confined to a limited and discrete group and is not misused or inaccurate in any way, routine suspicionless and covert transaction surveillance can eat away at whatever trust is left between government and its citizenry. As I wrote in a discussion of Stuntz' 1 4 2 S e e g e n e r a, G a b l S o T e r r o r m : T h e K n o w n E m e n t N o O n e C a n D e e, 1 1 W L A M E T T E J. I N T ' L L. & D P. R E S O L. 1 2 3 0 0 4 S e e a o P e r S w e, T h e S m o f F o r e n e n c e S u n c e L a w, 7 2 G E W A S H. L. R E 1 3 0 6, 1 3 7 1 0 0 4 ) t g a t h e h r y o f p r e v u s c y c s s h o w s e m p n o f s u r v e n c e s s s a n e v e r - c r e a s g s c o p e o f a c e h o p e s a t s t a b m o r e s u r v e n c e w c a h e r r o r t s o r p r e v e n t a n a c. 1 4 3. a t 1 3 6 6 c u s s g n g - r u n c o n c e r n a t s e c r e t... o r d e r a w g c c e s s e n e d a b a s e s o f r e c o r d s... w b e u s e d e x p a n s d e a w e a r r a y o f d o m e s m a t. 1 4 4 T h e r e c e n t e x e m p n o f e F B C e n l R e c o r d s S y s m d a b a s e o m e p r o v n e P A c t a t q u e s g o v e r n m e n t c o r d s b e a c c u - r a, 6 8 F e d. R e g. 1 4 1 4 0 a r. 2 4, 2 0 0 3 ) b e c o d d a s 2 8 C. p 1 6 w n o t h e m a r s. lly rie ll, is le fin IL IS (2 ). ls te ir yste ig In te llig rveilla O. V. (2 (s ta in th At is to io le th te ta tio illa ystem to ju tify in in tivity, in th th ju little it illa ill tc th te is tta k@) Id (d is in Aa lo th s@ llo in Aa to tir ta ill ively to in tru in to id tic ters@) tio th I's tra te ta fr th is io in th rivacy th re ir re to te (M (to ifie.f.r t. ), ill lp tte

FILE:C:\SLOBOGIN.DTP Dec 12/13/05 Tue 12:53PM 2005] TRANSACTION SURVEILLANCE 195 proposal in the context of public camera surveillance: o n c e th e p u b lic b e c o m e s a w a re th a t ra n d o m c o ve rt s u rve illa n c e is o c c u rrin g, a s it in e vita b ly w o u ld a fte r a fe w p ro s e c u - tio n s in w h ic h th e c o ve rtly g le a n e d in fo rm a tio n is u s e d, th e p a n o p tic e ffe c t o f th is r e g im e w ill b e g re a te r th a n o c c u rs w ith o ve rt [s u rve illa n c e ].... [W ]e w o u ld a s s u m e th a t s e c re t s u r ve illa n c e w a s p e rva s ive, n o t ju s t in c id e n ta l.... P ro b a b ly n o p a s s a g e in O rw e ll's n o ve l 1 9 8 4 is m o re c h illin g th a n th e [fo llo w in g ]: At h e re w a s o f c o u r s e n o w a y o f k n o w in g w h e th e r yo u w e re b e in g w a tc h e d a t a n y g ive n m o m e n t... It w a s e ve n c o n c e iva b le th a t th e y w a tc h e d e ve ryb o d y a ll th e tim e.@ With the power of today's computers, government could monitor the transactions of everybody, all the time. A regulatory regime that explicitly endorsed that sort of process would destroy any sense of security people might have in today's technological society. Indeed, if government is to be allowed to find out details of our lives whenever it is interested in doing so, we would probably be more comfortable knowing precisely when the surveillance is occurring, rather than being left in the dark. 146 A final means of regulating transaction surveillance is to leave the task up to the legislature, specifically Congress. Professor Orin Kerr has made the most powerful argument for this approach. 147 He correctly points out that congressional statutes 1 4 5 C h ris to p h e r S lo b o g in, P u b lic P rivacy: C a m e r a S u r v e illa n c e o f P u b lic P la c e s a n d th e R ig h t to A n o n ym ity, 7 2 M IS S. L.J. 2 1 3, 3 0 5 (2 0 0 2 ); s e e a ls o T h e C o u n c il fo r E x c e lle n c e in G o vernm e n t, F r o m th e H o m e F r o n t to th e F r o n t L in e s, A m e r ic a S p e a k s O u t A b o u t H o m e la n d S e c u rity 6 (M a r c h 2 0 0 4 ) a v a ila b le a t h ttp :/ / w w w. e x c e lg o v.o r g (p o ll in d ic a t in g th a t 7 2 % o f A m e r ic a n s h a v e As o m e@ o r Av ery lit tle @ tru s t in th e g o v e r n m e n t to Au s e p e r s o n a l in fo r m a tio n a p p r o p r ia te ly@). 1 4 6 C f. D A V ID B R IN, T H E T R A N S P A R E N T S O C IE T Y (1 9 9 8 ) (a r g u in g th a t Aw a tc h in g th e w a tc h e r s@ is th e o n ly w o r k a b le m e th o d o f r e g u la tin g g o v e r n m e n t in trus io n in th e a g e o f te c h n o lo g y). 1 4 7 O rin S. K e rr, T h e F o u r th A m e n d m e n t a n d th e N e w T e c h n o lo g ie s : C o n s titu tio n a l M yth s a n d th e C a s e fo r C a u tio n, 1 0 2 M IC H. L. R E V. 8 0 1 (2 0 0 4 ).

F IL E :C : \ S L O B O G IN.D T P D e c 1 2 / 1 3 / 0 5 T u e 1 2 :5 3 P M 1 9 6 M IS S IS S IP P I L A W J O U R N A L [V o l. 7 5 have provided more protection against transaction surveillance than the Supreme Court's construal of the Fourth Amendment in cases like Miller, 148 and that, in theory, legislatures are better equipped than courts to craft clear rules governing transaction surveillance in an era of rapidly changing, complicated technology. 149 But his arguments fail to negate two crucial facts, documented in this article, about the transaction surveillance rules that Congress has enacted to date: The rules have not been particularly clear 150 and, more importantly, they do not provide adequate protection against government access to our personal records. Especially in the wake of 9/11, Congress is unlikely to alter its stance unless the courts, relying on the Fourth Amendment, nudge it in the right direction. Will the courts be willing to engage in such nudging? Certainly, Miller, Smith and like cases indicate that the Supreme Court is reticent about doing so. But in more recent decisions applying the Aspecial needs@ doctrine, which raises parallel issues, the Court has backed off its nonchalant attitude toward nontraditional searches and seizures. In Ferguson v. City of Charleston, 151 the Court declared unconstitutional a policy that authorized hospital drug testing of pregnant patients for the purpose of detecting illegal drug use, over a dissent by Justice Scalia arguing that, under Miller, the patients voluntarily assumed the risk the results of such tests would be used for investigative purposes. 152 The majority in Ferguson ignored 1 4 8. a t 8 5 6. 1 4 9. a t 8 5 7-8 7. 1 5 0 K e s e h a s n o d a t m u c h o f e g n g o v e r n g n s a c n s u r v e n c e c o m p a d. S e e, e K e s u p r a n o 9 0, a t 1 2 0 8 ( C u r, g r s, a n d e v e n g a l s c h o r s h a v e h a d a v e r y h a r d e m a k g s e n s e o f e r e d C o m m u n a n s A c t o f E C P A ; O S. K e L g e o o f r n e t S u n c e : H o w a S u p p r e s s n R e m e d y W o u C h a n g e C o m p u r C e L a w, 5 4 H A S T G S L. 8 0 5, 8 2 0 0 0 3 ) e w o f e c n s u r v e n c e - m o u s c o m p x, n o t e n e p e n e. 1 5 1 5 3 2 U. 6 7 0 0 1 1 5 2. a t 9 5 c a, J d s e n g ) n d a w e h a v e n e v e r h e r e v e n s u g g e s h a t m a r l w h h a p e r s o n v o n r e n s s o m e o n e e e Id Id rr him lf te th th le is la tio in tra tio illa is lic te.g., rr, te A[ ]o ts le is la to le la tim in th [S to ic tio ].@) rin rr, iftin th AF g@ In te rveilla io ld te rim IN.J (2 (th Ala le tro ic illa is fa ly le if tir ly im trab le.@).s (2 ). Id (S lia., is tin (AU til to y, ld Co te dct te ia ic lu ta ily tru ts to ls

FILE:C:\SLOBOGIN.DTP Dec 12/13/05 Tue 12:53PM 2005] TRANSACTION SURVEILLANCE 197 Scalia's complaint, reasoning that a reasonable patient would assume the test results would be used for diagnostic purposes and that otherwise they would be kept confidential. 153 In both Ferguson and Indianapolis v. Edmond, 154 which held invalid a roadblock set up to interdict narcotics, the Court also emphasized that individualized cause requirements may not be relaxed if the only Aspecial need@ pleaded by the government is a Ageneral interest in law enforcement.@ 155 Ferguson signals that the Court is hesitant about granting the government an exemption from traditional Fourth Amendment standards simply because information relevant to a criminal investigation has been handed over to a third party (thus undermining Miller's premise). And both Ferguson and Edmond suggest that strong government allegations that relaxation of those standards is necessary to detect criminal activity will not always prevail (thus undermining the Aheightened need@ rationale as a ground for reducing Fourth Amendment protections). These decisions provide a glimmer of hope that, when confronted with cases challenging subpoenas for personal records about medical treatment, personal finances and the contents of email messages, the Court will withdraw from its broad pronouncements in Miller. If it does so, further, more detailed rule-making along the lines suggested here might best c a n n o t b e g e n b y a t p e r s o n e p o e, a n d u s e d r w h a v e r e v e n c e m a y c o n. 1 5 3. a t 7 8 h e u s e o f a n a d v e r s e s t s u d q u a o n e o m e r a p a r u r b e n e s u c h a s a p r o m o n o r a n o p p o r n p a r a a n e x c u r u r a c v o e s a s s s e r i o u s s n o n p r a n e u n - a u o e d d s e m a n o f s u c h r e s u d p a r s. T h e r e a s o n a b e x p e c n o f p r a c y e n d b y e a l p a n t u n d e r g o g d g n o s s a h o s p l a t e r e s u o f o s e s w n o t b e s h a r e d w n o n m e d a l p e r s o n n e l w o u t h e r c o n s e n. 1 5 4 5 3 1 U. 3 2 0 0 0 1 5 5 F e r g u s o n, 5 3 2 U. a t 7 9 ; E d m o n d, 5 3 1 U. a t 4 7 h e n w e n r c e m e n t a u o r i s p u r s u e p r a r g e n e r a l e c o n l p u r p o s e s a t c h e c k p o s u c h a s h e r e, h o w e v e r, s p s c a n o n b e s d b y s o m e q u a n m o f d u a e d s u s p n. iv th to th lic fo te id it ta in.@) Id (AT te re lt to is lify fr lig ib ility fo tic la fit, tio tu ity to tic ip te in tra ric la tivity, in lv le in tru io ivacy th th th riz is in tio lts to th ir tie le ta tio iv jo ye th typ ic tie in ia tic te ts in ita is th th lts th te ts ill ith ic ith t.@).s (2 )..S.S (AW la fo th tie im ily crim tro in ts to ly ju tifie tu in ivid liz ic io.@)

F IL E :C : \ S L O B O G IN.D T P D e c 1 2 / 1 3 / 0 5 T u e 1 2 :5 3 P M 1 9 8 M IS S IS S IP P I L A W J O U R N A L [V o l. 7 5 be left to Congress, for the reasons Kerr suggests. The goal is meaningful protection of personal information. The source of that protection is not so important. CONCLUSION Analysis of government surveillance has tended to focus on communications and physical surveillance. Yet transaction surveillance is at least as pervasive as these other types of investigative techniques, and can be as inimical to privacy interests. Public and private records contain information regarding virtually every aspect of our lives. In the past few decades, technology has made that information infinitely more easily aggregated and accessible. Nonetheless, neither legislatures nor courts have evidenced much concern about transaction surveillance. Congress appears to think of transaction information as Abusiness records,@ and thus at most entitled to the protection afforded by subpoenas, while the Supreme Court tells us we must assume the risk that record-holders will betray us. These positions ignore the obvious fact that medical, financial and other types of private and public records contain much personal information. They also fail to acknowledge that disclosure of that information to record-keepersbdisclosure that those of us who live a modern lifestyle cannot avoidbis no different, in expectation of privacy terms, than communicating with others by phone or email or interacting with others inside one's home, both activities clearly protected by the Constitution. As Senator Sam Ervin recognized in 1974, A[g]overnment has an insatiable appetite for power, and it will not stop usurping power unless it is restrained by laws they cannot repeal or nullify.@ 156 When it comes to transaction surveillance, only the Fourth Amendment provides that type of restraint. 1 5 6 In tro d u c tory R e m a r k s o f S e n a to r S a m J. Ervin o n S. 3 4 1 8, H.R. R E P. N O. 9 3-1 4 1 6 (1 9 7 4 ), r e p r in te d in U.S. C O N G R E S S, L E G IS L A T IV E H IS T O R Y O F T H E P R I- V A C Y A C T O F 1 9 7 4, a t 3-8 (1 9 7 6 ).

FILE:C:\SLOBOGIN.DTP Dec 12/13/05 Tue 12:53PM 2005] TRANSACTION SURVEILLANCE 199

F IL E :C : \ S L O B O G IN.D T P D e c 1 2 / 1 3 / 0 5 T u e 1 2 :5 3 P M 2 0 0 M IS S IS S IP P I L A W J O U R N A L [V o l. 7 5