Habeas Data excerpt: How a mugger helped create the modern NSA surveillance program.
His follow-up harassing phone calls to his victim have had stupendous ramifications for us all.
This piece is adapted from Habeas Data: Privacy vs. the Rise of Surveillance Tech, by Cyrus Farivar, published by Melville House.
It was just another quiet Tuesday in October 2013 when a startling call from a reporter arrived on Stephen Sachs' phone. The reporter was with an outlet that Sachs had never heard of—Wired—and he was asking about a Supreme Court case, Smith v. Maryland, from decades ago. The career lawyer had practically forgotten about it. But the Foreign Intelligence Surveillance Court had been secretly relying on Smith, which began as a late-night robbery in Baltimore in 1975, to justify a massive surveillance program at the National Security Agency.
The 1979 Smith decision "was a routine robbery case," he told David Kravets. "To extend it to what we now know as massive surveillance, in my personal view, is a bridge too far." Specifically, Smith had become a critical linchpin in the third-party doctrine.
Today, the third-party doctrine works like this: If Alice calls Bob using Verizon, the fact that this call went over Verizon's network means that a third party (Verizon) was brought into the mix. Under this logic, neither Alice nor Bob can claim a privacy interest over the fact that the call took place. So, Verizon can disclose this metadata (who called whom, when, and for how long) to the police with little difficulty. In short, the government claims (and the Supreme Court agreed in 1979), that there was no "reasonable expectation of privacy" in numbers disclosed to a phone company.
In Smith, the Supreme Court found that a Baltimore robber, Michael Lee Smith, did not have a reasonable expectation of privacy in the numbers that he dialed—the third party here was the Chesapeake and Potomac Telephone Co. As such, the police did not need a warrant to obtain the numbers dialed through the use of a device called a pen register. Therefore, when it was shown that he repeatedly called a woman that he had burglarized, law enforcement was able to obtain a warrant to search his apartment and ultimately convict him. Smith, through his lawyer, Howard Cardin, unsuccessfully challenged the evidence that derived from the original use of the pen register. It was Sachs' victory over Cardin in Smith that laid the foundation of the FISC's legal opinion that massive warrantless wiretapping was acceptable to the law.
The story of Smith v. Maryland began just after midnight on March 5, 1976, when a woman named Patricia McDonough had just returned to her Baltimore home. As she approached her front door, a man grabbed her from behind, snatching her purse away from her, and fled the scene.
Soon after, McDonough told Baltimore police officer Kenneth Lucas what her assailant looked like and described a green bottom and tan top 1975 Chevrolet Monte Carlo that she'd seen earlier. But the robber wasn't done with her—he began making a series of "threatening and obscene" phone calls to McDonough and even told her that he was the one who had committed the crime against her.
One way that telephone companies dealt with this situation was to employ a pen register, which monitors inbound calls, while a "trap and trace" device monitors outbound calls. Today, pen registers and trap and trace devices are often used in combination, or are just referred to simply as a pen register for a singular device that can capture both incoming and outgoing calls. Antiquated as these pen registers are, they ended up playing an enormous role in surveillance law, with serious echoes into our own time.
As a result of McDonough's complaints, on March 13, 1976, the Baltimore Police Department asked Chesapeake and Potomac Telephone Co. to install a pen register on McDonough's line. It would record the phone numbers of all incoming calls.
The device showed that McDonough was frequently being called from pay phones in the neighborhood. On March 15, she received yet another call. A man asked her to step outside of her house so that he could observe her, and amazingly, she did so. She watched the Monte Carlo slowly drive past her home.
The following day, March 16, Officer Lucas was on the lookout for the green car in McDonough's neighborhood. Incredibly, the driver of that car stopped him, asking for help, as he had locked himself out. Lucas took down the plate number and eventually determined that it belonged to one Michael Lee Smith. The next day, the BPD asked the phone company to install a pen register to record all calls emanating from Smith's home. Later that same day, Smith again called his victim.
With this new information, the BPD got a warrant to search Smith's car and his apartment. There, authorities found "a page in Smith's telephone book was turned down; it contained the name and number of the victim." She positively identified him at police headquarters as part of a lineup on March 19.
Smith was formally indicted for robbery on April 6, 1976. His attorney, Cardin, tried to raise the pen register's legitimacy on a motion to suppress evidence (which was denied). After a brief bench trial, Smith was found guilty and sentenced to six years in prison.
In a 4–3 decision on July 14, 1978, the court of appeals found that because a pen register was not a device that "intercepts" a telephone call, it did not violate the state's wiretap law and was not a search. This decision turned on a specific distinction between data and metadata.
Judge Harry Cole, the first black American to be elected to the Maryland Senate and to serve on the Maryland Court of Appeals, was one of the judges who dissented. Judge Cole explained that his colleagues' understanding of what a search was remained far too narrow, in his view. It is not the fact that a particular location was examined, or even that a call was intercepted, or items taken. Rather, it is the "gathering of information," regardless of what form it comes in.
Three months after the Maryland Court of Appeals' decision, the Foreign Intelligence Surveillance Act was signed into law on Oct. 25, 1978. The new law was designed to strike a balance between the needs of the government to conduct secret surveillance and providing adequate oversight by creating an entirely new court, FISC.
In his cert petition to the Supreme Court, Howard Cardin largely reprised many of the same arguments that he had made at the lower courts. On the prosecution side, the arguments fell to Stephen Sachs, who had just been elected as the Maryland attorney general, and was installed in his position in January 1979.
Cardin forcefully argued that the local phone company installed the pen register at the behest of the police—without a court order or warrant of any kind—and captured his client's information without any legitimate authority.
He also pointed out that modern pen registers could easily be converted to surreptitious wiretaps, simply by plugging in headsets. Without adequate judicial oversight, police could easily abuse their authority without any meaningful consequences.
It captures no words uttered into the mouthpiece, as this Court phrased it in Katz. It captures no content. It achieves no communication, other than the limited communication between the user and the phone company itself. … It doesn't disclose if the call is completed. It doesn't reveal who the caller is. It doesn't say if the number was busy. It doesn't say who the parties are and it doesn't tell the duration of the call.
The Supreme Court published its decision less than three months later, on June 20, 1979. The court found, in a 5–3 decision, in favor of Sachs and the state of Maryland. The justices still viewed metadata and content as distinct, with differing legal protections. The decision then spent a little time discussing New York Telephone and how that law specifically did not consider pen registers an interception.
Furthermore, the majority found, "we doubt that people in general entertain any actual expectation of privacy in the numbers they dial." After all, consumers must realize that the phone company has the ability to retain those records, as they receive bills for long-distance calls. But even if Smith did have an "expectation of privacy" in his numbers dialed, society as a whole—according to the two-part Justice John Marshall Harlan test from Katz and subsequent rulings—does not recognize a privacy interest in information that he turns over to third parties.
Decades later this logic carried over to the NSA's metadata program—essentially that if the police could get three days of one person's phone records, then the NSA could obtain years' worth of everyone's phone records.
In the wake of Snowden's public disclosure in 2013, the FISC released the opinion upholding the NSA's telephone metadata collection program, and the American public found out for the first time the legal leap that the judiciary had made in signing off on the NSA's metadata program, which collected phone records for years on end—and Smith v. Maryland was its linchpin. "Put another way, where one individual does not have a Fourth Amendment interest, grouping together a large number of similarly situated individuals cannot result in a Fourth Amendment interest springing into existence ex nihilo [out of nothing]," wrote FISC Judge Claire Eagan. But she didn't acknowledge that that perspective itself sprung into existence from the unlikeliest of cases.
Cyrus Farivar is a senior tech policy reporter at Ars Technica, and is also a radio producer and author. His latest book, Habeas Data, about the legal cases over the past 50 years that have had an outsize impact on surveillance and privacy law in America, is out now. He is based in Oakland, California.