Variety of "wiretaps"

January 9, 2007

When someone says “wiretap” most people immediately think of a law enforcement agent huddled over a recorder listening intently to some bad guys plotting their next crime. However, only a very small percentage of wiretaps include the voice portion or “content” of a call. In practice there are three “levels” of “assistance” that carriers have to support when requested by law enforcement.

The first level is a subpoena for call records. These are historical records reflecting the calling activity of a particular target. This is by far the most frequently asked for and utilized capability by law enforcement. In 2006 there were approximately 2 million subpoenas/court orders requesting these types of records. The records for each request are provided to law enforcement either by electronic transfer to their collection function or by a manual process.

The next level moves from static, historical records to real-time reporting of the target’s activities. This level includes two categories of activity. The first category is a “Pen Register” which captures only the outgoing calls of the target. The second is a “Trap and Trace” which captures the inbound calls. Both of these types require the carrier to utilize a standards based, real-time solution that identifies and delivers call “events” to the collection function. These events include outgoing call attempts, incoming call attempts, digits dialed during the call, conferencing, transfers etc. In practice, carriers typically receive Pen Register and Trap/Trace requests together so that all inbound and outbound traffic is received. Far fewer of these were done in 2006, approximately 130 thousand, as compared to subpoenas for call records.

The final level is the Title III. This too is a real-time interface based on safe harbor standards (J-STD, ETSI, PacketCable etc.) but instead of just receiving call events (like the stand alone Pen Register / Trap &Trace), the actual content (conversations) are included. This means that a copy of the conversation is delivered along with the call event messages. Even though the whole conversation is provided, the call events perform a very important function in this scenario as they allow law enforcement to understand, as they are listening, who the active parties of a call are during transfers, call waiting, conferences etc. And as was true with the previous tiers, the number of Title III intercepts done each year is dramatically smaller, only about 2,600 were done in 2006.

These levels represent increased amounts of information but also an increased burden on law enforcement. At each step along the way, the judicial system is scrutinizing and critically reviewing these requests to make sure the need is genuine and justifiable.

Till next time ...