Republican Proposal Would Make Wiretaps Easier, But Might Violate Federal Law

As Capitol police officers move to block the doors to the JFC meeting, protesters pull out their phones to record. Photo by Henry Redman/Wisconsin Examiner.

Republican lawmakers have again introduced a bill to expand how wiretapping devices such as pen registers or trap and trace devices are defined under state law. A pen register is intended to collect information from a target phone, such as the phone numbers of outgoing or incoming calls, without eavesdropping on the call’s content or conversation.

When the bill was pitched two years ago, legislators argued that it would simply modernize Wisconsin law and align it with federal standards. But the bill has raised concerns over privacy and whether its passage could open the door to wider surveillance.

Like the previous bill, which was introduced in the Legislature’s 2021-22 biennium but failed to pass, the new bill (AB-334 / SB-331) expands the definition of pen registers to include “a device or process that records or decodes dialing, routing, addressing, or signaling information transmitted on a telephone line or by an instrument or facility from which a wire or electronic communication is transmitted.”

The bill would define trap and trace to include a device or process that “identifies the originating number or other dialing, routing, addressing, and signaling information” of an instrument or facility from which a wire or communication “was received.”

It would allow the state attorney general and local district attorneys to go to any Wisconsin county’s circuit court to apply for a court order for a pen register or trap and trace service, rather than requiring the application to be filed where the target phone or device is located, as the state law currently specifies.

The bill also states that “a person is considered to be doing business in this state, for the purpose of a pen register or trap and trace device order, if the person contracts with or engages in a terms of service agreement with any other person for the use of a line, instrument, or facility, and any part of the performance of the contract or provision of service takes place within this state on any occasion.”

In the previous legislative session, authors described the bill as innocuously updating Wisconsin’s statutory definitions. During committee hearings in 2021, Sen. Andre Jacque (R-De Pere) said the bill would make it easier for law enforcement to issue warrants for social media.

Rep. Jeffrey Mursau (R-Crivitz) testified in a different committee that it would allow police to capture “over-the-air or cell data that could be crucial to a criminal investigation.”

Privacy advocates worry that language in the new bill seems to loosen any restrictions on what information law enforcement may collect through these technologies.

“The proposed legislation broadens the surveillance powers of state and local law enforcement, allowing the government to gather a broad swath of ‘metadata’ about our phone and electronic communications,” Tim Muth, staff attorney at the American Civil Liberties Union (ACLU) of Wisconsin, said in an emailed statement to Wisconsin Examiner.

Metadata for a phone call can show days or times the call occurred, identifying information for the devices that sent or received the call or geolocation information for the phone, but not the content of the call. “Existing law authorizes court orders to install ‘pen registers’ and ‘trap and trace’ devices solely for the purpose of recording the phone numbers for incoming and outgoing calls received by a specific phone” that is under surveillance, said Muth, who was interviewed by email. The new law would allow capturing much more than phone numbers.”

That could lead to other forms of surveillance than it seems to indicate at face value, he adds. “This could be read to allow tracking the senders and recipients of a target’s email, instant messages, and chats (which are all ‘electronic communications’) as well as cell phone location data (which is ‘routing, addressing, or signaling’ information),’” said Muth.

Ben Levitan, a long-time telecommunications engineer and expert court witness for wiretap-related cases, said in an email to Wisconsin Examiner that allowing police to get these sorts of warrants in any county court could simplify a bureaucratic process. “Even I would support that,” Levitan said. But he has concerns that the bill doesn’t meet “technical requirements” of the 1994 Communications Assistance for Law Enforcement Act (CALEA).

That federal law requires telecommunications companies to design their facilities and products in such a way that they have “the necessary surveillance capabilities to comply with legal requests for information,” according to the Federal Communications Commissions’ website. By requiring companies to have capabilities to fulfill lawful orders for information, the law places those companies as a sort of middle-man in that process. In an interview in 2021 about the bill’s previous iteration in Wisconsin, Levitan said, “A judge’s order is an order on the cell phone company, not a license to go wiretap on your own.”

Levitan contrasted the federal law with the way technology worked in the days when phone service was transmitted over wires. The bill’s use of language such as “a device or process,” he said, “is a red flag.” Its reference to “installation” of a device is “an archaic term,” and the terms “pen register” and “trap and trace” are also archaic.

When phones used rotary dials, dialing a number would create a series of clicks that corresponded to the number being dialed. “If you are at the phone company, the wire from your house would come in and you would hear those clicks so the phone machine could dial your number,” said Levitan. “We would sit a policeman on the ground next to your wire. Every time someone dialed a number the policeman would hear the clicks and write the number of clicks on a piece of paper with a pen.”

Over time, both phones and the technologies used to track and intercept them have evolved.

“The point is that [the Wisconsin bill] gives green light to any ‘DEVICE,’” Levitan said. “This allows law enforcement to get permission to use a ‘device.’ CALEA only permits you to get an order to command the phone company to do that.” He added, “CALEA only commands the phone company to provide the data and leaves it to them to figure out how. This law gives permission for an outside party to install something, or use a stingray.”

“Stingray” was the brand name that Harris Corp. (now called L3 Harris) used for its cell site simulator technology, which mimics cell phone towers and tricks phones into connecting to the simulator rather than a legitimate tower and collects data in the process.

Cell site simulators are often used to track a phone’s location. They can also be used to capture information included in a pen register and, with the right software, the content of communications like calls or text messages.

The use of simulators has been shrouded in secrecy for decades, with information gradually coming to public light. Police departments at the local, state and federal levels have used these technologies.

In recent years, however, local police departments have had to turn away from Harris’s cell tracking gear. Companies like Tactical Support Equipment, which sold a new cell site simulator system to the Milwaukee Police Department in 2019, have stepped in for Harris.

Some of the same companies that have sold stingrays to law enforcement also made unsuccessful attempts to obtain controversial spyware technologies.

Levitan said language in the new bill that refers to facilities from which any electronic information or wire “is transmitted” could allow law enforcement to capture signals off cell towers. He also highlights a provision in the bill stating that a pen register or trap and trace could be installed by a service provider, landlord, as well as any “other person.”

Those two words fly against the spirit of the CALEA law, said Levitan, which includes cell phone service providers in the process. “The term instrument should never be in here,” he said.

“When we let police into the phone company to listen to wires, they stayed and listened to other people,” he said. “CALEA forbids the receiver of the wiretap to be in the phone company.”

Legislators “need to read CALEA and carefully,” Levitan added. “None of this is authorized in CALEA and is specifically forbidden in CALEA.”

Republican wiretap bill again raises concerns about privacy, overreach was originally published by the Wisconsin Examiner.