In re Application for Pen Register and Trap/Trace

• Citation: 396 F.Supp.2d 747
• Decision Date: 14 October 2005
• Docket Number: No. H-05-557M.,H-05-557M.
• Parties: In re APPLICATION FOR PEN REGISTER AND TRAP/TRACE DEVICE WITH CELL SITE LOCATION AUTHORITY
• Court: U.S. District Court — Southern District of Texas

396 F.Supp.2d 747

In re APPLICATION FOR PEN REGISTER AND TRAP/TRACE DEVICE WITH CELL SITE LOCATION AUTHORITY

No. H-05-557M.

United States District Court, S.D. Texas, Houston Division.

October 14, 2005.

Pen Register, Defendant, Pro se.

OPINION

STEPHEN WM. SMITH, United States Magistrate Judge.

As part of an ongoing criminal investigation, the government seeks a court order compelling a cell phone company to disclose records of a customer's cell phone use. Among the records sought is "cell site data," which reveals the user's physical location while the phone is turned on. By order dated September 2, 2005, the court granted the application in large part, authorizing the continued use of a pen register/trap and trace device and disclosure of certain customer records including historical cell site data. However, the order denied access to prospective cell site information, for reasons explained more fully in this opinion.

The underlying order and application have been sealed at the government's request, in order not to jeopardize the ongoing criminal investigation. This opinion will not be sealed, because it concerns a matter of statutory interpretation which does not hinge on the particulars of the underlying investigation. The issue explored here has serious implications for the balance between privacy and law enforcement, and is a matter of first impression in this circuit as well as most others.¹

Following its standard practice in this district, the government has combined its request for subscriber records with an application to install a pen register and trap/trace device on the target phone. Basically, a pen register is a device or process which records the telephone numbers of outgoing calls; the trap and trace device captures the telephone numbers of incoming calls. See 18 U.S.C. § 3127. Among the most commonly used law enforcement techniques,² a pen/trap order authorizes real-time electronic monitoring of a telephone user's calls (excluding content) for a limited duration, typically 60 days. Id. at § 3123(c).

To assist this monitoring effort, the government seeks access to subscriber records maintained by the phone company pursuant to 18 U.S.C. § 2703(c). Among the records sought is "the location of cell site/sector (physical address) at call origination (for outbound calling), call termination (for incoming calls), and, if reasonably available, during the progress of a call." Sealed Application, at ¶ 21. Also sought is information regarding the strength, angle, and timing of the caller's signal measured at two or more cell sites, as well as other system information such as a listing of all cell towers in the market area, switching technology, protocols, and network architecture. Armed with this information, collectively known as "cell site data," investigators are often able to locate suspects and fugitives. The application makes this purpose explicit in a paragraph/sentence of clumsy boilerplate:

[T]he device characteristics (such as model and capabilities), network characteristics (such as a provider's System and Base Identity listings, which are FCC assigned numbers used to identify providers and to subdivide their service markets, and communications protocol, e.g. GSM, CDMA, TDMA, or iDEN and Cellular vs. PCS service band), cell site listings (physical locations and numbering of towers), cell site activations and facings (when, and as, accessed by the Target Device), control channels and subchannels (the non-content communications signals that coordinate calls and help determine when a cell is switched or "handed-off"), signal strengths between the device and the cell site (used to estimate distance and determine when a cell site "hand-off" is necessary and possible), and other system information, when coupled with the subscriber records for all calls identified by the pen register and trap and trace device may provide the general geographic location of the Target Device and, thus, may allow investigators to identify a suspect's location.

Sealed Application, at ¶ 20.

The issue presented here is what legal standard the government must satisfy to compel disclosure of such prospective or "real-time" cell site data. More particularly, is this location information merely another form of subscriber record accessible upon a showing of "specific and articulable facts" under 18 U.S.C. § 2703(d), as the government contends? Or does this type of surveillance require a more exacting standard, such as probable cause under Federal Rule of Criminal Procedure 41?

1. Technology

Unavoidably, some familiarity with cell phone technology is necessary to address this issue. A cell phone is a sophisticated two-way radio with a low-power transmitter that operates in a network of cell sites.³ "Cell" refers to geographic regions often illustrated as hexagons, resembling a bee's honeycomb; a "cell site" is where the radio transceiver and base station controller are located (at the point three hexagons meet). Cell phones and base stations communicate with each other on frequencies called channels. Two frequencies are paired to create a channel; one for transmitting, one for receiving. Channels that carry only cell system data are called control channels. The control channel is a frequency shared by the phone and the base station to communicate information for setting up calls and channel changing when the user moves from one cell to another. By comparison, voice channels are those paired frequencies which handle a call's traffic, be it voice or data, as well as signaling information about the call itself. The cell site sends and receives traffic from the cell phones in its geographic area to a mobile telecommunications switching office, which handles all phone connections and controls all base stations in a given region.

When a cell phone is powered up, it acts as a scanning radio, searching through a list of control channels for the strongest signal. The cell phone re-scans every seven seconds or when the signal strength weakens, regardless of whether a call is placed. The cell phone searches for a five-digit number known as the System Identification Code assigned to service providers. After selecting a channel, the cell phone identifies itself by sending its programmed codes which identify the phone, the phone's owner, and the service provider. These codes include an Electronic Serial Number (a unique 32-bit number programmed into the phone by the manufacturer), and a Mobile Identification Number, a 10-digit number derived from the phone's number.

The cell site relays these codes to the mobile telecommunications switching office in a process known as registration. The registration process is explained in the Department of Justice's Electronic Surveillance Manual:

Cellular telephones that are powered on will automatically register or re-register with a cellular tower as the phone travels within the provider's service area. The registration process is the technical means by which the network identifies the subscriber, validates the account and determines where to route call traffic. This exchange occurs on a dedicated control channel that is clearly separate from that used for call content (i.e. audio) — which occurs on a separate dedicated channel.

U.S. Dep't of Justice, Electronic Surveillance Manual, at 178-79 n. 41 (rev. June 2005)⁴ (emphasis supplied).

It should be emphasized that cell site data transmitted during the registration process "are not dialed or otherwise controlled by the cellular telephone user." Id. at 40. This registration process automatically occurs even while the cell phone is idle. Moving from one service area to another triggers the registration process anew. The cell site can even initiate registration on its own by sending a signal to the cell phone causing the phone to transmit and identify itself.

When the switching office gets an incoming call, it sends a "page" to the cell phone over the control channel. When the cell phone responds, the switching office assigns a voice channel to carry the actual conversation; at that point the control channel drops off. The speaker's voice is converted into electronic digits (i.e. a series of 1s and 0s), which are then compressed for transmission over the voice channel.

In summary, a cell phone is (among other things) a radio transmitter that automatically announces its presence to a cell tower via a radio signal over a control channel which does not itself carry the human voice. By a process of triangulation from various cell towers, law enforcement is able to track the movements of the target phone, and hence locate a suspect using that phone.⁵

2. Statutes

The basic contours of electronic surveillance law were fixed by the Electronic Communications Privacy Act of 1986 ("ECPA"). Pub.L. No. 99-508, 100 Stat. 1848 (1986). The ECPA comprised three titles. Title I amended the 1968 federal wiretap statute⁶ to cover electronic communications. The Wiretap Act had imposed several additional requirements for lawful interception of a telephone conversation, beyond a judicial finding of probable cause: a wiretap is authorized only for specified crimes, for a limited duration, as a last resort, with minimized interception of innocent conversations, notice to targets, and extensive judicial oversight. See generally 18 U.S.C. § 2518. The ECPA amendments extended these restrictions to interception of electronic communications, with certain significant exceptions. This portion of the ECPA has no bearing on the issue before us, except to illustrate the full panoply of protections given to the content of private conversations under the Fourth Amendment; indeed, one commentator has referred to these wiretap requirements collectively as a form of "super-warrant." Orin S. Kerr, Internet Surveillance Law After the USA PATRIOT Act: The Big Brother That Isn't, 97 NW. U.L.REV. 607, 630 (Winter 2003).

Another portion of ECPA's Title I concerns mobile...