Requests for Information Under the Electronic Communications Privacy Act The Federal Bureau of Investigation may issue a national security letter to request, and a provider may disclose, only the four types of information—name, address, length of service, and local and long distance toll billing records—listed in 18 U.S.C. § 2709(b)(1). The term “local and long distance toll billing records” in section 2709(b)(1) extends to records that could be used to assess a charge for outgoing or incoming calls, whether or not the records are used for that purpose, and whether they are linked to a particular account or kept in aggregate form. Before issuance of a national security letter, a provider may not tell the FBI whether that provider serves a particular customer or telephone number, unless the FBI is asking only whether the number is assigned, or belongs, to that provider.
November 5, 2008
MEMORANDUM OPINION FOR THE GENERAL COUNSEL FEDERAL BUREAU OF INVESTIGATION
You have asked whether, under the Electronic Communications Privacy Act of 1986, Pub. L. No. 99-508, § 201, 100 Stat. 1848, 1860 (“ECPA”) (codified as amended at 18 U.S.C. § 2709 (2006)), the Federal Bureau of Investigation (“FBI”) may obtain certain types of information from communications providers. See Memorandum for Steven G. Bradbury, Principal Deputy Assistant Attorney General, Office of Legal Counsel, from Valerie Caproni, General Counsel, Federal Bureau of Investigation, Re: Electronic Communications Privacy Act (Aug. 28, 2007) (“FBI Memorandum”). Section 2709(b)(1) of ECPA enables the FBI to “request the name, address, length of service, and local and long distance toll billing records” of a subscriber, if that information may be “relevant to an authorized investigation to protect against international terrorism or clandestine intelligence activities, provided that such an investigation of a United States person is not conducted solely on the basis of activities protected by the first amendment to the Constitution of the United States.” The provider “shall comply” with such a request. 18 U.S.C. § 2709(a). In most other circumstances, ECPA prohibits the disclosure of a “record or other information pertaining to a subscriber to or customer of” a communications service. 18 U.S.C. § 2702(a)(3) (2006). In response to your specific questions, we conclude: (i) the FBI may issue a national security letter (“NSL”) to request, and a provider may disclose, only the four types of information—name, address, length of service, and local and long distance toll billing records—listed in section 2709(b)(1); (ii) the term “local and long distance toll billing records” in section 2709(b)(1) extends to records that could be used to assess a charge for outgoing or incoming calls, whether or not the records are used for that purpose, and whether they are linked to a particular account or kept in aggregate form; and (iii) before issuance of an NSL, a provider may not tell the FBI whether that provider serves a particular customer or
145 Opinions of the Office of Legal Counsel in Volume 32
telephone number, unless the FBI is asking only whether the number is assigned, or belongs, to that provider. 1
I.
Under 18 U.S.C. § 2709(a), a wire or electronic communications service pro- vider
shall comply with a request for subscriber information and toll bill- ing records information, or electronic communication transactional records in its custody or possession made by the Director of the Fed- eral Bureau of Investigation under subsection (b) of this section.
Section 2709(b)(1), in turn, enables the Director or his designee to
request the name, address, length of service, and local and long dis- tance toll billing records of a person or entity if the Director (or his designee) certifies in writing to the wire or electronic communication service provider to which the request is made that the name, address, length of service, and toll billing records sought are relevant to an authorized investigation to protect against international terrorism or clandestine intelligence activities, provided that such an investigation of a United States person is not conducted solely on the basis of ac- tivities protected by the first amendment to the Constitution of the United States.
You have asked whether the four types of information listed in subsection (b)(1)— the subscriber’s name, address, length of service, and local and long distance toll billing records—are exhaustive or merely illustrative of the information that the FBI may request and a provider may turn over. We conclude that the list in section 2709(b)(1) is exhaustive. 2
A.
We begin with the text of the statute. Limtiaco v. Camacho, 549 U.S. 483, 488 (2007). Section 2709(b) authorizes the FBI to request from a provider “the name, address, length of service, and local and long distance toll billing records of a person or entity.” By its express terms, subsection (a), which specifies the
1 We solicited and received the views of the National Security Division and the Criminal Division on these questions. 2 Although the same issue could arise under section 2709(b)(2), we refer to section 2709(b)(1) for convenience, because your question about “toll billing records,” to which we turn below, relates only to section 2709(b)(1).
146 Requests for Information Under the Electronic Communications Privacy Act
information that the provider is to disclose, reaches no further than the information that the FBI may request under subsection (b): subsection (a) requires a provider to comply with a request for “subscriber information and toll billing records infor- mation” made by the FBI “under subsection (b).” 18 U.S.C. § 2709(a) (emphasis added). Subsection (b) specifies the items for which the FBI may ask, and there is no indication that the list of items is illustrative. Cf. Burgess v. United States, 553 U.S. 124, 131 n.3 (2008) (examples where the word “includes” may enlarge the meaning of a definition beyond the terms in the list). The list—the name, address, length of service, and local and long distance toll billing records of a person or entity, see id. § 2709(b)(1)—thus sets the limits of what the FBI may request under section 2709, as well as what the provider may disclose under that provi- sion. The text of subsection (b) forecloses an interpretation that would add other types of information to the excepted categories. See Swierkiewicz v. Sorema N.A., 534 U.S. 506, 513 (2002) (applying the canon of expressio unius est exclusio alterius). 3 ECPA’s structure reinforces this conclusion. Section 2709 is an exception to the background rule of privacy established by 18 U.S.C. § 2702(a), which generally bars a provider from giving the Government a record or other infor- mation pertaining to a subscriber or customer. Here, the exceptions listed in section 2709(b)(1) specify some types of information—a subscriber’s name, address, length of service, and billing records—and not others. Other exceptions to the rule of privacy appear in section 2702(b), dealing with voluntary disclosures, and in section 2703, dealing with disclosures in response to subpoenas or warrants. We would not infer additional exceptions. See 2A Norman J. Singer, Statutes and Statutory Construction § 47.11, at 250–51 (6th ed. 2000) (“Where there is an express exception, it comprises the only limitation on the operation of the statute and no other exceptions will be implied. . . . [W]here a general provision in a
3 Subsection (a) also refers to “electronic communication transactional records” requested under subsection (b). In its current form, however, subsection (b) does not include this term. As originally enacted, subsection (b) did not specify the items of information that the FBI could request, but simply provided the means by which the FBI could ask for “any such information and records” as were described in subsection (a). Pub. L. No. 99-508, § 201, 100 Stat. 1848, 1867 (1986). When Congress in 1993 added to subsection (b) the specification of “name, address, length of service, and toll billing records,” it did not include “electronic communication transactional records” in that list. Pub. L. No. 103-142, 107 Stat. 1491 (1993). Nevertheless, the reference to “electronic communication transactional records” in subsection (a), along with the absence of the phrase in subsection (b), does not undermine the conclusion that the categories of information listed in subsection (b) are exclusive. As the committee report on the original enactment explained, the language about “electronic communication transactional records” gives the FBI “the necessary authority [to issue NSLs] with regard to subscriber information and toll billing information with respect to electronic communication services other than ordinary telephone service.” S. Rep. No. 99-541, at 44 (1986) (emphasis added). While clarifying that NSLs can extend to other types of services, therefore, the language reaches only those categories of information parallel to subscriber information and toll billing records for ordinary telephone service.
147 Opinions of the Office of Legal Counsel in Volume 32
statute has certain limited exceptions, all doubts should be resolved in favor of the general provision rather than the exceptions.”). 4 The FBI Memorandum suggests that, under basic principles of interpretation, the general term “subscriber information” should be construed in light of specific examples in the statute. FBI Memorandum at 3–4. According to the FBI Memo- randum, the term “subscriber information” in subsection (a) should encompass all information similar to the types specified in subsection (b), so that a provider could turn over, for example, a subscriber’s date of birth or social security number. Under the widely employed canon of statutory construction known as “ejusdem generis,” “where general words follow specific words in a statutory enumeration, the general words are construed to embrace only objects similar in nature to those objects enumerated by the preceding specific words.” Circuit City Stores v. Adams, 532 U.S. 105, 114–15 (2001) (internal quotation marks and citation omitted); see also Vanderbrook v. Unitrin Preferred Ins. Co., 495 F.3d 191, 219 (5th Cir. 2007) (noting that the ejusdem generis canon “is used to interpret general terms (e.g., ‘and the like’) following a list of specific terms”). The canon thus allows a list of specific terms to define and limit an otherwise ambiguous term within the same list. See, e.g., 2A Norman J. Singer, Statutes and Statutory Construction § 47.17, at 188 (5th ed. 1992). The FBI Memorandum, however, would rely on this canon to draw the reverse inference, by expanding the meaning of a general term (“subscriber information”) that appears outside the list of terms in section 2709(b) and in a separate subsection of the statute. Even if the text of section 2709(a) were unclear, the canon of ejusdem generis would offer little support for the argument that subsection (a) should be interpreted more broadly than subsection (b). In any event, because the text of subsection (a) shows that a provider is to supply only information requested under subsection (b), the canon of ejusdem generis does not apply. See, e.g., Tourdot v. Rockford Health Plans, Inc., 439 F.3d 351, 354 (7th Cir. 2006) (noting that the canon of ejusdem generis applies only where a statutory term is ambiguous, that it may not be used “both to create and to resolve [a statutory] ambiguity,” and that it “may not be used to defeat the obvious purpose or plain meaning of the text”).
B.
The FBI Memorandum also relies upon the legislative history of ECPA’s 1993 amendments to argue that, using NSLs, the FBI may seek and providers may
4 The conclusions in this memorandum apply only to disclosures under section 2709. We do not address other statutory provisions under which law enforcement officers may get information pertaining to electronic communications. See, e.g., 18 U.S.C. § 2702(b)(8), (c)(4) (authorizing disclo- sure of communications and customer records to governmental entities if the provider reasonably “believes that an emergency” involving “danger of death or serious physical injury to any person” justifies disclosure of the information); id. § 2703(a) (authorizing disclosure to a governmental entity of “the contents of a wire or electronic communication” pursuant to a warrant).
148 Requests for Information Under the Electronic Communications Privacy Act
disclose—as “subscriber information”—“any information kept by the communica- tions service provider for its own business purposes that identifies the subscriber,” not just the types of information listed in section 2709(b). FBI Memorandum at 5. In our view, the language of the provision is straightforward, and “[g]iven [a] straightforward statutory command, there is no reason to resort to legislative history.” United States v. Gonzales, 520 U.S. 1, 6 (1997). In any event, we believe that the legislative history accords with our conclusion. In a passage that the FBI Memorandum cites, the House Judiciary Committee Report for the 1993 amendments stated that “[t]he Committee intends . . . that the authority to obtain subscriber information . . . under section 2709 does not require communications service providers to create records which they do not maintain in the ordinary course of business.” H.R. Rep. No. 103-46, at 3 (1993), reprinted in 1993 U.S.C.C.A.N. 1913, 1915. While the legislative history of ECPA therefore suggests that the statute does not require a provider to “create” new records, it does not follow that the statute would authorize the FBI to seek, or the provider to disclose, any records simply because the provider has already created them in the ordinary course of business. The universe of records subject to an NSL is still restricted to the types listed in the statute. 5 Indeed, the 1993 amendments clarified and underscored the limitations on the scope of “subscriber information.” As the House Judiciary Committee Report explained, “[i]nstead of ‘subscriber information,’ the amendment here uses more specific terms: ‘name, address, length of service.’” H.R. Rep. No. 103-46, at 3, reprinted in 1993 U.S.C.C.A.N. at 1915 (emphasis added). More generally, the Report set the context of the amendments by declaring that “the national security letter is an extraordinary device” and that “[n]ew applications [for its use] are disfavored.” Id. at 3, reprinted in 1993 U.S.C.C.A.N. at 1914–15. Where Congress enlarged the FBI’s authority in the 1993 amendments, it placed careful limits on the new authority. It rejected one FBI proposal as “too broad” and substituted a narrower provision. See id. at 2, reprinted in 1993 U.S.C.C.A.N. at 1914. The Report, therefore, reinforces our construction of the text.
II.
Next, you have asked whether, under section 2709, the term “local and long distance toll billing records” includes records of incoming and outgoing calls upon which a charge could be assessed, whether or not a provider actually assesses a charge, and whether or not a provider maintains such records as aggregate data (as opposed to subscriber-specific data). We believe that the term includes records of individual calls identifying the telephone numbers called from a particular
5 We do not address whether the FBI must purge its files of any additional information given to it by communications providers.
149 Opinions of the Office of Legal Counsel in Volume 32
telephone number or attributed to a particular account, if maintained in the normal course of a provider’s business, whether or not the provider charges for each such call. In our view, moreover, section 2709 encompasses call records stored in aggregate form, even if they are not organized by customer accounts, provided that, as explained below, an NSL for such information is not unreasonably burdensome.
Section 2709(a) requires a provider, in response to an NSL, to supply “sub- scriber information and toll billing records information.” As we explained in part I, section 2709(b) specifies the “subscriber information and toll billing records information” that an NSL may demand and a provider may supply. This infor- mation consists of “the name, address, length of service, and local and long distance toll billing records of a person or entity.” In addition to “subscriber information,” therefore, an NSL may demand, and a provider must turn over, “toll billing records information,” consisting of “local and long distance toll billing records.” The “billing records” to which section 2709 refers could denote either records that are actually used for billing or records that could be used for that purpose. In the abstract, either meaning could be a natural use of language. For example, the phrase “running shoes” could mean either shoes actually used for running or those of a type making them suitable for that purpose, even if the owner only walks. We believe that the phrase “local and long distance toll billing records” covers records—including the caller’s number, the number dialed, and the duration of the call—that are suitable for billing, whether or not the provider imposes a per call “toll.” As originally enacted, section 2709(b) provided that the FBI could use NSLs to seek “toll billing records.” See 100 Stat. at 1867. In 1996, Congress amended the provision to read “local and long distance toll billing records.” See Intelligence Authorization Act for Fiscal Year 1997, Pub. L. No. 104-293, § 601, 110 Stat. 3461, 3469 (1996). The amendments clarified that billing records for local service, as specified in section 2709(b)(1), could be a type of “toll billing records infor- mation” that section 2709(a) directs a provider to turn over in response to an NSL. The reference in section 2709(b)(1) to billing records for “local” service, as a type of “toll billing records information” within section 2709(a), makes sense only if it encompasses records that are not actually used for billing customers, but are of a type that could be put to that use, because “local” service has traditionally been understood to be service for which the provider does not impose a per call “toll.” The terms “local” and “long distance toll” are well established terms in the communications industry. See, e.g., N.C. Utils. Comm’n v. FCC, 552 F.2d 1036, 1045 (4th Cir. 1977) (distinguishing local service from “‘toll,’ or long distance, service” and suggesting both are “term[s] of art”). Traditionally, local service has
150 Requests for Information Under the Electronic Communications Privacy Act
been identified and defined by the absence of per call charges, or “tolls.” See Newton’s Telecom Dictionary 488 (20th ed. 2004) (defining “local call” as one that “may or may not cost money. In many parts of the United States, the phone company bills its local service as a ‘flat’ monthly fee.”). By contrast, long distance service has been defined by the use of per call “toll” charges. See id. at 839 (defining “toll call” as “[a] long distance call”); see also Webster’s Third New International Dictionary 2405 (1993) (defining “toll” as “a charge for a long- distance telephone call”). Congress has distinguished between “local” and “long distance toll” calls on this basis for as long as the federal government has regulated the telecommunica- tions industry. In section 3 of the Communications Act of 1934, for example, Congress defined the term “telephone toll service” as “telephone service between stations in different exchange areas for which there is made a separate charge not included in contracts with subscribers for exchange service.” Act of June 19, 1934, ch. 652, § 3, 48 Stat. 1064, 1066 (codified at 47 U.S.C. § 153(s) (1934)) (emphasis added). Congress separately defined “telephone exchange service,” otherwise known as “local” service, as “service within a telephone exchange, or . . . within the same exchange area . . . and which is covered by the exchange service charge.” Id. § 3, 48 Stat. at 1066 (codified at 47 U.S.C. § 153(r) (1934)) (emphasis added). As the Federal Communications Commission explained in its rule implementing the AT&T consent decree, the definitions in the Communications Act “rel[y] primarily upon the non-toll or toll nature of a call to determine whether the call is a [local] or [long-distance] call.” See Memorandum Opinion, Order and Authori- zation, FCC 83-566, 96 F.C.C.2d 18, ¶ 17 n.24 (Dec. 23, 1983); see also Office- Max, Inc. v. United States, 428 F.3d 583, 596 (6th Cir. 2005) (explaining that before the divestiture of AT&T, all long distance calls were subject to tolls, which varied according to the duration of the call and the distance between the callers); Howard A. Shelanski, Adjusting Regulation to Competition: Toward a New Model for U.S. Telecommunications Policy, 24 Yale J. on Reg. 55, 59–60 (2007) (noting that before divestiture of its local assets, “AT&T charged flat monthly fees for local service, [but] it charged by the minute for long-distance service, and the [Federal Communications Commission] allowed AT&T to set long-distance rates well above cost for the purpose—at first implicit and later expressly stated—of providing profits AT&T could use to cross-subsidize local rates in support of universal service policies”). Even the tax code draws the distinction between “local” and “toll” calls. For example, the Excise Tax Reduction Act of 1965, Pub. L. No. 89-44, 79 Stat. 136, 145 (1965) (“ETRA”), amended the Internal Revenue Code to impose a three percent excise tax on, among other things, “local telephone service.” See 26 U.S.C. §§ 4251(b)(1)(A), 4252(a) (2006). Excluded from the definition of the term “local telephone service” was any “toll telephone service,” as defined in section 4252(b). See, e.g., Reese Bros., Inc. v. United States, 447 F.3d 229, 233 (3d Cir. 2006); W. Elec. Co. v. United States, 564 F.2d 53, 55 (Ct. Cl. 1977). “Toll tele-
151 Opinions of the Office of Legal Counsel in Volume 32
phone service” means, in relevant part, a “telephonic quality communication for which . . . there is a toll charge which varies in amount with the distance and elapsed transmission time of each individual communication.” 26 U.S.C. § 4252(b)(1)(A). 6 In view of this background, when Congress inserted the words “local and long distance” before “toll billing records” in section 2709(b)(1), it was not limiting ECPA to those local calls for which a provider imposes a per call “toll.” We presume that Congress understood the well-established distinction between “local” and “long distance toll” calls and knew that “local” service was frequently defined by the absence of a per call charge. See Standard Oil Co. v. United States, 221 U.S. 1, 59 (1911) (“[W]here words are employed in a statute which had at the time a well-known meaning at common law or in the law of this country they are presumed to have been used in that sense.”) (emphasis added); Felix Frankfurter, Some Reflections on the Reading of Statutes, 47 Colum. L. Rev. 527, 537 (1947) (“[I]f a word is obviously transplanted from another legal source, whether the common law or other legislation, it brings the old soil with it.”). Therefore, the reference to “billing records” for “local” service in section 2709(b)(1), as a type of “toll billing records information” that section 2709(a) requires a provider to turn over, is best read to cover records that could be used for per call billing, not only those that actually are used for that purpose. When Congress enacted the 1996 amendments, it was well known that provid- ers of telephone service might keep records of local calls from or attributable to particular numbers, even if they did not assess per call charges. Providers had long used pen registers, for example, to record all telephone numbers dialed from particular telephones, whether the calls were local or long distance. See, e.g., Smith v. Maryland, 442 U.S. 735, 749 (1979) (Marshall, J., dissenting) (emphasiz- ing that the Court’s conclusion hinges on the fact “that pen registers are regularly used for recording local calls”); Hodge v. Mountain States Tel. & Tel. Co., 555 F.2d 254, 266 (9th Cir. 1977) (Hufstedler, J., concurring) (emphasizing that pen registers collect records of local calls); In the Matter of Grand Jury Subpoenas to Southwestern Bell Mobile Systems, Inc., 894 F. Supp. 355, 358 (W.D. Mo. 1995) (“Southwestern Bell”) (holding the term “toll billing records” means “‘billing records and telephone toll records (including the record of long distance numbers
6 Congress acknowledged that telephone companies might choose not to impose per call charges for some “toll telephone service.” For example, ETRA defined “toll telephone service” as, among other things, “a [non-local] service which entitles the subscriber, upon payment of a periodic charge (determined as a flat amount or upon the basis of total elapsed transmission time), to the privilege of an unlimited number of telephonic communications.” 79 Stat. at 146 (emphasis added). See also Reese Bros., 447 F.3d at 233–34 (noting that before 1984, AT&T offered a type of “long-distance service[]” known as “Wide Area Telephone Service,” the bills for which “were based on a flat rate for unlimited calls”). As explained below, ECPA’s use of the term “long distance toll billing records” encompasses records of long distance calls, even if a telephone company uses “flat rate” (as opposed to per call) billing for long distance service.
152 Requests for Information Under the Electronic Communications Privacy Act
and message unit detailing information)’”) (quoting H.R. Rep. No. 99-647, at 69 (1986)); People v. Guerra, 478 N.E.2d 1319, 1321 (N.Y. 1985) (noting pen registers “provide a list of all numbers dialed, both local and long distance or toll calls,” and that such information is included in phone companies’ billing records). 7 The reference to “toll billing records” covers this type of information. The single occurrence of the words “billing records” in section 2709 applies to both “local” and “long distance toll” services. Because in the case of local service the phrase “billing records” covers records that could be used for billing, we would accord it the same meaning when the phrase applies to long distance service. Consequently, even if a provider does not impose per call charges for long distance service, we believe that the provider’s records, if suitable for billing, are subject to disclosure under an NSL. 8 The interpretation that “billing records” extends to records usable for billing, even if not actually used for that purpose, is supported by the limited judicial authority on the point and by the legislative history of the 1996 amendments. Before 1996, 18 U.S.C. § 2703 authorized law enforcement officials to subpoena a
7 See also United States v. N.Y. Tel. Co., 434 U.S. 159, 174–75 (1977) (noting that phone compa- nies use pen registers “for the purposes of checking billing operations,” among other things); United States v. Clegg, 509 F.2d 605, 608 & n.2 (5th Cir. 1975) (describing the “TTS 176” device, which “monitors the line to which it is attached and produces a paper tape record of the time and date of all outgoing telephone calls, local and long distance, complete and incomplete,” and which phone companies use “to show both that its billing procedures were bypassed and that completed calls were made”); United States v. Fithian, 452 F.2d 505, 506 (9th Cir. 1971) (noting that a phone company’s “business records necessarily must contain” the “records of calls from [a subscriber’s] residence”); cf. Reporters Comm. for Freedom of Press v. AT&T Co., 593 F.2d 1030, 1046 n.49 (D.C. Cir. 1978) (noting that “a telephone subscriber has no Fourth Amendment interest in local call records obtained by means of a pen register installed without his knowledge”). 8 The use of per call charges may be less prevalent today than in 1996, when Congress amended ECPA. Cellular phone customers typically do not incur per call charges for either local or long distance service, and cellular phone use has multiplied since 1996. See Statistical Abstract of the United States at 720 (U.S. Census Bureau, 2007) (noting that there were fewer than 34 million cellular phone subscribers in the United States in 1995, whereas there were almost 208 million in 2005 (the most recent year for which statistics are available)). Partly in response to the pricing strategies employed by cellular phone companies, other telecommunications providers have shifted to “flat rate billing.” See, e.g., Kathleen Q. Abernathy, Preserving Universal Service in the Age of IP, 3 J. Telecomm. & High Tech. L. 409, 412 (2005) (describing “the increasing prevalence of bundled service plans” as an “important trend” in the telecommunications industry). As then-FCC Commissioner Abernathy explained, “For years, wireless carriers have offered buckets of any-distance minutes at flat rates, and now wireline carriers are offering packages that include local and long distance for a single price. In addition, many carriers offer business customers bundles that include local and long distance voice services, Internet access, and customer premises equipment.” Id. (footnote omitted). The provision of telephone service over Internet connections—as opposed to traditional wireline or wireless technolo- gies—has further contributed to the decline in per call billing. See id.; see also Steven C. Judge, VoIP: A Proposal for a Regulatory Scheme, 12 Syracuse Sci. & Tech. L. Rep. 77 (2005) (“[I]nstead of paying a per minute charge for long distance calls, many [voice over internet protocol, or “VoIP”] providers provide a flat rate that includes both local- and long-distance calling.”). However providers may charge for such services, we conclude that ECPA covers any call record in a provider’s custody or possession that is suitable for billing.
153 Opinions of the Office of Legal Counsel in Volume 32
subscriber’s “telephone toll billing records” during the course of an official investigation. Similarly, 18 U.S.C. § 2709 enabled the Director of the FBI to use an NSL to obtain a subscriber’s “toll billing records” during the course of an authorized foreign counterintelligence investigation. The United States District Court for the Western District of Missouri held that the term “telephone toll billing records,” under section 2703, included
any record (except a record pertaining to the content of a conversa- tion) maintained by an electronic communication service provider identifying the telephone numbers called from a particular telephone number or attributed to a particular account for which a communica- tion service provider might charge a service fee. ‘Telephone toll bill- ing records’ covers all records maintained of individual calls made from a particular telephone number or attributed to it that are or could be the subject of a particularized charge depending on the bill- ing plan offered by the provider and accepted by the customer. In other words, a telephone toll billing record is broad enough to cover all records of calls from or attributed to a particular number, re- gardless of whether, in fact, a separate charge is assessed for each call.
Southwestern Bell, 894 F. Supp. at 359 (emphasis added). The court relied upon ECPA’s legislative history, which indicates that “‘toll billing records consist of information maintained by a wire or electronic communication service provider identifying the telephone numbers called from a particular phone or attributable to a particular account for which a communication service provider might charge a service fee.’” Id. at 358 (quoting 1993 U.S.C.C.A.N. at 1915). Accordingly, the court held that, even when a cellular phone subscriber had a monthly plan under which he did not pay a “toll” for any particular call, the record of every call he made, local or long distance, fell within the meaning of “telephone toll billing records” under section 2703. In 1996, Congress amended section 2703, as well as section 2709, to ratify the decision in Southwestern Bell. See Intelligence Authorization Act for Fiscal Year 1997, Pub. L. No. 104-293, § 601, 110 Stat. 3461, 3469 (1996). The 1996 amendments inserted the words “local and long distance” before the words “toll billing records” in both section 2703 and section 2709. Id. The Senate Report explained that the amendments “make clear . . . that the phrase [‘toll billing records’] applies to both local and long distance telephone toll billing records” in accordance with the decision in Southwestern Bell. S. Rep. No. 104-258, at 22 (1996), reprinted in 1996 U.S.C.C.A.N. 3945, 3967. The committee quoted the court’s holding that a provider must disclose “‘records that contain information which was used or could be used to charge for telephone calls or services.’” Id. (emphasis added).
154 Requests for Information Under the Electronic Communications Privacy Act
We therefore conclude that the term “local and long distance toll billing rec- ords” extends to records of individual calls identifying the telephone numbers called from a particular telephone number or attributed to a particular account, whether or not the provider charges individually for each such call. 9
Telecommunications providers generally maintain call data in one of two forms: call records linked to particular accounts (such as records of a given customer’s calls and associated charges), and aggregate records (such as records of all calls routed through a particular call center on a particular day). See, e.g., Ameritech Corp. v. McCann, 403 F.3d 908, 910 (7th Cir. 2005). The aggregate records are generally stored on “searchable media” that a carrier could cull to extract records of calls to or from a particular number. See id. The records culled in this way could be used to bill for the service to a particular number, although they are not typically used for this purpose. Because section 2709 covers records of calls for which a carrier could impose charges—even if the carrier does not actually do so—it does not matter whether the provider maintains those records in the form of billing statements that reflect actual per call charges on customers’ accounts. Under 18 U.S.C. § 2709(b)(1), an NSL may request “the name, address, length of service, and local and long distance toll billing records of a person or entity,” and the records of a subscriber’s calls are “records of [that] person or entity,” even if the calls of a particular subscriber are dispersed among the aggregate records of all calls going through a call center. Responding to the NSL, a provider must turn over any “local and long distance toll billing records” in its “custody or possession.” 18 U.S.C. § 2709(a). Even if a provider maintains its call data in aggregate form, the billing records are in the provider’s “custody or possession” and fall within section 2709. To comply with the NSL, therefore, the provider would have to extract the subscriber data from the aggregate records. This conclusion is consistent with the Seventh Circuit’s decision in McCann, which interpreted 18 U.S.C. § 2706 (2000). Under section 2706, governmental entities, state or federal, must compensate providers for complying with certain requests or demands for information other than NSLs, except when a request seeks “records or other information maintained by a communications common carrier
9 Whether the statute should be read to cover “local . . . billing records” or “local . . . toll billing records” would not affect our analysis. See S. Rep. No. 104-258, at 22, reprinted in 1996 U.S.C.C.A.N. 3945, 3967 (“This amendment is a clarification of the meaning of the phrase ‘telephone toll billing records’ as used in [sections] 2703 and 2709.”). In either case, the phrase is a more detailed formulation of “toll billing records” in section 2709(a). A provider can disclose information if it is a “toll” record of an incoming or outgoing call, as explained above. If the information is not such a “toll” record, the provider can disclose it only if it is “subscriber information”—the “name, address, and length of service” of the subscriber. See 18 U.S.C. § 2709(a), (b)(1).
155 Opinions of the Office of Legal Counsel in Volume 32
that relate to telephone toll records” and that request does not present an undue burden. In McCann, the court held that certain aggregate call data did not consti- tute such “records or other information” within the exception, because the provider did not “maintain” the data as sought there. 403 F.3d at 912 (characterizing the process of culling data as the “creat[ion]” of reports). The Department has questioned whether McCann was correctly decided. See U.S. Dep’t of Justice Ad Hoc Technology Working Group, 18 U.S.C. § 2706 (ECPA) Cost Reimbursement Guidance at 5 (May 25, 2005) (arguing that “there is a reasonably strong argument that Ameritech Corp. v. McCann’s interpretation of section 2706 is flawed”). Even if correct, McCann’s interpretation of section 2706 would not reach NSLs, which are issued under section 2709. The Seventh Circuit’s decision turned exclusively on the meaning of “maintain” in section 2706(c)—a term that does not appear in section 2709, compare id. § 2709(a) (referring to “records in [a carrier’s] custody or possession”)—and the court did not address the meaning of “telephone toll records,” let alone the meaning of “local and long distance toll billing records.” As the FBI Memorandum notes, some providers have argued that culling rec- ords of individual calls from aggregate call data amounts to the “creation” of a new record, in contravention of Southwestern Bell, as well as the House report upon which that decision relied. See FBI Memorandum at 9. The Southwestern Bell court emphasized, however, that a carrier may be asked to turn over all call records in the carrier’s custody, even if a particular customer does not choose a per call billing plan. 894 F. Supp. at 359. To be sure, the FBI may not be able to force a communications provider to alter its business practices and, for example, create and maintain records of per call usage. See id. at 358–59 (quoting and relying upon H. Rep. No. 103-46, 1993 U.S.C.C.A.N. 1913, 1915, which provides that “the authority to obtain subscriber information and toll billing records under § 2709 does not require communication service providers to create records which they do not maintain in the ordinary course of business”). But to the extent that a communications provider, in the ordinary course of business, collects information regarding the calls made to or from a particular account and could use that information for billing a customer, such information—however it is stored—falls within section 2709. At the same time, the FBI may not use section 2709 to demand that a telecom- munications provider cull data if the search would be unduly costly or burden- some. An NSL is, in effect, an administrative subpoena: it is an agency order requiring the production of specified information, issued as part of an investiga- tion. We would read section 2709 in light of the principle that, as the Supreme Court has held, the Fourth Amendment “in no way leaves a [firm] defenseless against an unreasonably burdensome administrative subpoena requiring the production of documents.” Donovan v. Lone Steer, Inc., 464 U.S. 408, 415 (1984). An administrative subpoena must be “‘sufficiently limited in scope, relevant in purpose, and specific in directive so that compliance will not be unreasonably burdensome.’” Id. (quoting See v. City of Seattle, 387 U.S. 541, 544 (1967)). In
156 Requests for Information Under the Electronic Communications Privacy Act
other contexts, ECPA deals with a possible undue burden by requiring the government to compensate the provider for the costs of the search. See 18 U.S.C. § 2706. Particularly because ECPA allows no such payment for complying with an NSL, we would construe section 2709 as not enabling the FBI to force a provider to cull data when it would be unduly costly or burdensome for the provider to do so. A provider would not have to comply with an unduly burdensome NSL. Therefore, any call record that a communications provider keeps in the regular course of business and could use for billing a subscriber falls within the scope of section 2709. As in the case of administrative subpoenas, however, an NSL may not be unreasonably burdensome. 10
III.
Finally, you have asked whether a provider, in answer to an oral request before service of an NSL, may tell the FBI whether a particular account exists. This information would be confined to whether a provider serves a particular subscriber or a particular phone number. We believe that ECPA ordinarily bars providers from complying with such requests. Section 2702(a)(3) states that “a provider of . . . electronic communication service to the public shall not knowingly divulge a record or other information pertaining to a subscriber to or customer of such service . . . to any governmental entity.” 18 U.S.C. § 2702(a)(3). That a subscriber receives services from a particular provider is “information pertaining to” the subscriber. Indeed, section 2709 lists the subscriber’s name among the types of “subscriber information” that an NSL can request. Therefore, when the FBI identifies a subscriber by name, section 2702(a)(3) forbids a provider from divulging the existence of that person’s or entity’s subscription with the provider. Although the question is far closer, we do not believe that this conclusion changes if the FBI identifies a phone number, rather than a customer’s name, where the FBI is asking whether the number has been given to a subscriber. The phrase “record or other information pertaining to a subscriber” is broad. The ordinary meaning of “pertaining,” in this phrase, would reach information that “relate[s] to” or “concern[s]” the subscriber, Black’s Law Dictionary 1165 (7th ed. 1999), or has “some connection with or relation to” him, Webster’s Third New International Dictionary 1688 (1993). The fact of a provider’s service to a given number constitutes “information pertaining to a subscriber,” because it indicates that the provider serves “a subscriber” (or, in some cases, each of several subscrib- ers) with that phone number. The information is associated with a particular subscriber, even if that subscriber’s name is unknown.
10 We express no view on what would constitute an unreasonably burdensome request.
157 Opinions of the Office of Legal Counsel in Volume 32
We do not believe that, for this analysis, it matters whether the information sought by the FBI has already been made public, unless the subscriber has given a consent broad enough to cover a response to the FBI’s request. An example of such consent would be the subscriber’s having a listed number. See 18 U.S.C. § 2702(c)(2). Without such consent, section 2702(a)(3), by its terms, bars a provider from supplying otherwise protected information, even if it has become public. Nor would it matter whether such information falls outside the category of “customer proprietary network information” under the Communications Act, so that its disclosure would not be unlawful under that statute. See 47 U.S.C. § 222(h) (2000). ECPA may forbid disclosure of particular information, even if the Communications Act does not. 11 Nevertheless, if the FBI asks only whether a number is among those assigned, or belonging, to the provider and not whether the provider has given it to a subscriber, we do not believe that the inquiry seeks “information pertaining to a subscriber.” A provider’s confirmation that a number is assigned, or belongs, to it would not reveal whether the number is being used by a subscriber.
DANIEL L. KOFFSKY Deputy Assistant Attorney General Office of Legal Counsel
11 A provider that does not serve a given individual or phone number would not appear to be revealing “information pertaining to a subscriber” by answering the FBI’s request in the negative. Nevertheless, once a provider has given this negative answer in one instance, a response of “no comment” in a later instance could have the effect of disclosing “information pertaining to a subscriber.” By entertaining the question at all, the provider would risk disclosing protected infor- mation.