Requests for Information Under the Electronic Communications Privacy Act ( 2008 )

Requests for Information Under the Electronic
Communications Privacy Act
The Federal Bureau of Investigation may issue a national security letter to request, and a provider may
disclose, only the four types of information—name, address, length of service, and local and long
distance toll billing records—listed in 18 U.S.C. § 2709(b)(1).
The term “local and long distance toll billing records” in section 2709(b)(1) extends to records that
could be used to assess a charge for outgoing or incoming calls, whether or not the records are used
for that purpose, and whether they are linked to a particular account or kept in aggregate form.
Before issuance of a national security letter, a provider may not tell the FBI whether that provider
serves a particular customer or telephone number, unless the FBI is asking only whether the number
is assigned, or belongs, to that provider.
November 5, 2008
MEMORANDUM OPINION FOR THE GENERAL COUNSEL
FEDERAL BUREAU OF INVESTIGATION
You have asked whether, under the Electronic Communications Privacy Act of
1986, Pub. L. No. 99-508, § 201, 100 Stat. 1848, 1860 (“ECPA”) (codified as
amended at 18 U.S.C. § 2709 (2006)), the Federal Bureau of Investigation (“FBI”)
may obtain certain types of information from communications providers. See
Memorandum for Steven G. Bradbury, Principal Deputy Assistant Attorney
General, Office of Legal Counsel, from Valerie Caproni, General Counsel, Federal
Bureau of Investigation, Re: Electronic Communications Privacy Act (Aug. 28,
2007) (“FBI Memorandum”). Section 2709(b)(1) of ECPA enables the FBI to
“request the name, address, length of service, and local and long distance toll
billing records” of a subscriber, if that information may be “relevant to an
authorized investigation to protect against international terrorism or clandestine
intelligence activities, provided that such an investigation of a United States
person is not conducted solely on the basis of activities protected by the first
amendment to the Constitution of the United States.” The provider “shall comply”
with such a request. 18 U.S.C. § 2709(a). In most other circumstances, ECPA
prohibits the disclosure of a “record or other information pertaining to a subscriber
to or customer of” a communications service. 18 U.S.C. § 2702(a)(3) (2006).
In response to your specific questions, we conclude: (i) the FBI may issue a
national security letter (“NSL”) to request, and a provider may disclose, only the
four types of information—name, address, length of service, and local and long
distance toll billing records—listed in section 2709(b)(1); (ii) the term “local and
long distance toll billing records” in section 2709(b)(1) extends to records that
could be used to assess a charge for outgoing or incoming calls, whether or not the
records are used for that purpose, and whether they are linked to a particular
account or kept in aggregate form; and (iii) before issuance of an NSL, a provider
may not tell the FBI whether that provider serves a particular customer or
145
Opinions of the Office of Legal Counsel in Volume 32
telephone number, unless the FBI is asking only whether the number is assigned,
or belongs, to that provider. 1
I.
Under 18 U.S.C. § 2709(a), a wire or electronic communications service pro-
vider
shall comply with a request for subscriber information and toll bill-
ing records information, or electronic communication transactional
records in its custody or possession made by the Director of the Fed-
eral Bureau of Investigation under subsection (b) of this section.
Section 2709(b)(1), in turn, enables the Director or his designee to
request the name, address, length of service, and local and long dis-
tance toll billing records of a person or entity if the Director (or his
designee) certifies in writing to the wire or electronic communication
service provider to which the request is made that the name, address,
length of service, and toll billing records sought are relevant to an
authorized investigation to protect against international terrorism or
clandestine intelligence activities, provided that such an investigation
of a United States person is not conducted solely on the basis of ac-
tivities protected by the first amendment to the Constitution of the
United States.
You have asked whether the four types of information listed in subsection (b)(1)—
the subscriber’s name, address, length of service, and local and long distance toll
billing records—are exhaustive or merely illustrative of the information that the
FBI may request and a provider may turn over. We conclude that the list in section
2709(b)(1) is exhaustive. 2
A.
We begin with the text of the statute. Limtiaco v. Camacho, 549 U.S. 483, 488
(2007). Section 2709(b) authorizes the FBI to request from a provider “the name,
address, length of service, and local and long distance toll billing records of a
person or entity.” By its express terms, subsection (a), which specifies the
1
We solicited and received the views of the National Security Division and the Criminal Division
on these questions.
2
Although the same issue could arise under section 2709(b)(2), we refer to section 2709(b)(1) for
convenience, because your question about “toll billing records,” to which we turn below, relates only to
section 2709(b)(1).
146
Requests for Information Under the Electronic Communications Privacy Act
information that the provider is to disclose, reaches no further than the information
that the FBI may request under subsection (b): subsection (a) requires a provider to
comply with a request for “subscriber information and toll billing records infor-
mation” made by the FBI “under subsection (b).” 18 U.S.C. § 2709(a) (emphasis
added). Subsection (b) specifies the items for which the FBI may ask, and there is
no indication that the list of items is illustrative. Cf. Burgess v. United States, 553
U.S. 124, 131 n.3 (2008) (examples where the word “includes” may enlarge the
meaning of a definition beyond the terms in the list). The list—the name, address,
length of service, and local and long distance toll billing records of a person or
entity, see id. § 2709(b)(1)—thus sets the limits of what the FBI may request
under section 2709, as well as what the provider may disclose under that provi-
sion. The text of subsection (b) forecloses an interpretation that would add other
types of information to the excepted categories. See Swierkiewicz v. Sorema N.A.,
534 U.S. 506, 513 (2002) (applying the canon of expressio unius est exclusio
alterius). 3
ECPA’s structure reinforces this conclusion. Section 2709 is an exception to
the background rule of privacy established by 18 U.S.C. § 2702(a), which
generally bars a provider from giving the Government a record or other infor-
mation pertaining to a subscriber or customer. Here, the exceptions listed in
section 2709(b)(1) specify some types of information—a subscriber’s name,
address, length of service, and billing records—and not others. Other exceptions to
the rule of privacy appear in section 2702(b), dealing with voluntary disclosures,
and in section 2703, dealing with disclosures in response to subpoenas or warrants.
We would not infer additional exceptions. See 2A Norman J. Singer, Statutes and
Statutory Construction § 47.11, at 250–51 (6th ed. 2000) (“Where there is an
express exception, it comprises the only limitation on the operation of the statute
and no other exceptions will be implied. . . . [W]here a general provision in a
3
Subsection (a) also refers to “electronic communication transactional records” requested under
subsection (b). In its current form, however, subsection (b) does not include this term. As originally
enacted, subsection (b) did not specify the items of information that the FBI could request, but simply
provided the means by which the FBI could ask for “any such information and records” as were
described in subsection (a). Pub. L. No. 99-508, § 201, 100 Stat. 1848, 1867 (1986). When Congress in
1993 added to subsection (b) the specification of “name, address, length of service, and toll billing
records,” it did not include “electronic communication transactional records” in that list. Pub. L. No.
103-142, 107 Stat. 1491 (1993). Nevertheless, the reference to “electronic communication transactional
records” in subsection (a), along with the absence of the phrase in subsection (b), does not undermine
the conclusion that the categories of information listed in subsection (b) are exclusive. As the
committee report on the original enactment explained, the language about “electronic communication
transactional records” gives the FBI “the necessary authority [to issue NSLs] with regard to subscriber
information and toll billing information with respect to electronic communication services other than
ordinary telephone service.” S. Rep. No. 99-541, at 44 (1986) (emphasis added). While clarifying that
NSLs can extend to other types of services, therefore, the language reaches only those categories of
information parallel to subscriber information and toll billing records for ordinary telephone service.
147
Opinions of the Office of Legal Counsel in Volume 32
statute has certain limited exceptions, all doubts should be resolved in favor of the
general provision rather than the exceptions.”). 4
The FBI Memorandum suggests that, under basic principles of interpretation,
the general term “subscriber information” should be construed in light of specific
examples in the statute. FBI Memorandum at 3–4. According to the FBI Memo-
randum, the term “subscriber information” in subsection (a) should encompass all
information similar to the types specified in subsection (b), so that a provider
could turn over, for example, a subscriber’s date of birth or social security number.
Under the widely employed canon of statutory construction known as “ejusdem
generis,” “where general words follow specific words in a statutory enumeration,
the general words are construed to embrace only objects similar in nature to those
objects enumerated by the preceding specific words.” Circuit City Stores v.
Adams, 532 U.S. 105, 114–15 (2001) (internal quotation marks and citation
omitted); see also Vanderbrook v. Unitrin Preferred Ins. Co., 495 F.3d 191, 219
(5th Cir. 2007) (noting that the ejusdem generis canon “is used to interpret general
terms (e.g., ‘and the like’) following a list of specific terms”). The canon thus
allows a list of specific terms to define and limit an otherwise ambiguous term
within the same list. See, e.g., 2A Norman J. Singer, Statutes and Statutory
Construction § 47.17, at 188 (5th ed. 1992). The FBI Memorandum, however,
would rely on this canon to draw the reverse inference, by expanding the meaning
of a general term (“subscriber information”) that appears outside the list of terms
in section 2709(b) and in a separate subsection of the statute. Even if the text of
section 2709(a) were unclear, the canon of ejusdem generis would offer little
support for the argument that subsection (a) should be interpreted more broadly
than subsection (b). In any event, because the text of subsection (a) shows that a
provider is to supply only information requested under subsection (b), the canon of
ejusdem generis does not apply. See, e.g., Tourdot v. Rockford Health Plans, Inc.,
439 F.3d 351, 354 (7th Cir. 2006) (noting that the canon of ejusdem generis
applies only where a statutory term is ambiguous, that it may not be used “both to
create and to resolve [a statutory] ambiguity,” and that it “may not be used to
defeat the obvious purpose or plain meaning of the text”).
B.
The FBI Memorandum also relies upon the legislative history of ECPA’s 1993
amendments to argue that, using NSLs, the FBI may seek and providers may
4
The conclusions in this memorandum apply only to disclosures under section 2709. We do not
address other statutory provisions under which law enforcement officers may get information
pertaining to electronic communications. See, e.g., 18 U.S.C. § 2702(b)(8), (c)(4) (authorizing disclo-
sure of communications and customer records to governmental entities if the provider reasonably
“believes that an emergency” involving “danger of death or serious physical injury to any person”
justifies disclosure of the information); id. § 2703(a) (authorizing disclosure to a governmental entity of
“the contents of a wire or electronic communication” pursuant to a warrant).
148
Requests for Information Under the Electronic Communications Privacy Act
disclose—as “subscriber information”—“any information kept by the communica-
tions service provider for its own business purposes that identifies the subscriber,”
not just the types of information listed in section 2709(b). FBI Memorandum at 5.
In our view, the language of the provision is straightforward, and “[g]iven [a]
straightforward statutory command, there is no reason to resort to legislative
history.” United States v. Gonzales, 520 U.S. 1, 6 (1997). In any event, we believe
that the legislative history accords with our conclusion.
In a passage that the FBI Memorandum cites, the House Judiciary Committee
Report for the 1993 amendments stated that “[t]he Committee intends . . . that the
authority to obtain subscriber information . . . under section 2709 does not require
communications service providers to create records which they do not maintain in
the ordinary course of business.” H.R. Rep. No. 103-46, at 3 (1993), reprinted in
1993 U.S.C.C.A.N. 1913, 1915. While the legislative history of ECPA therefore
suggests that the statute does not require a provider to “create” new records, it
does not follow that the statute would authorize the FBI to seek, or the provider to
disclose, any records simply because the provider has already created them in the
ordinary course of business. The universe of records subject to an NSL is still
restricted to the types listed in the statute. 5
Indeed, the 1993 amendments clarified and underscored the limitations on the
scope of “subscriber information.” As the House Judiciary Committee Report
explained, “[i]nstead of ‘subscriber information,’ the amendment here uses more
specific terms: ‘name, address, length of service.’” H.R. Rep. No. 103-46, at 3,
reprinted in 1993 U.S.C.C.A.N. at 1915 (emphasis added). More generally, the
Report set the context of the amendments by declaring that “the national security
letter is an extraordinary device” and that “[n]ew applications [for its use] are
disfavored.” Id. at 3, reprinted in 1993 U.S.C.C.A.N. at 1914–15. Where Congress
enlarged the FBI’s authority in the 1993 amendments, it placed careful limits on
the new authority. It rejected one FBI proposal as “too broad” and substituted a
narrower provision. See id. at 2, reprinted in 1993 U.S.C.C.A.N. at 1914. The
Report, therefore, reinforces our construction of the text.
II.
Next, you have asked whether, under section 2709, the term “local and long
distance toll billing records” includes records of incoming and outgoing calls upon
which a charge could be assessed, whether or not a provider actually assesses a
charge, and whether or not a provider maintains such records as aggregate data (as
opposed to subscriber-specific data). We believe that the term includes records of
individual calls identifying the telephone numbers called from a particular
5
We do not address whether the FBI must purge its files of any additional information given to it
by communications providers.
149
Opinions of the Office of Legal Counsel in Volume 32
telephone number or attributed to a particular account, if maintained in the normal
course of a provider’s business, whether or not the provider charges for each such
call. In our view, moreover, section 2709 encompasses call records stored in
aggregate form, even if they are not organized by customer accounts, provided
that, as explained below, an NSL for such information is not unreasonably
burdensome.
A.
Section 2709(a) requires a provider, in response to an NSL, to supply “sub-
scriber information and toll billing records information.” As we explained in part
I, section 2709(b) specifies the “subscriber information and toll billing records
information” that an NSL may demand and a provider may supply. This infor-
mation consists of “the name, address, length of service, and local and long
distance toll billing records of a person or entity.” In addition to “subscriber
information,” therefore, an NSL may demand, and a provider must turn over, “toll
billing records information,” consisting of “local and long distance toll billing
records.”
The “billing records” to which section 2709 refers could denote either records
that are actually used for billing or records that could be used for that purpose. In
the abstract, either meaning could be a natural use of language. For example, the
phrase “running shoes” could mean either shoes actually used for running or those
of a type making them suitable for that purpose, even if the owner only walks. We
believe that the phrase “local and long distance toll billing records” covers
records—including the caller’s number, the number dialed, and the duration of the
call—that are suitable for billing, whether or not the provider imposes a per call
“toll.”
As originally enacted, section 2709(b) provided that the FBI could use NSLs to
seek “toll billing records.” See 100 Stat. at 1867. In 1996, Congress amended the
provision to read “local and long distance toll billing records.” See Intelligence
Authorization Act for Fiscal Year 1997, Pub. L. No. 104-293, § 601, 110 Stat.
3461, 3469 (1996). The amendments clarified that billing records for local service,
as specified in section 2709(b)(1), could be a type of “toll billing records infor-
mation” that section 2709(a) directs a provider to turn over in response to an NSL.
The reference in section 2709(b)(1) to billing records for “local” service, as a type
of “toll billing records information” within section 2709(a), makes sense only if it
encompasses records that are not actually used for billing customers, but are of a
type that could be put to that use, because “local” service has traditionally been
understood to be service for which the provider does not impose a per call “toll.”
The terms “local” and “long distance toll” are well established terms in the
communications industry. See, e.g., N.C. Utils. Comm’n v. FCC, 552 F.2d 1036,
1045 (4th Cir. 1977) (distinguishing local service from “‘toll,’ or long distance,
service” and suggesting both are “term[s] of art”). Traditionally, local service has
150
Requests for Information Under the Electronic Communications Privacy Act
been identified and defined by the absence of per call charges, or “tolls.” See
Newton’s Telecom Dictionary 488 (20th ed. 2004) (defining “local call” as one
that “may or may not cost money. In many parts of the United States, the phone
company bills its local service as a ‘flat’ monthly fee.”). By contrast, long distance
service has been defined by the use of per call “toll” charges. See id. at 839
(defining “toll call” as “[a] long distance call”); see also Webster’s Third New
International Dictionary 2405 (1993) (defining “toll” as “a charge for a long-
distance telephone call”).
Congress has distinguished between “local” and “long distance toll” calls on
this basis for as long as the federal government has regulated the telecommunica-
tions industry. In section 3 of the Communications Act of 1934, for example,
Congress defined the term “telephone toll service” as “telephone service between
stations in different exchange areas for which there is made a separate charge not
included in contracts with subscribers for exchange service.” Act of June 19, 1934,
ch. 652, § 3, 48 Stat. 1064, 1066 (codified at 47 U.S.C. § 153(s) (1934)) (emphasis
added). Congress separately defined “telephone exchange service,” otherwise
known as “local” service, as “service within a telephone exchange, or . . . within
the same exchange area . . . and which is covered by the exchange service charge.”
Id. § 3, 48 Stat. at 1066 (codified at 47 U.S.C. § 153(r) (1934)) (emphasis added).
As the Federal Communications Commission explained in its rule implementing
the AT&T consent decree, the definitions in the Communications Act “rel[y]
primarily upon the non-toll or toll nature of a call to determine whether the call is
a [local] or [long-distance] call.” See Memorandum Opinion, Order and Authori-
zation, FCC 83-566, 96 F.C.C.2d 18, ¶ 17 n.24 (Dec. 23, 1983); see also Office-
Max, Inc. v. United States, 428 F.3d 583, 596 (6th Cir. 2005) (explaining that
before the divestiture of AT&T, all long distance calls were subject to tolls, which
varied according to the duration of the call and the distance between the callers);
Howard A. Shelanski, Adjusting Regulation to Competition: Toward a New Model
for U.S. Telecommunications Policy, 24 Yale J. on Reg. 55, 59–60 (2007) (noting
that before divestiture of its local assets, “AT&T charged flat monthly fees for
local service, [but] it charged by the minute for long-distance service, and the
[Federal Communications Commission] allowed AT&T to set long-distance rates
well above cost for the purpose—at first implicit and later expressly stated—of
providing profits AT&T could use to cross-subsidize local rates in support of
universal service policies”).
Even the tax code draws the distinction between “local” and “toll” calls. For
example, the Excise Tax Reduction Act of 1965, Pub. L. No. 89-44, 79 Stat. 136,
145 (1965) (“ETRA”), amended the Internal Revenue Code to impose a three
percent excise tax on, among other things, “local telephone service.” See 26
U.S.C. §§ 4251(b)(1)(A), 4252(a) (2006). Excluded from the definition of the term
“local telephone service” was any “toll telephone service,” as defined in section
4252(b). See, e.g., Reese Bros., Inc. v. United States, 447 F.3d 229, 233 (3d Cir.
2006); W. Elec. Co. v. United States, 564 F.2d 53, 55 (Ct. Cl. 1977). “Toll tele-
151
Opinions of the Office of Legal Counsel in Volume 32
phone service” means, in relevant part, a “telephonic quality communication for
which . . . there is a toll charge which varies in amount with the distance and
elapsed transmission time of each individual communication.” 26 U.S.C.
§ 4252(b)(1)(A). 6
In view of this background, when Congress inserted the words “local and long
distance” before “toll billing records” in section 2709(b)(1), it was not limiting
ECPA to those local calls for which a provider imposes a per call “toll.” We
presume that Congress understood the well-established distinction between “local”
and “long distance toll” calls and knew that “local” service was frequently defined
by the absence of a per call charge. See Standard Oil Co. v. United States, 221
U.S. 1, 59 (1911) (“[W]here words are employed in a statute which had at the time
a well-known meaning at common law or in the law of this country they are
presumed to have been used in that sense.”) (emphasis added); Felix Frankfurter,
Some Reflections on the Reading of Statutes, 47 Colum. L. Rev. 527, 537 (1947)
(“[I]f a word is obviously transplanted from another legal source, whether the
common law or other legislation, it brings the old soil with it.”). Therefore, the
reference to “billing records” for “local” service in section 2709(b)(1), as a type of
“toll billing records information” that section 2709(a) requires a provider to turn
over, is best read to cover records that could be used for per call billing, not only
those that actually are used for that purpose.
When Congress enacted the 1996 amendments, it was well known that provid-
ers of telephone service might keep records of local calls from or attributable to
particular numbers, even if they did not assess per call charges. Providers had long
used pen registers, for example, to record all telephone numbers dialed from
particular telephones, whether the calls were local or long distance. See, e.g.,
Smith v. Maryland, 442 U.S. 735, 749 (1979) (Marshall, J., dissenting) (emphasiz-
ing that the Court’s conclusion hinges on the fact “that pen registers are regularly
used for recording local calls”); Hodge v. Mountain States Tel. & Tel. Co., 555
F.2d 254, 266 (9th Cir. 1977) (Hufstedler, J., concurring) (emphasizing that pen
registers collect records of local calls); In the Matter of Grand Jury Subpoenas to
Southwestern Bell Mobile Systems, Inc., 894 F. Supp. 355, 358 (W.D. Mo. 1995)
(“Southwestern Bell”) (holding the term “toll billing records” means “‘billing
records and telephone toll records (including the record of long distance numbers
6
Congress acknowledged that telephone companies might choose not to impose per call charges for
some “toll telephone service.” For example, ETRA defined “toll telephone service” as, among other
things, “a [non-local] service which entitles the subscriber, upon payment of a periodic charge
(determined as a flat amount or upon the basis of total elapsed transmission time), to the privilege of an
unlimited number of telephonic communications.” 79 Stat. at 146 (emphasis added). See also Reese
Bros., 447 F.3d at 233–34 (noting that before 1984, AT&T offered a type of “long-distance service[]”
known as “Wide Area Telephone Service,” the bills for which “were based on a flat rate for unlimited
calls”). As explained below, ECPA’s use of the term “long distance toll billing records” encompasses
records of long distance calls, even if a telephone company uses “flat rate” (as opposed to per call)
billing for long distance service.
152
Requests for Information Under the Electronic Communications Privacy Act
and message unit detailing information)’”) (quoting H.R. Rep. No. 99-647, at 69
(1986)); People v. Guerra, 478 N.E.2d 1319, 1321 (N.Y. 1985) (noting pen
registers “provide a list of all numbers dialed, both local and long distance or toll
calls,” and that such information is included in phone companies’ billing records). 7
The reference to “toll billing records” covers this type of information.
The single occurrence of the words “billing records” in section 2709 applies to
both “local” and “long distance toll” services. Because in the case of local service
the phrase “billing records” covers records that could be used for billing, we
would accord it the same meaning when the phrase applies to long distance
service. Consequently, even if a provider does not impose per call charges for long
distance service, we believe that the provider’s records, if suitable for billing, are
subject to disclosure under an NSL. 8
The interpretation that “billing records” extends to records usable for billing,
even if not actually used for that purpose, is supported by the limited judicial
authority on the point and by the legislative history of the 1996 amendments.
Before 1996, 18 U.S.C. § 2703 authorized law enforcement officials to subpoena a
7
See also United States v. N.Y. Tel. Co., 434 U.S. 159, 174–75 (1977) (noting that phone compa-
nies use pen registers “for the purposes of checking billing operations,” among other things); United
States v. Clegg, 509 F.2d 605, 608 & n.2 (5th Cir. 1975) (describing the “TTS 176” device, which
“monitors the line to which it is attached and produces a paper tape record of the time and date of all
outgoing telephone calls, local and long distance, complete and incomplete,” and which phone
companies use “to show both that its billing procedures were bypassed and that completed calls were
made”); United States v. Fithian, 452 F.2d 505, 506 (9th Cir. 1971) (noting that a phone company’s
“business records necessarily must contain” the “records of calls from [a subscriber’s] residence”); cf.
Reporters Comm. for Freedom of Press v. AT&T Co., 593 F.2d 1030, 1046 n.49 (D.C. Cir. 1978)
(noting that “a telephone subscriber has no Fourth Amendment interest in local call records obtained by
means of a pen register installed without his knowledge”).
8
The use of per call charges may be less prevalent today than in 1996, when Congress amended
ECPA. Cellular phone customers typically do not incur per call charges for either local or long distance
service, and cellular phone use has multiplied since 1996. See Statistical Abstract of the United States
at 720 (U.S. Census Bureau, 2007) (noting that there were fewer than 34 million cellular phone
subscribers in the United States in 1995, whereas there were almost 208 million in 2005 (the most
recent year for which statistics are available)). Partly in response to the pricing strategies employed by
cellular phone companies, other telecommunications providers have shifted to “flat rate billing.” See,
e.g., Kathleen Q. Abernathy, Preserving Universal Service in the Age of IP, 3 J. Telecomm. & High
Tech. L. 409, 412 (2005) (describing “the increasing prevalence of bundled service plans” as an
“important trend” in the telecommunications industry). As then-FCC Commissioner Abernathy
explained, “For years, wireless carriers have offered buckets of any-distance minutes at flat rates, and
now wireline carriers are offering packages that include local and long distance for a single price. In
addition, many carriers offer business customers bundles that include local and long distance voice
services, Internet access, and customer premises equipment.” Id. (footnote omitted). The provision of
telephone service over Internet connections—as opposed to traditional wireline or wireless technolo-
gies—has further contributed to the decline in per call billing. See id.; see also Steven C. Judge, VoIP:
A Proposal for a Regulatory Scheme, 12 Syracuse Sci. & Tech. L. Rep. 77 (2005) (“[I]nstead of paying
a per minute charge for long distance calls, many [voice over internet protocol, or “VoIP”] providers
provide a flat rate that includes both local- and long-distance calling.”). However providers may charge
for such services, we conclude that ECPA covers any call record in a provider’s custody or possession
that is suitable for billing.
153
Opinions of the Office of Legal Counsel in Volume 32
subscriber’s “telephone toll billing records” during the course of an official
investigation. Similarly, 18 U.S.C. § 2709 enabled the Director of the FBI to use
an NSL to obtain a subscriber’s “toll billing records” during the course of an
authorized foreign counterintelligence investigation. The United States District
Court for the Western District of Missouri held that the term “telephone toll billing
records,” under section 2703, included
any record (except a record pertaining to the content of a conversa-
tion) maintained by an electronic communication service provider
identifying the telephone numbers called from a particular telephone
number or attributed to a particular account for which a communica-
tion service provider might charge a service fee. ‘Telephone toll bill-
ing records’ covers all records maintained of individual calls made
from a particular telephone number or attributed to it that are or
could be the subject of a particularized charge depending on the bill-
ing plan offered by the provider and accepted by the customer. In
other words, a telephone toll billing record is broad enough to cover
all records of calls from or attributed to a particular number, re-
gardless of whether, in fact, a separate charge is assessed for each
call.
Southwestern Bell, 894 F. Supp. at 359 (emphasis added). The court relied upon
ECPA’s legislative history, which indicates that “‘toll billing records consist of
information maintained by a wire or electronic communication service provider
identifying the telephone numbers called from a particular phone or attributable to
a particular account for which a communication service provider might charge a
service fee.’” Id. at 358 (quoting 1993 U.S.C.C.A.N. at 1915). Accordingly, the
court held that, even when a cellular phone subscriber had a monthly plan under
which he did not pay a “toll” for any particular call, the record of every call he
made, local or long distance, fell within the meaning of “telephone toll billing
records” under section 2703.
In 1996, Congress amended section 2703, as well as section 2709, to ratify the
decision in Southwestern Bell. See Intelligence Authorization Act for Fiscal Year
1997, Pub. L. No. 104-293, § 601, 110 Stat. 3461, 3469 (1996). The 1996
amendments inserted the words “local and long distance” before the words “toll
billing records” in both section 2703 and section 2709. Id. The Senate Report
explained that the amendments “make clear . . . that the phrase [‘toll billing
records’] applies to both local and long distance telephone toll billing records” in
accordance with the decision in Southwestern Bell. S. Rep. No. 104-258, at 22
(1996), reprinted in 1996 U.S.C.C.A.N. 3945, 3967. The committee quoted the
court’s holding that a provider must disclose “‘records that contain information
which was used or could be used to charge for telephone calls or services.’” Id.
(emphasis added).
154
Requests for Information Under the Electronic Communications Privacy Act
We therefore conclude that the term “local and long distance toll billing rec-
ords” extends to records of individual calls identifying the telephone numbers
called from a particular telephone number or attributed to a particular account,
whether or not the provider charges individually for each such call. 9
B.
Telecommunications providers generally maintain call data in one of two
forms: call records linked to particular accounts (such as records of a given
customer’s calls and associated charges), and aggregate records (such as records of
all calls routed through a particular call center on a particular day). See, e.g.,
Ameritech Corp. v. McCann, 403 F.3d 908, 910 (7th Cir. 2005). The aggregate
records are generally stored on “searchable media” that a carrier could cull to
extract records of calls to or from a particular number. See id. The records culled
in this way could be used to bill for the service to a particular number, although
they are not typically used for this purpose.
Because section 2709 covers records of calls for which a carrier could impose
charges—even if the carrier does not actually do so—it does not matter whether
the provider maintains those records in the form of billing statements that reflect
actual per call charges on customers’ accounts. Under 18 U.S.C. § 2709(b)(1), an
NSL may request “the name, address, length of service, and local and long
distance toll billing records of a person or entity,” and the records of a subscriber’s
calls are “records of [that] person or entity,” even if the calls of a particular
subscriber are dispersed among the aggregate records of all calls going through a
call center. Responding to the NSL, a provider must turn over any “local and long
distance toll billing records” in its “custody or possession.” 18 U.S.C. § 2709(a).
Even if a provider maintains its call data in aggregate form, the billing records are
in the provider’s “custody or possession” and fall within section 2709. To comply
with the NSL, therefore, the provider would have to extract the subscriber data
from the aggregate records.
This conclusion is consistent with the Seventh Circuit’s decision in McCann,
which interpreted 18 U.S.C. § 2706 (2000). Under section 2706, governmental
entities, state or federal, must compensate providers for complying with certain
requests or demands for information other than NSLs, except when a request seeks
“records or other information maintained by a communications common carrier
9
Whether the statute should be read to cover “local . . . billing records” or “local . . . toll billing
records” would not affect our analysis. See S. Rep. No. 104-258, at 22, reprinted in 1996 U.S.C.C.A.N.
3945, 3967 (“This amendment is a clarification of the meaning of the phrase ‘telephone toll billing
records’ as used in [sections] 2703 and 2709.”). In either case, the phrase is a more detailed formulation
of “toll billing records” in section 2709(a). A provider can disclose information if it is a “toll” record of
an incoming or outgoing call, as explained above. If the information is not such a “toll” record, the
provider can disclose it only if it is “subscriber information”—the “name, address, and length of
service” of the subscriber. See 18 U.S.C. § 2709(a), (b)(1).
155
Opinions of the Office of Legal Counsel in Volume 32
that relate to telephone toll records” and that request does not present an undue
burden. In McCann, the court held that certain aggregate call data did not consti-
tute such “records or other information” within the exception, because the provider
did not “maintain” the data as sought there. 403 F.3d at 912 (characterizing the
process of culling data as the “creat[ion]” of reports). The Department has
questioned whether McCann was correctly decided. See U.S. Dep’t of Justice Ad
Hoc Technology Working Group, 18 U.S.C. § 2706 (ECPA) Cost Reimbursement
Guidance at 5 (May 25, 2005) (arguing that “there is a reasonably strong argument
that Ameritech Corp. v. McCann’s interpretation of section 2706 is flawed”). Even
if correct, McCann’s interpretation of section 2706 would not reach NSLs, which
are issued under section 2709. The Seventh Circuit’s decision turned exclusively
on the meaning of “maintain” in section 2706(c)—a term that does not appear in
section 2709, compare id. § 2709(a) (referring to “records in [a carrier’s] custody
or possession”)—and the court did not address the meaning of “telephone toll
records,” let alone the meaning of “local and long distance toll billing records.”
As the FBI Memorandum notes, some providers have argued that culling rec-
ords of individual calls from aggregate call data amounts to the “creation” of a
new record, in contravention of Southwestern Bell, as well as the House report
upon which that decision relied. See FBI Memorandum at 9. The Southwestern
Bell court emphasized, however, that a carrier may be asked to turn over all call
records in the carrier’s custody, even if a particular customer does not choose a per
call billing plan. 894 F. Supp. at 359. To be sure, the FBI may not be able to force
a communications provider to alter its business practices and, for example, create
and maintain records of per call usage. See id. at 358–59 (quoting and relying
upon H. Rep. No. 103-46, 1993 U.S.C.C.A.N. 1913, 1915, which provides that
“the authority to obtain subscriber information and toll billing records under
§ 2709 does not require communication service providers to create records which
they do not maintain in the ordinary course of business”). But to the extent that a
communications provider, in the ordinary course of business, collects information
regarding the calls made to or from a particular account and could use that
information for billing a customer, such information—however it is stored—falls
within section 2709.
At the same time, the FBI may not use section 2709 to demand that a telecom-
munications provider cull data if the search would be unduly costly or burden-
some. An NSL is, in effect, an administrative subpoena: it is an agency order
requiring the production of specified information, issued as part of an investiga-
tion. We would read section 2709 in light of the principle that, as the Supreme
Court has held, the Fourth Amendment “in no way leaves a [firm] defenseless
against an unreasonably burdensome administrative subpoena requiring the
production of documents.” Donovan v. Lone Steer, Inc., 464 U.S. 408, 415 (1984).
An administrative subpoena must be “‘sufficiently limited in scope, relevant in
purpose, and specific in directive so that compliance will not be unreasonably
burdensome.’” Id. (quoting See v. City of Seattle, 387 U.S. 541, 544 (1967)). In
156
Requests for Information Under the Electronic Communications Privacy Act
other contexts, ECPA deals with a possible undue burden by requiring the
government to compensate the provider for the costs of the search. See 18 U.S.C.
§ 2706. Particularly because ECPA allows no such payment for complying with an
NSL, we would construe section 2709 as not enabling the FBI to force a provider
to cull data when it would be unduly costly or burdensome for the provider to do
so. A provider would not have to comply with an unduly burdensome NSL.
Therefore, any call record that a communications provider keeps in the regular
course of business and could use for billing a subscriber falls within the scope of
section 2709. As in the case of administrative subpoenas, however, an NSL may
not be unreasonably burdensome. 10
III.
Finally, you have asked whether a provider, in answer to an oral request before
service of an NSL, may tell the FBI whether a particular account exists. This
information would be confined to whether a provider serves a particular subscriber
or a particular phone number. We believe that ECPA ordinarily bars providers
from complying with such requests.
Section 2702(a)(3) states that “a provider of . . . electronic communication
service to the public shall not knowingly divulge a record or other information
pertaining to a subscriber to or customer of such service . . . to any governmental
entity.” 18 U.S.C. § 2702(a)(3). That a subscriber receives services from a
particular provider is “information pertaining to” the subscriber. Indeed, section
2709 lists the subscriber’s name among the types of “subscriber information” that
an NSL can request. Therefore, when the FBI identifies a subscriber by name,
section 2702(a)(3) forbids a provider from divulging the existence of that person’s
or entity’s subscription with the provider.
Although the question is far closer, we do not believe that this conclusion
changes if the FBI identifies a phone number, rather than a customer’s name,
where the FBI is asking whether the number has been given to a subscriber. The
phrase “record or other information pertaining to a subscriber” is broad. The
ordinary meaning of “pertaining,” in this phrase, would reach information that
“relate[s] to” or “concern[s]” the subscriber, Black’s Law Dictionary 1165 (7th ed.
1999), or has “some connection with or relation to” him, Webster’s Third New
International Dictionary 1688 (1993). The fact of a provider’s service to a given
number constitutes “information pertaining to a subscriber,” because it indicates
that the provider serves “a subscriber” (or, in some cases, each of several subscrib-
ers) with that phone number. The information is associated with a particular
subscriber, even if that subscriber’s name is unknown.
10
We express no view on what would constitute an unreasonably burdensome request.
157
Opinions of the Office of Legal Counsel in Volume 32
We do not believe that, for this analysis, it matters whether the information
sought by the FBI has already been made public, unless the subscriber has given a
consent broad enough to cover a response to the FBI’s request. An example of
such consent would be the subscriber’s having a listed number. See 18 U.S.C.
§ 2702(c)(2). Without such consent, section 2702(a)(3), by its terms, bars a
provider from supplying otherwise protected information, even if it has become
public. Nor would it matter whether such information falls outside the category of
“customer proprietary network information” under the Communications Act, so
that its disclosure would not be unlawful under that statute. See 47 U.S.C. § 222(h)
(2000). ECPA may forbid disclosure of particular information, even if the
Communications Act does not. 11
Nevertheless, if the FBI asks only whether a number is among those assigned,
or belonging, to the provider and not whether the provider has given it to a
subscriber, we do not believe that the inquiry seeks “information pertaining to a
subscriber.” A provider’s confirmation that a number is assigned, or belongs, to it
would not reveal whether the number is being used by a subscriber.
DANIEL L. KOFFSKY
Deputy Assistant Attorney General
Office of Legal Counsel
11
A provider that does not serve a given individual or phone number would not appear to be
revealing “information pertaining to a subscriber” by answering the FBI’s request in the negative.
Nevertheless, once a provider has given this negative answer in one instance, a response of “no
comment” in a later instance could have the effect of disclosing “information pertaining to a
subscriber.” By entertaining the question at all, the provider would risk disclosing protected infor-
mation.
158