Tread Cautiously on Wiretap Act Update for Video, Ex-Prosecutor Says

The hearing was held in response to a school district’s remote activation of webcams on school-owned laptops that students can check out. It prompted a civil court complaint by the parents of a student who got in trouble at school for behavior in his bedroom caught on the webcam. The Lower Merion School District said the remote activation was a theft-tracking feature of software on the laptop. The parents said the laptop was never reported lost, and other students said the green “on” light for webcams on their checked-out laptops occasionally lit up by itself.

"It is fairly well settled that silent video surveillance is outside the scope” of Title III of the Wiretap Act, which prohibits the interception of wire and electronic communications, or “oral communications” if the speaker has a “reasonable expectation” of privacy, said former prosecutor Marc Zwillinger. He worked in the Justice Department’s Computer Crime and Intellectual Property Section. Most of the discomfort about video surveillance comes from its surreptitious use on minors or in places where people disrobe, but not where cameras are installed to protect people, such as in parks or “nanny-cams,” he said in prepared remarks.

Limiting video surveillance the way wire and electronic communications monitoring are would make illegal cameras at ATMs, gas stations and other public places, and turn “well-intentioned” journalists, parents and others into “serious criminals,” said Zwillinger, who also teaches cybercrime law at Georgetown’s law school. Even if treated the same as oral communications, video surveillance would be covered by Fourth Amendment protections in the eyes of most federal appeals courts, he said. The use of surveillance for legitimate purposes could be “chilled” because determining whether a person has an expectation of privacy in any given place is “highly fact-dependent.” Few courts have considered the status of “private audio recordings in semi-private places,” so someone robbing an ATM under surveillance could plausibly claim a Title III violation, Zwillinger said. The Video Voyeurism Prevention Act, passed in 2004, doesn’t deal with remote activation of webcams without voyeuristic intent, but it’s a “better starting point” for changing the law than Title III, he said. Zwillinger proposed creating a safe harbor for video surveillance if the provider follows “strict internal controls” to prevent inappropriate use of the technology.

The millions of webcams on laptops create a “pervasive threat” of remote surveillance, including by foreign governments that hijack webcams through malware, Kevin Bankston, senior staff attorney for the Electronic Frontier Foundation, said in prepared remarks. Without a third party intercepting communications, video surveillance is out of the law’s reach, he said, noting that the 7th U.S. Circuit Court of Appeals said in a 1984 decision it would be “very good” for Congress to update Title III to cover video. Lawmakers’ “somewhat baffling failure” to include video in the 1986 Electronic Communications Privacy Act left it to a handful of states to create highly nuanced restrictions on surveillance, Bankston said. Adding video to Title III would codify “overwhelming Circuit precedent” by clearly requiring a court order for surveillance.

"It is ironic” that the Foreign Intelligence Surveillance Act gives foreign agents more protection than U.S. citizens get by law, Fred Cate, the director of Indiana University’s Center for Applied Cybersecurity Research, said in prepared remarks. But it won’t be easy to regulate video surveillance through Title III, because of the statute’s focus on interception and the possibility that security cameras in public places could be banned, he said. Better to amend the statute so that it prohibits capturing video “intentionally” in a setting where such recording isn’t expected or justified, Cate said. He also recommended that Congress consider a wholesale rewrite of Title III to take account of dramatic changes in technology that have confused courts going back to 1928, when the Supreme Court decided the Fourth Amendment didn’t cover wiretapping, Cate said. “It is increasingly clear that the thoughtful intervention of Congress is necessary.” He said school districts should have policies in writing on the remote activation of webcams, should give notice to students and parents and should regularly review use of the webcams, to quickly detect violations.

The maker of the activation software on the school laptops said the webcam functionality was disabled earlier this year. Absolute Software CEO John Livingston said in prepared remarks that the feature was part of a “theft track” product offered by a company, LANRev, whose assets Absolute acquired. Livingston said Absolute, of Vancouver, British Columbia, has helped Philadelphia police several times through its “security-as-a-service” technology, in one case recovering a laptop that led to a child-pornography suspect. Company personnel are trained to activate the recovery feature only after receiving theft reports from customers, who must provide police reporting file numbers, he said, calling that a “superior” model to the end-user practice used by LANRev.

Privacy groups, Google and Microsoft will discuss Tuesday proposed changes in the Electronic Communications Privacy Act, they said Monday. The Electronic Frontier Foundation, the Center for Democracy & Technology and the ACLU confirmed that they will take part in a conference call. A spokesman for the center told us that the groups will discuss a broad range of proposals, going beyond the video surveillance at issue in Monday’s hearing.