Court Puts Secret Service in Sunshine

First printed in
Legal Times - January 6, 1996
By Benjamin Wittes

Civil Libertarians Cheer Ruling In Hacker Case

It was a setback for the Secret Service in court and a significant victory for civil libertarians seeking information about federal law enforcement's campaign against cybercrime.

The U.S. Court of Appeals for the D.C. Circuit ruled Jan. 2 that the Secret Service must disclose documents concerning its role in a bizarre raid on a group of computer hackers at the Pentagon City mall three years ago.

The three-judge panel's decision was not an unqualified victory for freedom-of-information activists. The court allowed the government to block aCounsel Connectess to certain information about the case to protect the privacy of those being investigated by the law enforcement agency. Indeed, it is not clear exactly how much information the Secret Service will have to fork over.

Still, the appeals court ruling came as a pleasant surprise to sunshine advocates, who say it will help clarify a 1993 Supreme Court decision narrowing federal law enforcement's ability to withhold information under the Freedom of Information Act (FOIA). The implications of the decision extend beyond computer crimes, potentially improving access to information about a wide range of criminal probes.

The litigation itself, moreover, prompted significant government disclosures about the mysterious raid, according to the Electronic Privacy Information Center (EPIC), the cyberspace civil liberties group that handled the case.

"The Secret Service was forced . . . to give out far more information than they were originally prepared to give," says David Sobel, legal counsel for the three person non-profit, who argued the case before the appellate panel.

EPIC may just be getting started. The group has a spate of other FOIA challenges about encryption, security policy, and the like pending in federal court here_all involving the sensitive fault line between legitimate law enforcement interests about computer security and civil libertarians' fears that those efforts could lead to oppressive policing of the electronic frontier.

"The purpose of FOIA has always been to give citizens a right to see what they want to see, not what the agency wants them to see," says Sobel. "The bottom line is to hold agencies accountable for their actions and to go beyond the official pronouncements that are contained in agency press releases."

Secret Service officials declined comment, referring inquiries to the Justice Department, which represented the agency in the case. Justice spokesman Carl Stern says that while he is not personally familiar with the decision, department lawyers seem happy with it.

"In sum and substance, the case was won. I didn't perceive this as a loss," says Stern, who adds that the government has not made any decisions regarding possible appeals.

While EPIC's absolutist civil-libertarian positions on many issues are often criticized as uncompromising, the group's FOIA work attracts widespread praise.

Sobel and EPIC head Marc Rotenberg are "skilled at using the FOIA to begin to peel the onion and really find out what's going on in these really important areas that other people are unwilling to touch," says former White House staff secretary John Podesta. "By pursuing these cases not just as individual cases, but by thinking about this in a more global environment . . . they've really done the public a great service," adds Podesta, who now teaches at Georgetown University Law Center.

The Secret Service case began in November 1992, when a group of young techies gathered in Pentagon City's food court for a monthly meeting of their hacker discussion group. At the time, public awareness of the threat that hackers could pose to computer and telephone security was crystallizing. And these hackers happened to be fans of a magazine called 2600, which deals with security flaws in computer systems_and, critics complain, publicizes those flaws to eager computer intruders.

According to The Washington Post, which wrote about the incident six days later, several mall security guards, along with at least one Secret Service agent, and with Arlington County Police officers at the scene, surrounded the group. The mall security officers demanded to see identification from the roughly 20 hackers, rifled through and confiscated bags containing computer books and printouts, and then evicted the youths from the mall. No one was arrested, and the Secret Service later declined to confirm to the Post that it had any involvement in the incident.

EPIC, however, picked up on the story, and filed a FOIA request for documents relating to the incident. The Secret Service claimed it had no information concerning its own involvement, but that it had documents concerning third parties related to the incident; it turned over various press reports it had about the raid, but not the two documents it had identified.

While the agency was processing the request, Sobel, whose group was then part of the California-based Computer Professionals for Social Responsibility_filed suit.

The Secret Service, which investigates financial and computer crimes in addition to protecting the president, ultimately admitted in court that it had eight documents concerning the raid. Moreover, in an affidavit in the case, William Burch, who heads the Secret Service's Washington field office, acknowledged that those documents were obtained during a fraud investigation related to long-distance telephone hacking. Through these admissions, Sobel claims, the Secret Service effectively confirmed that it had been behind the incident at Pentagon City.

Although the Secret Service all but acknowledged that the raid was conducted in the course of an investigation, agency officials argued that it should not have to hand over the material. Doing so, the agency claimed, would violate source confidentiality and the privacy of the targets of the investigations.

"At the request of my office, the records at issue in this case, with the exception of the newspaper articles, were withheld from release due to the ongoing nature of the enforcement proceeding, as to release information could constitute an invasion of the privacy of certain individuals, as the records at issue had been provided to the Secret Service by a confidential source, and as to release the records would reveal the identity of confidential sources," said agent Burch in his affidavit.

Burch added, in response to Sobel's charge that the Secret Service was merely engaged in monitoring private individuals, "I would state that there is absolutely no truth to plaintiff's suggestion."

U.S. District Senior Judge Louis Oberdorfer, however, ruled that Sobel was entitled to most of the information he had requested. In his July 1, 1994 decision in Computer Professionals for Social Responsibility v. U.S. Secret Service, Oberdorfer cited a 1993 Supreme Court ruling in which the court held that law enforcement cannot exempt material from the FOIA simply by blithely citing source confidentiality. Unless the government specifically promises confidentiality_or unless the type of crime being investigated would make retribution against any informant likely_the government cannot withhold material for confidentiality reasons, the high court ruled in Department of Justice v. Landano.

The appeals court reversed part of Oberdorfer's decision, but left his interpretation of the Landano ruling intact.

"The Service offered no evidence that a fear of retaliation by hackers is sufficiently widespread to justify an inference that sources of information relating to computer crimes expect their identities and the information they provide to be kept confidential," wrote Judge James Buckley on behalf of the panel, which also included Judges Stephen Williams and Karen Henderson. The court remanded the case to the District Court to determine which documents could be withheld on other grounds.

The appeals court's ruling, say sunshine activists, should give teeth to the earlier Landano decision.

"I expected [Landano] to be somewhat hollow," says Robert Gellman, a privacy consultant who served as longtime chief counsel to the House Subcommittee on Information, Justice, Transportation, and Agriculture until the GOPtakeover of Congress in 1994. "I expected the courts to find that as a matter of fact, every informant is confidential in every case, and the court really did not do that at all here."

Adds James Dempsey, deputy director of the Center for National Security Studies: "It has become increasingly difficult to use the FOIA to obtain information about federal law enforcement practices. This case plus Landano . . . may signify the end, if not the reversal, of that trend."

George Terwilliger III, who served as deputy attorney general under President George Bush, acknowledges that Landano and its progeny have opened the door for greater scrutiny of law enforcement. But he says that this does not, in principle, jeopardize police operations.

"I would not sense that [the appeals court ruling] represents any kind of a major breach of the ability of law enforcement to protect the kinds of relationships that are essential to good law enforcement work," says Terwilliger, now a partner in the D.C. office of Richmond, Va.'s McGuire, Woods, Battle & Boothe. "The attitude of investigators is that everything they are told in a matter that is an active or semi -active investigation should be confidential and shielded from FOIA. . . . And what the courts are saying is that the confidential source exemption cannot be broadly applied to anyone who provides information to law enforcement."

For his part, Sobel claims victory not only because the decision preserves what he describes as the core of the lower court ruling, but also because the litigation itself has largely answered his questions. While he does not believe that the documents he will ultimately receive will prove particularly revealing, the Secret Service has already made disclosures in the case he considers highly significant.

'BLATANTLY ILLEGAL'

The Secret Service even admitted that the meeting was of interest because of the reading choices of the club's members. A footnote in the agency's appellate brief notes that a meeting of 2600 readers would "obviously" be interesting to the Secret Service "because those individuals have, by their conduct, evidenced an interest in the technical intricacies of the telephone system."

Says Sobel: "The [search] was blatantly illegal. . . . It was basically a privatized search and seizure."

He adds, "It's important that FOIA not just be a statute that is on the books but one that is being actively and aggressively used."

If anyone is actively and aggressively using FOIA, it's EPIC. The group, which last year had a budget of roughly $200,000, has three other pending FOIA cases and has litigated three others over the past few years.

EPIC is suing the Commerce Department, seeking a copy of a department survey of encryption software availability abroad. It has a pending suit against the National Security Council seeking information about the Security Policy Board, the executive body established in 1994 to take charge of governmentwide security policy.

And the group is suing the NSC and the National Security Agency seeking documents related to the Clipper Chip initiative, the government's proposed national encryption standard.

In two now completed cases against the Federal Bureau of Investigation, the group sought and received some of the FBI's documentation of the need for the 1994 digital telephony law, a measure which guaranteed continued law-enforcement wiretapping authority as telecommunications technology progresses. Many of the key documents were heavily redacted.

And a suit against the National Institute of Standards and Technology sought documents dealing with development of the Digital Signature Standard, a means of verifying the origin of computer files. The suit was thrown out, but a significant cache of documents was released, says Sobel.

EPIC's FOIA work gets high marks from a diverse range of people interested in computer policy.

"This is what Congress intended when it passed the law," says Stewart Baker, who served as general counsel at the NSA, where he helped shepherd the Clipper proposal, which EPIC opposes.

"It's probably a better use of FOIA than 90 percent of FOIA use, which is big law firms submitting requests to inform their rich clients," adds Baker, now a partner at D.C.'s Steptoe & Johnson.

Even Jerry Berman, director of the Center for Democracy and Technology, which has often clashed with EPIC, speaks admiringly of the group's anti-secrecy crusade:

"I think that David Sobel has done some very important work under the FOIA, whether its getting the documents under the digital telephony bill or the Secret Service case," he says. "It's important in the public accountability sense, and it's important in framing the debate over civil liberties."