FW:  April 24,2015

A lawyers’ group called this week for greater oversight of a program giving law enforcement officials access to metadata from private communications for criminal investigations and national security purposes.

But while the recommendations from the National Association of Criminal Defense Lawyers (NACDL) ring familiar from recent debates over warrantless surveillance of email and phone records, the program in question traces back to long before the Internet and even before the modern telephone network.

"If your mail’s gonna be monitored—every single thing you send and receive—I would certainly feel that my privacy has been violated."

Recent revelations that the U.S. Postal Service photographs the front and back of all mail sent through the U.S., ostensibly for sorting purposes, has brought new scrutiny to an obscure surveillance program run by its law enforcement division, the Postal Inspection Service.

The program lets state or federal law enforcement agencies request what’s called a "mail cover," giving them access to address information from envelopes and packages sent or received by people targeted in criminal investigations, without a search warrant. Because a mail cover involves reading only information on the outside of the envelope or package that could be seen by any observer, courts have not ruled it a violation of the Fourth Amendment. But that hasn't stilled concerns about privacy and abuse.

"If your mail’s gonna be monitored—every single thing you send and receive—I would certainly feel that my privacy has been violated," Steven R. Morrison, an assistant professor of law at the University of North Dakota who wrote the report for the NACDL, told Fast Company.

In 2013, an internal audit found, the Postal Service approved nearly 50,000 requests, through a process with "insufficient controls" to prevent abuse. About 20% of the requests from outside law-enforcement agencies were not approved by authorized personnel, the report said, and 13% were either unjustified or not correctly documented.

A related initiative called the Mail Isolation Control and Tracking Program, which the Postal Service says has been used only in a handful of cases where poisoned or contaminated mail was found in the system, was launched after the anthrax attacks in 2001, which killed five people including two postal workers. But the mail cover program predates it by over a century.

"The mail cover has been in use, in some form, since the 1800s," Chief Postal Inspector Guy J. Cottrell told Congress in November. The program targets a range of criminal activity including fraud, pornography, and terrorism, but, he said, "today, the most common use of this tool is related to investigations to rid the mail of illegal drugs and illegal drug proceeds."

Anchor

Historically, the rules around mail covers have been much more lenient than around opening mail, which generally requires a warrant, since it’s assumed there’s inherently less privacy in what’s written on the outside of an envelope than what’s sealed within. But the NACDL report suggests the long-established program might raise a very modern concern, if the postal metadata, possibly combined with other data, can be used to build a sophisticated portrait of a suspect’s day-to-day communications.

"Mail covers are virtually explicitly meant to create a mosaic," according to the report, referring to a recent legal theory that government surveillance efforts should be scrutinized, under the Constitution, not just as individual steps—like looking at the address on a letter or recording who called whom—but in aggregate, especially since technology can make it substantially easier to gather huge swaths of data in each of those steps.

"Long-term surveillance of letters or places visited is more intrusive than a single glance over the shoulder at the post office or a few hours of tailing on the highway."

The thinking, say advocates of the theory, is that long-term surveillance of ostensibly public information, like letters mailed or places visited, is more intrusive than a single glance over the shoulder at the post office or a few hours of tailing on the highway.

Under current postal regulations, the Postal Inspection Service is only allowed to authorize mail covers when agencies have "reasonable grounds" to believe it's necessary for ongoing investigations. But, privacy advocates say, leaving that decision in the hands of postal inspectors, rather than the courts, leaves out an important safeguard.

"It should be the same thing as any other surveillance—get a warrant," said security researcher Bruce Schneier. "You should not be allowed to surveil somebody without going to a judge and saying, 'This is why I want to violate his privacy.'"

Anchor

An audit report issued last May by the Postal Service’s Office of the Inspector General found the Inspection Service, which fulfilled about 49,000 such requests in its 2013 fiscal year, frequently didn’t follow the existing guidelines designed to preserve the privacy of Americans' mail. Some mail covers were authorized by officials who legally didn’t have the authority to sign off, and about 13% of the audited mail covers lacked documentation showing they were justified under the "reasonable grounds" standard.

Of about 6,000 requests received from outside agencies in that year, the Inspection Service rejected only 10, the OIG’s Deputy Inspector General Tammy Whitcomb told Congress in November. The vast majority of requests apparently originate with the Postal Inspection Service itself, though it’s not immediately clear how many involve joint investigations with other agencies.

"Insufficient controls over the mail covers program could hinder the Postal Inspection Service’s ability to conduct effective investigations, lead to public concerns over privacy of mail, and harm the Postal Service’s brand," the audit report warned.

Privacy of mail is indeed a concern for the NACDL, which said in its report that the modern guidelines only came about in the 1970s, after the Federal Bureau of Investigation and other agencies were alleged to have abused the mail cover process to track purported subversives.

In one case, the group said, a 15-year-old girl became the subject of an FBI investigation after writing to a political organization that was the subject of a mail cover for alleged subversive activities. The girl was simply asking the group about its positions and policies as part of a homework assignment, and had actually intended to send the questionnaire to another organization with a similar name, according to court records cited by the NACDL.

"Among the investigative tactics used by the sheriff’s office was surveillance of the correspondence of one of the sheriff's opponents."

"As a result of these abuses, mail cover regulations were promulgated in 1975, and now appear [in the Federal Register]," according to the NACDL report. "Based on concerns about the vagueness and overbreadth of authorizing mail covers for 'national security,' the regulations were amended in 1979 to include a more precise definition of that term."

In a more recent case, Phoenix-area politician Mary Rose Wilcox secured a nearly $1 million settlement last year from Arizona’s Maricopa County, over what she said was a trumped-up corruption investigation launched by Joe Arpaio, the county’s controversial sheriff, with whom she had frequent disagreements while on the county Board of Supervisors. Among the investigative tactics used by the sheriff’s office was a mail cover tracking Wilcox’s correspondence, according to the NACDL report. That led the sheriff to obtain search warrants for the banking information of two restaurants Wilcox and her husband owned. After he raided a company that hired Wilcox to provide concessions at the local airport, she lost the contract.

Anchor

A postal worker at a sorting facility, where mail is routinely photographed.

After the initial audit report was released, the Postal Inspection Service said it had taken steps to review its own procedures and ensure compliance with existing regulations. And while a 2013 report in The New York Times suggested mail images generated for automated sorting could also be used for surveillance—the kind of long-term, aggregate scrutiny adherents of the mosaic theory envision—the Inspection Service denies that they're regularly used for surveillance.

They can however be requested by law enforcement, and the Postal Service has acknowledged they've been used in certain cases, including one in which ricin-laced mail was addressed to President Barack Obama and then-New York Mayor Michael Bloomberg.

"Those images reside locally at the processing plant," Chief Postal Inspector Cottrell said in Congressional testimony. "They are not stored in a database, nor do they reside in a format that allows them to be mined or analyzed electronically." The postmaster general told the Associated Press that photographs of the front of envelopes and packages are stored on machines for periods of up to 30 days before they are destroyed.

"If they’re saving it, they’re surveilling—you don’t need to save it to route mail."

Still, the very act of saving the images—regardless of how they're currently used—has drawn the suspicion of privacy advocates from multiple sides of the political spectrum.

"If they’re saving it, they’re surveilling—you don’t need to save it to route mail," Schneier said. "You possibly need to OCR the address, print the bar code on the bottom of the level, and you’re done.

The NACDL argues the existing mail cover standards should be tightened further. Postal Inspection Service officials should be explicitly required to conclude that surveillance requests are necessary and to "record and maintain the articulable facts and reasons the supporting evidence is reliable," not just rely on the word of outside agencies. If the evidence is later found not to be enough to justify a mail cover, courts shouldn't allow the postal metadata into evidence, the NACDL suggests.

The report also called for some sort of internal review system to help protect against potential abuses, something the NACDL acknowledges has also been suggested for digital surveillance.

"Much like current proposals to have a privacy advocate in Foreign Intelligence Surveillance Courts to challenge what have been viewed as one-sided, rubber-stamping procedures to obtain surveillance orders in the national security context, mail cover procedures should be subject to similar internal controls," the lawyers' report said.

 

http://www.fastcompany.com/3045337/postal-service-surveillance-privacy-snail-mail