The document summarizes trends in wiretaps and surveillance intercepts authorized by US law enforcement from 1987 to 2009. It finds that the total number of authorized intercepts has steadily increased each year, with the vast majority now being for portable devices. It also notes that while phone surveillance intercepts have increased over time, other forms of electronic surveillance intercepts have plunged to less than 5 per year since 2004. The document hypothesizes that law enforcement agencies have shifted away from performing real-time network surveillance intercepts and instead rely on accessing stored communications from providers.

1. The State of Surveillance
Christopher Soghoian
Center for Cybersecurity Research
Indiana University

2. The state of surveillance
(law enforcement)

3. Wiretaps in the US
• Real-time interception of communications
content.
• Includes
– Voice communications
– Text messages / IM
– Network traffic (think: tcpdump)
• To get one, law enforcement must get a
“super warrant”: probable cause +

4. The use of real-time, content
intercepts (“wiretaps”) in the US
continues to grow each year

5. 0
500
1000
1500
2000
2500 '87
'88
'89
'90
'91
'92
'93
'94
'95
'96
'97
'98
'99
'00
'01
'02
'03
'04
'05
'06
'07
'08
'09
Intercept orders granted between 1987 and 2009
Total intercepts authorized Federal intercepts authorized

6. Drugs are bad
(If you value your privacy)

7. 0
500
1000
1500
2000
2500
'99 '00 '01 '02 '03 '04 '05 '06 '07 '08 '09
Major offense specified in intercept order:
Narcotics vs all other crimes
Narcotics All other crimes

8. If you are going to break the law, and
don’t want to be wiretapped, stick
with something safer…

9. Like murder, bribery, or extortion

10. Major offense specified in intercept
orders (2009)
Arson, explosives, and weapons 18
Bribery 2
Extortion (includes usury and loan-sharking) 3
Gambling 35
Homicide and assault 82
Larceny and theft 35
Narcotics 2,046
Robbery and burglary 9
Racketeering 61
Other or unspecified 85
Total 2376

11. Phone surveillance increases each
year, while other forms all decline
(due to more intercepts by states,
not the federal government)

12. 0
500
1000
1500
2000
2500
'97 '98 '99 '00 '01 '02 '03 '04 '05 '06 '07 '08 '09
Types of intercept orders
(1997 - 2009)
Total Phone Intercept Orders Federal Phone Intercept Orders
Total Electronic Intercept Orders Federal Electronic Intercept Orders
Total Combined Intercept Orders Federal Combined Intercept Orders

13. In 2009, 95% of all intercept orders
were for a portable device

14. 0
500
1000
1500
2000
2500
'00 '01 '02 '03 '04 '05 '06 '07 '08 '09
Location of authorized intercept orders
(2000 - 2009)
Personal residence Business Portable device

15. Electronic intercept orders used to be
significant in number…..

16. 0
100
200
300
400
500
600
700
800
'97 '98 '99 '00 '01 '02 '03 '04 '05 '06 '07 '08 '09
Electronic and Combined Intercept Orders
(1997 - 2009)
Total Electronic Intercept Orders Federal Electronic Intercept Orders
Total Combined Intercept Orders Federal Combined Intercept Orders

17. But have plunged over the past few
years….

18. To less than 5 per year.

19. 0
5
10
15
20
25
30
35
40
'04 '05 '06 '07 '08 '09
Electronic Intercept Orders
(2004 - 2009)
Total Electronic Intercept Orders Federal Electronic Intercept Orders

20. What happened?

22. Network Wiretaps?
• Law enforcement agencies are simply not
performing real-time data network intercepts of
communications content.
• These stats do not cover FISA / intel agencies,
who almost certainly are.
• Law enforcement are instead relying on access
to stored communications (cheaper, easier, etc).
• Why tap your ISP in real-time when your email
provider will readily give up the files later?