Defensive Information Operations and

**Domestic Law: Limitations on Government Investigative Techniques**

[Lieutenant Colonel Joginder S. Dhillon]{.smallcaps}[^1]

[Lieutenant Colonel Robert I. Smith]{.smallcaps}[^2][^\*^]{.smallcaps}

I. INTRODUCTION

Our society is becoming ever more reliant on the Internet and our
national information infrastructure. As is common in this country, our
laws have been slow to develop in this new venue. Unlike commercial
enterprises that may choose to take advantage of gaps and loopholes in
the law, those engaged in protecting our national security face a
tougher challenge. The protectors of our national security should not be
free to take advantage of these gaps and loopholes, as they are charged
not only with ensuring that their conduct is consistent with the letter
and spirit of our laws, but that they also act consistent with our
constitutional values. While a commercial enterprise may choose to act
in the absence of legislation prohibiting a given act, the defenders of
national security not only must ask "may" they legally perform this act,
but they also must ask whether they "should" perform the act. This
additional constraint becomes critically important in the area of
electronic surveillance, where evolving technology threatens individual
rights and liberties.

However, while the information age presents tremendous promise of
benefits to our nation, so too does it bring increased vulnerabilities.
Our infrastructures used to be protected by physical distance or
isolation from threats, the availability of effective defenses, and the
belief of our opponents that we were likely to retaliate. Today's
weapons limit the effectiveness of all of these layers of defense. Our
increasingly wired world is becoming increasingly vulnerable to numerous
threats, including malicious hackers, curious teenagers, terrorists,
organized crime, and foreign powers. Anonymous Internet users may
attempt to gain access to our infrastructures while physically remote
from the site of the intrusion, and they act with reduced threats of
detection and little risk of retaliation.

This article consists of three parts. Section II reviews the nature of
the critical information infrastructure. The discussion covers some of
the recent directives from the President, as well as a discussion of the
Internet in general. Section III dis­cusses the nature of threats against
that infrastructure. The discussion includes a review of some actual and
some simulated intrusion attempts against the computer systems, and the
known results of those incidents. Section IV of the article reviews the
relevant domestic laws and the constraints they place on those charged
with defending these infrastructures. The discussion covers Fourth
Amendment law, the Computer Fraud and Abuse Act, the Electronic
Communications Privacy Act, the Foreign Intelli­gence Surveillance Act,
and the Posse Comitatus Act.

II\. THE IMPACT OF INFORMATION TECHNOLOGY

A. The President's Response

> Life is good in America because things work. When we flip the switch,
> the lights come on. When we turn the tap, clean water flows. When we
> pick up the phone, our call goes through. We are able to assume that
> things will work because our *infrastructures* are highly developed
> and highly effective.[^3]

In order to ensure that Americans may continue to rely on our critical
infrastructures, President Clinton created the President's Commission on
Critical Infrastructure Protection (PCCIP).[^4] The PCCIP is charged
with reviewing physical and cyber threats to eight critical
infrastructures. These infrastructures include transportation,
production and storage of fossil fuels, water supply, emergency
services, continuity of government service, banking and finance,
electrical power, and information and communications.[^5]

Historically, many of these critical infrastructures were "physically
and logically separate systems that had little interdependence."[^6]
However, the combination of advances in technology and the push for
ever-increasing levels of efficiency has driven these systems to a state
of increased automation and interdependence.[^7] This networking and
interlinking of our critical infrastructures has "created new
vulnerabilities to equipment failures, human error, weather and other
natural causes, and physical and cyber at­tacks."[^8]

In the past, "\[t\]he physical breadth of the infrastructures made it
difficult for a potential malefactor to cause anything other than an
isolated disturbance."[^9] However, the networking and interdependence
of the critical infrastructures today places almost no limit on the
damage that may be wrought by a sophisticated potential malefactor.
Furthermore, these threats are real, and an inability to properly
respond to the threats could prove very costly.[^10] The President has
made clear that he does not intend to allow these threats to remain
unchallenged.

> It has long been the policy of the United States to assure the
> continuity and viability of critical infrastructures. President
> Clinton intends that the United States will take all necessary
> measures to swiftly eliminate any significant vulnerability to both
> physical and cyber attacks on our critical infrastructures, including
> especially our cyber systems.[^11]

B. The Internet

The Internet has both enabled the increased interoperability and
efficiency of the information age, and acts as its Achilles heel. "The
Internet is not a physical or tangible entity, but rather a giant
network which interconnects innumerable smaller groups of linked
computer networks. It is thus a network of networks."[^12] The Internet
sprang forth from research conducted by the Defense Advanced Research
Projects Agency (DARPA).[^13] The major breakthrough came with the
development of packet switching networks. Prior to packet switching, the
networking of computers required a dedicated direct link between the two
computers. The expense of creating direct links and the error rates
observed in the former method resulted in a horribly expensive and
inefficient system.[^14]

Packet switching allowed data to be broken into small packets of
information. The labeling of these packets potentially allowed each
packet to follow a different route to the destination computer. Once the
packets arrived at the destination computer, the packets were rearranged
into the correct order, regardless of the order of transmission or
receipt.[^15] The DARPA scientists further improved the system by
proving that the technology could work over satellites and other
wireless networks.[^16] The age of the Internet was upon us, and things
would never be the same again.

What grew from a desire to have a communication system cable of routing
around a nuclear attack, has grown into huge network of homes and
businesses. There are now up to one billion people on the Internet.[^17]
Each of these people theoretically not only has access to e-mail and the
world wide web, but also potential access to the systems that control
our critical infrastructures. Worse yet, our security measures have not
adapted to the changed nature of the threat.

III\. THE NATURE OF THE THREAT

> We have spent years making systems interoperable, easy to access, and
> easy to use, yet we still rely on the same methods of security that we
> did when data systems consisted of large mainframe computers housed in
> closed rooms with limited physical access. By doing so, we are
> building an information infrastructure, the most complex the world has
> ever known, on a very insecure foundation. . . . An article in China's
> People's Liberation Daily stated that . . . 'an adversary wishing to
> destroy the United States only has to mess up the computer systems of
> its banks by high-tech means. This would disrupt and destroy the U.S.
> economy.' If we overlook this point and simply rely on the building of
> a costly standing army, it is just as good as building a contemporary
> Maginot Line.[^18]

A. Difficulties in Measuring the Threat

*1.* *The Private Sector*

Federal Bureau of Investigation (FBI) estimates that electronic crime
totals more than \$10 billion a year.[^19] The true extent of electronic
crime is difficult to measure. First, victims may not be aware that an
intruder has accessed their system. Second, even if aware, a company may
not want to report the crime. This reluctance to report the intrusion
may stem from the fear of a loss of competitive position---they may lose
business if they are perceived as vulnerable to attack.[^20]
Alternatively, the company may not desire to report the incident because
they do not want investigators to gain access to their systems. Some
estimate that less than 20% of the victims of electronic crime report
the incidents to law enforcement.[^21]

*2. The Department of Defense*

The Defense Information Infrastructure (DII) presents a large target.
The Department of Defense (DOD) relies on the DII's more than two
million computers, 10,000 local area net­works, and 100 long-distance
networks.[^22] "Despite the existence of dedicated military
communications satellites, more than 95 percent of military
communications travels via the commercial telephone networks."[^23]
Given there are so many potential points of entry, and the nature of the
information available on the DII, it is of little surprise that the DII
is one of the main targets for intrusion attempts.

The DOD was the target of 22,126 detected attacks in 1999 alone.[^24] Of
these intrusion attempts, about 10 a day require a detailed
investigation.[^25] Again, the full magnitude of the problem may not yet
be known. The Defense Information Systems Agency (DISA) conducts a
Vulnerability Analysis and Assessment Program.[^26] According to
Secretary Hamre, DISA targeted the DII for 38,000 intrusion attempts.
DISA successfully gained access in nearly two out of three attempts, and
the target detected only four percent of the success­ful intrusions.[^27]
Of the detected intrusions, only 27 percent were reported to DISA as
required by government procedures.[^28] These numbers, while
unacceptable, are better than results in the private sector.[^29]

While the number of intrusion attempts is staggering, few of the
attempts are known to be the work of foreign agents, terrorists, or
organized crime. It is believed that the vast majority of the attacks
are the result of fledgling hackers seeking prestige within their
community. "\[H\]ackers see the Department of Defense as . . . the big
banana. The final exam. The ultimate challenge . . . to test their
skills."[^30] However, even these hackers can pose a significant risk,
as they routinely publish their exploits on the Internet and may post
stolen information as proof of their exploits.

B. Real World Results for Intrusion Attempts and Exercises

Both the private sector and the DOD have fallen victim to malicious
hackers. The best known example in the private sector targeted the
telephone system. Additionally, the DOD has released the results of
several simulated intrusion attempts.

*1. The Private Sector Example*

In March 1997, a teenaged hacker disabled a telephone local loop in
central Massachu­setts.[^31] This shut down the telephone system for the
entire area. More than 600 residents serviced by the local loop lost all
telephone service, including 911 emergency services.[^32] One of those
"residents" was the air traffic control tower at the Worcester
Airport.[^33] As a result of the hacker's actions "the air traffic
control tower \[was\] unable to printout progress of incoming and
passing aircraft."[^34]

Bell Atlantic technicians spent more than two hours trying to locate the
problem, and another four hours to restore service.[^35] Security
countermeasures designed to prevent future intrusion attempts took more
than a year to implement.[^36] Had the hackers targeted a more vital
communication point, the results could have been catastrophic.

*2. The Department of Defense*

Intruders into the DII "have stolen, modified, and destroyed both data
and software. . . . They have shut down entire systems and networks,
thereby denying service to users who depend on automated systems to help
meet critical functions."[^37] This section discusses two real world
examples, and the results of two exercises conducted by the DOD.

For three months in 1994, two malicious hackers repeatedly gained
unauthorized access to a computer network at an Air Force research and
development facility in Rome, New York. The Rome Laboratory is the Air
Force's lead research facility for all information technology issues.
The facility needs to interact with academia, software developers, and
other entities, therefore, it is connected to the Internet.[^38]

System administrators did not detect the intruders for five days.[^39]
Furthermore, because the intruders used multiple systems as
intermediaries in their intrusion attempts, tracking the hackers back to
their homes in Great Britain proved difficult and time consuming. The
trail included multiple sites within the United States and South
America.[^40] While they had unauthorized access to the network, the
hackers caused substantial damage.

> The attackers were able to seize control of Rome's support systems for
> several days and establish links to foreign Internet sites. During
> this time, they copied and downloaded critical information such as air
> tasking order systems data. By masquerading as a trusted user at Rome
> Laboratory, they were able to successfully attack systems at other
> government facili­ties, including the National Aeronautics and Space
> Administration(NASA) Goddard Space Flight Center, Wright-Patterson Air
> Force Base, some Defense contractors, and other private sector
> organizations.[^41]

The Air Force estimates that responding to the intrusion cost
approximately \$500,00­0. However, the damage to national security is
difficult to quantify. The extent of the problem is illustrated by the
fact that the Air Force may not yet know everything the hackers did
while in the system. For example, they may have placed "malicious code
in software which could be activated years later, possibly jeopardizing
a weapons system's ability to perform safely and as intended."[^42]

The second example, because it occurred during a time of military
tensions, caused even more consternation. In February 1998, the United
States was preparing to employ military force against Iraq. During
preparations, the Air Force Information Warfare Center detected a
coordinated series of intrusions into the DII. The intruders were traced
to the Middle East.[^43] During the investigation, investigators
discovered a series of trapdoors that would enable the intruders to
return undetected at a later date. The systems did not contain any
classified information, however,

> Pentagon officials worried that by tampering with the data, the
> hackers could disrupt military operations, especially the U.S. force
> buildup then occurring in the Persian Gulf. Unsure where the attacks
> were originating or how many hackers were involved, Deputy Defense
> Secretary John J. Hamre notified President Clinton early in the search
> that the intrusions might be the first shots of a genuine cyber war,
> perhaps by Iraq as it faces a renewed threat of U.S. airstrikes.[^44]

However, the hackers proved to be two sixteen year-old Americans in
California acting under the guidance of an eighteen 18 year-old Israeli
"mentor." The Americans were sentenced to perform community service, and
were ordered to refrain from using a computer during their probationary
period. Three DOD exercises demonstrate that both the National
Information Infrastructure (NII) and DII remain vulnerable. In 1997, the
Joint Chiefs of Staff directed a no-notice exercise known as "Eligible
Receiver." The exercise was designed to test the government's response
to a coordinated cyber assault on the NII/DII.[^45]

Approximately forty DOD employees made up the entire "enemy" force. The
employees were not computer experts, but had a working knowledge of
information technology. They were given approximately three months to
plan their "attack," and their "weapons" were limited hacker tools
available on the Internet.[^46] The "enemy" proved to be a formidable
foe.

> \[T\]he hackers found it exceptionally easy to penetrate well-defended
> systems. Air traffic control systems were taken down, power grids made
> to fail, oil refineries stopped pumping\--all initially apparent
> accidents. At the same time . . . \[it\] proved remarkably easy to
> disrupt the \[DOD logistics\] network both by changing orders so that,
> for example headlamps rather than missiles end up at a fighter
> squadron, and to interrupt the logistics flow by disrupting train
> traffic. . . The result was a serious degradation of the Pentagon's
> ability to deploy and to fight. In other words, a team of hired
> hackers, using commercially available information and artificially
> constrained by the law and the rules of the game, had successfully
> shown that an electronic Pearl Harbor is not only possible today but
> could be completely successful.[^47]

More recently, the DOD has released the results of the Web Risk
Assessment Team (WRAT). The WRAT was created by the Joint Task Force for
Computer Network Defense, and "is made up of reservists who spend one
weekend each month scanning DOD Web sites."[^48] The WRAT found "as many
as 1,300 'discrepancies,' some of them involving highly classified
information."[^49] The team also found war plans on more than ten sites,
and more than twenty sites containing detailed maps of DOD
locations.[^50]

The team located plans for an annual exercise known as Cobra Gold. The
site contained "an entire list of the participating units,
communications frequencies and call signs for aircraft and data on
Identification Friend or Foe squawks."[^51] The team also found a site
that contained detailed discussion of "Site R," which "serves as the
alternate Joint Communications Center for U.S. nuclear forces."[^52] The
details included floor plans for the facility, as well as a photograph
depicting tunnel entryways.[^53]

Each of the sites was supposed to contain only unclassified information.
The fact that so much classified information was available on an
unclassified system raises many questions. But it also demonstrates that
the stakes in computer network defense can be rather high.[^54] This
article now turns to the legal constraints in place in this area.

IV\. DOMESTIC LEGAL CONSTRAINTS

A. Fourth Amendment Law

The right of the people to be secure in their persons, houses, papers,
and effects, against unreasonable searches and seizures, shall not be
violated, and no Warrants shall issue, but upon probable cause,
supported by Oath or affirmation, and particularly describing the place
to be searched, and the persons or things to be seized.

U.S. Const[.]{.smallcaps} amend. IV*.*

The Fourth Amendment places limits upon the government's ability to
intrude into the lives of the people. The government's motive for the
intrusion generally is irrelevant. The parameters of the Fourth
Amendment are not absolute, rather, they reflect an attempt to preserve
the government's authority to maintain public order, while protecting
individual liberty and autonomy.[^55] The Fourth Amendment is composed
of two independent clauses. The first clause requires reasonableness on
the part of the government when intruding into certain aspects of the
lives of the people.[^56] The second clause mandates the requirements
for the issuance of a warrant.[^57] A question remains as to whether or
not a warrantless search is per se unreasonable.

Many believe warrantless searches generally are unreasonable. As one
commentator put it, "\[t\]he firm rule until the late 1960's was that in
order for a search to be 'reasonable,' law enforcement officials
desiring to conduct a search must first obtain a warrant from a neutral
and detached magistrate by establishing probable cause that a law had
been violated."[^58] However, as the nature of crime and the
sophistication of criminals has changed over time, the Supreme Court has
created numerous exceptions to the warrant requirement, and has viewed
the reasonableness clause as an additional restriction on these
exceptions.[^59] This portion of the article will review the
applicability of the Fourth Amendment and the exceptions. Specifically,
it will address how the exceptions apply to the actions of national
security agencies responding to real or perceived intrusion attempts.

*1. The Changing Nature of Fourth Amendment Protection*

For most of our history, the Supreme Court interpreted the Fourth
Amendment very literally. "Unless government agents searched or seized
tangible 'houses, papers, or effects,' Fourth Amendment protections
failed to apply."[^60] Perhaps the best example of the literal
interpretation is found in the case of *Olmstead v. United States.*[^61]
*Olmstead* involved the actions of United States prohibition officers
who placed wiretaps on telephone wires of suspected prohibition
violators. The devices were placed on wires in a manner that did not
require a physical trespass onto the suspects' property, and did not
involve a physical intrusion onto their property. The Court ruled that
the Fourth Amendment was not implicated, as the actions of the agents
did not amount to a search.

> Neither the cases we have cited nor any of the many federal decisions
> brought to our attention hold the Fourth Amendment to have been
> violated as against a defendant unless there has been an official
> search and seizure of his person, or such a seizure of his papers or
> his tangible material effects, or an *actual physical invasion* of his
> house or 'curtillage' for the purpose of making a seizure.[^62]

Justice Brandeis wrote a now-famous dissent wherein he argued that the
Court should interpret the Fourth Amendment in light of the principles
it was designed to protect.[^63] Justice Brandeis feared that technology
would advance, and would allow the government to perform formerly
prohibited acts in new ways that the framers could not have
foreseen.[^64] Justice Brandeis characterized the Fourth Amendment as
being designed to protect the people's right to be let alone. He
concluded that if acts of the Government invaded on that right, such
acts would trigger Fourth Amendment scrutiny.[^65]

Nearly forty years passed before the views of Justice Brandeis won out.
*Katz v. United States*[^66] involved the results of wiretaps that had
been placed on the outside of a public telephone booth.[^67] By a seven
to two vote, the Supreme Court decided to abandon *Olmstead's* physical
trespass standard, and instead relied upon the concept of reasonable
expecta­tions of privacy. In the words of Justice Stewart, "the Fourth
Amendment protects people, not places."[^68] The Court thereby shifted
the focus of the inquiry from where and how the interception took place,
to the expectation of the suspect.[^69]

However, the majority opinion did not prove to be the lasting standard
against which future searches and seizures would be measured. Justice
Harlan wrote a concurring opinion that set out the test that is still in
use today.[^70] Justice Harlan invoked a two-part test to determine
whether a given scenario triggers the protections of the Fourth
Amendment. First, the individual must have exhibited an actual
expectation of privacy. Second, that expectation must be one that
society is willing to recognize as reasonable.[^71] This article now
turns to how the Court applies this test in cyberspace this new venue.

*2. The Fourth Amendment and Cyberspace*

Computers serve as "repositories of personal information" such as
financial records, personal notes, trade secrets and other matters that
seem to fit within the definition of "papers and effects."[^72] However,
since the Court has shifted away from literal interpreta­tion, a court
must analyze cases involving computers using the two-part reasonableness
test. Most courts attempting to resolve novel issues generally attempt
to analogize the situation to one previously decided.[^73] The choice of
analogy often determines to outcome. Cyberspace has many unique features
that are not easily analogized to previous situations. This article will
now look at some of the features of cyberspace, and what analogies have
or should be made.

Electronic mail (e-mail) is one area where courts and commentators have
chosen to apply the analogy of first class mail.[^74] While at first
appearing to be a useful analogy, it is not a perfect fit. Mail
recipients have a reasonable expectation of privacy in sealed letters
being forwarded by first class mail.[^75] However, there are significant
differences between the handling of first class mail and the handling of
e-mail. One of the main differences involves the carrier. First class
mail is handled by the United States Postal Service. Society can and
should view an expectation of privacy in matter handled by the federal
government as being reasonable. However, e-mail is handled by many
actors, and few if any of them are state actors. E-mail sent over the
Internet may reside on numerous mail servers before reaching the mail
server of the user's Internet Service Provider. Addition­ally, many
networks are configured to send duplicate copies of all e-mail to the
system administrator. Given these differences, it is not a forgone
conclusion that society should view an expectation of privacy in e-mail
as reasonable.

Courts also may choose to analogize cyberspace to the telephone system.
However, not all information traveling over telephone lines receives
Fourth Amendment protection. In *Smith v. Maryland*,[^76] the Court
ruled that the telephone company could lawfully use pen registers[^77]
to record the telephone numbers dialed from a private residence. The
Court ruled that there are numerous legitimate business reasons for
recording this information, and that the recording did not implicate the
Fourth Amendment.[^78] Using this analogy tends to indicate that an
Internet Service Provider could record the addressees on all e-mail
being sent from their system. However, this analogy would not appear to
authorize the interception of the contents of those communications.[^79]

Another analogy involves characterizing cyberspace as a physical place
or object. Under this analogy, the storage device for a computer could
be viewed as a closed container or file cabinet.[^80] Questions may
arise under either analogy. For example, if a person stores his or her
electronic documents on a remote server on the Internet, who owns the
filing cabinet or sealed container, and who may consent to a search of
the contents?[^81] Additionally, given the huge quantities of
information capable of being stored in very inexpensive storage
facilities, how "particularly" does a warrant have to describe the place
to be searched?[^82]

Despite the problems inherent in using analogies when dealing with
cyberspac­e, courts generally have found that the Fourth Amendment
protects information stored on computers.[^83] However, as discussed
earlier, there are numerous exceptions to the warrant requirement. This
article will focus on whether, and if so how, these exceptions may apply
in cyberspace.

*3. Cyberspace and the Exceptions to the Warrant Requirement*

Despite the clear preference for warrants,[^84] the Supreme Court has
created several exceptions where the government need not seek a warrant,
and may not even need to be acting under probable cause.[^85] These
exceptions include searches incident to a lawful arrest;[^86] seizure of
items in plain view;[^87] exigent circumstances;[^88] consent;[^89] and
border searches.[^90]

The question here is whether the government's interests in responding to
intrusion attempts against the NII/DII are of such import as to justify
the creation of a new exception or the use of a pre-existing
exception.[^91] The most appropriate point for the application of an
exception to the warrant requirement is in the early stages following
the detection of an intrusion attempt. The first step in such situations
is to attempt to determine the identity of the intruder. Such intruders
typically weave their way to their target through a series of
intermediate computers, and take other steps to mask their true
identity.[^92] If an intruder uses certain techniques, once he or she
departs, tracing them back to their source is very difficult, if not
impossible. Those attempting to defend the NII/DII from authorized
access must act with speed and stealth. Does this situation meet the
requirements of the hot pursuit or exigent circumstances exception?

One could argue that the exigent circumstances exception should apply.
However, to reach this conclusion would require an extension of the
exigent circumstances exception, particularly where the defender is part
of the DOD. The attractiveness of applying the exigent circumstances
exception comes from the fact that while the defenders are not
physically in pursuit of a suspect, they are engaged in a concerted
effort to identify a suspect before he or she can destroy evidence or
commit further misdeeds.[^93] However, the United States military does
not act primarily to collect­ evidence of wrongdoing, the United States
military may only act if their primary motivation relates to national
security.[^94] Since the core purpose of the exigent circumstances
exception is the preservation of evidence, and that is not the main
motivation of the military, ­rather than extend the exigent circumstances
exception, perhaps a better fit may be found under the "special needs"
exception.

The Supreme Court first recognized the "special needs" exception in *New
Jersey v. T.L.O.*[^95] The case involved a warrantless search at a
school. A student had been observed smoking in a school restroom. An
assistant vice principal then searched the student's purse. The results
of the search indicated the student may have been involved in the use
and distribution of marijuana. The Supreme Court ruled that the evidence
was obtained in a lawful manner.

Justice White wrote for the Court and noted the government's substantial
interest in "maintaining an environment \[in the schools\] in which
learning can take place."[^96] The Court then balanced the state's
interest in "swift and informal disciplinary procedures" against the
student's right to privacy.[^97] The Court concluded that the warrant
require­ment would unduly burden the government and was likely "to
frustrate the purpose behind the search."[^98]

It was, however, the concurring opinion of Justice Blackmun that
contained what would become the parameters of the special needs
exception. Justice Blackmun feared that the Court's balancing approach
could be too broadly applied. He argued that the balancing should only
take place when required by a "special law enforcement need for greater
flexibility."[^99] "The special need for an immediate response to
behavior that threatens either the safety of schoolchildren and teachers
or the educational process itse­lf justifies the Court in excepting
school searches from the warrant and probable cause requirement, and in
applying a standard determined by balancing the relevant
interests."[^100]

The Court has applied the special needs exception several times since
its creation. *O'Conn­or v. Ortega*[^101] extended the special needs
exception to workplace searches. The Court justified the exception on
the government's substantial interest in maintaining an efficient and
proper workplace. "Requiring an employer to obtain a warrant whenever
the employer wished to enter an employee's office, desk, or file
cabinets for a work related purpose would seriously disrupt the routine
conduct of business and would be unduly burdensome."[^102] *Griffin v.
Wisconsin*[^103] extended the exception to include warrantless searches
of the homes of probationers. The Court ruled that so long as the search
was based upon a reasonable suspicion that it would produce evidence of
a probation violation, a warrant was not required.[^104] The special
need to preserve "the deterrent effect of the supervisory arrangement"
justified the application of the exception.[^105] In *Skinner v. Railway
Labor Executives Association*,[^106] the Court extended the exception to
include the warrantless drug and alcohol testing of railroad employees.
As the Court put it,

> The Government's interest in regulating the conduct of railroad
> employees to ensure safety, like its supervision of probationers or
> regulated industries, or its operation of a government office, school,
> or prison, "likewise pres­ents 'special needs' beyond normal law
> enforcement that may justify departures from the usual warrant and
> probable cause requirements."[^107]

In *National Treasury Employees Union et al. v. Von Raab*,[^108] a case
decided the same day as *Griffin*, the Court extended the exception to
include suspicionless searches of employees seeking sensitive jobs with
the United States Customs Service. It was the duty of the United States
Custom Service to provide for the security of the nation that served as
the special need.[^109]

The most recent special needs case involved mandatory drug testing for
students wishing to participate in school sponsored athletics.[^110]
Here, the Court looked to the importance of "deterring drug use by our
Nation's schoolchildren" as the special need.[^111] "Taking into account
all the factors we have considered above---the decreased expecta­tion of
privacy, the relative unobtrusiveness of the search, and the severity of
the need met by the search---we conclude \[the school's\] Policy is
reasonable and hence constitu­tional."[^112]

One can argue that the desire to determine the identity of an ongoing
intrusion attempt against the NII/DII involves "special needs beyond
normal law enforcement." After all, such activities are motivated by a
compelling interest in avoiding an "electronic Pearl Harbor," not the
collection of evidence for ordinary law enforcement purposes.[^113] As
the Court put it in another, much older case: "To preserve its
independence, and give security against foreign aggression and
encroachment, is the highest duty of every nation, and to attain these
ends nearly all other considerations are to be subordinated."[^114] If
the government has a reasonable suspicion unauthorized users are
attempting to gain access to critical infrastructures, a limited special
needs exception may be appropriate, particularly if the actions taken
are relatively unintrusive and for limited duration.

However, under current case law, courts may be precluded from applying
such just such an exception. The Supreme Court ruled, during the age of
Watergate, that an interest in protecting national security does not
override the warrant requirement of the Fourth Amendment.[^115] The
Court noted "Successive Presidents for more than one-quarter of a
century have authorized \[electronic\] surveillance in varying degrees,
without guidance from the Congress or a definitive decision of this
Court."[^116] The case involved three defendants charged with conspiracy
to destroy government property, including one charged with the dynamite
bombing of a Central Intelligence Agency building in Ann Arbor,
Michigan.[^117] Some of the evidence was obtained pursuant to electronic
surveil­lance authorized by the Attorney General (acting on behalf of the
President) and not a magistrate.

The Attorney General stated that he approved the wiretaps "to gather
intelligence information deemed necessary to protect the nation from
attempts of domestic organiza­tions to attack and subvert the existing
structure of the Government."[^118] The government asserted that the
warrantless surveillance was lawful because it constituted "a reason­able
exercise of the President's power (exercised through the Attorney
General) to protect the national security."[^119] The Supreme Court was
not persuaded.

The Court first recognized that implicit in the duty imposed by Article
II, §1, of the Constitution is the "power to protect our Government
against those who would subvert or overthrow it by unlawful
means."[^120] The Court noted that electronic surveillance could be "an
effective investigatory instrument in certain circumstances"[^121] The
Court further opined that "\[i\]t would be contrary to the public
interest for Government to deny itself the prudent and lawful employment
of those very techniques which are employed against the Government and
its law-abiding citizens."[^122] This is true because "unless Government
safeguards its own capacity to function and to preserve the security of
its people, society itself could become so disordered that all rights
and liberties would be endangered."[^123]

Along with these domestic security surveillance issues comes a
temptation for abuse. As the Court noted,

> History abundantly documents the tendency of government--however
> benevolent and benign its motives--to view with suspicion those who
> most fervently dispute its policies. Fourth Amendment protections
> become the more necessary when the targets of official surveillance
> may be those suspected of unorthodoxy in their political beliefs. The
> danger to political dissent is acute where the government attempts to
> act under so vague a concept as the power to protect "domestic
> security." Given the difficulty of defining the domestic security
> interest, the danger of abuse in acting to protect that interest
> becomes apparent.[^124]

In other words, the case involved two vital interests for
Americans--domestic security interests and free speech interests. The
Court put it thus,

> The price of lawful public dissent must not be a dread of subjection
> to an un­checked surveillance power. Nor must the fear of unauthorized
> official eavesdrop­ping deter vigorous citizen dissent and discussion
> of government action in private conversation. For private dissent, no
> less than open public discourse, is essential to our free
> society.[^125]

In resolving the tension between the two interests, the Court asked
"whether the needs of the citizens for privacy and free expression may
not be better protected by requiring a warrant" before the government
may engage in electronic surveillance for domestic security
purposes.[^126] While at the same time, the Court must ask "whether a
warrant requirement would unduly frustrate the efforts of Government to
protect itself from acts of subversion and overthrow directed against
it."[^127]

In the end, the Court concluded that "prior judicial approval is
required for the type of domestic security surveillance involved in this
case."[^128] However, in addition to the doors left open by the
questions left unanswered, the Court stated that the warrant
require­ments in domestic security cases could differ from the
requirements for other cases. In fact, the Court stated that "different
standards may be compatible with the Fourth Amendment if they are
reasonable both in relation to the legitimate need of Government for
intelligence information and the protected rights of our
citizens."[^129]

Despite this holding, one could argue that responding to a detected
intrusion attempt against the nation's critical infrastructures might
result in a different outcome when balancing the interests. Unlike the
situation in *Keith* where free speech interests were directly at stake,
responding to an attempted unauthorized intrusion into the NII/DII does
not directly invoke free speech. Additionally, the *Keith* opinion deals
with the gathering of intelligence as opposed to military operations in
response to a criminal act and in furtherance of national security
objectives. The Court could not have understood the national security
implications of our emerging reliance on a networked information
infrastructure. These differences may shift the balance, and lead the
Court to conclude that a reasonable exercise of the president's
constitutional powers as commander-in-chief does not violate the Fourth
Amendment.

The Fourth Amendment is not the only limitation on government responses
to ongoing intrusion attempts. Several federal statutes come to bear on
the issue as well. This article now turns to those statutes.

B. Computer Fraud and Abuse Act

\[I\]n most cyber attacks, the identity, location, and objective of the

perpe­trator are not immediately apparent. Nor is the scope of his

attack\--i.e., whether an intrusion is isolated or part of a broader

pattern affecting numerous targets. This means it is often

impossible to determine at the outset if an intrusion is an act of

vandalism, organized crime, domestic or foreign terrorism,

economic or traditional espionage, or some form of strategic

military attack. The only way to determine the source, nature, and

scope of the incident is to gather information from victim sites and
intermediate sites such as Internet Service Providers and

telecommunica­tions carriers.[^130]

If one were able to "hack-back" to locate the source of an attack
without violating the Fourth Amendment, the question becomes whether the
Computer Fraud and Abuse Act (CFAA) would provide an independent barrier
to such action. The CFAA of 1986[^131] was the first federal legislative
for­ay into computer crimes. Prior to its enactment, federal law only
touched computer crimes through application of more generic criminal
laws, or through the use of the mail and wire fraud statutes.[^132]

As originally enacted in 1984, the CFAA was intended to protect
federally owned or operated computers.[^133] It "prohibited unauthorized
access to certain categories of computers if the defendant realized
monetary gain or obtained access to classified material."[^134] It was
amended in 1986 and 1994. The 1994 amendments were intended to broaden
its reach to reflect the broader range of means of using computers to
wreak havoc. The law now protects "computers used by financial
institutions or the federal government"[^135] and any "computer which is
used in interstate or foreign commerce or communications."[^136] The Act
covers acts of fraud involving computers, and the unautho­rized
destruction or alteration of data stored in computers.[^137]

Section 1030(a) contains the substantive protections that may be used to
prosecute intrusion attempts against the NII/DII.[^138] However, 18
U.S.C. §1030(a)(2)(C) is of particular importance to this article.
Section 1030(a)(2)(C) prohibits obtaining "informa­tion from any
protected computer if the conduct involved an interstate or foreign
communication" by intentionally accessing a computer without access or
exceeding authorized access.[^139] The CFAA definition of "protected
computer" includes all computers "used in interstate or foreign commerce
or communications."[^140] Given the nature of the Internet, it seems
clear that a court would rule that all computers connected to the
Internet are "used in interstate or foreign commerce or communications."
Therefore, while the CFAA originally was enacted to protect information
on computers owned or operated by the federal government, it now may be
read to prohibit the DOD from taking certain actions to respond to those
attacks.

However, an argument can be made that the CFAA provides an exception for
such conduct. Section 1030(f) reads, "This section does not prohibit any
lawfully authorized investigative, protec­tive, or intelligence activity
of a law enforcement agency of the United States, a State, or a
political subdivision of a State, or of an intelligence agency of the
United States."

This provision appears to leave the door open for properly authorized
activities of those DOD components with law enforcement or
intelligence/counter-intelligence missions. For example, each branch of
the military service contains an investigative unit that performs the
dual roles of law enforcement and counter-intelligence.[^141]
Additionally, each branch of the service contains an intelligence
unit.[^142] The CFAA does not prohibit these units from responding to
intrusion attempts against the NII/DII. However, the exception does not
explicitly include a national security provision. The legislative
history of the CFAA[^143] does not contain any discussion of this
section, and no cases have addressed the issue. It is our view that the
statute should not be construed to restrict the authority of the
President, acting pursuant to his constitutional power as the
commander-in-chief to direct operations to accomplish legitimate
national security objectives. However, this authority has not been
clearly defined. It appears appropriate only in circumstances in which
significant national security interests are at risk. There­fore, the CFAA
appropriately places additional limits beyond the Fourth Amendment on
some elements of the military. However, the CFAA is not the only
limitation on these activities.

C. Electronic Communications Privacy Act

The Federal Wiretap Act originally was enacted as Title III of the
Omnibus Control and Safe Streets Act of 1968. The enactment was a
legislative response to the holding in the *Katz* case that the warrant
requirement applied to electronic surveillance not involving a physical
trespass.[^144] Title III set out the parameters for the seizure of wire
communications by the govern­ment. Such seizures were authorized only in
the course of investigating certain listed criminal acts. The Federal
Wiretap Act required probable cause that less intrusive investigative
techniques would fail. It further required that techniques be employed
to limit the likelihood of intercepting innocent conversations. Finally,
it required that the target be informed of the seizure after the
investigation concluded.[^145]

However, while Title III as originally enacted protected all electronic
transmissions of voice communications, regardless of the method of
transmission, it did nothing to protect communications in the age of
e-mail.[^146] In response, Congress enacted the Electronic
Communications Privacy Act of 1986 (ECPA). The ECPA was an attempt to
"reestablish the balance between privacy and law enforcement, which
Congress found had been upset, to the detriment of privacy, by the
development of communications and computer technology and changes in the
structure of the telecommunications industry."[^147] It did this by
extending some of the protections afforded voice communica­tions to other
forms of electronic communications.[^148]

The ECPA does not, however, contain all of the same protections
originally afforded to voice communications. For example, instead of
limiting the interception powers to a set list of criminal acts, the
ECPA allows interceptions for the investigation of all felonies.[^149]
Additionally, while Title III contained an exclusionary rule for
evidence obtained in violation of its terms, the ECPA does not.[^150]

While *Katz* may have been the driving force behind Title III,
*Keith* opened the door for differing standards of probable cause and
different procedures for electronic surveillance conducted for national
security purposes. As the Court put it in *Keith,* "we do not hold that
the same type of standards and procedures prescribed by Title III are
necessarily applicable to this case. We recognize that domestic security
surveillance may involve different policy and practical considerations
from the surveillance of 'ordinary crime.'"[^151] The Court went on to
state that "\[d\]ifferent standards may be compatible with the Fourth
Amendment if they are reasonable both in relation to the legitimate need
of Government for intelligence information and the protected rights of
our citizens."[^152] Despite this invitation, Congress has not applied
different standards or procedures for national security cases under
Title III or ECPA. This failure to adopt a different balance, while
protective of civil rights, potentially puts the NII/DII at unnecessary
risk. Unfortu­nately, it may take a major cyber incident before Congress
and the American public decide to take the Court's invitation to
establish different standards of probable cause in this area.[^153]
However, Congress will have an example of just such a different
standard, as it created one in the Foreign Intelligence Surveillance
Act.

D. Foreign Intelligence Surveillance Act

Congress reacted to reported abuses of the Nixon Administration and the
potential for future abuses and enacted the Foreign Intelligence
Surveillance Act (FISA).[^154] While the Nixon Administration's abuses
may have brought the issue to light, Congress determined that previous
administrations had engaged in questionable electronic surveillance. The
Senate Select Committee to Study Government Operations with Respect to
Intelligence Activities concluded that although the "number of illegal
or improper national security taps and bugs conducted in the Nixon
administration may have exceeded those in previous administrations . . .
every President since Franklin D. Roosevelt asserted the authority to
authorize warrantless electronic surveillance and exercised that
authority."[^155] The purpose of FISA was to design "a secure framework
by which the Executive Branch could conduct legitimate electronic
surveillance for foreign intelligence purposes within the context of
this Nation's commitment to privacy and individual rights."[^156] This
framework limited the definition of foreign intelligence and provided
additional protections for United States persons.

*1. The Mechanics of Electronic Surveillance Under FISA*[^157]

§1801 Definitions

Among the definitions under FISA, the definition of a United States
"person" is the most important. This is important because United States
persons are entitled to heightened protections under FISA. FISA defines
a United States person as

> a citizen of the United States, an alien lawfully admitted for
> permanent residence, . . . an unincorporated association a substantial
> number of which are citizens of the United States or aliens lawfully
> admitted for permanent residence, or a corporation which is
> incorporated in the United States, but does not include a corporation
> or other association which is a foreign power.[^158]

A "foreign power" is an entity meeting any of six definitions.

> \(1\) a foreign government or any component thereof whether or not
> recognized by the United States;
>
> \(2\) a faction of a foreign nation or nations, not substantially
> composed of United States persons;
>
> \(3\) an entity that is openly acknowledged by a foreign government or
> governments to be directed and controlled by such foreign government
> or governments;
>
> \(4\) a group engaged in international terrorism or activities in
> preparation therefore;
>
> \(5\) a foreign-based political organization, not substantially
> composed of United States persons; or
>
> \(6\) an entity that is directed and controlled by a foreign
> government or governments.[^159]

Just as FISA differentiates between United States persons and all
others, it also distinguishes between these various types of foreign
powers for certain purposes. For example, 50 U.S.C. §1802(a)(1)(A)
authorizes certain activities without a Foreign Intelligence
Surveillance Court (FISC) order, but only if the targets fit within one
of the first three categories.

Any person (including a United States person) may be deemed an agent of
a foreign power if he or she meets one or more of four tests. The first
category includes anyone who "knowingly engages in clandestine
intelligence gathering activities for or on behalf of a foreign power,
which activities involve or may involve a violation of the criminal
statutes of the United States."[^160] The second category includes
anyone who, at the "direction of an intelligence service or network of a
foreign power, knowingly engages in any other clandestine intelligence
activities for or on behalf of such foreign power, which activities
involve or are about to involve a violation of the criminal statutes of
the United States."[^161] The third category includes anyone who
"knowingly engages in sabotage[^162] or international terrorism,[^163]
or activities that are in preparation therefor, for or on behalf of a
foreign power."[^164] The final category includes anyone who knowingly
aids, abets or conspires with any person in the conduct of the acts
covered by the first three catego­ries.[^165]

People other than United States persons may also be considered agents of
a foreign power under two additional situations. The first situation is
if they "act in the United States as an officer or employee of a foreign
power," or as a member of a group engaged in international terrorism or
activities in preparation therefore (regardless of where they
act).[^166] Second, if they act "for or on behalf of a foreign power
which engages in clandestine intelligence activities in the United
States contrary to the interests of the United States, when the
circumstances of such person's presence in the United States indicates
that such person may engage in such activities in the United States, or
when such person knowingly aids or abets any person in the conduct of
such activities or knowingly conspires with any person to engage in such
activities."[^167]

The Act includes two categories of foreign intelligence information. The
first category targets specific conduct or information, while the second
category generally targets certain groups. The first category covers
information regarding

> actual or potential attack or other grave hostile acts of a foreign
> power or an agent of a foreign power; sabotage or international
> terrorism by a foreign power or an agent of a foreign power; or
> clandestine intelligence activities by an intelligence service or
> network of a foreign power or by an agent of a foreign power.[^168]

If the surveillance does not target any United States person, the
information need only relate to these activities. However, if the
surveillance targets any United States person, the information must be
necessary to the United States' ability to protect against these
specific activities.[^169] The second category, while much broader in
the scope of activities covered, is much more narrow in who it may
target. This category of foreign intelligence information must relate to
(or if a United States person is targeted it must be necessary to) the
national defense or the security of the United States or the conduct of
the foreign affairs of the United States. However, only information
relating to a foreign power or foreign territory is a proper target
under this category.[^170]

Minimization procedures play an important role under FISA. The Attorney
General must adopt specific procedures that are reasonably designed in
light of the purpose and technique of the particular surveillance, to
minimize the acquisition and retention, and prohibit the dissemination,
of information not publicly available concerning "unconsenting United
States persons."[^171] Such procedures must prohibit the dissemination
of "nonpublicly available information, which is not foreign intelligence
information, . . . in a manner that identifies any United States person,
without such person's consent, unless such person's identity is
necessary to understand foreign intelligence information or assess its
impor­tance."[^172] There are two exceptions to the above requirements.
First, §1801(h)(3) authorizes procedures for "the retention and
dissemination of information that is evidence of a crime which has been,
is being, or is about to be committed and that is to be retained or
disseminated for law enforcement purposes."[^173] Additionally, in the
case of electronic surveillance conducted under 50 U.S.C. §1802
(surveillance without an order), a court order must be issued before any
communications to which a United States person is a party may be
disclosed, disseminated, or used for any purpose[^174] or retained for
longer than twenty-four hours.[^175]

§1802 Electronic Surveillance Without a Court Order

FISA provides for the President, through the Attorney General, to
authorize electronic surveillance without a FISC order.[^176] The
surveillance must be for the purpose of acquiring foreign intelligence
information, and may only last for up to a year.[^177] The Attorney
General must make certain sworn, written statements. First, he or she
must certify either that the surveillance is solely directed at either
the acquisition of the contents of communications transmitted by means
of communications used exclusively between or among foreign powers, or
the acquisition of technical intelligence, other than spoken
communications of individuals, from property or premises under the open
and exclusive control of a certain types of foreign powers.[^178] For
purposes of this section, the statute limits the definition of foreign
power to those found in 50 U.S.C. §1801(a)(1)-(3).[^179]

Next, the Attorney General's sworn, written certifications must also
state that "there is no substantial likelihood that the surveillance
will acquire the contents of any communi­cation to which a United States
person is a party,"[^180] and that "the proposed minimization procedures
meet the requirements of the Act."[^181] Electronic surveillance
conducted under this section may not continue for more than one
year.[^182]

§1804 Applications for Court Orders

All applications for FISC orders must be made by a federal officer and
must be approved by the Attorney General. The application must include
"the identity, if known, or a description of the target of the
electronic surveillance."[^183] The application also must include a
statement of the facts and circumstances relied upon to justify the
belief that "the target of the electronic surveillance is a foreign
power or an agent of a foreign power; and each of the facilities or
places at which the electronic surveillance is directed is being used,
or is about to be used, by a foreign power or an agent of a foreign
power."[^184] Additional requirements include a statement of the
proposed minimization procedures and a detailed description of the
nature of the information sought and the type of communications or
activities to be subjected to surveillance.[^185]

A specified national security or defense expert must also make certain
certifications. These certifications include that the information sought
is indeed foreign intelligence information, that the purpose of the
surveillance is to obtain foreign intelligence information, and that the
information cannot reasonably be obtained by normal investi­gative
techniques.[^186]

The application also must include a statement of the means by which the
surveillance will be effected, a statement as to whether or not physical
entry is required, a statement regarding the period of time for which
the surveillance will be required, and details regarding any previous
applications involving any of the people, places, or facilities targeted
in this application.[^187]

§1805 Issuing Court Orders and Emergency Orders

A FISA judge[^188] is required to approve the electronic surveillance if
he or she makes certain findings.[^189] These findings must include a
finding of probable cause that the target of the electronic surveillance
is a foreign power or an agent of a foreign power.[^190] Additionally,
the judge must find probable cause that "each of the facilities or
places at which the electronic surveillance is directed is being used,
or is about to be used, by a foreign power or an agent of a foreign
power."[^191] The judge must additionally find that the proposed
minimization procedures meet the requirements of FISA and that the
application contains the requisite certifications.[^192]

The Attorney General may approve an emergency order when he or she
reasonably determines that "an emergency situation exists with respect
to employment of electronic surveillance to obtain foreign intelligence
information before an order authorizing such surveillance can with due
diligence be obtained."[^193] The Attorney General must find a factual
basis for issuance of an order under the Act. Finally, an application
for an order must be made as soon as practicable, but no more than
twenty-four hours after the Attorney General authorizes the emergency
action.[^194]

Miscellaneous Provisions

Two other provisions merit attention. Section 1806 describes the
situations where the fruits of FISA electronic surveillance may be
used.[^195] Furthermore, this section provides for the suppression of
unlawfully obtained information, or information obtained by surveillance
not made in conformity with the Act.[^196] Additionally, any otherwise
privileged communication does not lose its privileged character by
virtue of its being obtained under the Act.[^197]

The act also criminalizes intentionally engaging in electronic
surveillance under color of law except as authorized by the Act.[^198]
Additionally, criminal sanctions exist for anyone disclosing or using
information obtained under color of law by electronic surveillance,
knowing or having reason to know that the information was obtained
through electronic surveillance not authorized by the Act.[^199]

*2. Application of FISA in Cyberspace*

Since the enactment of FISA, the world has experienced the explosive
growth of both the personal computer industry and the Internet. What
formerly required physical trespass by agents of foreign powers at great
personal risk, now can often be accom­plished from a lone personal
computer with a dial-up connection to the Internet.[^200] Hackers often
attempt to exploit sensitive national security systems.[^201] These
attempts can use techniques such as spoofing and site hopping to avoid
detection by law enforce­ment personnel. Compounding the problem is the
fact that law enforcement is critically understaffed to trace even a
fraction of the detected intrusion attempts.[^202] While many of these
intrusion attempts are motivated by adolescent angst, some originate
with foreign powers or agents of foreign powers.[^203] FISA no longer
strikes an appropriate balance.

Under FISA, a FISC order cannot issue unless the judge finds probable
cause to believe that the target of the electronic surveillance is a
foreign power or an agent of a foreign power. However, FISA grew out of
cases from involving situations where the govern­ment could characterize
the target. The computer era no longer allows us to do so, at least not
initially. When a computer network intrusion attempt is detected, the
source of the attempt is unknown. If the government is limited to
traditional law enforcement means, the intruder will be gone before he
or she is identified. For example, if any hop involves an unfriendly
country, traditional techniques may never discover the identity of the
intruder if that country chooses not to cooperate and allow United
States authorities to review logs in the computers used for the hop.
Even more troublesome is the case of a hacker using a prepaid long
distance calling card from a pay telephone to start his or her intrusion
attempt. Traditional law enforcement will, at best, reach back as far as
the telephone, but there is not likely to be any record of who used the
telephone.

If an appropriately limited exception allowed active electronic
surveillance during the intrusion attempt, government officials would be
able to detect the source of more intrusions. Any such process must
adequately balance both the rights guaranteed by the Fourth Amendment
and the government's ability to collect foreign intelligence informa­tion
and protect national security.[^204]

*3. A Proposed Amendment*

The first step in addressing the problem is to designate which systems
are vital to our national defense or security. Shockingly, while some
systems are vital to our national security, under current law, the
government is limited to the same tools used to investigate an intrusion
attempt against, for example, the local video rental store. An
appropriate individual or group could designate these vital systems. For
example, the law could require that the systems be identified in an
Executive Order. Additionally, in order to prevent abuses, the FISA
court could review any such designation either at the time of the
designation, or at any later probable cause hearing. The detection of an
intrusion attempt against one of these vital systems would trigger a
three-phased response.

The first phase is based on exigent circumstances. The Supreme Court has
recognized exigent circumstances exceptions to the warrant requirement,
however, these excep­tions "have been few in number and carefully
delineated."[^205] These exceptions, in general, "serve the legitimate
needs of law enforcement officers to . . . preserve evidence from
destruction."[^206] One could argue that any attempt at unauthorized
access to any federal interest computer could trigger an exigent
circumstances exception.[^207] However, limiting the exigent
circumstances exception to those cases involving properly designated
systems is another means of carefully tailoring the exception to the
legiti­mate and compelling need to protect national security and to
collect foreign intelligence information.

The initial phase would last for up to twenty-four hours. Within that
period, the govern­ment would need to make an application to a FISA
judge. This application would identify the system involved, it would
include sworn statements regarding any information the government has
regarding the identity of the intruder, and a sworn statement that the
purpose of the surveillance is to gather foreign intelligence or
national security informa­tion. Such an application could also indicate
any minimization procedures being used to minimize the interception of
unrelated information (say, for example, on intermediate systems used by
the intruder). If the judge finds probable cause that the purpose of the
surveillance is proper, and that the minimization procedures are
adequate, he or she would issue an order authorizing the government to
continue the surveillance pending identification of the intruder. These
orders could be for limited time periods. Such time limitations should
be long enough to allow additional evidence to be obtained. However,
they should also be short enough as to present an administrative burden
that would serve as an additional barrier to abuse. A one-week period
would seem appropriate.

The second phase would end when the judge denies an application, or a
renewal application.[^208] If the government were successful in
identifying or locating the intruder, the third phase would begin. In
this third and final phase, the government would seek a normal FISA
order, or a Title III order, as appropriate. During this third phase,
one could argue that the government should be allowed to make use of
presumptions used elsewhere under FISA. For example, current military
regulations presume that a person or organization outside the United
States is not a United States person "unless specific information to the
contrary is obtained."[^209] Likewise, an alien in the United States is
not presumed to be a United States person "unless specific information
to the contrary is obtained"[^210] These presumptions are particularly
appropriate in computer intrusion cases, because even if the government
can locate the computer used in the intrusion attempt, it is unlikely
that the government will be able to identify the operator of the
computer.[^211] An additional limitation on military defenders of the
NII/DII is found in the Posse Comitatus Act.

E. Posse Comitatus Act

The Posse Comitatus Act[^212] (PCA) reflects our deeply rooted belief in
the division between civil law enforcement and military actions.[^213]
Indeed, the concept of limiting military involvement in civil matters
has been a part of Anglo-American history since it was first included in
the Magna Carta in 1215.[^214] The PCA was enacted in 1878 in response
Southern complaints about the use of federal troops in a law enforcement
role during the Reconstruction period.[^215] The PCA states,

> Whoever, except in cases and under circumstances expressly authorized
> by the Constitution or Act of Congress, willfully uses any part of the
> Army or the Air Force as a posse comitatus or otherwise to execute the
> laws shall be fined under this title or imprisoned not more than two
> years, or both.[^216]

While the provisions of the PCA are deeply rooted in American history,
they remain statutory. Congress remains empowered to authorize military
assistance to civilian law enforcement.[^217] An example of such an
authorization is the involvement of the United States military in the
drug interdiction campaign.[^218] Additionally, while the PCA has been a
part of our criminal law for more than 120 years, no one has ever been
prosecuted for violating it.[^219] However, courts have had
opportunities to interpret it.

Several cases have dealt with defendants arguing that the actions of the
military improperly assisted in their prosecution.[^220] Other cases
have involved private causes of actions against military officials
participating in or authorizing certain operations.[^221] Finally, the
United States has used the PCA to shield itself from liability in a
Federal Tort Claims Act case.[^222]

Courts have applied several tests in determining whether the PCA has
been violated in a given case. One test requires direct, active
involvement by one or more military mem­bers. This test is founded upon
the observation that "the prevention of the use of military supplies and
equipment was never mentioned in the debates, nor can it reason­ably be
read into the words of the Act."[^223] A second line of cases prohibits
the use of one or more military members in a role that pervades the
activities of civil law enforcement organizations.[^224] This standard
seems to allow the use of military equipment, but may prohibit the use
of military members to operate or maintain the equipment. It also may
prevent the use of military advisor. The final standard prevents the use
of military members in a manner that amounts to the exercise of
regulatory, proscriptive, or compulsory military power.[^225] This test
focuses on how military power is employed against the citizenry.

> It is the nature of their primary mission that military personnel must
> be trained to operate under circumstances where the protection of
> constitu­tional freedoms cannot receive the consideration needed in
> order to assure their preservation. The posse comitatus statute is
> intended to meet that danger. \[T\]he feared use \[of military
> personnel\] which is prohibited by the posse comitatus statute is that
> which is regulatory, proscriptive or compul­sory in nature, and causes
> the citizens to be presently or prospectively subject to regulations,
> proscriptions, or compulsions imposed by military authority.[^226]

Under any of these standards, the use of military members to trace the
trail of an intruder into the NII/DII may violate the PCA. One could
argue that such actions are in response to criminal activities directed
against military assets, and that the PCA allows the military some
latitude.[^227] However, the nature of the Internet again must be
considered. Since most intrusion attempts directed against the NII/DII
will involve innocent interme­diate computer systems, Congress should be
more explicit in whether, and to what extent the military may become
involved in such activity. This clarification will be particularly
necessary as the role and responsibility of the DOD in performing
"Homeland Defense" receives greater attention.

V. CONCLUSION

The Internet has forever changed the nature of our lives. However, while
the wired world brings with it many advantages, so too does it bring
many new, and potentially catastrophic dangers. Congress needs to
maintain an appropriate balance between our civil liberties and the
national security. A return to the days of unfettered Executive
discretion is unwise and dangerous. However, potential intruders have
access to a host of very effective "weapons" on the Internet. The
defenders of our NII/DII need access to appropriate tools under
appropriate circumstances in order to defend our national security. The
current state of affairs allows too many intruders to escape
identification. The time to authorize limited exceptions to current law
is now, not after we suffer an "Electronic Pearl Harbor."

[^1]: ^\*^ *Lieutenant Colonel Dhillon (B.S., USAF Academy; J.D.,
    Harvard University; LL.M., University of Houston) is Chief,
    Operational Law, United States Space Command & North American
    Aerospace Defense Command, Peterson AFB, Colorado.*

[^2]: ^\*\*^ *Lieutenant Colonel Smith (B.S., USAF Academy; J.D., Boalt
    Hall, U.C. Berkley; LL.M., The John Marshall Law School) is Chief,
    Information Technology & Privacy, General Law Division, Office of
    the Air Force Judge Advocate General, The Pentagon, Washington, DC*.

[^3]: The Report of the President's Commission on Critical
    Infrastructure Protection, *Critical Foundations: Protecting
    America's Infrastructures*, Oct. 1997, p.3 \[hereinafter *Critical
    Foundations*\].

[^4]: Exec. Order No. 13,010, 61 Fed. Reg. 37,345 (July 17, 1996),
    *available at* http://www.access.gpo.gov/su_docs/aces/aces140.html
    \[copy on file with the *Air Force Law Review*\].

[^5]: *Critical Foundations*, supra note 1, at 4.

[^6]: WHITE PAPER, *The Clinton Administration's Policy on Critical
    Infrastructure Protection: Presidential Decision Directive 63*, May
    22, 1998, p.1, *available at*
    http://www.doc.gov/cio/oipr/whitepaper.html (copy on file with the
    *Air Force Law Review*) \[hereinafter WHITE PAPER\].

[^7]: The chief of the Federal Bureau of Investigation's National
    Infrastructure Protection Center highlights the interdependence as
    follows:

    > \[E\]lectronic power grids and natural gas pipelines are
    > controlled by computer systems, and those computers may be linked
    > to each other and to the company headquarters by publicly
    > accessible telecommunications systems and commercially available
    > information technologies to allow efficient management of power
    > generation and smooth delivery to consumers. Billions of shares
    > are traded each day over the telephone or Internet, and the stock
    > exchanges could not function today without their vast networks of
    > computers. Banks no longer rely on ledger books and safe deposit
    > boxes to account for and secure their holdings, but depend on
    > computerized accounting systems to manage depositors' accounts.
    > The telecommunications system itself no longer uses operators to
    > manually plug in calls to a switchboard but depends on
    > computerized switching stations to handle the billions of calls
    > placed each day. The government also relies on computers and
    > publicly available communications systems to conduct the nation's
    > business.

    Michael Vatis, Cybercrime, Transnational Crime and Intellectual
    Property Theft, Prepared Statement to the Joint Economic Committee,
    United States Congress, Mar. 24, 1998, *available at*
    http://www.house.gov/jec/hearings/cyber/vatis.htm (copy on file with
    the *Air Force Law Review*) \[hereinafter Michael Vatis\].

[^8]: WHITE PAPER, *supra* note 4, at 1.

[^9]: Michael Vatis, *supra* note 5, at 2.

[^10]: *See* Robert MacMillian, *Big Increase in Net Warfare Predicted*,
    [Newsbytes]{.smallcaps}, Mar. 23, 2000 (noting China plans to create
    a fourth branch of their armed forces devoted to cyber warfare).

[^11]: WHITE PAPER, *supra* note 4, at 1.

[^12]: American Civil Liberties Union v. Janet Reno, 929 F. Supp. 824,
    830 (E.D. Pa. 1996).

[^13]: Dr. Robert E. Kahn, Statement to the Senate Committee on the
    Judiciary, Nov. 4, 1997, Federal News Service.

[^14]: *Id*.

[^15]: *Id.*

[^16]: *Id.*

[^17]: "Estimates that there will be over 1 billion users on the
    Internet by 2000 underscores the importance of establishing trust
    and security in a highly distributed, network-centric computing
    environment such as the Defense Information Infrastructure (DII)."
    Arthur L. Money, Testimony Before the House Armed Services
    Committee, Subcommittee on Military Procurement, Military Research
    and Development, Feb. 23, 1999, *available at*
    http://www.house.gov/hasc/testimony/106thcongress/99-02-23money.htm
    (copy on file with the *Air Force Law Review*).

    > The nature of the Internet is such that it is very difficult, if
    > not impossible, to determine its size at a given moment. It is
    > indisputable, however, that the Internet has experienced
    > extraordinary growth in recent years. In 1981, fewer than 300
    > computers were linked to the Internet, and by 1989, the number
    > stood at fewer than 90,000 computers. By 1993, over 1,000,000
    > computers were linked. Today, over 9,400,000 host computers
    > worldwide, of which approximately 60 percent located within the
    > United States, are estimated to be linked to the Internet. This
    > count does not include the personal computers people use to access
    > the Internet using modems. In all, reasonable estimates are that
    > as many as 40 million people around the world can and do access
    > the enormously flexible communication Internet medium. That figure
    > is expected to grow to 200 million Internet users by the year
    > 1999.

    *ACLU v. Reno*, 929 F. Supp. at 830.

[^18]: George Tenet, Testimony to the Senate Governmental Affairs
    Committee, June 24, 1998, Federal News Service.

[^19]: *See* Center for Strategic and International Studies,
    *Cybercrime. . . Cyberterrorism. . . Cyberwarfare. . . : Averting an
    Electronic Waterloo*, 1998, *available at*
    http://www.csis.org/pubs/cyberfor.html.

    > The U.S. today faces a new and unprecedented threat: strategic
    > information warfare. There is now the potential for a dedicated,
    > sophisticated adversary to conduct coordinated strikes against the
    > computers, communications systems, and databases that underpin
    > modern society. This is not mere hacking or computer crime; rather
    > the objectives are geopolitical and economic. And traditional
    > national security measures will be ineffective. . . . This report
    > assess that threat and points the way towards practical responses.

    *Id*. at Forward.

[^20]: *See* *Cyber Threats Are All Too Real: Governments Fail to
    Comprehend Information Warfare*, [Nat'l Post]{.smallcaps}, Feb. 20,
    1999, § D, at 3 (citing example involving the theft of \$10 million
    from Citibank, and the subsequent use of the incident by
    competitors).

[^21]: *Id.*

[^22]: General Accounting Office, *Information Security---Computer
    Attacks at Department of Defense Pose Increasing Risks*,
    (GAO/AIMD-96-84) May 1996, 12, *available at*
    http://epic.org/security/GAO_DOD_security.html (copy on file with
    the *Air Force Law Review*) \[hereinafter *Information Security*\].

[^23]: Department of the Air Force, A Primer on Legal Issues in
    Information Operations, p.4 (copy on file with the authors).

[^24]: *See* Daniel Verton, *Cyberdefense Alarms Ring on Hill*, [Federal
    Computer Week]{.smallcaps}, Mar. 10, 2000, *available at*
    http://www.fcw.com; Daniel Verton, *Cyber Attacks Up 300 Percent
    This Year*, Military and C4I, Inforwar.com, Nov. 8, 1999, *available
    at* http://www.infowar.com.

[^25]: John J. Hamre, Testimony Before the Senate Armed Services
    Committee, Subcommittee on Emerging Threats and Capabilities, Mar.
    16, 1999 (copy on file with the *Air Force Law Review*).

[^26]: *Id.*

[^27]: *Id.*

[^28]: *Id.*

[^29]: *See* Matthew G. Devost, National Security in the Information Age
    16 (1995) (unpublished M.A. thesis, The University of Vermont),
    *available at* http://www.terrorism.com/documents/devostthesis.html
    (citing the results of a study showing an 88 percent success rate
    for intrusion attempts, a 4 percent detection rate, and a response
    rate of 5 percent for the detected intrusions).

[^30]: Michael Vatis, Testimony Before the United States Senate, June
    10, 1998.

[^31]: The Department of Justice Press Release stated

    > In many respects, a loop carrier system serves the same function
    > as a circuit breaker box in a home or an apartment. Individual
    > wires do not run from each plug or light in a home or an apartment
    > to the electric company. Rather, the myriad of plugs and lights
    > are connected to a circuit breaker box in a corner of the home or
    > apartment, to which the electric company attaches a single,
    > efficient cable. If the circuit breaker box is disabled, however,
    > none of the lights and outlets in the house can function. Loop
    > carrier systems are used by telephone companies to integrate
    > service provided over hundreds of telephone lines for digital
    > transmission over a single, high capacity fiber-optic cable to a
    > central office.

    Department of Justice Press Release, Juvenile Computer Hacker Cuts
    Off FAA Tower At Regional Airport---First Federal Charges Brought
    Against A Juvenile For Computer Crime (Mar. 18, 1998), *available
    at* http://www.usdoj.gov/criminal/cybercrime/juvenilepld.htm (copy
    on file with the *Air Force Law Review*).

[^32]: Jack Danahy, Framing the Issues: Some Examples, A Presentation to
    the Center for Law, Ethics, and National Security at Duke
    University, Apr. 1998, p.2.

[^33]: *Id.*

[^34]: *Id.*

[^35]: *Id.*

[^36]: *Id.*

[^37]: *Information Security*, *supra* note 20, at 13.

[^38]: *Id.*

[^39]: Lieutenant Colonel John Pirog, Rome Lab Break-In, Presentation to
    the Legal Aspects of Information Operations Symposium, Air Force
    Judge Advocate General School, Oct. 20, 1999.

[^40]: *Information Security*, *supra* note 20, at 13.

[^41]: *Id.*

[^42]: *Id.*

[^43]: Gregory Vistica and Evan Thomas, *The Secret Hacker Wars*,
    [Newsweek]{.smallcaps}, June 1, 1998, at 60.

[^44]: *Id.*

[^45]: F. Whitten Peters and Richard Marshall, Defensive Information
    Operations, Presentation to the Legal Aspects of Information
    Operations Symposium, Air Force Judge Advocate General School, Oct.
    18, 1997.

[^46]: Ellie Padgett, Testimony to the United States Senate Subcommittee
    on Technology, Terrorism and Government Information, June 10, 1998,
    Federal Document Clearing House, Inc.

[^47]: [James Adams, The Next World War: Computers are the Weapons and
    the Front Line is Everywhere]{.smallcaps} 187-88 (1998).

[^48]: Dan Verton, *DOD Web-Watchers Find War Plans Online*, [Federal
    Computer Week]{.smallcaps}, Apr. 26, 2000, *available at*
    http://www.fcw.com.

[^49]: *Id.*

[^50]: *Id.*

[^51]: *Id.*

[^52]: *Id.*

[^53]: *Id.*

[^54]: In response to these problems, the Department of Defense is
    considering moving all of its networks off of the Internet. *See*
    Dan Verton, *DOD Pushing Forward on Internet Disconnect*, [Federal
    Computer Week]{.smallcaps}*,* Apr. 26, 2000, *available at*
    http://www.fcw.com (stating Department of Defense remains committed
    to developing a technical architecture that will allow it to
    disconnect from the Internet).

[^55]: "Civil liberties, as guaranteed by the Constitution, imply the
    existence of an organized society maintaining public order without
    which liberty itself would be lost in the excesses of unrestrained
    abuses." Cox v. New Hampshire, 312 U.S. 569, 574 (1941).

[^56]: A debate still rages over which clause is the central purpose of
    the Fourth Amendment. *See* Jennifer Y. Buffaloe, *"Special Needs"
    and the Fourth Amendment: An Exception Poised to Swallow the Warrant
    Preference Rule*, 32 [Harv. C.R.-C.L. L. Rev.]{.smallcaps} 529, 529
    n.2 (Summer, 1997) ("*Compare* [Jacob W. Landynski, Search and
    Seizure and the Supreme Court: A Study in Constitutional
    Interpretation]{.smallcaps} 42 (1966) . . . , *with* Akhil Reed
    Amar, *Fourth Amendment First Principles*, 107 [Harv. L.
    Rev]{.smallcaps}. 757, 801 (1994) (arguing that the 'core of the
    Fourth Amendment . . . is neither a warrant nor probable cause, but
    reasonableness.')").

[^57]: "Inherent in the concept of a warrant is its issuance by a
    'neutral and detached magistrate.' *Coolidge v. New Hampshire,*
    \[403 U.S. at 481\]; *Katz v. United States*, \[389 U.S. at 356\]"
    United States v. United States District Court for the Eastern
    District of Michigan, 407 U.S. 297, 304 (1972).

[^58]: Jennifer Y. Buffaloe, "*Special Needs*" *and the Fourth
    Amendment: An Exception Poised to Swallow the Warrant Preference
    Rule*, 32 [Harv. C.R.-C.L. L. Rev.]{.smallcaps} 529, 530 (Summer
    1997). *See* Almeida-Sanchez v. United States, 413 U.S. 266, 277
    (1973) (Powell, J., concurring) ("But it is by now axiomatic that
    the Fourth Amendment's proscription of 'unreasonable searches and
    seizure' is to be read in conjunction with its command that 'no
    Warrants shall issue, but upon probable cause.").

[^59]: *See* Craig M. Bradley, *Two Models of the Fourth Amendment*, 83
    [Mich. L. Rev]{.smallcaps}. 1468, 1473-74 (1985) (identifying twenty
    exceptions to the warrant preference rule); Elise Bjorkan Clare et
    al., *Warrantless Searches and Seizures*, 84 [Geo. L.J]{.smallcaps}.
    717, 743 (1996) (thirteen categories of exceptions, including
    searches in which the special needs of law enforcement make the
    probable cause requirement impracticable).

[^60]: Michelle Skatoff-Gee, *Changing Technologies and the Expectation
    of Privacy: A Modern Dilemma*, 28 [Loy. U. Chi. L.J]{.smallcaps}.
    189, 192 (Fall, 1996).

[^61]: Olmstead v. United States, 277 U.S. 438 (1928).

[^62]: *Id.* at 466 (emphasis added).

[^63]:
    > Clauses guaranteeing to the individual protection against specific
    > abuses of power, must have a similar capacity of adaptation to a
    > changing world. It was with reference to such a clause that this
    > Court said in *Weems v. United States*, 217 U.S. 349, 373:
    > 'Legislation, both statutory and constitutional is enacted, it is
    > true, from an experience of evils, but its general language should
    > not, therefore, be necessarily confined to the form that evil had
    > theretofore taken. Time works changes, brings into existence new
    > conditions and purposes. Therefore a principle to be vital must be
    > capable of wider application than the mischief which gave it
    > birth. This is peculiarly true of constitutions. They are not
    > ephemeral enactments, designed to meet passing occasions. . . .
    > The future is their care and provision for events of good and bad
    > tendencies of which no prophecy can be made. In the application of
    > a constitution, therefore, our contemplation cannot be only of
    > what has been but of what may be.

    *Id.* at 472-73 (Brandeis, J., dissenting).

[^64]:
    > The progress of science in furnishing the Government with means of
    > espionage is not likely to stop with wire-tapping. Ways may some
    > day be developed by which the Government, without removing papers
    > from secret drawers, can reproduce them in court, and by which it
    > will be enabled to expose to a jury the most intimate occurrences
    > of the home.

    *Id.* at 474.

[^65]:
    > \[I\]t follows necessarily that the \[Fourth\] Amendment is
    > violated by the officer's reading the paper without a physical
    > seizure, without his even touching it. . . . The makers of our
    > Constitution undertook to secure conditions favorable to the
    > pursuit of happiness. They recognized the significance of man's
    > spiritual nature, of his feelings and of his intellect. They know
    > that only a part of the pain, pleasure and satisfactions of life
    > are to be found in material things. They sought to protect
    > Americans in their beliefs, their thoughts, their emotions and
    > their sensations. They conferred, as against the Government, the
    > right to be let alone\--the most comprehensive of rights and the
    > right most valued by civilized men. To protect that right, every
    > unjustifiable intrusion by the Government upon the privacy of the
    > individual, whatever the means employed must be deemed a violation
    > of the Fourth Amendment.

    *Id.* at 478.

[^66]: Katz v. United States, 389 U.S. 347 (1967).

[^67]: *Id.* at 348.

[^68]: *Id.* at 351.

[^69]:
    > Because of the misleading way the issues have been formulated, the
    > parties have attached great significance to the characterization
    > of the telephone booth from which the petitioner placed his calls.
    > The petitioner has strenuously argued that the booth was a
    > 'constitutionally protected area.' The Government has maintained
    > with equal vigor that it was not. But this effort to decide
    > whether or not a given 'area,' viewed in the abstract, is
    > 'constitutionally protected' deflects attention from the problem
    > presented by this case. For the Fourth Amendment protects people,
    > not places. What a person knowingly exposes to the public, even in
    > his own home or office, is not a subject of Fourth Amendment
    > protection. . . . But what he seeks to preserve as private, even
    > in an area accessible to the public, may be constitutionally
    > protected.

    *Id.* at 351 (citations omitted).

[^70]: One commentator has observed,

    > Based on Justice Harlan's concurring opinion in *Katz v. United
    > States*, the Supreme Court has developed a two-part test to
    > determine whether a given inspection is a search: if the
    > government action has violated an individual's subjective
    > expectation of privacy, and if society recognizes that expectation
    > as reasonable, then the inspection is a search and the protections
    > of the Fourth Amendment apply. . . . \[T\]he *Katz* test remains
    > the relevant inquiry for determining whether a search has taken
    > place.

    Note, *Keeping Secrets in Cyberspace: Establishing Fourth Amendment
    Protection for Internet Communication*, 110 [Harv. L.
    Rev]{.smallcaps}. 1591, 1596 (May, 1997).

[^71]:
    > I join the opinion of the Court, which I read to hold only (a)
    > that an enclosed telephone booth is an area where, like a home,
    > *Weeks v. United States*, and unlike a field, *Hester v. United
    > State*s, a person has a constitutionally protected reasonable
    > expectation of privacy; (b) that electronic as well as physical
    > intrusion into a place that is in this sense private may
    > constitute a violation of the Fourth Amendment; and (c) that the
    > invasion of a constitutionally protected area by federal
    > authorities is, as the Court has long held, presumptively
    > unreasonable in the absence of a search warrant. . . . As the
    > Court's opinion states, 'the Fourth Amendment protects people, not
    > places.' The question, however, is what protection it affords to
    > those people. Generally, as here, the answer to that question
    > requires reference to a 'place.' My understanding of the rule that
    > has emerged from prior decisions is that there is a twofold
    > requirement, first that a person have exhibited an actual
    > (subjective) expectation of privacy and, second, that the
    > expectation be one that society is prepared to recognize as
    > 'reasonable.' Thus a man\'s home is, for most purposes, a place
    > where he expects privacy, but objects, activities, or statements
    > that he exposes to the \"plain view\" of outsiders are not
    > 'protected' because no intention to keep them to himself has been
    > exhibited. On the other hand, conversations in the open would not
    > be protected against being overheard, for the expectation of
    > privacy under the circumstances would be unreasonable.

    *Katz*, 389 U.S. at 361 (Harlan, J., concurring) (citations
    omitted).

[^72]: Raphael Winick, *Searches and Seizures of Computers and Computer
    Data*, 8 [Harv. J.L. & Tech]{.smallcaps}. 75, 81 (1994).

[^73]: *See, e.g.,* United States v. Myers, 46 F.3d 668, 670 (7th Cir.),
    *cert. denied*, 116 S.Ct. 213 (1995) (holding that the use of a
    thermal imager to detect heat emanating from a home did not
    constitute a search on the basis that it was comparable to a dog
    sniffing a luggage for drugs).

[^74]: *See, e.g.,* Chris J. Katopsis*, "Searching" Cyberspace: The
    Fourth Amendment and Electronic Mail*, 14 [Temp. Envtl. L. &
    Tech]{.smallcaps}. J. 175, 176 (1995); Winick, *supra* note Error:
    Reference source not found, at 81-82.

[^75]: *See*, *e.g.*, United States v. Maxwell, 45 M.J. 406, 416
    (C.A.A.F. 1996)

[^76]: 442 U.S. 735 (1979).

[^77]: "Pen registers are used to identify outgoing numbers called from
    a subject's phone line." Air Force Office of Special Investigations,
    Office of the Staff Judge Advocate, Legal Guide to Computer Crime,
    (1994) at 15.

[^78]: *Smith v. Maryland*, 442 U.S. at 743-44.

[^79]: An exception would be cases in which a court were to find a
    legitimate business reason for recording the contents of the e-mail.
    Prior to the enactment of the Digital Millennium Copyright Act, one
    example of a legitimate business requirement would have been to
    avoid copyright infringement actions.

[^80]: Winick, *supra* note Error: Reference source not found, at 82.

[^81]: Minnesota v. Olson, 495 U.S. 91, 95-100 (1990) (overnight guest
    has reasonable expectation of privacy).

[^82]: "A typical home computer with a modest 100 megabyte storage
    capacity can contain the equivalent of more than 100,000 typewritten
    pages of information." Winick, *supra* note Error: Reference source
    not found, at 81.

[^83]: *See, e.g.,* United States v. Maxwell, 45 M.J. 406 (C.A.A.F.
    1996) (determining that a reasonable expectation of privacy existed
    in the private America Online account of an active duty Air Force
    officer charged with, among other things, transporting or receiving
    child pornography in interstate commerce.); United States v. Lyons,
    992 F.2d 1029 (10th Cir. 1993) (seizure of data from hard disks did
    not violate defendant's subjective expectation of privacy because he
    had no right to exclude others from the property in question.);
    United States v. Charbonneau, 979 F. Supp. 1177 (S.D. Ohio 1997)
    (determining that the extent of the expectation of privacy in e-mail
    transmissions are contextually dependent).

[^84]: *See* Almeida-Sanchez v. United States, 413 U.S. 266, 277 (1973)
    (Powell, J., concurring) ("But it is by now axiomatic that the
    Fourth Amendment's proscription of 'unreasonable searches and
    seizures' is to be read in conjunction with its command that 'no
    Warrants shall issue, but upon probable cause.'"); Johnson v. United
    States, 333 U.S. 10, 14 (1948) (holding that the requirement for a
    warrant exists absent an applicable pre-existing exception).

[^85]: *See*, *e.g*., Jeremy J. Calsyn et al., *Warrantless Searches and
    Seizures*, 86 [Geo. L.J]{.smallcaps}. 1214 (1998).

[^86]: United States v. Robinson, 414 U.S. 218, 234-36 (1973) (holding
    that the safety of the arresting officer justifies, but limits the
    scope of, a warrantless search of a person incident to a lawful
    arrest).

[^87]: Horton v. California, 496 U.S. 128, 136 (1990) (holding that no
    warrant required when officer is in a lawful position to observe
    apparently incriminating evidence).

[^88]: Mincey v. Arizona, 437 U.S. 385, 392-93 (1978) (holding that
    reasonable belief that entry is in response to one in need of
    "immediate aid" permissible).

[^89]: Schneckloth v. Bustamonte, 412 U.S. 218, 219 (1973) (holding that
    no warrant required if a person with authority has consented).

[^90]: United States v. Ramsey, 431 U.S. 606 (1977) (holding that
    warrant not required at the border to search individuals or items
    entering the country).

[^91]: For a discussion of the formal national security exception to the
    warrant requirement, see *supra*, section IV.C., the Electronic
    Communication Privacy Act.

[^92]: Michael Vatis, Prepared Statement to the Senate Committee on
    Judiciary, Subcommittee on Technology, Terrorism, and Government
    Information, Federal News Service, June 10, 1998, p.3.

[^93]: *See, e.g.,* U.S. v. Santana, 427 U.S. 38 (1976).

[^94]: The Department of Defense includes organizations that are
    responsible and authorized to perform law enforcement,
    intelligence/counter-intelligence, and service provider functions
    within the national security context. This discussion focuses on the
    primary national security role and responsibility of the DOD.
    Others, such as the FBI are tasked with law enforcement, not the
    military. Aside from "turf" battles preventing the military from
    stepping into the fray motivated by law enforcement purposes, as
    will be discussed below, the Posse Comitatus Act, 18 U.S.C. § 1385,
    specifically limits the participation of the Air Force in domestic
    law enforcement.

[^95]: New Jersey v. T.L.O., 469 U.S. 325 (1985).

[^96]: *Id*. at 340.

[^97]: *Id.*

[^98]: *Id.*

[^99]: *Id.* at 351 (Blackmun, J., concurring).

[^100]: *Id.* at 350-351 (Blackmun, J., concurring).

[^101]: O'Connor v. Ortega, 480 U.S. 709 (1987).

[^102]: *Id.* at 720.

[^103]: Griffin v. Wisconsin, 483 U.S. 868 (1987).

[^104]: *Id.* at 873-74.

[^105]: *Id.* at 878.

[^106]: Skinner v. Railway Labor Executives Ass'n, 489 U.S. 602 (1989).

[^107]: *Id.* at 620 (quoting Griffin v. Wisconsin, 483 U.S. 868, 873-74
    (1987)).

[^108]: Nat'l Treasury Employees Union et al. V. Van Raab, 489 U.S. 656
    (1989).

[^109]:
    > The Customs Service is our Nation's first line of defense against
    > one of the greatest problems affecting the health and welfare of
    > our population. . . . It is readily apparent that the Government
    > has a compelling interest in ensuring that front-line interdiction
    > personnel are physically fit, and have unimpeachable integrity and
    > judgment. Indeed, the Government's interest here is at least as
    > important as its interest in searching traveler's entering the
    > country. . . . While reasonable tests designed to elicit
    > \[information that bears on employee's fitness to perform their
    > duties\] doubtless infringe some privacy expectations, we do not
    > believe these expectations outweigh the Government's compelling
    > interests in safety and in the integrity of our borders.

    *Id.* at 668-71

[^110]: Vernonia School District 47J v. Action, 515 U.S. 646 (1995).

[^111]: *Id.* at 664.

[^112]: *Id.* at 665.

[^113]:
    > It is a mistake, however, to think that the phrase 'compelling
    > state interest,' in the Fourth Amendment context, describes a
    > fixed, minimum quantum of governmental concern, so that one can
    > dispose of a case by answering in isolation the question: Is there
    > a compelling state interest here? Rather, the phrase describes an
    > interest that appears important enough to justify the particular
    > search at hand, in light of other factors that show the search to
    > be relatively intrusive upon a genuine expectation of privacy.

    *Id.* at 661.

[^114]: Chinese Exclusion Case, 130 U.S. 581, 606 (1889).

[^115]: United States v. United States District Court for the Eastern
    District of Michigan, 407 U.S. 297 (1972) (referred to as the
    "*Keith*" case).

[^116]: *Id.* at 299.

[^117]: *Id.*

[^118]: *Id.*

[^119]: *Id.* at 301.

[^120]: *Id.* at 310 (quoting Article II, § 1 duty to "preserve, protect
    and defend the Constitution of the United States").

[^121]: *Id.* at 312.

[^122]: *Id.*

[^123]: *Id.*

[^124]: *Id.* at 314.

[^125]: *Id.*

[^126]: *Id.* at 315.

[^127]: *Id.*

[^128]: *Id.* at 324.

[^129]: *Id.* at 322-323 (for an application of different probable cause
    standards see the discussion on the Foreign Intelligence
    Surveillance Act, *supra* section VI.D.).

[^130]: Michael A. Vatis, Statement for the Record to the Senate Armed
    Service Committee, Subcommittee on Emerging Threats and
    Capabilities, Federal Document Clearing House, Mar. 16, 1999, at 2.

[^131]: 18 U.S.C. § 1030.

[^132]: *See* [R. Nimmer, The Law of Computer Technology
    12-19]{.smallcaps} (1997).

[^133]: One commentator has noted

    > The decision to pass a statute that limited federal intervention
    > to certain specific situations reflected legislators' realization
    > that the scope of the computer crime problem was not well known
    > and that their actions might have unforeseen repercussions.
    > Legislators considered and rejected broader bills that
    > criminalized the use of a computer as a part of a scheme to
    > defraud that affected interstate commerce, choosing instead to
    > protect only the most vital federal interests that could be
    > injured by computer users.

    Note, *The Computer Fraud and Abuse Act of 1986: A Measured Response
    to a Growing Problem*, 43 [Vand. L. Rev]{.smallcaps}. 453, 454
    (1990)

[^134]: The Computer Abuse Amendments of 1990, Senate Report 101-544
    (1990).

[^135]: *Id.*

[^136]: 18 U.S.C. § 1030(e)(2).

[^137]: The Act defines a protected computer as follows:

    > a computer exclusively for the use of a financial institution or
    > the United States Government, or, in the case of a computer not
    > exclusively for such use, used by or for a financial institution,
    > or the United States Government and the conduct constituting the
    > offense affects that use by or for the financial institution or
    > the Government; or which is used in interstate or foreign commerce
    > or communications.

    18 U.S.C. §1030(e)(2).

[^138]: Section 1030(a) reads as follows:

    > \(a\) Whoever---
    >
    > \(1\) having knowingly accessed a computer without authorization
    > or exceeding authorized access, and by means of such conduct
    > having obtained information that has been determined by the United
    > States Government pursuant to an Executive order or statute to
    > require protection against unauthorized disclosure for reasons of
    > national defense or foreign relations, or any restricted data, as
    > defined in paragraph y.\[(y)\] of section 11 of the Atomic Energy
    > Act of 1954 \[*42 USCS § 2014*(y)\], with reason to believe that
    > such information so obtained could be used to the injury of the
    > United States, or to the advantage of any foreign nation willfully
    > communicates, delivers, transmits, or causes to be communicated,
    > delivered, or transmitted, or attempts to communicate, deliver,
    > transmit or cause to be communicated, delivered, or transmitted
    > the same to any person not entitled to receive it, or willfully
    > retains the same and fails to deliver it to the officer or
    > employee of the United States entitled to receive it;
    >
    > \(2\) intentionally accesses a computer without authorization or
    > exceeds authorized access, and thereby obtains---
    >
    > \(A\) information contained in a financial record of a financial
    > institution, or of a card issuer as defined in section 1602(n) of
    > title 15, or contained in a file of a consumer reporting agency on
    > a consumer, as such terms are defined in the Fair Credit Reporting
    > Act *(*15 U.S.C. 1681 et seq.);
    >
    > \(B\) information from any department or agency of the United
    > States; or
    >
    > \(C\) information from any protected computer if the conduct
    > involved an interstate or foreign communication;
    >
    > \(3\) intentionally, without authorization to access any nonpublic
    > computer of a department or agency of the United States, accesses
    > such a computer of that department or agency that is exclusively
    > for the use of the Government of the United States or, in the case
    > of a computer not exclusively for such use, is used by or for the
    > Government of the United States and such conduct affects that use
    > by or for the Government of the United States;
    >
    > \(4\) knowingly and with intent to defraud, accesses a protected
    > computer without authorization, or exceeds authorized access, and
    > by means of such conduct furthers the intended fraud and obtains
    > anything of value, unless the object of the fraud and the thing
    > obtained consists only of the use of the computer and the value of
    > such use is not more than \$ 5,000 in any 1-year period;
    >
    > \(5\) (A) knowingly causes the transmission of a program,
    > information, code, or command, and as a result of such conduct,
    > intentionally causes damage without authorization, to a protected
    > computer;
    >
    > \(B\) intentionally accesses a protected computer without
    > authorization, and as a result of such conduct, recklessly causes
    > damage; or
    >
    > \(C\) intentionally accesses a protected computer without
    > authorization, and as a result of such conduct, causes damage;
    >
    > \(6\) knowingly and with intent to defraud traffics (as defined in
    > section 1029) in any password or similar information through which
    > a computer may be accessed without authorization, if---
    >
    > \(A\) such trafficking affects interstate or foreign commerce; or
    >
    > \(B\) such computer is used by or for the Government of the United
    > States;
    >
    > \(7\) with intent to extort from any person, firm, association,
    > educational institution, financial institution, government entity,
    > or other legal entity, any money or other thing of value,
    > transmits in interstate or foreign commerce any communication
    > containing any threat to cause damage to a protected computer;
    >
    > shall be punished as provided in subsection (c) of this section.

    18 U.S.C. § 1030(a).

[^139]: 18 U.S.C. § 1030(a)(2)(C).

[^140]: 18 U.S.C. § 1030(e)(2).

[^141]: In the Air Force, this unit is the Air Force Office of Special
    Investigations.

[^142]: In the Air Force, this unit is the Air Intelligence Agency.

[^143]: Senate Report No. 99-432, *reprinted in* 4 U.S.C.C.A.N. 2479.

[^144]: *See* Basil W. Mangano, *The Communications Assistance For Law
    Enforcement Act and Protection of Cordless Telephone Communications:
    The Use of Technology as a Guide to Privacy*, 44 [Clev. St. L.
    Rev]{.smallcaps}. 99, 104 (1996).

[^145]: James X. Dempsey, *Communications Privacy in the Digital Age:
    Revitalizing the Federal Wiretap Laws to Enhance Privacy*, 8 [Alb.
    L.J. Sci. & Tech]{.smallcaps}. 65, 71 (1997) (citing 18 U.S.C. §§
    2511, 2516, 2518).

[^146]: *Id.*

[^147]: *Id*. at 73.

[^148]: 18 U.S.C. § 2510(a)(12) defines Electronic Communication as

    > any transfer of signs, signals, writing, images, sounds, data, or
    > intelligence of any nature transmitted in whole or in part by a
    > wire, radio, electromagnetic, photoelectronic or photooptical
    > system that affects interstate or foreign commerce, but does not
    > include---
    >
    > \(A\) any wire or oral communication;
    >
    > \(B\) any communication made through a tone-only paging device;
    >
    > \(C\) any communication from a tracking device (as defined in
    > section 3117 of this title); or
    >
    > \(D\) electronic funds transfer information stored by a financial
    > institution in a communications system used for the electronic
    > storage and transfer of funds;

    18 U.S.C. § 2510(a)(12).

[^149]: While it is true that the list of felonies is itself a list of
    criminal acts, this difference in coverage allows more flexibility
    and does not require an amendment to ECPA to respond to new types of
    serious criminal activity.

[^150]: *See* Dempsey, *supra* note Error: Reference source not found,
    at 74.

[^151]: 407 U.S. at 321.

[^152]: *Id.*

[^153]: For an example of a policy that likely goes too far in allowing
    government access, see Associated Press, *Britain Plans Spy Center
    for Private E-mail*, [Chi. Trib]{.smallcaps}., May 11, 2000, § 1, at
    6.

[^154]: *See* 114 Cong. Rec. 14, 750 (1968) (remarks of Senator Hart)

    > As I read it---and this is my fear--- . . . the President . . .
    > could declare---name your favorite poison---draft dodgers, Black
    > Muslims, the Ku Klux Klan, or civil rights activists to be a clear
    > and present danger to the structure or existence of the Government
    > and thus possibly exempt from Title III's procedures under
    > 2511(3).

    *Id.*

[^155]: Robert A. Dawson, *Foreign Intelligence Surveillance Act:
    Shifting the Balance: the D.C. Circuit and the Foreign Intelligence
    Surveillance Act of 1978*, 61 [Geo. Wash. L. Rev.]{.smallcaps} 1380,
    1386 (June 1993)

[^156]: Foreign Intelligence Surveillance Act of 1978: Hearing Before
    the Subcommittee on Criminal Laws and Procedures of the Senate
    Committee on the Judiciary, 95th Congress, 1st Sess. 13 (1977)
    (quoted in S. Rep. No. 604, 95^th^ Cong., 1^st^ Sess., pt. 1 at 15
    (1977)), *reprinted in* 1978 U.S.C.C.A.N. 3904, 3916.

[^157]: FISA also addresses physical searches (50 U.S.C. §§ 1821-29),
    pen register, and trap and trace devices (50 U.S.C. §§ 1841-46), and
    access to certain business records (50 U.S.C. §§ 1861-63). However,
    this article will only discuss electronic surveillance.

[^158]: 50 U.S.C. § 1801(i).

[^159]: 50 U.S.C. § 1801(a).

[^160]: 50 U.S.C. § 1801(b)(2)(A).

[^161]: 50 U.S.C. § 1801(b)(2)(B).

[^162]: 50 U.S. § 1801(d) defines sabotage as activities that involve a
    violation of 18 U.S.C. §§ 2151 et seq., or that would involve such a
    violation if committed against the United States.

[^163]: In order for activities to meet the definition of international
    terrorism, they must meet three tests. First, they must "involve
    violent acts or acts dangerous to human life that are a violation of
    the criminal laws of the United States or of any State, or that
    would be a criminal violation if committed within the jurisdiction
    of the United States or any other state." Second, the acts must
    "appear to be intended to---(A) intimidate or coerce a civilian
    population; (B) influence the policy of a government by intimidation
    or coercion; or (C) affect the conduct of government by
    assassination or kidnapping." Finally, they must "occur totally
    outside the United States or transcend national boundaries in terms
    or means by which they are accomplished, the persons they appear
    intended to coerce or intimidate, or the locale in which their
    perpetrators operate or seek asylum." 50 U.S.C. § 1801(c).

[^164]: 50 U.S.C. § 1801(b)(2)(C).

[^165]: 50 U.S.C. § 1801(b)(2)(D).

[^166]: 50 U.S.C. § 1801(b)(1)(A).

[^167]: 50 U.S.C. § 1801(b)(1)(B).

[^168]: 50 U.S.C. § 1801(e)(1)(A)-(C).

[^169]: 50 U.S.C. § 1801(e)(1).

[^170]: 50 U.S.C. § 1801(e)(2).

[^171]: 50 U.S.C. § 1801(h)(1) (these procedures must also be consistent
    with the need of the United States to obtain, produce, and
    disseminate foreign intelligence information.

[^172]: 50 U.S.C. § 1801(h)(2).

[^173]: 50 U.S.C. § 1801(h)(3).

[^174]: The court order requirement applies to uses of such information
    under 50 U.S.C. § 1801(h)(3).

[^175]: 50 U.S.C. § 1801(h)(4).

[^176]: 50 U.S.C. § 1802.

[^177]: 50 U.S.C. § 1802(a)(1).

[^178]: 50 U.S.C. § 1802(a)(1)(A).

[^179]: 50 U.S.C. § 1802(a)(1)(A)(ii).

[^180]: 50 U.S.C. § 1802(a)(1)(B).

[^181]: 50 U.S.C. § 1802(a)(1)(C).

[^182]: 50 U.S.C. § 1802(a)(1).

[^183]: 50 U.S.C. § 1804(a)(3).

[^184]: 50 U.S.C. § 1804(a)(4).

[^185]: 50 U.S.C. § 1804(a)(5)-(6).

[^186]: 50 U.S.C. § 1804(a)(7)(A)-(C).

[^187]: 50 U.S.C. § 1804(a)(8)-(10).

[^188]: The Chief Justice of the United States publicly designates seven
    district court judges from seven of the United States judicial
    circuits. These judges have jurisdiction to hear applications for
    orders. 50 U.S.C. § 1803(a).

[^189]: 50 U.S.C. § 1805(a).

[^190]: 50 U.S.C. § 1805(a)(3)(A) (Note, however, that no United States
    person may be considered a foreign power or an agent of a foreign
    power solely upon the basis of activities protected by the First
    Amendment.).

[^191]: 50 U.S.C. § 1805(a)(3)(B).

[^192]: 50 U.S.C. § 1805(a)(4)-(5).

[^193]: 50 U.S.C. § 1805(e)(1).

[^194]: 50 U.S.C. § 1805(e)(2).

[^195]: 50 U.S.C. § 1806.

[^196]: 50 U.S.C. § 1806(e).

[^197]: 50 U.S.C. § 1806(a).

[^198]: 50 U.S.C. § 1809(a)(1).

[^199]: 50 U.S.C. § 1809(a)(2).

[^200]: *See*, *e.g.*, [Lawrence T. Greenberg et al., Information
    Warfare and International Law]{.smallcaps} (1997).

[^201]: *See*, *e.g.*, Robert Suro, *FBI Cyber Squad Fallin Behind in
    Rise in Computer Intrusions*, [Wash. Post]{.smallcaps}, Oct. 7, 1999
    (suggesting Russia poses the largest threat and reporting on the
    theft of "sensitive information about essential defense technical
    research" and characterizing the FBI office responsible for
    investigating suspected crimes as "still more virtual than real").

[^202]: *Id.* (detailing the rise in computer crimes, but a shortfall in
    trained law enforcement agents to investigate the crimes).

[^203]: The threat posed by foreign governments is likely to increase in
    the future. *See*, *e.g*., Bill Gertz, *China Plots Winning Role in
    Cyberspace,* [Wash. Times]{.smallcaps}, Nov. 17, 1999 (reporting
    that "China is preparing to carry out high-technology warfare over
    the Internet and could develop a fourth branch of the armed services
    devoted to information warfare").

[^204]: While FISA currently is limited to foreign intelligence
    information, such a limitation is solely based on the Act itself,
    and the Supreme Court specifically stated that a differing probable
    cause standard may apply to national security cases as well. *See*,
    *Keith*, 407 U.S. at 322-23.

[^205]: *Keith,* 407 U.S. at 318.

[^206]: *Keith,* 407 U.S. at 318*.*

[^207]: All such acts involve criminal activity under The Computer Fraud
    and Abuse Act, 18 U.S.C. §§ 1030, et seq. Any delay in responding to
    secure a warrant could in the loss of evidence.

[^208]: However, a procedure could exist to allow the government to
    continue the surveillance pending the results of any appellate
    procedure authorized under the amendment.

[^209]: Department of Defense Regulation 5240.1-R, Procedures Governing
    the Activities of DOD Intelligence Components that Affect United
    States Persons ¶ 25.b. (Dec. 1982).

[^210]: *Id.*

[^211]: Some may argue that such presumptions are inappropriate given
    that most reported intrusions ultimately involved United States
    persons. However, one can imagine that the government may not want
    to report detected intrusions by foreign agents. For example, the
    government may not want the foreign agent to know that they have
    been detected. Additionally, the individuals behind sophisticated
    intrusion attempts currently may go untraced under the current
    process. At any rate, once sufficient information is gathered
    regarding the identity or location of an intruder, then the
    government will be constrained by the appropriate rules.

[^212]: 18 U.S.C. § 1385.

[^213]: *See* Laird V. Tatum, 408 U.S. 1, 15-16 (1972) ("The concerns of
    the Executive and Legislative Branches . . . reflect a traditional
    and strong resistance of Americans to any military intrusion into
    civilian affairs. That tradition has deep roots in our history and
    found early expression, for example, in the Third Amendment\'s
    explicit prohibition against quartering soldiers in private homes
    without consent and in the constitutional provisions for civilian
    control of the military. Those prohibitions are not directly
    presented by this case, but their philosophical underpinnings
    explain our traditional insistence on limitations on military
    operations in peacetime.").

[^214]: Roger Blake Hohnsbeen, *Fourth Amendment and Posse Comitatus Act
    Restrictions on Military Involvement in Civil Law Enforcement*, 54
    [Geo. Wash. L. Rev]{.smallcaps}. 404, 404 (1986)

[^215]: Testimony of Brigadier General Walter B. Huffman, Assistant
    Judge Advocate General of Military Law and Operations, United States
    Army, before the House Judiciary Committee, July 20, 1995. One
    author comments

    > \[The Military Reconstruction Laws\] one way or another imposed on
    > the Army the duties of initiating and implementing state-making on
    > the basis of biracial citizen participation. Protecting the
    > personnel of the federal courts and Freedman's Bureau, shielding
    > blacks and whites who collaborated in the new order of equality
    > under state law from retaliations by indignant vigilante
    > neighbors, and monitoring the quality of the daily marketplace
    > justice in ten thousand villages---these were tasks that West
    > Point had not prepared Army officers to perform.

    [Harold Human, Ulysses Grant I, Emperor of America?: Some
    Civil-Military Continuities and Strains of the Civil War and
    Reconstruction, in The United States Military Under the Constitution
    of the United States]{.smallcaps} (Richard H. Kohn ed., 1991).

[^216]: 18 U.S.C. § 1385 (1998). Although the provisions of the PCA do
    not literally apply to the United States Navy, Department of Defense
    policy applies the same limitations on the Navy. *See* Department of
    Defense Directive 5525.5, DOD Cooperation with Civilian Law
    Enforcement Officials (Jan. 15, 1986).

[^217]: The 'posse comitatus' restriction on the use of U.S. military
    forces to enforce laws within the United States is not contained in
    the Constitution but rather in a post-reconstruction era Act of
    Congress. See 18 U.S.C. § 1385. That Act expressly recognizes that
    Congress can enact statutes authorizing military involvement in law
    enforcement. Further, its provisions have been construed by the
    courts to be limited to activities that involve the direct execution
    of laws, e.g., making arrests. In contrast, the Posse Comitatus Act
    has not been construed to preclude the military from providing
    logistical, technical, and other forms of assistance to law
    enforcement. For example, the military has traditionally provided
    assistance to law enforcement in explosive ordnance disposal.
    Recently, Congress enacted statutes specifically addressing the use
    of the military in response to terrorist incidents involving
    chemical and biological weapons of mass destruction. *See* 10 U.S.C.
    § 382; 18 U.S.C. §§ 175a and 2332e. Further, more generic statutes
    authorize the President to use military forces to resolve domestic
    emergencies. *See* 10 U.S.C. §§ 331- 333.

[^218]: Defense Drug Interdiction Assistance Act, Pub. L. No. 99-570, §§
    3051-57 (1986).

[^219]: Matthew Carlton Hammond, *The Posse Comitatus Act: A Principle
    in Need of Renewal*, 75 [Wash. U. L. Q]{.smallcaps}. 953, 961
    (Summer 1997).

[^220]: *See*, *e.g.*, United States v. Walden, 490 F.2d 372, 375 (4th
    Cir.), *cert. denied*, 416 U.S. 983 (1974); United States v. Cotten,
    471 F.2d 744, 747-48 (9th Cir.), *cert. denied*, 411 U.S. 936
    (1973); United States v. Casper, 541 F.2d 1275 (8th Cir. 1976),
    *cert. denied*, 430 U.S. 970 (1977); Gilbert v. United States, 165
    F.3d 470 (6th Cir. 1999).

[^221]: Bissonette v. Haig, 776 F.2d 1384 (8th Cir.1985); *aff\'d en
    banc*, 800 F.2d 812 (8th Cir.1986), *aff\'d*, 485 U.S. 264, 108 S.
    Ct. 1253, 99 L. Ed. 2d 288 (1988).

[^222]: Wrynn v. United States, 200 F. Supp. 457 (E.D. N.Y. 1961).

[^223]: United States v. Red Feather, 392 F. Supp. 916, 922 (1974).

[^224]: United States v. Jarmillo, 380 F. Supp. 1375 ( D. Neb. 1974).

[^225]: *See* United States v. McArthur, 419 F. Supp. 186 (D. N.D.
    1975), *aff'd sub nom* United States v. Casper, 541 F.2d 1275 (8th
    Cir. 1976).

[^226]: *Id.* at 193-94.

[^227]: *See* United States v. Banks, 539 F.2d 14, *cert. denied*, 429
    U.S. 1024 (1976).