### LEGALITY OF INTRUSION-DETE CTION SYSTEM TO PROTECT

UNCLASSIFIED COMPUTER NETWOR KS IN THE EXECUTIVE BRANCH

Operation of the EINSTEIN 2.0 intrusion-detecti on system complies with the Fourth Amendment

to the Constitution

, title III of the Omnibus Crime Control and Safe Streets Act of 1968, the Foreign Intelligence Surveillance Act, th e Stored Communications Act, and the pen register and trap and trace provisions of chapter 206 of title 18, United Stat es Code, provided that certain log-on banners or computer-user agreements are consistently adopted, implemented, and enforced by executive departments and agencies using the system. Operation of the EINSTEIN 2.0 system also does not run afoul of state wiretapping or communications privacy laws.

August 14, 2009

MEMORANDUM OPINION FOR AN

ASSOCIATE DEPUTY ATTORNEY GENERAL

This memorandum briefly summarizes the curre nt views of the Offi ce of Legal Counsel on the legality of the EINSTEIN 2.0 intrusion- detection system. This Office previously considered the legality of the system in an opinion of January 9, 2009. See Memorandum for Fred F. Fielding, Counsel to the President, from Steven G. Bradbury, Principal Deputy Assistant Attorney General, Office of Legal Counsel, Re: Legal Issues Relating to the Testing, Use, and Deployment of an Intrusion-Dete ction System (EINSTEIN 2.0) to Protect Unclassified Computer

Networks in the Executive Branch (Jan. 9, 2009) (“EINSTEIN 2.0 Opinion”). We have reviewed that opinion and agree that the operation of the EINSTEIN 2.0 pr ogram complies with the Fourth Amendment to the United States Constitution, ti tle III of the Omnibus Crime Control and Safe Streets Act of 1968, Pub. L. No. 90-351, 82 Stat. 211, 18 U.S.C. § 2510 et seq . (2006), as amended (“the Wiretap Act”), the Foreign Inte lligence Surveillance Act, Pub. L. No. 95-511, 92 Stat. 1783, 50 U.S.C. § 1801 et seq . (West Supp. 2009), as amended (“FISA”), the Stored Communications Act, Pub. L. No. 99-508, tit. II , 100 Stat. 1848 (1986), 18 U.S.C. § 2701(a)(1) (2006), as amended, and the pen register and trap and trace provision of title 18, United States Code, 18 U.S.C. § 3121 et seq . (2006), as amended. Accordingly, we have drawn upon the analysis in that opinion in preparing this summar y, supplementing that materi al with analysis of an additional legal issue.

We have assumed for purposes of our analys is that computer us ers generally have a legitimate expectation of privacy in the content of Internet comm unications (such as an e-mail)

while it is in transmission over the Internet. 1 See, e.g

., United States v. Lifshitz , 369 F.3d 173, 190 (2d Cir. 2004) (analogizing expect ation of email user in privacy of email to expectation of individuals communicating by regular mail); United States v. Maxwell , 45 M.J. 406, 418 (C.A.A.F. 1996) (sender of an email generally “enjoys a reasonable e xpectation that police officials will not intercept the transmission w ithout probable cause and a search warrant”); see

1 Computer users do not have an objectively reasonable expectation of privacy in addressing and routing information conveyed for the purpose of transmitting Internet communications to or from a user. See Quon v. Arch Wireless Operating Co., Inc ., 529 F.3d 892, 904-05 (9th Cir. 2008); United States v. Forrester , 512 F.3d 500, 510- 11 (9th Cir. 2008); cf. Smith v. Maryland , 442 U.S. 735, 743-44 (1979) (no legitimate expectation of privacy in dialing, routing, addressing, and signaling information transmitted to telephone companies).Opinions of the Office of Legal Counsel in Volume 33

also Quon , 529 F.3d at 905 (“[U]sers do have a reasonabl e expectation of privacy in the content of their text messages vis-a-vis the service provider.”). Even gi ven this assumption, however, we believe the deployment, testing, and use of EI NSTEIN 2.0 technology comp lies with the Fourth Amendment where each agency participating in the program consistently adopts, implements, and enforces the model log-on banner or model computer-user agreements described in this Office’s prior opinion, or their substantial equivalents. See EINSTEIN 2.0 Opinion at 5-6.

First, we conclude that the adoption, impl ementation, and enforcement of model log-on banners or model computer-user agreements eliminates federal employees’ reasonable expectation of privacy in their uses of Government-owned in formation systems with respect to the lawful government purpose of protecting fe deral systems against ne twork intrusions and exploitations. We therefore do not believe that the operation of intrusion-detection sensors as part of the EINSTEIN 2.0 program constitutes a “search” for Fourth Amendment purposes. See

Minnesota v. Carter , 525 U.S. 83, 88 (1998). Whether a Government employee has a legitimate expectation of privacy in his use of governmental property at work in particular circumstances is determined by “[t]he operational realities of the workplace,” a nd “by virtue of actual office practices and procedures, or by legitimate regulation.” O’Connor v. Ortega , 480 U.S. 709, 717 (1987) (plurality); see United States v. Simons , 206 F.3d 392, 398 (4th Cir. 2000) (“[O]ffice practices, procedures, or regulations may redu ce legitimate privacy expectations.”). The existence of an expectation of privacy, moreover, may depend on th e nature of the intrusion at

issue. See O’Connor , 480 U.S. at 717-18 (plurality) (sugges ting that a government employee’s expectation of privacy might be unreasonable “when an intr usion is by a supervisor” but reasonable when the intrusion is by a law enforc ement official). The model banner and model computer-user agreement discussed in our prior op inion are at least as robust as—and we think stronger than—similar materials th at courts have held eliminated a legitimate government employee expectation of privacy in the content of Internet comm unications sent over government

systems. See, e.g

., Simons , 206 F.3d at 398 (finding no legitimate expectation of privacy in light of computer-use policy expressly noting that government agency would “‘audit, inspect, and/or monitor’” employees’ use of the In ternet, “including all file transfers, all websites visited, and all e-mail messages, ‘as deemed appropriate’”) (quoting policy); United States v. Angevine , 281 F.3d 1130, 1132-33 (10th Cir. 2002) (fi nding no legitimate expectati on of privacy in light of computer-use policy stating that university “‘reserves the right to view or scan any file or software stored on the comput er or passing through the network, and will do so periodically’” and has “‘a right of access to the contents of st ored computing information at any time for any purpose which it has a legitimate need to know’”) (quoting policy); United States v. Thorn , 375 F.3d 679, 682 (8th Cir. 2004), vacated on other grounds , 543 U.S. 1112 (2005) (finding no legitimate expectation of privacy in light of computer-use po licy warning that employees “‘ do

not have any personal privacy rights regarding th eir use of [the employing agency’s] information systems and technology,’” and that “‘[a]n employee’s use of [the agency’s] information systems and technology indicates that the employee understands and consents to [the agency’s] right to inspect and audit all such use as described in this policy’”) ( quoting policy). We therefore believe that the adoption, implementation, and enforcement of the language in those model materials, or their substantia l equivalents, by agencies pa rticipating in the EINSTEIN 2.0 program will eliminate federal employees’ legitimate expectations of privacy in their uses of

2Legality of Intrusion-Detection System to Protect Unclassified Computer Networks

in the Executive Branch

Government-owned information systems with re spect to the lawful government purpose of protecting federal systems against ne twork intrusions and exploitations. 2

We also believe that individuals in the pr ivate sector who communicate directly with federal employees of agencies participating in the EINSTEIN 2.0 program through Governmentowned information systems do not have a legitimat e expectation of privacy in the content of those communications provided th at model log-on banners or agreements are adopted and implemented by the agency. The Supreme Cour t has repeatedly held that where a person “reveals private information to another, he assume s the risk that his conf idant will reveal that information to the authorities, and if that o ccurs the Fourth Amendm ent does not prohibit governmental use of that information.” United States v. Jacobsen , 466 U.S. 109, 117 (1984); see also United States v. Miller , 425 U.S. 435, 443 (1976) (“[T]he Fourth Amendment does not prohibit the obtaining of information revealed to a third party and conveyed by him to Government authorities, even if the information is revealed on the assumption that it will be used only for a limited purpose and the confidence placed in the third party will not be betrayed.”); SEC v. Jerry T. O’Brien, Inc. , 467 U.S. 735, 743 (1984) (“[W]hen a person communicates information to a third party even on the understand ing that the communication is confidential, he cannot object if the third party conveys that information or records thereof to law enforcement authorities.”); Smith , 442 U.S. at 743-44 (“[A] person has no legitimate expectation of privacy in information he voluntarily turns over to third parties. ”). We believe this principle also applies to a person who emails a federal employee at th e employee’s personal email account when that employee accesses his or her personal email account through a Government-owned information system, when the consent procedures described above are followed. By clicking through the model log-on banner or agreeing to the terms of the model computer-user agreement, a federal employee gives ex ante permission to the Government to intercept, monitor, and search “any communications” and “any data” transiting or stored on a Government-owned information system for any “lawful purpose,” including the purpose of protecting federal computer systems against malicious network activity. Therefore, an indi vidual who communicat es with a federal employee who has agreed to permit the Governme nt to intercept, monitor, and search any personal use of the employee’s Government-owned information systems has no Fourth Amendment right against the Government activ ity of protecting federal computer systems against malicious network activity, as the employee has consented to that activity. See Jerry T.
O’Brien, Inc ., 467 U.S. at 743; Jacobsen , 466 U.S. at 117; Miller , 425 U.S. at 443.

Under Supreme Court precedent, this principl e applies even where, for example, the sender of an email to an employee’s personal, Web-based email account (such as Gmail or Hotmail) does not know of the recipient’s status as a federal employee or does not anticipate that the employee might read, on a federal Government system, an email sent to a personal email account at work or that the employee has agreed to Government monitoring of his communications on that system. A person communicat ing with another assume s the risk that the person has agreed to permit the Government to monitor the contents of that communication. See

,

2 The use of log-on banners or computer-user agreemen ts may not be sufficient to eliminate an employee’s legitimate expectation of privacy if the statements and ac tions of agency officials c ontradict these materials. See Quon , 529 F.3d at 906-07. Management officials of agenci es participating in the EI NSTEIN 2.0 program therefore should ensure that agency practices are consiste nt with the statements in the model materials.

3Opinions of the Office of Legal Counsel in Volume 33

e.g ., United States v. White , 401 U.S. 745, 749-51 (1971) (plurality opinion) (no Fourth Amendment protection against government moni toring of communications through transmitter worn by undercover operative); Hoffa v. United States , 385 U.S. 293, 300-03 (1966) (information disclosed to individu al who turns out to be a government informant is not protected by the Fourth Amendment); Lopez v. United States , 373 U.S. 427, 439 (1963) (same); cf.

Rathbun v. United States , 355 U.S. 107, 111 (1957) (“Each pa rty to a telephone conversation takes the risk that the other party may have an extension telephone and may allow another to

overhear the conversation. When su ch takes place there has been no violation of any privacy of which the parties may complain.”). Accordi ngly, when an employee agrees to let the Government intercept, monitor, and search any communication or data sent , received, or stored by a Government-owned information system, the Government’s interception of the employee’s

Internet communications with individuals outside of the relevant agen cy through a Governmentowned information system does not infringe upon a ny legitimate expectation of privacy of the parties to that communication.

We also think that, under the Court’s preceden ts, an individual who submits information through the Internet to a federa l agency participati ng in the EINSTEIN 2.0 program does not have a legitimate expectation of privacy for Fourth Amendment purposes in the contents of the information that he transmits directly to th e participating agency. An individual has no expectation of privacy in communications he makes to a known representative of the

Government. See United States v. Caceres , 440 U.S. 741, 750-51 (1979) (individual has no reasonable expectation of privacy in communications with IRS agen t made in the course of an audit). Further, as just di scussed, an individual who comm unicates information to another

individual who turns out to be an undercove r agent of the Government has no legitimate expectation of privacy in the cont ent of that information. It fo llows a fortiori that where an individual is communicating dire ctly with a declared agent of the Government, the individual does not have a legitimate expectation that his communication would not be monitored or acquired by the Government.

Second, even if EINSTEIN 2.0 operations were to constitute a “search” under the Fourth Amendment, we believe that those operations would be consistent with the Amendment’s “central requirement” that all searches be reasonable. Illinois v. McArthur , 531 U.S. 326, 330 (2001) (internal quotation marks omi tted). As discussed in the prio r opinion of this Office, the Government has a lawful, work-related purpos e for the use of EINSTEIN 2.0’s intrusiondetection system that brings the EINSTEIN 2.0 pr ogram within the “special needs” exception to

the Fourth Amendment’s warrant an d probable cause requirements. See O’Connor , 480 U.S. at 720 (plurality); see also Nat’l Treasury Employees Union v. Von Raab , 489 U.S. 656, 665-66 (1989) (warrant and probable cause provisions of the Fourth Amendment are inapplicable to a search that “serves special governmental needs, beyond the normal need for law enforcement”); Griffin v. Wisconsin , 483 U.S. 868, 872-73 (1987) (speci al needs doctrine applies in circumstances that make the “warrant and probable cause requirement impracticable”); United States v. Heckenkamp , 482 F.3d 1142, 1148 (9th Cir. 2007) (preve nting misuse of and damage to university computer network is a lawful purpose) . And, based upon the information available to us, and as discussed in the prio r opinion of this Office, we be lieve that the operation of the EINSTEIN 2.0 program falls under that exception and is reasonable under the totality of the

circumstances. See United States v. Knights , 534 U.S. 112, 118-19 (2001) (reasonableness of a

4Legality of Intrusion-Detection System to Protect Unclassified Computer Networks

in the Executive Branch

search under the Fourth Amendment is measured in light of the “totality of the circumstances,” balancing “on the one hand, the degree to which it intrudes upon an individual’s privacy and, on the other, the degree to which it is needed for the promotion of legitimate governmental interests”) (internal quotation marks omitted; New Jersey v. T.L.O. , 469 U.S. 325, 337 (1985) (“what is reasonable depends on the contex t within which a search takes place”); O’Connor , 480 U.S. at 726 (plurality) (reasonable workplace sear ch must be “justified at its inception” and “reasonably related in scope to the circumstances which justifie d the interference in the first place”) (internal quotation marks omitted). In li ght of that conclusion, we also think that a federal employee’s agreement to the terms of th e model log-on banner or the model computeruser agreement, or those of a ba nner of user agreement that are s ubstantially equivalent to those models, constitutes valid, voluntary consent to the reasonable scope of EINSTEIN 2.0 operations. See Schneckloth v. Bustamonte , 412 U.S. 218, 219 (1973) (consent is “one of the specifically established exceptions to the requir ements of both a warrant and probable cause”);

United States v. Sihler , 562 F.2d 349 (5th Cir. 1977) (pri son employee’s consent to routine search of his lunch bag valid); cf. McDonell v. Hunter , 807 F.2d 1302, 1310 (8th Cir. 1987) (“If a search is unreasonable, a government employer cannot require that its empl oyees consent to that search as a condition of employment.”).

With respect to statutory issues, we have also concluded that, for th e reasons set forth in our prior opinion—and so long as participating fede ral agencies consisten tly adopt, implement, and enforce model computer log-on banners or model computer-user agreements—the deployment of the EINSTEIN 2.0 program on fede ral information systems complies with the Wiretap Act, the Foreign Intelligence Surveillance Act, the Stored Communications Act, and the pen register and trap an d trace provisions of title 18 of the United States Code. We agree with the analysis of these issues set forth in our prior opinion, and will not repeat it here.

Finally, we do not believe the EINSTEIN 2.0 program runs afoul of state wiretapping or communication privacy laws. See

, e.g ,. Fla. Stat. Ann. § 934.03 (West Supp. 2009); 18 Pa. Cons. Stat. Ann. § 5704(4) (West Supp. 2009); Md. Code Ann., Cts. & Jud. Proc. § 10-402(c)(3) (LexisNexis 2006); Cal. Penal Code 631(a) (West 1999) . To the extent that such laws purported to apply to the conduct of federal agencies and agents conducting EINSTEIN 2.0 operations and imposed requirements that exceeded those imposed by the federal statutes discussed above, they would “stand[] as an obstacle to the accomp lishment and execution of the full purposes and objectives of Congress,” and be unenforceable under the Supremacy Clause. Hines v.
Davidowitz , 312 U.S. 52, 67 (1941); see also Geier v. American Honda Motor Co ., 529 U.S. 861, 873 (2000) (same); Old Dominion Branch v. Austin , 418 U.S. 264, 273 n.5 (1974) (Executive Order “may create rights protected against in consistent state laws through the Supremacy Clause”); Bansal v. Russ , 513 F. Supp. 2d 264, 283 (E.D. Pa. 2007) (concluding that “federal officers participating in a federal investigation ar e not required to follow” state wiretapping law containing additional requirements not present in the federal Wiretap Act, because in such circumstances, “the state law would stand as an obstacle to federal law enforcement”); Johnson v. Maryland , 254 U.S. 51 (1920); cf

. United States v. Adams , 694 F.2d 200, 201 (9th Cir. 1980)

5Opinions of the Office of Legal Counsel in Volume 33

(“evidence obtained from a consensual wire tap conforming to 18 U.S.C. § 2511(2)(c) is admissible in federal court proceedings without regard to state law”).

/s/

DAVID J. BARRON Acting Assistant Attorney General

6