Keystroke loggers take on two forms. One is a device that is physically implanted in the keyboard itself. The other method is a software program that's installed on the target computer. It is unclear which of the two methods was employed by law enforcement in their monitoring of Scarfo.
The judge who gave the green light to the FBI ruled that "normal investigative procedures to decrypt the codes and keys necessary to decipher the "factors' encrypted computer file have been tried and have failed."
On the evening of May 10, 1999, federal agents broke into Merchant Services, Scarfo's business in Belleville, N.J., and installed the key logger. Within a few months they had the password needed to access the hidden files. Scarfo used his father's prison number, nds09813-050, as his password. This time it seemed like the feds had Scarfo for good. On July 15, 1999, the FBI raided Merchant Services and carted away Scarfo's computer and were able to get into all the hidden files. They arrested Scarfo, charging him with bookmaking and loan-sharking.
This past summer as the case was coming around to trial, the defense filed a motion to have the FBI reveal the exact nature of the key logger system they used on Scarfo's computer. Scarfo's attorneys wanted to see if their client was subject to an unlawful search and seizure.
The U.S. Attorney on the case, Robert J. Cleary, asserted that the techniques used by the FBI were sensitive and that revealing them would pose a threat to national security. He requested that the techniques remain secret. The prosecution invoked a little-known 1980 law, the Classified Information Procedures Act (CIPA), which permits authorities to go beyond usual methods to protect classified information. Among the methods is to disclose the key logger to the judge but not to the defense.
Some contend that the key logger is merely an extended wiretap and violates the wiretap warrants, which generally allow for only targeted conversations to be monitored. The FBI counters that they did not monitor Internet activity, so it is technically not a wiretap. This argument is the crux of the defense's motions: to have the key logger system revealed so they can determine whether the technology violates the warrant.
George Anastasia, a Philadelphia Inquirer reporter who has followed the Philly mob for two decades, echoes some of the criticism of the FBI's methods in the case. "I think this an example of the FBI overreaching and using sophisticated, anti-terrorism technology to track a bookmaker, which on the face of it seems like overkill. Pre-Sept. 11, I think most people would have agreed."
Within days of the Sept. 11 attacks, a new set of laws strengthening law enforcement's powers to aid in the war against terrorism were being drawn up. On Oct. 26, 2001, President Bush signed HR 3162, Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism (US PATRIOT Act); ushering in a new era in the fight against terrorism, and critics say, an even greater erosion of civil rights.
Commenting on the Scarfo case and the effect of the anti-terrorism bill, David Sobel of the Electronic Privacy Information Center says, "The government was not inclined to disclose the (key logger) methods before Sept. 11. On the other hand the need for public information concerning these techniques is stronger than ever because this type of technique will be used more frequently."
"It's very clear what happened to US PATRIOT. Whatever bright idea law enforcement had, that they wanted to pass before Sept. 11 was rolled into one bill. And it was passed rapidly without Congress to make a significant effort to really evaluate what they were doing," said Mike Phenegar secretary of the ACLU in Florida. Phenegar is a retired U.S. Army colonel intelligence officer and the former Deputy Director of Intelligence at Central Command at MacDill Air Force Base. He was also the Director of Intelligence for Special Operation Command and one of the ACLU's few conservative Republican activists.
While the US PATRIOT Act does not mention the key logger system specifically, it is clear that new methods of electronic surveillance are on the horizon and the government will be giving more leeway to agencies using similar methods to gather intelligence from both criminal and suspected terrorist enterprises.
Section 101 of the new law deals with many of the electronic issues. The section opens the door for monitoring of electronic correspondence via pen registers, which traditionally were limited to telephone numbers. The PATRIOT Act redefines a pen register to encompass Internet Service Provider (ISP) addresses, but unlike the old trap and trace devices that looked only at the numbers being dialed, the information gleaned from electronic monitoring would contain far more information. Additionally, one judge's orders for a pen register as well as subpoena for electronic records would transcend all jurisdictions and be, in essence, a blanket warrant. This is one area that particularly concerns some privacy rights groups.
