• ABA Home
• Join
• Web Store
• About the ABA

• GP|Solo Home
• Calendar
• CLE
• GPSOLO Magazine
• Newsletters
• Books
• Committees
• Resources
• Sponsors
• Contact
• Join GP|Solo

 
Volume 20, Number 4
June 2003

Lawyers, Cell Phones, Ethics, and Security

By David J. Bilinsky and Laura Calloway

David J. Bilinsky is the Practice Management Advisor and staff lawyer for the Law Society of British Columbia. He is a past co-chair of ABA TECHSHOW and the current chair of the Pacific Legal Technology Conference.

Laura Calloway practiced law for 16 years as a solo and in small firms in Montgomery, Alabama, before joining the Alabama State Bar as director of its Law Office Management Assistance Program in 1997. She can be reached at lcalloway@alabar.org.

Portions of this article are based on the "Practice Management Q & As" column by David J. Bilinsky originallyappearing in the Benchers' Bulletin, January/February 2001, no. 1, pages 14-15. Reprinted with permission of the Law Society of British Columbia, © 2001, all rights reserved.

Lawyers may-and increasingly do-communicate with clients in many ways other than traditional face-to-face meetings or calls via hard-wired telephones: analog cell phones, digital cell phones, digital PCS devices, cordless telephones, pagers, wireless devices such as RIM BlackBerry, web-enabled cell phones or combo cell phones, PalmPilots or other PDAs, and, of course, in-flight telephones. Increasingly, we are seeing an alternate communication method: voice over IP (VoIP). How secure is information transmitted via these devices?
The question of security raises two issues that must be examined: First, what legal protection is afforded to communications? Second, notwithstanding the legal protections and practically speaking, what precautions should a lawyer take when using these devices?

Legal Protections
U.S. law. Both federal and state law (in about 40 states and the District of Columbia) prohibit to some degree the interception and disclosure of wire, oral, or electronic communications.
On the federal level, 18 U.S.C. section 2511 prohibits the intentional interception of such communications, as well as the intentional disclosure or use of the content of such communications when the person making the disclosure or use knows, or has reason to know, that the information was obtained in violation of the statute. There are, however, exceptions, and the following types of communications are not protected:

-Oral communications made in a setting with no reasonable expectation of privacy.
-Interception and disclosure made by wire or electronic communications providers and FCC officials acting in the normal course of employment, and by those acting under color of law and authorized by lawful warrants.
-One of the parties to the communication gives prior consent to the interception, or an electronic communication is made through a system that is configured so that the communication is available to the general public.
-Unencrypted radio transmissions made on a frequency generally monitored by those providing it or generally using it.
-Tone-only pagers.
The federal statute provides both criminal penalties, which may be enforced by the government, and civil penalties that include injunction, punitive damages where appropriate, and attorney fees, which may be invoked by a party whose communication is intercepted.

Case law has carved out a narrow but interesting exception to the application of the statute. In Bartniki v. Volper,1 the U.S. Supreme Court, in a 6-3 decision, held that where a publisher has lawfully obtained information from a source who unlawfully intercepted it, and the content of the communication was a matter of great public concern, disclosure of that information by the publisher was protected by the First Amendment.
Canadian law. Section 184(1) of the Criminal Code creates an indictable offense for the willful interception of a private communication, and section 184.5 creates an indictable offense for the willful interception of a radio-based telephone communication. This would appear to extend the Criminal Code provisions respecting the interception of private communications to cellular-based devices. Section 183 defines a "radio-based telephone communication" as being one, within the definition of the Radiocommunication Act, made over apparatus used primarily for connection to a public switched telephone network.

R. v. Cheung2 held that conversations over a cellular telephone were private communications. R. v. Solomon (1996) 110 CCC (3d) 354, 139 DLR (4th) 625 (Que CA) held that there is an expectation of privacy in the use of a cellular phone, provided that the parties to the conversation take the necessary care to isolate themselves and talk only when they are alone; the expectation would be nonexistent if those same persons were in a crowed restaurant. Interestingly, R. v. Lubovac3 held that pager communications were not private communications because the pager simply broadcasts a message to those who may happen to hear or overhear it.

Given this legal background, it is fair to state that, in Canada, there is usually a reasonable expectation of privacy when using a land-based telephone or a cellular telephone. Communications that take place over the new generation of devices, especially those that combine pager services with e-mail such as the RIM BlackBerry, are an open issue. It is likely a court would extend privacy protections to these communications because textual messages are delivered over a public communication network, unlike the pager prompts in Lubovac.

Practical Considerations
Notwithstanding a certain degree of legal protection for today's high-tech communications, practical considerations may help you decide the appropriate circumstances for your use of them. And, although you as a lawyer may avoid anything but a hard-wired telephone to communicate with clients, you have no certainty that your client will be as cautious or aware of the issues involved.

As any criminal lawyer knows, even a hard-wired land telephone is not completely secure-the communications are not encrypted or scrambled and can be overheard or recorded by someone (legally or illegally) tapping into the connection. Analog cell phones and cordless phones are "clear"-the communications are transmitted in a form that can be instantly comprehended (clear speech), and receivers and scanners within range can intercept and overhear the conversation.

Airplane telephones have the additional problem that anyone seated nearby can overhear the conversation. Digital phones and devices have the advantage that the communication stream is transmitted in digital form, which is not instantly comprehensible. However, they are not immune to interception, although this would appear to require a deliberate act, unlike cordless phones or analog cell phones, which are susceptible to inadvertent interception. Digital cell phones do have an inherent danger, however: the call that you thought was taking place on a relatively secure digital stream might be bounced over to analog-in which case you are just as vulnerable to interception as any pure analog call. Digital calls frequently are bounced over to analog mode when roaming, for example.
How they work. Cell-phone networks use one of three methods to transmit digital information: frequency division multiple access (FDMA), time division multiple access (TDMA), and code division multiple access (CDMA). Digital services are provided in both the 800 MHz and 1900 MHz bands in North America. (Other parts of the world, Europe in particular, enable cellular systems differently, which is why your North American cell phone probably won't work there unless it is a special tri-mode phone that incorporates the international digital phone standard.) Analog service uses a method called AMPS (advanced mobile phone system), which operates at the 800 MHz frequency band. Checking the specs of any cellular phone will give you the transmission methods enabled on that particular telephone.

Cellular telephones can be straight analog (rare these days), dual band, dual mode, or tri mode. A dual-band cell phone has the capability to switch frequencies-it can operate in both the 800 MHz and 1900 MHz bands. A dual-mode phone can switch between two types of transmission technology, such as AMPS and TDMA. If your phone supports both AMPS and, say, TDMA, it can switch between analog and digital service. This switch often takes place without any indication to the caller. Dual-band/dual- mode phones are able to switch between frequency bands and transmission modes as needed.

Tri-mode phones are a bit trickier because the modes are not fixed. The phone might be set to switch between two digital technologies such as TDMA and CDMA as well as be able to go analog. Or it might support one digital technology in both 800 MHz and 1900 MHz bands in addition to analog mode. Some tri-mode phones therefore can function both in North America and internationally.

However, the cellular service you employ is only half of the equation; you also must be concerned about the communication method at the other end. The least-secure cellular telephone call is one carried over an analog network. The preferred communication takes place between speakers on single-mode digital phones that have no possibility of flipping to analog. In this situation, the communication is totally digital.

It is prudent to know whether your cell phone is capable of flipping from digital to analog services. Most of the PCS (personal communication service) devices in use are dual mode and thus capable of flipping, at one or both ends of the communication, in which case the call becomes just as susceptible to interception as a straight analog cell phone call. This occurs often when the digital signal strength fades and the phone flips to analog to keep the call going.
Loopholes. Even if the communication takes place in an entirely digital medium, the transmission is not definitely secure. Digital communications are not "clear"-not immediately understandable-but it is possible to translate the digital stream into comprehensible speech. TDMA telephones in digital mode use a three-digit random number to encode the transmission. This is a very weak form of encryption. More secure phones use a SIM (subscriber identity module) "smart" card that slides into a slot on the telephone; the SIM card carries embedded encryption, keeping the communication more secure than an ordinary digital cell signal. Accordingly, the safest assumption at present is that any cellular call is capable of being overheard and cannot be counted upon to be secure in any fashion.

High-powered, encrypted cell transmissions are several years away-awaiting the adoption of third generation (3G) cell service. New developments will allow wide-band wireless service and, I am told, allow encryption on the dataset itself. It is expected that 3G telephones will incorporate encryption methods similar to DES (digital encryption standard) or triple-DES, subject to government approval, but this is not by any means assured.
PDAs and such. What about BlackBerrys and Palm handhelds, and pocket PCs? How secure are these? All of these are equipped with a password-authentication protocol, network protocol, or in some cases, biometric authentication protocol. Because these nifty devices are stolen or lost with alarming frequency, password and network protection always should be enabled; otherwise a stranger can have immediate access to your stored confidential e-mail or even the files on the office network (via 802.11b or other wireless standards such as Bluetooth or wireless Internet).

Communications also are at risk for interception. When PDAs use elliptic curve cryptography (ECC), the data is encrypted and transported directly to the enterprise or content server, passing through networks as if in a sealed envelope. To be totally secure, the transmission must pass through all stages of communication (from the originator, through the land lines, to the wireless service, and onto the PDA) in its encrypted form to remain secure-it cannot be de-encrypted and re-encrypted, for example, when being converted to a wireless signal. Unless you can be assured that both ECC and full transmission occur at every point along the path for every communication to receive and send, you cannot take the security of the communication for granted.
Users of wireless PDAs should inves-tigate the possibility of symmetric or public-key encryption to ensure a reasonable degree of privacy in exchanging data with the network. Palm, for example, is developing strong cryptographic services for its applications, providing encryption, decryption, key-generation, and the like for its latest lines.

Voice via computers. VoIP is a category of hardware and software tools that enable people to use the Internet as the transmission medium for telephone calls. Essentially it treats digitized voice as just another form of data and uses the Internet Protocol (IP) to deliver those data packets. Thus, VoIP calls are only as "secure" as the Internet generally, and we know the Internet is vulnerable.

Virtual private networks are one way to secure VoIP when using PCs equipped with voice calling, but that may not be possible for people using VoIP handsets. Calls via VoIP also can be "hijacked"-a hacker need only change the IP address of an end user's IP phone to an address of the hijacker's choice to redirect calls.
Given these realities, it may be prudent for lawyers to develop explicit policies on the use of communication devices for contact with clients, expert witnesses, and others. In the meantime, let us all recall that, for truly private communications, there is still nothing to equal whispering directly into a listener's ear.

Notes
1. 532 U.S. 514 (2001).
2. (1995) 100 CCC (3d) 441 (BCCA).
3. (1989) 52 CCC (3d) 551 (Alta CA).

Illicit Clone Calls
Cell phones, like sheep and humans in funny Star Trek clothes, are susceptible to being cloned: The phone's "identity" is stolen and later used to place unauthorized calls charged to the owner's account. But what the heck is your phone's identity, and how can you tell if yours has had a cloning crisis?
All cell phones have at least three pieces of identity associated with that specific phone:
-Electronic serial number (ESN), a unique 32-bit number programmed into the phone when it is manufactured
-Mobile identification number (MIN), a ten-digit number derived from your cell phone's telephone number, and
-System identification code (SID), a unique five-digit number assigned to each carrier by the FCC.
The ESN is considered a permanent part of each phone; both the MIN and SID codes are programmed into the phone after you purchase a service plan and phone activation.

Here is how cloning occurs: At the beginning of a call, your phone transmits the ESN and MIN to the network. The MIN/ESN pair is a unique tag for your phone-it is how the phone company tracks calls and knows where to send the bill. When your phone transmits the MIN/ESN, it is possible for less-than-scrupulous persons who happen to be listening to scanners to capture them. MIN/ESN pairs transmitted in "clear" (analog) form can be extremely easy to steal; with the right equipment, they are modified and entered into another phone, and magically fraudulent calls can be made on your account.

There's no way to completely eliminate the possibility that your cell phone will be cloned, but there are some steps you can take to protect yourself. First, make sure that your phone is a digital-only model. Dual-mode phones, which can flip to analog, are more vulnerable. Second, check with the service pro-viders in your area to determine the levels of encryption available and base your selection on safety and confidentiality, not cost. Third, limit roaming to a minimum. When you are in roaming access, the fraud detection programs offered by your cellular company may be unavailable. Finally, review your wireless phone bill carefully and report any unknown numbers or calls you did not make to your provider. Cell phone thieves often spread the fraud over many stolen numbers. A few calls per number can easily go unnoticed each month but can add up to a substantial bill for you.