Phone companies keep press surveillance secret

A letter by Sen. Ron Wyden about surveillance of senators’ phone lines has an important lesson for journalists, too: Be careful in selecting your phone carrier.

On May 21, Wyden wrote his Senate colleagues revealing which wireless carriers inform customers about government surveillance requests (Cape, Google Fi, and US Mobile), and which don’t (AT&T, Boost Mobile, Charter/Spectrum, Comcast/Xfinity Mobile, T-Mobile, and Verizon).

A handy chart at the bottom of the senator’s press release provides a quick summary.

Wyden’s letter was inspired in part by a Department of Justice inspector general report that revealed that the DOJ had collected phone records of Senate staff as part of leak investigations under the first Trump administration.

But that report wasn’t just about surveillance of the Senate. It also discussed how the DOJ surveilled journalists at The New York Times, The Washington Post, and CNN in 2020-21 as part of leak investigations related to news reporting about the Trump campaign’s connections with Russia and Russia’s interference in the 2016 election.

Investigators demanded telephone records from phone companies for the work and personal phones of journalists at all three outlets. In all three cases, the telephone companies turned over the records, which would have shown the numbers dialed, the date and time of calls, and their duration — information that could reveal the identities of confidential sources.

The telephone companies apparently didn’t notify the Times, Post, or CNN that their records had been sought, even though they legally could have done so. The DOJ also didn’t give the news outlets notice, taking advantage of internal guidelines that allowed them to delay notice to news media companies about legal demands for communications records from third parties in certain circumstances. (The rules for delayed notice from the DOJ remain in effect in the recently revised DOJ news media guidelines.)

According to the inspector general report, DOJ cover letters to the telephone companies asked them not to disclose the demands because the DOJ claimed it might impede the investigation. But the DOJ never sought a court order prohibiting disclosure. One prosecutor told the IG that nondisclosure orders weren’t obtained for the telephone companies “because the providers typically do not notify subscribers when their records are sought.”

That’s a problem, and it’s exactly what Wyden called out in his recent letter. Journalists can’t oppose surveillance that they don’t know about. Notification is what enables journalists (or any other customer) to fight back against overbroad, unwarranted, or illegal demands for their data. That’s exactly what the Times did when Google notified the newspaper of demands for its journalists’ email records in connection with the same leak investigation in which investigators sought phone records from Times journalists.

The Times’ contract with Google required the company to notify the news outlet of government demands. But even contractual agreements might not be enough to compel phone companies to inform their customers when they’re being spied on. Wyden’s letter reveals that “three major phone carriers — AT&T, Verizon, and T-Mobile — failed to establish systems to notify (Senate) offices about surveillance requests, as required by their Senate contracts.”

In addition, even if large news outlets could negotiate contracts with their phone carriers that require notification of surveillance requests when legally allowed, that wouldn’t help their journalists who speak to sources using personal phones that aren’t covered by their employers’ contracts. Freelance journalists are also unlikely to have the power to negotiate notification into their phone contracts.

Rather than one-off contractual agreements then, it would be better for all phone companies to follow the lead of tech companies, like Google, that have a blanket policy of notifying customers of government demands for their data, assuming they’re not gagged. These policies are now widespread in the tech world, thanks to activism by groups like the Electronic Frontier Foundation, which has long monitored tech companies’ notification policies and encouraged them to do better.

Phone companies must do better, too. It’s a shame that some of the largest wireless carriers can’t be bothered to tell their customers when they’re being surveilled. Journalists — and all of us — who care about privacy have a choice to make when selecting their wireless provider: Do they want to know when they’re being spied on, or are they OK with being left in the dark?