9.4.6. Surveillance and Non-Consensual Monitoring

(1) The permanent installation of concealed microphones, recording equipment, and similar devices in IRS offices is prohibited. Temporary installations are permitted only when authorized in accordance with the requirements for consensual and non-consensual monitoring.

(2) The use of transmitters or other devices used to assist in trailing vehicles or personal property is permitted pursuant to subsection 9.4.6.7.5 and 18 USC 3117.

(3) Although mechanical devices may be used to intercept, overhear, or record conversations at public telephones, pursuant to the procedures outlined in 18 USC 2510, et seq., extreme care must be exercised to segregate conversations of innocent third parties from conversations of the identified subject(s). In each instance of monitoring, the equipment must be installed immediately prior to monitoring the identified subject and removed immediately thereafter. Due to the potential for inadvertent monitoring of innocent third party conversations and the elevated standard of probable cause required for this type of monitoring, it is rarely used; however, extreme caution should be exercised when this technique is utilized.

(4) Miniature recorders and radio transmitters will not be used surreptitiously in conducting routine surveys and interviews with third parties unless consensual monitoring is authorized.

(5) Field offices may not purchase, fabricate, or arrange for the manufacture of any equipment or accessories designed to acquire communications of any type without obtaining approval from the Associate Director, Security and Technical Operations or his/her designee. The acquiring field office shall enter all such equipment into the Criminal Investigation Management Information System (CIMIS).

(6) Permission to employ eavesdropping devices may only be granted to special agents or to personnel acting under their direction. The approval process, prohibitions, and limitations outlined in this section apply equally to non-IRS personnel who act at the direction of special agents.

(7) Title 18 prohibits the use of radio scanners to listen to transmissions on wireless telephone frequencies (e.g., mobile telephones or cordless telephones). Monitoring of wireless transmissions requires a wiretap order pursuant to 18 USC 2518. Normally, citizens band radio transmissions may be monitored unless there is reason to believe that a base station is using a wire link supplied by a common communications carrier.

(8) A search warrant issued pursuant to Rule 41, Federal Rules of Criminal Procedure, is required to obtain evidence that cannot be observed from a public place with the naked eye. Federal statutes and the Supreme Court have placed restrictions on the use of sense enhancing devices. The local Criminal Tax attorney should be consulted prior to the use of such technology.

(1) Contents are defined by 18 USC 2510(8) to include any information concerning the substance, purpose, or meaning of any given communication.

(2) A wire communication is defined as a communication that involves the human voice being transmitted through the use of a wire, cable, or similar method between the points of origin and reception (see 18 USC 2510(1) and (18).) In addition, tone-and-voice pagers are included within the definition of a wire communication, and the interception of the human voice segment must be treated the same as a wire interception. A conversation on a telephone is a wire communication.

(3) An oral communication is "any oral communication uttered by a person exhibiting an expectation that such communication is not subject to interception under circumstances justifying such expectations, but this term does not include any electronic communication." A conversation between two or more individuals who have a reasonable expectation that the conversation will not be intercepted constitutes an oral communication.

(4) An electronic communication is defined as "any transfer of signs, signals, writing, images, sounds, data, or intelligence of any nature transmitted in whole or in part by a wire, radio, electromagnetic, photo-electronic, or photo-optical system that affects interstate or foreign commerce." The term electronic communication does not include communications containing the human voice. An electronic communication includes the "real-time" point-to-point transmission of, for example, digital display pager information, electronic mail, computer-to-computer transmissions, facsimiles, transmissions, and private video transmissions (but not video surveillance).

(5) Interception means "the aural or other acquisition of the contents of any wire, electronic, or oral communication through the use on any electronic, mechanical, or other device."

(6) Electronic, mechanical or other device is defined by 18 USC 2510(5) to include "any device or apparatus which can be used to intercept a wire, oral or electronic communication other than." Examples of such a device or apparatus include:

1. Any telephone or telegraph instrument, equipment or facility, or any component thereof (i) furnished to the subscriber or user by a provider of wire or electronic communication service and used by the subscriber or user...in the ordinary course of its business or (ii) being used by a provider...in the ordinary course of its business or by an investigative or law enforcement officer in the ordinary course of his duties.

2. A hearing aid or similar device being used to correct subnormal hearing to no better than normal.

(7) Consent is defined to mean that one or more of the parties to a wire, oral, or electronic communication has given his/her prior permission that such communication may be intercepted. In the Federal system, one party’s consent is needed, even if the other parties to the conversation are unaware that the communication is being intercepted or recorded.

(1) A "wiretap" is the acquisition of the contents of a wire or oral communication through the use of any electronic, mechanical, or other device where an expectation exists that the communication is not subject to interception. See subsection 9.4.6.7.1(3)(a) for a discussion of those offenses for which wiretaps may be authorized.

(2) The following are not covered by the wiretap statute:

1. Use of pen registers or trap and trace devices; authority for the use of these techniques is found in 18 USC 3122,

2. Overhearing of conversations without the aid of electronic, mechanical, or other devices,

3. Radio or television broadcasts readily accessible by the public,

4. Tone-only pagers per 18 USC 2510 (12)(B),

5. Electronic tracking devices, also called transponders or beepers (18 USC 3117),

6. Marine and aeronautical communication systems per 18 USC 2511(2)(g)(ii)(IV),

7. Public safety radio systems,

8. Amateur radio operator services, citizens band radio, and general mobile radio services,

9. Electronic communications which are readily accessible by the general public,

10. Physical/visual surveillance,

11. Individuals’ use of telephone extensions.

(3) Consensual monitoring where one of the parties consents to the monitoring of the conversation or internet communication is addressed and specifically excepted out of the wiretap statute.

(1) An order to intercept wire, oral, or electronic communication may be obtained only to investigate those offenses enumerated in 18 USC 2516 (Title 26 offenses are not included). However, if the contents of intercepted wire, oral, or electronic communications relate to other criminal acts, that evidence may be used by other law enforcement officers (including CI special agents) in furtherance of their investigations, including Title 26 offenses. Title 18 USC 2517 sets forth a statutory scheme under which the disclosure and use of intercepted oral, wire, or electronic communications is permitted.

(2) Title 18 USC 2517(1) permits law enforcement officers (obtaining officers) who obtain intercepted wire, oral, or electronic communications to disclose such evidence to other law enforcement officers (receiving officers) as is appropriate in the performance of the obtaining and receiving officers’ duties.

(3) Title 18 USC 2517(2) permits law enforcement officers who have lawfully obtained or received intercepted wire, oral, or electronic communications, or evidence otherwise derived from intercepted wire, oral, or electronic communications, to use the contents of that evidence to the extent such use is appropriate for the proper performance of his/her official duties.

(4) Title 18 USC 2517(3) permits law enforcement officers who have obtained or received information from intercepted wire, oral, or electronic communications, or evidence otherwise derived from intercepted communications, to disclose such information while giving testimony under oath in any Federal or state, criminal, or civil proceeding. This includes testimony before a grand jury.

(5) Title 18 USC 2517(5) requires that a court order, referred to as a "derivative use order," be obtained prior to any disclosure as defined in 18 USC 2517(3), of intercepted communications relating to offenses other than those specified in the order of authorization or approval to intercept. Such an order must be obtained prior to any law enforcement officer making any testimonial disclosure of information or evidence relating to intercepted wire, oral, or electronic communications, or evidence derived from such intercepted communications. Such an application should be made as soon as practicable. The derivative use order must be based upon the court's finding that the information and evidence to be disclosed was otherwise properly intercepted. Failure to obtain such an order can result in the dismissal of the case or subject the officer to liability for civil damages related to the unauthorized disclosure.

(1) As soon as practicable, information or evidence received by CI special agents from other law enforcement officers that originated from intercepted wire, oral, or electronic communications, or evidence otherwise derived from the intercepted communications or transcripts thereof, will be referred to the SAC, or his/her designee, who should immediately evaluate the potential use for criminal and civil tax purposes.

(2) If it is apparent that the information or evidence is likely to or will be used by IRS in a criminal or civil judicial proceeding, the SAC, or his/her designee, should immediately ascertain whether an 18 USC 2517(5) order covering use by the IRS has been obtained. If an order has not yet been obtained, the SAC or his/her designee should contact and consult with the supervisory Assistant United States Attorney (AUSA) to ensure the order is obtained prior to disclosure.

(1) Three situations exist where approval is required for IRS CI special agents' participation in investigations where non-consensual monitoring of voice communications occurs:

1. When CI special agents are present in the wire room and do NOT have the responsibility of monitoring conversations as they occur.

2. Criminal Investigation monitoring of non-consensual conversations where an agent from another agency prepared the affidavit in support of an application for monitoring.

3. Criminal Investigation monitoring of non-consensual conversations where an agent from CI prepared the affidavit in support of an application for monitoring.

(1) Copies of the 10-day reports and closing reports must be sent to Special Investigative Techniques within 15 days of the completion of the report.

(2) If an extension of time is required, the Director, Field Operations is the approving official. A request must be prepared by the field office providing a summary of the results obtained to date and a reason for the extension. Upon approval by the Director, Field Operations, the request will be electronically forwarded to Special Investigative Techniques.

(3) If an expansion is required to add new telephone lines related to the same targets and the same offenses, the Director, Field Operations is the approving official. A request must be prepared by the field office providing a summary of the results obtained to date and a reason for the expansion. Upon approval by the Director, Field Operations, the request will be electronically forwarded to Special Investigative Techniques.

(4) If it becomes necessary to include additional targets or additional offenses, approval by the Deputy Commissioner, IRS is required. The procedures for the expansion to add new targets or add new offenses mirrors the procedures required to initiate a wiretap request (see subsections 9.4.6.7.2.5.2 or see 9.4.6.7.2.5.3).

(1) The "real time" or simultaneous interception of digital display pagers in transmission, transmission of electronic mail, computer-to-computer transmissions, facsimile transmissions, and private video transmissions (but not video surveillance) are all covered by the wiretap statute (see subsection 9.4.6.7.2.1 - stored electronic communications 18 USC 2703.)

(2) The interception of electronic communications can provide valuable information and evidence relating to any Federal felony under the investigative jurisdiction of CI, including Title 26 offenses. Under 18 USC 2516(3), the order authorizing such interception must conform to 18 USC 2518. However, cost, technical requirements, and encryption are all factors that can impact its actual use.

(1) Stored electronic communications (defined in 18 USC 2510) includes those electronic messages temporarily stored by an electronic communications service provider prior to delivery to the intended recipient or stored as a backup. The term also includes information stored with a"remote computing service". The term includes display data stored in digital-display pagers and cell phones, stored electronic mail, stored computer-to-computer transmissions, stored telex transmissions, stored facsimile data, and private video transmissions.

(2) The statute applies only to data stored with an electronic communications service provider. The real-time interception of transmissions to tone-and-voice-pagers is governed by the wiretap statute. (A tone-and-voice-pager enables callers to transmit short voice messages to a subscriber's pager). The acquisition of transmissions to or from display pagers and facsimile transceivers during the transmission(s) requires the approval of the Deputy Commissioner, IRS, an affidavit, an application (which must be approved by the Department of Justice), and a court order obtained in accordance with 18 USC 2516 and 2518 (see subsection 9.4.6.7.2.7).

(1) Title 18 USC 2702 prohibits disclosure of electronic communications by providers of electronic communication services or remote computing services unless one or more of the following conditions is met:

1. The information is given to its intended recipient or addressee,

2. The information is given to the government pursuant to a court order, search warrant, or subpoena,

3. The subscriber/customer gives consent,

4. The disclosure is to a facility used to forward the communication,

5. The disclosure is incident to testing equipment or quality of service,

6. The information was obtained inadvertently and specifically refers to a crime.

(2) Title 18 USC 2702(c)(4) permits, but does not require, a service provider to disclose to law enforcement either content or non-content customer records in emergencies involving an eminent act which could result in the death of or cause serious physical injury to any person as provided by the USA Patriot Act.

(1) Title 18 USC 2703 specifies the means by which a governmental entity may obtain access to stored electronic communications. The statute prohibits electronic communications providers from voluntarily providing information to a governmental entity, and requires law enforcement to use either a search warrant, court order, or subpoena (as described below in paragraphs 2, 3, 4, and 5) in order to obtain the following classes of information:

1. The contents of electronic communication in electronic storage with an electronic communication service (such as unopened e-mail) or with a remote computing service (such as records in off-site archives).

2. Basic subscriber information; including the name, address, local and long distance telephone toll billing records, telephone number or other subscriber number or identity (such as temporarily assigned Internet Protocol (IP) addresses); length of service; and types of services the customer or subscriber utilized.

3. Transactional information, which includes all other records or information pertaining to a subscriber or customer that are not included in a) or b).

(2) If the contents of a wire or electronic communication have been in storage for 180 days or less, the government must obtain a search warrant, based on probable cause, to obtain access to the contents. Notice to the subscriber or customer is not required. Because the statute requires the use of a search warrant to obtain this class of information, it is not necessary to prepare an Enforcement Action Approval Form or to justify the use of the warrant as the least intrusive means to obtain the Information. Form 9809, Request for Stored Electronic Information is used to obtain the appropriate authorization for the search warrant application and execution.

1. The government may obtain the contents of an electronic communication that has been in storage for more than 180 days using a search warrant, a court order issued under 18 USC 2703(d), or a grand jury subpoena or administrative summons.

2. Notice need not be given to the subscriber if a search warrant is used to obtain the information. The statute requires that the customer or subscriber to whom the information pertains be notified if the government obtains a court order or issues a subpoena or summons for the information. That notice may be delayed for up to ninety days pursuant to 18 USC 2705. (This initial 90-day period can be extended for an additional 90-day period upon application to the court for an extension under 18 USC 2705(4).) Exhibit 9.4.6-1 is a sample of a 18 USC 2703(d) Order.

(3) The above-stated transactional information may be obtained, without providing notice to the subscriber, by any of the following means:

1. A search warrant.

2. A court order for disclosure per 18 USC 2703(d).

3. Consent from the customer or subscriber of the service.

4. Submission of a formal written request, pursuant to a law enforcement investigation concerning telemarketing fraud, for the name, address, and place of business of a subscriber or customer of such provider, when a subscriber or customer is engaged in telemarketing as defined in 18 USC 2325.

(4) Basic subscriber information may be obtained with any of the means described in (3) above or with a grand jury subpoena or administrative summons, without providing notice to the subscriber.

(5) Title 18 USC 2703(f) imposes on the provider of wire or electronic communication services or a remote computing service the obligation, upon the written request of a governmental entity, to take all necessary steps to preserve records and other evidence in its possession pending the issuance of a court order or other process.

1. The Preservation Letter requires providers of wire or electronic communication services or remote computing services to retain records for a period of 90 days. This initial 90-day period can be extended for an additional 90-day period upon a renewed request by the governmental entity.

(1) The investigating special agent should consult with the local Computer Investigative Specialist (CIS) and Criminal Tax attorney about access to stored electronic or wire communications to determine the proper method of obtaining the desired information. The use of court orders and search warrants to obtain stored electronic information, transactional information, or subscriber information requires approval by the SAC on Form 9809. After SAC approval, the Form 9809 must be forwarded electronically to Special Investigative Techniques for filing. The SAC must seek the endorsement of the United States Attorney to apply for a court order to obtain stored electronic communications. Local procedures must be followed to obtain the court order. If preparation of an affidavit is necessary, the local Criminal Tax attorneys opinion regarding the affidavit’s legal sufficiency and form should be obtained. The SAC approval is not required when a subpoena is used for obtaining the information.

(1) In situations where a court order or search warrant was used, a memorandum will be submitted to CI:OPS:SIT. The memorandum is due 15 working days after receipt of the information by the field office. The memorandum should contain information identifying the investigation name and number, the allegations involved, the reason the information was acquired, and a description of the information obtained.

(1) A pen register, which is more appropriately called a "Dialed Number Recorder" (DNR), is a mechanical instrument attached to a telephone line, usually at a central telephone office. A pen register:

1. Records the outgoing numbers dialed on a particular telephone,

2. Registers incoming calls,

3. Does not identify the telephone number from which the incoming call originated unless caller identification (ID) service is present, the service is on, and no one has blocked the caller ID service.

(2) Use of pen registers is restricted to recording the area code, telephone number, and extension dialed. Pen registers may not be utilized for gathering transactional data input by a touch-tone phone (i.e., account numbers, amounts, etc.).

(3) If possible, equipment that does not record transactional data should be used. Gathering transactional data input by touch-tone phone constitutes interception of electronic communication in transmission and requires a wiretap order that must be obtained under the procedures in subsection 9.4.6.7.2.

(4) Pen registers and other types of telephone number recorders can be utilized only when authorized by court order, except as provided by 18 USC 3121(b). They may be used in both tax and non-tax investigations where CI has the authority to investigate and locate fugitives from justice who are the subject of a CI investigation. A fugitive from justice is defined as a person against whom criminal action (e.g., return of an indictment, filing of a complaint or information, or a conviction) has been taken, and who has fled the jurisdiction to escape prosecution or to avoid serving a sentence. Requests for pen registers to locate fugitives will be considered only for fugitives who are charged with felony violations.

(5) Unless an exception is approved by the SAC, only IRS-owned pen registers and accessory equipment may be used in CI investigations.

(6) The USA Patriot Act amended 18 USC 3121, 3123, 3124, and 3127 to clarify that the pen register and trap and trace statute applies to a broad variety of communication technologies. As a result, law enforcement may use pen registers and trap and trace device orders to trace communications on the Internet and other computer networks.

(7) The USA Patriot Act added 18 USC 3123(a)(1) which gives Federal courts the authority to compel assistance from any provider of communication services in the United States whose assistance is appropriate to effectuate the order.

(8) The USA Patriot Act added 18 USC 3123(a)(3) whereby law enforcement authorities are required to file a special report with the court whenever it is necessary to install a separate device, such as Etherpeek or the FBI’s DCS 1000, to collect the information sought. The special report must include: the identity of the officers who installed or accessed the device; the date and time the device was installed, accessed, and uninstalled; the configuration of the device at installation with any subsequent modifications; and the information collected by the device.

(9) The USA Patriot Act added 18 USC 3123(b)(1)(C) such that there are no geographic limitations placed upon pen registers and trap and trace devices; thus, pen register and trap and trace orders extend nationwide and are not limited to the jurisdiction in which the order was issued. The issuing court must, however, have jurisdiction over the crime under investigation

(1) The SAC, or his/her designee, will seek the endorsement of the US Attorney to apply for a court order pursuant to 18 USC 3123. Pen registers require approval by the SAC on Form 9170, Request for Pen Register and/or Trap and Trace Devices. After SAC approval, the Form 9170 must be forwarded electronically to Special Investigative Techniques for filing.

(2) Upon final approval by the SAC, the investigating special agent should promptly contact the US Attorney for the purpose of obtaining a court order based upon an application by the AUSA pursuant to 18 USC 3122. (Exhibit 9.4.6-3 Application for Pen Register; Exhibit 9.4.6-4, Court Order for Pen Register). After approval by the magistrate or judge, the SAC, or his/her designee, will arrange for the timely shipment of a pen register(s) and other requested accessory equipment.

(3) Orders pursuant to 18 USC 3123 which authorize the installation of pen registers or trap and trace devices shall also authorize the use of such devices for a period not to exceed 60 days. Extensions for a period not exceeding 60 days are available upon application for another court order pursuant to 18 USC 3122 and 18 USC 3123(C)(1) and (2).

(1) If time does not permit the completion of Form 9170, the information may be orally transmitted to the SAC. An oral request for approval must be confirmed in writing and submitted within 2 working days after the oral request is made. After the oral approval has been obtained, the investigating special agent will contact the US Attorney to apply for the necessary court order. The previously discussed approval process and routing of the Form 9170 applies.

(2) Title 18 USC 3125 addresses emergency pen register installation prior to obtaining a court order and relates only to those situations involving the immediate threat of death or serious bodily injury, or conspiratorial activities characteristic of organized crime. The local Criminal Tax attorney and AUSA should be consulted to ensure the statute is followed.

(1) The intentional installation or use of pen registers or trap and trace devices without first obtaining a court order under 18 USC 3123 is prohibited. In compliance with the prohibition, the following procedures must be completed in order to install a pen register.

(2) Contact the telephone company to identify the line to which the pen register is to be attached.

(3) If the telephone company does not have the personnel available to confirm the correctness of the line at the appearance point, the tech agent will do the following:

1. A voltmeter must be attached to the identified line to determine if the telephone is in use.

2. If the telephone is not in use, attach the telephone test set to the line and confirm that the line is the correct line. If someone attempts to use the line while the butt set is attached to the line, the butt set will be immediately disconnected and not be reconnected until it has been determined (using the voltmeter) that the line is not in use.

3. Note that if physical intrusion is necessary for installation, a search warrant or consent is required.

(4) After the pen register has been activated, the SAC will ensure that installers and operators are competent to operate the equipment. Adequate precautions will be taken to limit access to the pen register only to its operator and other necessary personnel. Upon completion of use, pen registers must be immediately returned to the issuing office.

(5) Pen registers may not be utilized for gathering any transactional data inputted by a touch-tone phone (i.e., account numbers, amounts, etc.).

(6) If the authorization is not utilized, a memorandum will be submitted to the SAC setting forth the reasons for not using the pen register. The memorandum will include the name of the investigations pursuant to which authorization was sought.

(7) If an extension is necessary, submit a request per Form 9170 to the SAC for consideration. The request must summarize the information that has been obtained to date, and set forth the number of days the extension is sought. The extension may not exceed 60 days.

(8) Requests to add additional phone numbers or equipment not specified in the original order must be made per Form 9170 and must set forth the reasons supporting the issuance of another order under 18 USC 3123. Include in the request the new telephone numbers to be monitored and the name(s) and address(es) of the subscribers. The request for an extension of time can be combined with this request where appropriate.

(1) A trap and trace device is also called a "grabber". It records the telephone numbers from incoming calls to a particular telephone. The device used by the telephone company is a TTS-176 device, an electronic switching system (ESS), or a cross bar switching facility. Like a pen register, no conversations will be recorded. Trap and trace procedures are necessary when attempting to monitor call forwarding.

(2) Call forwarding is part of the trap and trace procedure. It requires a telephone company to identify which facility or number telephone calls are being forwarded. Historically, telephone companies have been reluctant to assist in trap and trace procedures or call forwarding monitoring unless the situation concerns threats to the President of the United States and/or involves a kidnapping. The statute now protects companies from any liability resulting from the use of such devices (see 18 USC 3124(d)).

(3) The telephone company may be able to provide a record of incoming calls to the telephone of a subject under investigation. This depends on the type of switching facility (exchange) involved. This information can be as useful as a pen register/DNR.

(4) Trap and trace service requires the same approval as pen registers/DNRs. Requests, extensions, and any deviations from requests must conform to the same procedures governing pen register requests and will be considered in the same manner.

(5) Consider the availability and use of "caller ID" to obtain desired information prior to applying for a trap and trace authorization.

(6) A court order under 18 USC 3123 is required. This order requires the same application and the same information as the order for installation of pen registers.

(7) Whenever possible, before obtaining an order to trace incoming calls to a particular line, review the proposed trace with the local telephone company's security officer. The security officer should be able to advise of foreseeable problems in the execution of the proposed order.

(8) Except in very rare instances, orders should be limited to Electronic Switching System (ESS) or No. 5 cross-bar facilities. The likelihood of successfully tracing telephone calls through a system using less sophisticated equipment is extremely low and requires an inordinate amount of time and equipment.

(9) Where possible, all orders should also be limited with respect to the following:

1. Scope: An order should minimize the number of lines on which trap and trace service is requested at a given switching facility.

2. Geography: It is preferable that the order limit traces to "all calls originating in X city" or "all calls originating within a y-mile radius of Z town."

3. Duration: Orders must limit the trace to 60 days, subject to an extension of an additional 60 days if the supervising attorney determines it to be necessary.

4. Hours: If it is possible to anticipate when calls will come into a target phone, tracing should be limited to these hours.

(10) Seek the tracing information from the telephone company no more than once a day and, except in unusual circumstances, only during regular business hours.

(11) Each order should contain a clause forbidding the telephone company to disclose that a trace is or has been in progress as provided by 18 USC 3123(d). A telephone company should be given the opportunity for a closed hearing before the issuing judge to seek limitations of any proposed order if the telephone company feels the order is too burdensome.

(12) The SAC's approval of a Form 9170, Request for Pen Register and/or Trap and Trace Devices, is required to obtain authorization to use trap and trace devices. After SAC approval, the Form 9170 must be electronically forwarded to Special Investigative Techniques.