Document text
l
i ti7 H
l
UNCLASSIFIED - FOR OFFICIAL U_SE ONLY
Domestic Investigations and Operations Guide
10." U! Sensitive Investigative Matter / Academic Nexus
10.1. U! Overview 7
U! Certain investigative matters should be broughtto the attention of FBI management and DOJ
officials because of the possibility of public notoriety and sensitivity. Accordingly, assessments
andpredicatedinvestigationsinvolving- sensitive investigative matters have specialiapprovaland reporting requirements. l K I l '
10.2. U!Purpose, Scopeand Denitions
U//FOUO! A sensitive investigativematter is dened as an investigative matter involving the
activities of a domestic public official or political candidate involving comiption or a threat to
the national security!, religious or political organization or individual prominent in such an
organization, or news media, or any other matter which, in the judgment of the official
authorizing an investigation, should be brought to the attention of FBI Headquarters and other
DOJ officials, AGG-Dom, Part VLLN.! As a matter of FBI policy, judgment means that the
decision of the authorizing official is discretionary. Descriptions for each of the ofcials and
entities contained in the sensitive investigative matter denition are a_s followst,
A. U//FQUQ! ;1!_o_x}_1e'_'sti_c Public,Official-A-domesticpublic ofcialis an indiv'id"ua1 elected or
appointed to a position of trust in a federal, state, local or tribal governmental entity or
political subdivision thereof; A matter involving a domestic public ofcial is a sensitive
investigative matter if the assessment or predicated investigation involves corruption or a
threat to the national security.
B. U//FOUO!l_olitical candidateA political candidate is an individual who is seeking
election to,.or nomination for election to, or who has authorized others to explore on his or
her behalf the possibility of election to, an office in a federal, state, local or tribali
govemmentalentity or political subdivision thereof. As with domestictpublic officials, a
matter involving a political candidate is a sensitive investigative matter if the assessment or
predicated investigation involves corruption or a threat to the national security.
C._j_U[/fOUO! Political organization or individual prominent in such an organization-,"
13.] U//F_OUO! Religious organization or individual prominent in such an organizationm
l L
lO8
UNCLASSIFIEDF OR OFFICIALUSE ONLYb2
b7E
4!
I?
UNCLASSIFIED ~ FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
E. U//FQUO! Member of the media or a news organizatiop-;{
F. ' U/I/F OUO1 Academic Nexus-%/ I I
I
s
U//FOUO! The sensitivity related to an academic institution arises from the American
tradition of academic freedom e.g., an atmosphere in which students and faculty are free
to express unorthodox ideas and views and to challenge conventional thought without fear of
repercussion!. Academic freedom does not mean, however, that academic institutions are off
limits to FBI investigators in pursuit of information or individuals of legitimate investigative
interest. _
_ see the classied appendix. ,
G. U//FOUO! Other MattersAny matter that in thejudgment of theofficial authorizing an
investigation that should be brought to the attention of FBIHQand other Departmentof.
Justice officials. As a matter of FBI policy, judgment means that the decision of the
authorizing official is discretionary.
10.3. U//FOUO! Factors to Consider When Initiating or Approving an Investigative
Activity Involving a Sensitive Investigative Matter .
U//FOUO! In addition to the standards for approving investigative activity in Sections 5, 6, 7
and 9, the following factors should be considered by the: i! FBI» employee who seeks to initiate
an assessment or predicated investigation involving a sensitive investigative matter; ii! CDC or
OGC when reviewing such matters; and iii! approving official in determining whether the
assessment or predicated investigation involving a sensitive investigative, matter should be
authorized:
A. U//FOUO! Seriousness/severity of theviolation/threat; ,
B. U//FOUO! Signicance of the information sought to the violation/threat;
C. U//FOUO! Probability that the proposed course of action will be successful;
D. U//FOUO! Risk of public exposure, and if there is such a risk, the adverse impact or the
perception of the adverse impact on civil liberties and public condence; and 1
E. U//FOUO! Risk to the national security or the public welfare ifthe proposed course of I
action is not approved i.e,, risk.of doing nothing!.
U//FOUO! ln the context of a sensitive investigative matter, particular care should be taken
when,consideringwhetherthe planned course of action is the least intrusive method feasible.
l09 1
UNCLASSIFIED-FOR OFFICIAL USE ONLYb2
b7E'-'
UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
10.4. U! Duration, Approval, Notice and Documentation
U//FOUO! The following are required approval and notification levels for investigative
activities involving sensitive investigative matters: _ *
. U//FOUO! Initiated by a Field Office:
U//FOUO! Assessment: An FBI employee may initiate assessment type one and two
activities, as described in Section 5.6.A. land 2 prompt checking of leads!, without prior
supervisory approval: However, because assessments involvingisensitive investigative
matters must be brought to the attention of FBl»Field Ofce management, CDC review and
SAC approval to continue the assessment must be acquired as soon as practicable. For
assessment types 3, 4 and 6 assessments see DIOG Section 5.6.A.3. 4 and 6! involving a
sensitive investigative matter, prior CDC review and SAC approval is required. For
assessment types 3, 4, a'nd,6, as described in Section 5.6.A.3. 4 and 6, if a sensitive
investigative matter arises after the initiation of an assessment, investigative activity must
cease until CDC review and SAC approval is acquired.
U//FOUO! Assessments involving a sensitive investigative matter do notrequire notication
to DOJ or the United States Attomey. AGG-Dom, Part ll.B.5.a! All positive foreign
, intelligence collection assessments, regardless of whetherthey involve-a sensitive
investigative matter, require prior FBII-IQ CMS approval. If a sensitive investigative matter
arises after the initiation of a positive foreign intelligence collection assessment, notice must
be provided to FBIHQ CMS. K .
U//FOUO! Predicated Investigat_ion:- For all predicated investigations involving a sensitive
investigative matter, prior CDC review and SAC approval is required, and the Field Office
must provide writtentnotication to the appropriate FBI}-IQ Unit Chief and.Section Chief.
Additionally, the Field Office must provide written notication to-the UnitedStates Attomey
or the appropriate-EBIHQ Section must provide written notication to the DOJ Criminal
Division or NSD, as soon as practicable, but no later than 30 calen on ofthe redicatedinve ' ', 'ce must identi®,_ , _ 1 _ see classied appendix forw
U//FOUO! It'.a sensitive investigative matter arises after the initiationof at predicated
investigation, investigativeactivity must cease until CDC review and SAC approval is
acquired and notice is fumished to theFBlllQ Unit and Section as speciedabove.
B. U//FOUO! Initiated by FBIHQ:
U//FOUO!'Assessment: For assessment types 3, 4 and.6, as described in Section 5.6.A.3. 4
g1_tld_6_, involving a sensitive investigative matter, OGC review and Section Chief approval is
required. if a sensitive investigative matter arises after the initiation of an assessment,
investigative activity must cease until OGC review and Section Chief approval is acquired.
U//FOUO! Assessments involving a sensitive investigative matter do not require notication
to DOJ or the United States Attorney. AGG-Dom, Part II.B.5.a! All positive foreign ,
intelligence collection assessments, regardless of whether they involve a sensitive t
investigative matter, require prior FBIHQ CMS approval. If a sensitive investigative matter
arises after the initiation of a positive foreign intelligence collection assessment, notice must
be provided to FBIHQCMS.
t ill!
UNCLASSIFIED-FOR OFFICIAL USE ONLY b2
ms
if/
UNCLASSIFIED L FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
U//FOUO! Predicated Investigation:-For predicated investigations involving a sensitive
investigative matter, OGC review, Section Chief approval, and written notication to the
United States Attorney, DOJ Criminal Division or DOJ NSD is required, assoon as
practicable, but no later than 30 calendar days after the initiation of such an investigation.'st identifyi_ I I
see classied appendix 1
. U//FOUO! If a sensitive investigative matter arises after the initiation of a predicated
investigation, investigative activity must cease until OGC review and Section Cliief approval
is acquired and notice is furnished as specied above.
10.5. U//FOUO! Distinction Between Sensitive Investigative Matter and Sensitive
Circumstance
U//FOUO! The term sensitive investigative matter should not be confused with the temi
sensitive circumstance as that term is used in undercover operations. A sensitive
circumstance relates to an undercover operation requiring FBIHQ approval. A comprehensive
list of sensitive circumstances for criminal activities is contained in the Attomey Generals
Guidelines on FBI Undercover Operations and in Section ll of the DIOG for national sec r 92matters. The Crimi" _ v ' iew Committee CUORC! and must review ahdkiliprove undercoverw U I I
ions that involve sensitive circumstances. The detailed policyfor undercover operations is
described in DIOG Section l 1.8, the Field Guide For Undercover and Sensitive Operations
FGUSO!, and the FBIHQ substantive Division program implementation guides.
10.6. U//FOUO! Sensitive Operations.Review Committee U//FOUO * Ib2
b7 E
b2
b7E
~-¢;~".; :'.
ll I
I UNCLASSIFIED-FOR OFFICIAL USE ONLY
if 7l
F
I
;
ALL INFORMATION CONTAINED '
HREIH IS UNCLASSIFIED
DAIE D?U820U9 BY UC 60322 LPISTPISZ
UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
11. U! Investigative Methods
11.1. U! Overview
U//FOUO! The conduct of assessments, predicated investigations and other activities authorized
by'the AGG-Domrmay present choices between the use of differentinvestigative methods
formerly investigative techniques ! that are each operationally sound and effective, but that are
more or less intrusive, considering such factors as the effect on the privacy_ and civileliberties of
individuals and the potential damage to reputation. The least intrusive method feasible is to be
used in such situations. However, the choice of methods is a matter of judgment. The FBI is
authorized to use any lawful method consistent with the AGG-Dom, even if intrusive, whereihe
degree of intrusivenessis warrantedin light of the seriousness ofa criminal or-national security"
threat or the strength of the information indicating its existence, or in light of the importance of
foreign intelligence sought to the United States interests. AGG-Dom, Part I.C.~2.!
U! The availability of a particular investigative method in a particular case may depend upon
the level of investigative activity assessment, preliminary investigation, full investigation,
assistance to other agencies!, . i
=1921.1.1. » U_!-Least Intrusive:Method . *7 . , _
U! The AKQG-Dom requires that the "least intrusive" means or method be considered and-if
operationally sound and effectiveused to obtain intelligence or evidence in lieu o_f more
intrusive methods. This principle is also reected in Executive Order 12333, which govems the
activities of the United States intelligence.coinmunity.~ The concept of least intrusive method
applies to the collection of intelligence and evidence. e
U! Selection of theleast intrusive means is a balancing test as to which FBI employees mustuse
common sense and soundjudgment to effectively execute their duties whilermitigating the
potential negative impact on the privacy and civil liberties of all_people encompassed within the
assessment or predicated investigation, including targets, witnesses, and victims. Thisiprinciple
isanot intended to discourage investigators from seeking relevant and necessary intelligence,
information, or evidence, but rather is intended to encourage investigators to choose the least
intrusiveyet still,effective-means from the availableroptions toobtain the material.
Additionally, F Blemployees should operate openly and consensually with United States personsto the extent practicable when collecting foreign intelligencethat does not concem criminal
activities or threats to the nat_ional.security. _
U! Section 4.4 describesthe least intrusive methods concept and the standards to be applied by
FBI employees.
I 112
UNCLASSIFIED-FOR'OFF_ICIAL usr. ONLY
m 1
UNCLASSIFIED- FOR OFFICIAL USE ONLY
~ Domestic Investigations and Operations Guide
11.2. U! Authorized Investigative Methods in Assessments and Predieated Investigations
U! The below listed investigative methods may be used in assessments and predicated
investigations. The use and/or dissemination of information obtained by the use of all authorized
investigative methods must comply with the AGG-Dom and DIOG Section l'4.
11.2.1. U! Authorized Investigative Methods in Assessments .
I AGG-Dom, Part II.A.4.! i '
U//FOUO! Ah FBI,employee must document on the FD-71, or in Guardian, the use of or the-
request and approval for the use of authorized investigative methods in type I and 2 assessments
see DIOG Section 5.6.A.l and 2!. By exception, certain assessment type l and?2 situations may
require the use of an EC to document the use and approval of certain investigative methods. All
authorized investigative methodsin type 3, 4, and 6 assessments_ see DIOG Section 5.6:A.3 4
Ql_'l_§I_§! must use an EC to document the use of or the request and approval for the use of the
applicable-investigative method. For a detailed description of these methods see DIOG Section
5.9. --
A. U! Obtain publicly available infomnation. * _ _ > 7
B. U! Access and examine FBI and other Department of Justice records. and obtain information
from any FBI or other Department of Justice personnel. * _, K
C. U! Access and examine records maintained by. and request information from. other federal.
state. local. or tribal. or foreign govemmental entities or agencies.
D. U! Use online services and resources whether non-prot or commercial!.
E. U! Use and recruit human sources in conformitvwith the Attorney»Generals Guidelines
Regarding the Use of F BI_'Condential Human Sources.
F. U! Interview or request information from members of the public and private entities.
G. U! Accept information voluntarily/_provided by governmental or private entities.
H. U! Enaage in observation and conduct physical surveillance not requiring a court order.
I. U//FOUO! Grand jury subpoenasafor telephoneor electronic mail subscriber information
during type I and 2 assessments, _ .
U//FOUO! Note: In assessments, supervisory approval is required prior to use of the following
investigative methods: certain interviews, tasking of a" CI-IS, andphysical surveillance not
requiring arcourt order. During predicated investigations the supervisory approval requirements
for these investigative methods may not apply.
11.2.2. U! Authorized Investigative Methods in.Preliminary Investigations I
AGG-Dom, Part V.A.l-10!
U! In preliminary investigations the authorized methods include the following: IAGG-Dom.Part II.B. and Part -V.A.| I
A. U! The investigative methodsapproved for assessments.
B. U! Mail covers.
I13
UNCLASSIFIED-FOR OFFICIAL USE ONLY
UNCLASSIFIED - FOR OFFICIAL USE ONLY
~' Domestic Investigations and Operations Guide
C. U! Physical searches of personal or real property where a warrantor court order is not
lggallv rcquired becausc there is no reasonable expectation of privacL e.g.. trash covers!.
D. U! Consensual monitoring ofcommunications. including consensual computer monitoring.
subject to legal review bv the CDC or the OGC. When a sensitive monitoring circumstance is
involved, the monitoring-must be approved by the DOJ Criminal Division or, if the
investigation concems a threat to the national security or foreignintelligence, by the;DOJ
National Security Division. . '
U//FOUO! Note: For additional information, see the classied appendix.
U//FOUO! Note: For those state, local and tribal govemments that do not sanction or
provide a law enforcement, exception available to the FBI for one-party consent recording of
communications with persons within theirjurisdiction, the _SAC must approve the consensual
monitoring of communications as an OIA. Prior to the SAC authorizing the OIA, one-party
consent must be acquired. The SAC may delegate the.OlA approval authority to an ASAC orSSA. '
E. U! Use of closed-circuit television. direction nders. and other monitoring devices. subject-
to legal review by the CDC or the OGC. The methods described in this paragraph usually do
not-require court ordersor w:?1r'rants_urilesstheyinvolve an intrusioninto an area where there
is a reasonable expectation of privacy or non-consensual monitoring of communications, but
legal review is necessary to ensure compliance with all applicable legal requirements.!
F. U! Polygraph examinations. I
G. U! Undercover operations. In investigations relating to activities in violation ofrfederal
criminal law that do not concem threats to the national security or foreign intelligence,
undercover operations must be carried out in conformity with the Attorney Generals
Guidelines on Federal Bureau oflnvestigation Undercover Operations. ln investigations that
concem threats to the national security or foreign intelligence, undercover operations
involving religious or political organizations must be reviewed and approved by FBI
Headquarters, with participation by the DOJ National Security Division_in the review process
H. U! Compulsory/_process as authorized by law. including grand jury subpoenas and other
subpoenas. National,Securitv Letters 5 U.S.C. §§ l68lu, 1681v;_18 U.S.C. § 2709; 12
UlS.C.~§ 3414[a][5][A]; 50 U.S.C. § 436, and FISA orders [50 U.S.C. §§ 1861-63]!.
l. U! Accessing stored wire and electronic communications and transactional records in
' conformity with chapter:l2l oftitle l8. United States Code 8 U.S.C. §§ 2701-2712!.
J. U! Use of pen registers and trap iand trace devices in conformity with chapter 206 oftitle 18.
United States Code 8 U.S.C. §§ 3121-3-127! or FISA 0 U.S.C. §§ 1841-1846!.
11.2.3, U! Authorized Investigative Methods in Full Investigations l
AGG-Dom, Part V.A.l1*-13! * r
U! In full investigations, to include enterprise investigations, all investigative methods approved
for assessments and preliminary investigations may be _used. In addition, the three investigative
methods listed below may only be usedin full investigations:
- 3
114
UNCLASSIFIED-FOR OFFICIAL USE ONLY
i 1 1 __ __/J V _
UNCLASSIFIED - FOR OFFICIAL USE ONLY .
92 Domestic Investigations and Operations Guide
A. U! Electronic surveillance in conformiity withWel1ap_ter_l I9 of title 18. United States Code 8
U.S.C. §§ 25 I 0-2522!., or the Foreign Intelligence Surveillance Act. for Executivebrder
IZ333 Q 2.5. _ _ I .
B. U//FOUO! Phvsical searches. including mail openings. in conformitv with Rule 41 of the
Federal Rules of Criminal Procedure. the Foreign lntelligenee Surveillance Act. or Executive
Order l2333 § 2.5. "Note: For additional infonnation regardingeertain searches, see. the
classied appendix. _ ,
C. U! Acquisition of foreign intelligence information in conformity with Title Vll of the FISA.
U//FOUO! Note: Not all investigative methods areauthorized while collectingforeign
intelligence as part of a full investigation. See DIOG Section 9 for more information;
I-1.2.4. U! Particular Investigative Methods I
U//FOUO! All lawful investigative methods may be used in activities under the AGG-Dom as
authorized by the AGG-Dom. Authorized methods include, but are not limited to, those
identied in the rest of thissection. In someinstances they are subject to special restrictions or
review or approval requirements. AGG-Dom, Part V.A=!
_ l 15 _ I
UNCLASSIFIED-F OR OFFICIAL USE ONLY
UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
11.3. U! Investigative Method: Mail Covers
11.3.1. U! Summary
U! A mail cover may be sought only in a predicated investigation when there exists reasonable
grounds to demonstrate that the mail cover is necessary to: i! protect the national security; ii!
locate a fugitive; iii! obtain evidence of the commission or attempted commission of a federal
crime; or iv! assist in the identication of property, proceeds or assets forfeitable because of a
violation of criminal law. 39 C.F.R. § 233.3 e!!. _
U//i=ouo!| b2
b 7 E
U!. t 1 ~- b2
_ we
g lAs a
general rule, amailcover in the APO/FPO system overseas may only be ordered by a military
authority competent to order searches arid seiz"ur e"s for*laW enforcement purposes, usually a
commanding officer. See DoD 4525.6-M, the DoD Postal Manual.
U//FOUO! Applicationzl , | x 1 l b2I ' ' I b7E
11.3.2. U! Legal Authority e
A. U! Postal Sen/ice Regulation 39 C.F.R. § 233.3 is the sole authority and procedure for
initiating a mail cover and for processing, using and disclosing information obtained from a
mail cover;K
'B. U! There is no Fourth Amendment protection for information on the outside of a piece of
mail. See, e.g., U.S.v. Choate 576 F.2d 165,174 9" Cir., 1978!; and U.S. v. Huie, 593 F.2d14 s cm, 1979!; and, '
C. U! AGG-Dom, Part V.A.2.
11.3.3. U! Denition of Investigative Method _
U! A mail cover is the non-consensual recording of any data appearing on the outside cover of
any sealed or unsealed mail matter to obtain information in order to:
A. U! Protect the national security;
B. U! Locate a fugitive;
C. U! Obtain evidence of commission orattempted commission of a federal crime;
D. U! Obtain evidence of a violation or attempted violation of a postal statute; or i
E. U! Assist in the identication of property, proceeds or assets forfeitable under law.
39 C.F.R. §233.3 c! !. _
1 l6
UNCLASSIFIED-FOR OFFICIAL USE ONLY
i7 i i
UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
U! In this context, a recording means the transcription, photograph, photocopy, or other
facsimile of the image of the outside cover, envelope, or wrappers of mailedmatter. A warrant or
court order is almost always required to obtain the contents of any class of mail, sealed or
unsealed. ~ 92 <
11.3.4. U! Standard for Use and Approval Requirementsrfor Investigative Method
U! The standard to obtain a mail cover iscstablished by the Postal Service regulation'..The Chief
Postal Inspector may order a mail cover [w]hen a written request is received from any law
enforcement agency in which the requesting authority speciesthe reasonable grounds to
demonstrate the mail cover is necessaryto:
0 U! Protect the national security;
Q U! Locate a fugitive;
v U! Obtain infonnation regarding the commission or attempted commission of a crime; or
0 U! Assist in the identication of property, proceeds or assets forfeitable because of a
violation of criminal law. 29 C.F.R. § 233.3 e!!._
U/FOUO!~National=Security- Mail.Cover: A_national.secu_rity mail cover request must be
approved by the Director or designee, currently only the EAD of the National Security Branch.
All requests for national security mail covers must be reviewed by the Field Ofce SSA
according to the below-criteria. A national security mail cover sought to protect the national
security includes protectingthe United States from actual or threatened attack or other grave,
hostile act; sabotage; international terrorism; or clandestine intelligence activities, including
commercial [economic]~espionage by foreign powers or their agents. _
U//FOUO! After beingapproved by the SSA, the Field Ofce musttransmit the mail cover
letter reguest by EC, with the draft letter as an attachment,to the National Security Law Branch
NSLB! for legal review and concurrence. Upon review and concurrence, the NSLB must
transmit the letter request for signature approval to the EAD, National Security Branch, or, in his
or her absence,to the Director.
U//FOUO! Criminal Mail Cover: A criminal mail cover request may be approvedby the Field
Ofce SSA. The SSA may approve a request for a mail cover if there are reasonable grounds.to
demonstrate that the mail cover is necessary to assist in efforts to: i! locate a fugitive; ii! obtain
information regarding the commission or attempted commission of a federal crime; or iii! to
assist in the identification of property, proceeds or assets forfeitable because of aiviolationof
criminal law.
U//FOUO! SSA review and or approvalof a national security or criminalmail cover
request: Approval of any mail cover request or an extension is conditioned on the following
criteria being met:A._ U//rouoj I i
117 I
UNCLASSIFIED-FOR QFFICIAL USE ONLYb2
b/E
UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
B. ~ u//Fou0!| ¢ " 1 2
2 . C. U//FOUO!
D. u//Fouo>| r
E.- U//FOUO!| l
E. U//FOUO1 l I
Under postal regulations, a mail cover must not include matter mailedbetween the mail
cover subject and the subjects attomey,.unless the attomey is also a subject under the
investigation.!' ~ _ l N0te:
G. u//Fouo!| *
H. U//FOUO!| * , '
1. U//Fouo!| W I
U! Emergency Requests: When time is of the essence, the Chief Postal Inspector, or
g .designee, may act upongan oral requestto be conrmed by the requesting authority, in
writing,,within three calendar days. Information maybe released prior to receipt of the
~ 7 us
UNCLASSIFIED-FOR OFFICIAL USE ONLYb2
ma
132
ms
b2
b7E
b2
b7E.
1:2. l
me:
b2
b7E
b2
lo/Eb2
b7E,
UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
written request only when the releasing ofcial is satised that an emergency situation exists.
39 C.F.R. § 233.s ¢! s!. I ~
U! An emergency situation exists when the immediate release of infonnationis required
to prevent the loss of evidence or when there is a potential for immediate physical harm to
persons onproperty. 39 C.F.R. §233.3 c!0!. ~
11.3.5. U! Duration of Approval _ e
A. U! National Security: A national security mail cover is limited to 120 days from the date
the mailcover is initiated. Extensions can only be authorized by the Chief Postal Inspector or
his designee at the Nationall-Ieadquarters of the Ofce of the Chief Postal Inspector. 39
C.F.R. § 233.3 g!!.
B. U! Criminal mailacovers except fugitives: A mail cover in a criminal case is limited to no
more than 30 days, unless adequate justification is provided by the requesting authority. 39
C.F.R. § 233.3 g!!. Renewals may be granted for additional 30-day periods under the same
conditions and procedures applicable to the original request. The requesting authority must
provide a statement of the investigative benet of the mail cover and anticipated benets to
betderived-from the extension.
C. U! Fugitives: No mail cover instituted to locate a igitive may remain inforce folongere
than l2_O continuous days unless personally approved for further extension by the Chief
Postal Inspector or his/her designees at Natio'na'lI-Ieadquarters. 39 C.F.R. § 233.3 g!!.
D. U! Exception for Indictments: Except for fugitive cases, no mail cover may,remain in
force when an information has been led or the subject has been indicted for the matter for
which the mail cover has been requested. If the subject is under investigation forfuither
criminal violations, o_r a~mail cover is required to assist in the identication of property,
proceeds or assets forfeitable because of a violation of criminal law, a new mail cover order
musfbe requested. 39 C.F.R. '§ 233._3 g!!.
11.3.6. U! SpecicProcedures A K
U//FOUO! The Postal Regulation requires that physical storage of all reports issuedypursuant to
a mail cover request to be at the discretion of the Chief Postal Inspector. 39 C.F.R. § 233.3 h! '1!.
Accordingly,'FBl employeestmust conduct a timely review of mail cover documents received
'from_tlie USPS. A copy of the signed mail cover request and the signed transmittal letter must be
maintained in the investigative case le. .
U//Fouoj. .
11.3.7, U! Compliance and Monitoring A I A
U//FOUO! FBI employees must conduct a timely review of mail cover information received
frdmthe USPS for any potential production of data beyond the scope of the requested mail cover
overproduction ! and either destroy or retum the overproductionto the assigned USPS
representative noting the reason for the retum. ~ i
119
UNCLASSIFIED-FOR OFFICIAL USE ONLYl?2
'b7E
92
UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
11.4. U! Investigative Method: Physical searches of personal or real property where a
t rtd'tlll db th'* bl_warran or cou or er is no e a re urre ecause ere is no reasona e b2
expectation of privacy e.g. b/E
11.4.1. _ U! Summary .
U//FOUO! Application: In predicatedinvestigations, the FBI mayconduct physical searches
of personal or real property where a warrant or court order is not legally required because there is
I * ot otherwise rohibited by AGG~Dom, Partlno reasonable expectation of privacy] ' t
IlI.B.2 t3.| 3 q _ , '
11.4.2. U! Legal Authority -
A. U! AGG-Dom, Part V.A.3, -
B. U! Fourth Amendment to the United States Constitution
_11,4_.3. U! _Defin_ition of Investigative Method ,
U! The~Fourth Amendment to the United States Constitution prevents the FBI from conducting
unreasonable searches and seizures. It also generally requires a warrant be obtained if the search
will intrude on a reasonable expectation of privacy. To qualify as a reasonable expectation of
privacy, the individual must have an actual subjective expectation of privacy and'society must
be prepared to recognize that expectation as objectively reasonable. See Katz v. United States,
389 U.S. at 361. lfan individual has a reasonable expectation of privacy, a warrant or order
issued by a court of competentjurisdiction or an exception to the requirement for such a warrant
or order is required before a search may be conducted. Physical-searches of personal or real
property may be conducted without a search warrant or court order if there is no reasonable
expectation of privacy in the property or area. As a general matter, there is no reasonable
expectation of privacy in areas that are exposed to public view or that are otherwise available to
the public. A reasonable expectation of privacy may be terminated by an individual abandoning
property, setting trash at the edge of the curtilage or beyond for collection, or when a private
party reveals the. contents of a package. .
U! Examples of Searches not Requiring a Warrant because thereis no Reasonable
Expectation of Privacy: i! Vehicle identication numbers or personalproperty that is exposed
to public view andmay be seen when looking through the window of a car that is parked in an
area that isopen to andaccessible by members of thepublic; ii! neither the examination of
books and magazines ina book store nor thepurchase of suchitems is a search or seizure under Z
the Fourth Amendment. See Mgland v. Macon, 472 U._S. 463 985!; and iii! a deliberate
overight in navigable air. space to photograph marijuana plantsis not a search, despite the
landownerssubjective expectation of privacy. See California v. Ciraolo, 476 U.S..207 I986!.
U! Whether an area is curtilage is determined by reference to four factors: i! proximity of the
area in question to the home; ii! whether the area is within an enclosure surrounding the home;
iii! nature of the use to which the area is put; and iv! steps taken to protect the area from
observation by passers=by.
120
UNCLASSIFIED-FOR OFFICIAL USE ONLYb2
b7E
UNCLASSIFIED -FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide N '
U! An area is cuitilage if it is so intimately tied to the home itself that it should be placed underthe homes umbrella of Fourth Amendment protection.
11.4.4. U//FOUO! Standards for Use and Approval Requirements for InvestigativeMethod i
U//FOUO! No supervisory approval is required for the use of this method. However, if there is adoubt as to whether a person has a reasonable expectation of privacy in the area to be searched,1 consult with the CDC or~FBI Ofce of the General Counsel to determine whether a search '
warrant is required. Use of this rnethodmust be documented in the case le.
I21
UNCLASSIFIED-FOR OFFICIAL use ONLY
t
>UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide .
11.5. U! Investigative Method: Consensual Monitoring of Communications, including
consensual computer monitoring
11.5.1. U! Summary
U! Consensual monitoring of communications may be used in predicated investigations. Its use,
including consensual computer monitoring, requires review by the CDC or the OGCI. AGG-
Dom, Part V.A.4! ~ Z
U//FOUO! Application: This investigative method may be used in national security
investigations, criminal investigations and positive foreign intelligence collection cases, and for
assistance to other agencies when it is not otherwise prohibited by AGG-Dom, Part lll.B.2-3.
This method cannot be used during an assessment
U//FOUO! Note: For those state, local and tribal govemments that do not sanction or provide a
law enforcement exception available to the FBI for one-party consensual recording of
communications with persons within theirjurisdiction; the SAC must approve the consensual
monitoring of communications as an OIA. Prior to the SAC authorizing the OIA, one-party
consent must be acquired. The SAC may delegate the OIA approval authority to an ASAC orSSA. ' ' ' i ' ' C
11.5.2.' U! Legal Authority
A. U! The Fourth Amendment tothe United States Constitution and case law interpreting the
same; "
B. U! l8 U.S.C. § 251 l! b! & !; '~
C. U! The Foreign Intelligence Surveillance Act of 1978 FISA!, 50 U.S.C._ §§ 1801 et seq.,
denes electronic surve'illance to.include only those communications in which a person
has a reasonable expectation of privacy and a warrant would be required for law
enforcement purposes. 50 U.S.C. § l801 i!. If a party to the communication has consented
to monitoring, a Title Ill or FISA court order is not required to monitor those consensual
communications; and
D. U! Computer Trespasser Exception - 18 U.S.C. § 251 l! i!.
11.5.3. U! Definition of Investigative-Method T "
U! Consensual monitoring is: "monitoring of communications for which a court order or '
warrant is not legally 'requirecl'because of the consent of avparty to the communication. AGG-
Dom, Part VII.A.! Consensual monitoring includes the interception of the content of
communications that typically fall into one of three general categories:
A. U! Conventional telephone communications or other means of transmitting the human voice
through cable, wire, radio frequency RF!, or other similar connections; ,
B. U!*Oral communications, typically intercepted through the use of devices that monitor and
record oral conversations e.g., where a body transmitter or recorder or a xed location
transmitter or recorder is used during a face-to-face communication in which a person would
have a reasonable expectation of privacy but for the consent_ of the other party!; and
122
UNCLASSIFIED-FOR OFFICIAL USE ONLY
m
i
v
UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and ,Ope_r-ations Guide
C. U! Communications transmitted between parties using computer protocols, such as e-mail,
instant message, chat sessions, text messaging, peer-to-peer communications, or other
electronic communications, as that term is dened in 18 U.S.C. § 251O2!.
U! The consensual monitoring of communications, including consensual computer monitoring,
is subject to legal review by the CDC or. the OGC. AGG-Dom, Part V.A.4!
U! The computer trespasser exception to the wiretap statute, I8 U.S.C. § 251 1! i!,_relies on
the consent of the computer owner-operator and limits the monitoring -to only the - ~
communications of the trespasser. The statute includes additionaliimitations on the use of this
provision. -
11.5.4. U! Standards for Use and Approval Requirements for Investigative Method
A~. U! General Approval Requirements
U1/FOUO! Except as provided below in Section l~l.5.4.B, an SSA may approve the
consensualmonitoring of communications, including consensual computer monitoring of
communications, if the infonnationlikely to be obtained is relevant to an ongoing
investigation.~SSA approval is conditionedon the following criteria being met and
documentedusing the,.F.D-.759; ~
l. U//FOUO! Reasons for Monitoring: There is sufcient factual information
supporting the need for the monitoring and that the monitoring is related to the
investigative purpose, including, if applicable, a citation to the principal crifninal statute
involved;
2. U//FOUO!*Legal Review: Prior totheiinitiation of the consensual monitoring, the
CDC or the OGC concurred thatconsensualmonitoring under the facts of the
investigation is legall Whenever the monitoring circumstances change substantially, a
new FD-759 must be executed and the CDC orOGC must be recontacted to obtain a
new concurrence. AGG-Dom, Part V.A.4.! The following are examples of substantial
changes in monitoring circumstances which require a new FD~759: a different
consenting party, new interceptees, or a change in the location of a xedimonitoring
device;
3. U! Consentz -A party to the communication has consented to the monitoring and that
consent has been documented according to the below-procedures. Consent may be
express or implied. In consensual computer monitoring, for example, implied consent
to monitor may existifusers are given notice through a sign-on banner that all users
must actively acknowledge by- clicking through! or through other means of obvious
notice of possible monitoring. Consent to monitor pursuant to the computer trespasser
exception istnot provided by a party to the communication per se, but is instead,
provided by the owner, operator, or systems administrator of the computer to, be
monitored. "
4. U//FOUO! Subject: The monitoring will not intentionally-include a third-party who is
not of interestto the investigation, except for unavoidable or inadvertent overhears.
5. U//FOUO! Location of device: Appropriate safeguards exist to ensure that the
consenting party remains a party to the communication throughout the course of
monitoring. If a xed-location monitoring device is being used, the consenting party
123 ,
UNCLASSIFIED-FOR orrrcnu. use onmz
UNCLASSIFIED - FOR OFFICIAL USE ONLY
- Domestic Investigations and Operations Guide
has been admonished andagrces to be present during the duration of the monitoringand, if practicable, technical means are being used to activate monitoring only when theconsenting party is present. it
U//FOUO! Location of monitoring: If monitoring will occur outside a Field Ofcestei"ritory,~notice has been provided tocthe SAC or ASAC of each Field Office where themonitoring is to occur, and that notice has been documented in thecase le.
U//FOUO! Duration: The-request states the length of time needed for monitoring.Unless otherwise warranted, approval may be grantedsfor theduration of -the:investigation subject to a substantial change of circumstances, as described in Section11.5.4._A.2, above. When a sensitive monitoring circumstance is involved, DOJ maylimit its approval to a shorter duration;
B U//FOUO! Exceptions Requiring Additional Approval
l U//FOUO! Partv Located Outside the United States:
U//FOUO ' ' i '
a. U//FOUO] I I
. . ' r A r»
b, U//EOU0] "
iii
_ , . _i 'c._ U//FOUO!l J J l I 1 I
Jr r ' ' I
124
UNCLASSIFIED-FOROFFICIAL USE ONLYb2
we
b2
b7E
b2
b'7E
b2
b7E
UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
2. U! Consent of More than One Party Required:
U//FOUO! For those states or tribes that do not sanction or provide a law enforcementexception available to the FBI for one-party consent recording of communications withpersons withinatheir jurisdiction, the SAC must approvethe consensual monitoring ofcommunications as an OIA. Prior to the SAC authorizing the OIA, one-party consentmust be acquired. The SAC may delegate the OIA approval authority to a_n ASAC orSSA.
3. U! Sensitive Monitoring Circumstance:
U! Requests to consensually monitor communications when a sensitive monitoringcircumstance isinvolved must be approved by the DOJ Criminal Division, or if the I. investigation concerns a threat to the national security or foreign intelligence collection,by the DOJ NSD. AGG-Dom, Part V.A.4! A sensitive monitoring circumstance isdened in the AGG-Dom, Part VlI.O, to include the following: I
_a.
b
c
d U! Investigation of a member of Congress, a federal judge, amember of theExecutive Branch at Executive Level IV or above, or a person who has served insuch capacity within the previous two years Note: Executive Levels I through IVare_dened»in 5'U.S.C. §_§,53rl2:53 1'5!; , .
U! investigation of the Govemor, Lieutenant Govemor, or Attomey>General ofany state or territory, or a judge or justice of the highest court of any state orterritory, concerning an offenseinvolving bribery, conict of interest, or extortionrelated to_.the performance of official duties;
U! The Attomey General, the Deputy Attomey General, or an Assistant AttomeyGeneral has requested that the FBI obtain prior approval for the-use of consensualmonitoring in a specic investigation;
U! A partybto the communication is in the custody of the Bureau of Prisons or theUnited States Marshal Service or is being or,h_as been afforded protection in theWitness Security Program
U//FOUO] ,
4 Y e F I ' F L _ 'I 1,;
} r II ! U//FOUO Ll _ g _
I25
UNCLASSIFIED=FOR OFFICIAL USE ONLY! U//F0 we
-
UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide ! U//F _!UO!I I l I ' _ ' I
I
! U//FOUOI I I
! U//FOUO §
! U//FOUOI 1 I I ' N
! Iw/m0u0!
s! U//FOUO!| I II I I5 I I
9! u//Fouoj ' ~ _ r I - _
rt > 1
1! U//FOUO I . _ I2! U//FOUIO ' ~
3! U//FOUO C
4! U//FOUO
<15! '< F°U° I
6! U//FOUO "0! 1/r1@o110I<" I
1! U//FOUO! . I
U//FOU
.I I £ I
! U//P0uo!| l F I! U//FOUO
' 126
_ UNCLASSIFIED-FOR OFFICIAL USE ONLYI
b2
b/E
b2
b7E.
l;~2
b7E1
UNCLASSIFIED - Foiz OFFICIAL USE ONLY
D .omestic Investigations and Operations Guide
_ U//FOUO! Note: See ' ' classied Aggéndnx G for additional information regarding
1 consensual monitoring.
e. U//FOUO! Procedure for ObtainingZD0J A roval For a SensitiveMdnitoring C stance ' i I fV1 T, Ar92_[{ i.|
f.> U//FOUO! N0te: Enier ' 'om ring .
lrcumstances._ genclfequests1nvolv1nFSensitiveM to ' C. . _ .
! u//F000!
. |'i9217 I iNa1|Pi Hi
F "J M
U//FOUO!92 "
!=ifELI,/:Fou0-!-92_-I . j H
U//FOUO ,n,92
e 14A I Tr? . J 4!
11.5.5. U! Dnfation of_AE}iroval I" U//Fggggl I '
_ 127, i
UNCLASSIFIED-FOR OFFICIAL USE ONLY
- i1 » - * inb2.
b7E
b2
b7E
b2
b7E.
b2
b7E.
b2
b7E
U//F0001 k A I L I '
b2
b7E
b2
b7E
UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
I I
11.5.6. U//FOUO! Specic Procedures I
U//FOUO! The following procedures apply when obtaining consent.A. U//FOUO Documen ' consentI g I*"_ ,.T I > I - I .
. [J .,I____I ..q F r I b7E
I I I I
I I
B. U//FOUO Retenti o he consent form
III
C. U//FOUO! Documenting review and approvalw I r I rI I I Liar r '1
4 '-
E I I I I
D. U//FOUO Mliltiple comrnunications
T II II -|,I I
E. U//FOUO! Case specic approval I I _I It
I28
UNCLASSIFIED-FOR OFFICIAL USE ONLYb2
b7E
b2
b7E
b2
b7E
b2
b'7E
b2
b7E
UNCLASSIFIED -FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
11.5.7. U//FOUO! Compliance and Monitoring
U//FOUO! ELSUR program personnel must-conduct regularly scheduled reviews of the FD-
759s approved within the Field Office to determine whether approval was obtained prior to
initiationlof consensual monitoring and to ensure that the monitoring occurred in compliance
with the approvals. The ELS UR Program is also responsible for indexing all individuals or.
identiers of persons-intercepted during consensual monitoring and cross-referencing their
names or identiers to the approved FD-759. in the investigative case le.
l29
UNCLASSIFIED-FOROFFICIAL USE ONLY
ii -.
UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
11.6. U!Investigative Method: Use of closed-circuit television, direction nders, and
other monitoring devices Not needing a Court Order!
U! Note: Use of this method is subject to legal review by the CDC or OGC. '
11.6.1. U! Summary n . U//Fouoil I 8 -1 * I
.1 1:2
19715
U//FOUO!Appllcat1o1'1_92 0 l_ f I 1 25E
* A _ _ ' eiprohibited by AGG-Dom, Pm llI.'B.2-3.
11.6.2. U! Legal Authority
A; U! AGG-Dom, Part V' '
B. U! Tracking devices use I 8 U.S.C. §T25 lO[l2] [C]!
C. U! Rule 41 Federal'Rules of Criminal~Procedure
D. U! Fourth Amendment to the United _States.Constitution
11.6.3. U//FOU0! Denition of Investigative Method
A. U//FOUO! -Closed Circuit Television CCTV!: a xedelocationvideo camera that is
typically concealed from view or that is placedon or operated by a consenting party.B. U//FOUQ!Eleitronic Trackinf_Dev'ice_s_;] ' .1 - .
' _ p Electronic tracking devices are specically A
excluded from'Tit1e Ill requirements 8 U.S.C. § 2510[12] [C]!..In circumstances where a
. court order is required pursuant to FRCP Rule 41[e][2][B]!, ajudge or magistrate may
authoriie the useotjan electronic tracking device within the jurisdiction of the court and
A outside thatjurisdiction, if the device is installed in thatjurisdiction. FRCP Rule 41 b[4];18
U.S.C. § 3117.! ~ ' .
C. U//FOUO
~ no '
UNCLASSIFIED-FOR OFFICIAL use ounvb2
b7E
b2
b7E
UNCLASSIFIED - FOR OFFICIAL USE ONLY A
Domestic Investigations and Operations Guide V
U//FOUO
' An example would be using thermal-imaging to detect heat emanating fromwithin a home to make inferences about the use of high-powered marijuana-growing lamps
inside the home Kyllo v.>United States, 533 U.S._27 001!!.
Ll! Whether an area is cuitilage is determined by reference to four factors: i!, proximity ofthe area in question to the home; ii! whether the areais Within an enclosure surrounding thehome; iii! nature of the use to which the area is put; and iv! steps taken to protect thearealrom'.observ_ation by passers-by., _ 7 ' Z _
11.6.4. U//FOUQ!, Standards for Use and Approval Requirements for Investigative
Method
U//EOUO! Whena video camera is physically operated as a hand-held video and is being used7 in an area in which no one has a reasonable expectation of privacy, its use is equivalent to usinga still cameraand does not require supervisory approval.
U//FOUO! For those situations that require SSA approval for the use of CCTV, tracking deviceand other monitoring devices, SSA approval, which should be documented using the F D-759,may be granted if the following criteria have beenmet: '
A. U//FOUO! Legal review and concurrence from the CDC or'OGC that a court order is notrequired for installationoruse of the device because there has been lawful consent, noreasonable expectation of privacy exists, or no physical trespass necessary to install thedevice. Note: Whenever circumstances change in either installation or monitoring, a new. legal review should be obtained to determine whether a separate authorization is necessary.
B. U//FOUO! Use of the method is.reas_o'nably likely to achieve inve ' ' ' ' '
c. U//FGUO V
D. U//FOUO
1. U//FOUQ!!5,
2. U//FOUO| -
- 131.
UNCLASSIFIED-FOR OFFICIAL use ONLYb2
b7E
b2
b7E
b2
b7E
I b2
msb2
b'7E
I
UNCLASSIFIED - FOROFFICIAL USE ONLY
Domestic Investigations and Operations Guide3_l1<v//Povogl . .6 6.
F I4. U//Fouoj
U//FOUO11.6.5. U! Duration of Approval _ I '
11.6.6. U//FOUO! Specic Procedures ~
U//EOUO! To use the method, the case ageht must:
A U//FOUO 2-'< |B. SU/YFOUO! j M
<1 U/mo 1 Al
D. U//FOUO!|
Ail syn
lL_;Ll? r-hr l"E. u//F0uo!|
a
*l. U//FOUO 6 I _1 1' -i. re-J r 6. J 1
3. U//FQUO
132
UNCLASSIFIED-FOR OFFICIAL USE ONLYHb2'
b7E
b2
b/'E
. b2
b7E
b2
b7E
b2
19712;
b2
b7E
b2
b7E
b2
b7E
b2
b'7E
b2 _
b7E
bz
b7E
l
l
UNCLASSIFIED - FOR OFFICIAL USE ONLY -
Domestic Investigations and Operations Guide
U//FQU0 IV L I U22;
11.6.7. U//FOUO! Compliance and Monitoring l
U//FOUO! Authorization dcuments regarding the use of the CCTV, electronic tracking devices 1°?!> must» be documented in the substantive investigative ELSUR- le b Eand wil'l_be available for compliance and monitoring review. ~ '
I
Ii
133
UN CLASSIFIED-FOR OFFICIAL USE ONLY
UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
11.7. U! Investigative Method: Polygraph
11.7.1. U! Summary _ U//FOUO! Awlicarionli [ | I Z3»;
not ' e prohi ited'by AGG-Dom,*PartIlI.B.2-3. .
11.7.2. U! Legal Authority
U! AGG-Dom, Part V.A.6.
11.7.31 U//FOUO! Denition of Investigative Method
U//FOUO! The polygraphis used to: i aid in determining whether a person has pertinent Kknowledge of a particular matter under investigation or inquiry; ii! aid in determining thetruthfulness of statements made or information fumished by a subject, victim, witness, CHS, oran individual making allegations; iii! obtain information leading to the location of evidence,individuals or sites of offense; and iv! assist in verifying the accuracy and thoroughness of *information fumished-byrapplicants andvemployees; * * " "
U//FOUO! Note: This policy does not limit other authorized activities of the FBI, such as theFBls responsibilities to conduct background checks and inquiries conceming applicants andemployees under federal personnel security programs.
11.7.4. U//FOUO! Standards for Use and Approval Requirements for InvestigativeMethod. _
U//FOUO! An SSA may approve the use of apolygraph if:A. U//FOUO! _ "
B. _ U//FOUO I
CL <"' °"°> I A |
11.7.5. U! Durationiof Approval . _
U//FOUO!| . . . M [I Fr I ' I
134
UNCLASSIFIED-F OR OFFICIAL USE ONLY U//FOUO!! '_ .1 . " A
F Fb2
b7E
b2
b7E
b2
b7l-I
UNCLASSIFIED FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
11.7.6. Ul/FOUO!'Specic Procedures '
U//FOUO! An.EC must be prepared requesting SSA.approval for the polygraph. If an AUSA isassigned to the case; an FBI employee must confer with the USAO to discuss anyprosecutorialissuesprior to the administration of a polygraph.
11.7.7. U//FOUO! Compliance-and Monitoring . .
U//FOUO! Except for polygraphs administered as part ofa background check or as part of a,federalpersormel security program, all polygraphs must be conducted under and documented to asubstantive case le.
l
. 135
UNCLASSIFIED-FOR OFFICIAL USE ONLY
UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
11.8. U! InvestigativeMethod: Undercover Operations
11.8.1. U!Surnmary
U//FOUO!| .|' g
U//FOUO! Undercover operations must be conducted in conformity with General s"Guideline.s' on Federal Bureau Qflnvesligatiorr Undercover Operations AGG-UQO!in. investigations relating to activities in violation of federal criminal law that do not concernthreats to the national security or foreign intelligence. In investigations that concern threats to thenational security or foreign=intelligence,_, undercover operations involving religious or politicalorganizations must be reviewed and approved by FBI Headquarters,.with participation by theNS*in thereview process. AGG-Dom, PaitV.A.7! Other undercover operations involvingthreats to the~national~security or foreign intelligence are reviewedand approved pursuant to FBIpolicy as described herein. ' _
U//FOUO! Applicationzlpg F or r pl.
. a
9211.8.2. . U! Legal Authority
A-. U! AGG-Dom, Part V.A.7
B. U! AGG-UCO * K
11.8.3. U//FOUO! Deiinitionof Investigative.Method
A. U//FOUO! An undercover activity is any investigative activity involving the use of anassumed identity by an undercover employee for an official purpose, investigative activity, orfunction. An undercover employee is an employee of the FBI, another federal, State, orlocal law enforcement agency, another entity ofthe United States 'Intelligence.Community-, or.another foreign intelligence agency working underthe direction and control of the FBI whoserelationship with the.FBI is concealedfrom thirdparties by the maintenance of a cover oralias identify for an official purpose, investigative activity, or function.
B. U//FOUO!.An undercover operation is an operation that involves a series of related undercover activities over a period of time by an undercover employee. A series ofrelated undercover activities consists ofmore than ve separate substantive contacts by anundercover employee with the individuals under investigation. In investigations relating toactivitiesin violation of federalcriminal law that do not eoncem threats to the national .security or foreign intelligence, undercover activity involving sensitive circumstances, whichare listed in the AGG-UCO and the FGUSO, eonstitutesan undercover operation regardlessof the number of contacts involved. A substantive contact is a communication, whether by
136
UNCLASSIFIED=FOR OFFICIAL usn ONLY .b2
b7E
b2
b7E
UNCLASSIFIED - FOR OFFICLAL USE ONLY
Domestic Investigations and Operations Guide
oral, Written, wire, or electronic means, that includes information ofeinvestigative interest.Mere ineidentaleontact e.g., a conversation that establishes an agreed time and location foranother meeting! is nota substantive contact within the meaning of this policy.
U//FOUO! Distinction Between Sensitive Circumstance and Sensitive InvestigativeMatter: _
U//FOUO! The term sensitive investigative matter as used in the AGG-Dom should not beconfused with the term sensitive circumstance" as that term is used in undercover operationsor ELSUR matters. The term sensitive circumstance relates to a circumstance that arises inlanundercover operationthat requires the UCO to obtain FBIHQ approval. A comprehensive listof sensitive circumstances for criminal activitiesis contained in the AGG-UCO and fornational security matters in Section 28 of the NFIPM. The Criminal Undercover OperationsReview Committee CUORC! and the national security Undercover Review Committee UCRC! must review and approve undercover operations -that involve sensitivecircumstances. The detailed policy for undercover operations is described in this section ofthe DIOG, the Field Guide for Undercover and Sensitive Operations FGUSO!, and theFBIHQ substantive Division program implementation guides. C _
11 8.4. U//FOUO! Standards for Use and Approval liequirements for Investigative ,Method .
U//FOUO! An ofcial considering approval or authorization of a proposed undercoverapplication must weigh the risks and benets of the operation, giving careful-consideration tothe following:
1. U//FOUO!The risks of personalinjury to. individuals, property damage, nancial loss topersons or business, damage to reputation, orother harm to persons;
2. U//FOUO! The risk of civil liability or other loss to the government; g i
3. U//FOUO! The risk of invasion of privacy or interference with privileged or condentialrelationships and any potential constitutional concems or other legal concems;
4. U//FOUO! The risk that individuals engaged in undercover operationsmay become
involved in illegal conduct;
5. U//FOUO! The suitability of govemment participation in the type of activity that isexpected to occur during the operation. AGGUCO, Part lV.A,!
U//FOUO! The following approval and authorization requirements apply to undercover ioperations relating to activities in violation of federal criminal law that do not concern threatsto the national security or foreign intelligence:
*1. U//FOUO! An undercover activity in which an undercover employee plans to meetwith a subject requires the approval of the SSA.
_2. U//FOUO! An undercover operation must be approved by the SAC or an ASAC with
5 M V is ._delegated approval authority!. The CDC must review all undercover operations beforeapproval and provide advice to the SAC regarding predication of subjects, entrapmentissues, and whether the proposal meets the requirements of the AGG-UCO orother DOJand FBI policyguidance. -
137
UNCLASSIFIED-FOR OFFICIAL USE ONLY
-__
»
3
54
6
7UNCLASSIFIED - FOROFFICIAL USE ONLY
Domestic Investigationsand Operations Guide
U//FOUO! ln addition to SAC approval, authorization from the responsible FBIHQAssistant Director or Executive Assistant Director must be obtained if the undercoveroperation involves a sensitive circumstance or certainscal circumstances, as those termsare dened in the AGG-UCO or other FBI guidance.
U//FOUO! Undercover operations that involve a sensitive circumstance Group Iundercover operations! require review by the CUORC as part of the authorization processThis requirement applies to both new andrenewal proposals.
U//FOUO! Undercover operations that do not involve a sensitivecircumstance Group IIundercover operations! require notice to the appropriate FBIHQ substantive Unit andttothe Undercover and Sensitive Operations Unit following SAC approval, A renewal thatwould extend the operation beyondone year requires authorization from the responsibleAssistant Director. ' .
U//FOUO! All Innocent Images National initiative IINI! undercover operations deemedGroup I and Group II operations require initiation and renewal approvals from FBIHQ,Cyber Division._Group l llNl undercover operations -will also be reviewed by theCUORC. _
U//FOUO! Requirements fqinteiringgeapproval andem_ergencyappro,val,for undercover .operations are contained in the FGUSO.
C. U//FOUO! The following approval requirements apply to undercover operations thatconcem threats to the national security-or foreign intelligence:
1
2
3
4
5 U//FOUO! An undercover operation must be approved by the SAC or an ASAC withdelegated approval authority!: The CDC must review all undercover operations beforeapproval and provide advice to the SAC regarding predication of subjects, entrapmentissues, and whether the proposal meets the requirements of'Section 28 of the NF! PM, oritsvsuccessor, or other DOJ and FBI policy guidance. '
U//FOUO! In' addition to SAC approval, authorization from the responsible FBIHQAssistant Director or Executive Assistant Director must be obtained if the undercoveroperation involves a sensitive circumstance, as dened in Section 28 of the~NFlPM, orits
successor. . . -
U//FOUO! Undercover operations that involve a sensitive circumstance must bereviewed and authorized by the responsible Assistant Director Group I operations!.Review by the UCRC must precede such authorization.,If the matter involves religious orpolitical organizations, the review must include participation by a representative of theDOJ NSD. AGG-Dom, Section V; Section 28 of the NFlPM,.or its successor.! _
U//FOUO! Undercover operations that do not involve a sensitive circumstance Group IIundercover operations! must be forwarded to the appropriate substantive Unit at FBIHQfor review on a UACB basis prior to initiation of the operation. A renewal that~wouldextend the operation beyond .12 months requires authorization from the responsibleDeputy Assistant Director or Assistant Director.
U//FOUO! Requirements for interimiapproval and emergency approval for undercoveroperations are contained in Section 28 oft e F , or its successor. l 1 , h N [PM
I 138
UNCLASSIFIED-FOR OFFICIAL USE QNLY
UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
11.8.5. U! Duration of Approvai ' .
amwouoj I I b2
mm
11.8.6. l U! Additional Guidance
A.ammouo! i
B. U//FOUOb2
b'7E
b2
b'7E
C. §U//FOUO 2|
11.8.7. . U//FOUO! Compliance and Monitoring, and Reporting RequirementsiU//FOUO! All <UCOs must provide an] - _ Isummary usingltheg b7E -»tdappropi'iat = , I I V ' I * " "
139
UNCLASSIFIED-F OR OFFICIAL USE ONLYb2
b'7E
~ b2
4
UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
11.9. U! Investigative Method: Compulsory process as authorized by law, including
grand jury subpoenas and other subpoenas, National Security Letters
l5 U.S.C. §§ 168lu, 1681v; l8 U.S.C. § 2709; 12 U.S.C. §34l4 a!! A!; 50 U.S.C. § 436, and
FISA orders 0 U.S.C. §§ l86l-63!.
~ U! Summary _
U//FOUO
U//FOUO A lication"
1 4 V _ H _ g [When collecting positive foreign intelligence, if the
subject is a non-United States person, a request for businessirecords pursuant to 50 U.S.C.
§§ 1861-63 is lawful. -
11.9.1. U! Federal Grand Jury Subpoena
A. U! Legal Authorities .
U! A Federal Grand Jury is anindependent panel charged with determining whether there is
probable cause to believe one or more persons committed a particular federal offense within
the venue of the district court-. If the FGJ believes probable cause exists, it will vote a true
bill and the person will be indicted. An F GJ indictment is the most typical way persons are
charged with felonies in federal court. A FGJ can collect evidence through the use of an F GJ
subpoena, which is govemed by Rule 6 of the FRCP. FRCP 6 e! controls the release of
information obtained by the prosecutor as part of the FGJ proceeding. FRCP 6 e! allows
federal prosecutors to share valuableforeign intelligence, counterintelligence, and terrorism-
related threat information, and it is the DO.lVs policy that such information should be shared
to'the»fullest extent permissible by law and in a manner consistent withthe rule. The
Attomey General has issued revised Guidelines for the Disclosure and Use of Grand Jury
Information under Rule 6 e!! D! hereinafter FGJ-Guidelines !. A memorandum issued
by the Deputy Attorney General on May I5. 2008, provides amplifying guidance.
140
UNCLASSIFIED-FOR OFFICIAL USE ONLYb2
b7E
b2
b7E
B
C
E
F.
G.UNCLASSIFIED -, FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
U//FOUO! Denition of Method *
U//FOUO!.FGJ subpoenas aredemands for documents,_ records, testimony of witnesses, orany other evidence deemed relevant by a sitting grand,jury. The FBI can requestthe issuanceof an FGJ subpoena in coordination with the responsible United States '
all criminal investigative matters '7 "
D_ FGJ subpoenas are limited to use prior tothe indictment of the individual to whomthe subpoena relates.
. U! Approval Requirements
~ 92 . l. _ U! =There'are*no*FBI-supervisoryapproval requirem_ents,Ib ut allFGJ subpoenasmust beissued by the United States Attomeys Office that is handling the assessmentor investigationto which the subpoenaed materials or witnesses are relevant. '
U! Duration of Approval
U! FGJ subpoenaseinclude a retum _date, which is the date on which the subpoenaedmaterials or testimony is due to the grandjury.
. . U! Specic.Br_ocedures p . * '
U! FGJ subpoenas are govemed by Rule 6 e! of the Federal Rules for Criminal Procedureand can only be obtained in coordination with the responsible United States AttorneysOfce or the appropriatetDOJ Division. ,
U! Note: 28 C.F.R. § 50.10 requires the approvaliof the Attomey General before a trial orFGJ subpoena may be issued to athird party to obtain the telephone toll records of a memberof the news media,.Specific justication is required. Coordination with the Assistant UnitedStates Attomey handling the grand jury presentation or trial is necessary. Before proposingsuch~a subpoena, an agent should review 28 C.F.R. § 50.10.
U! Notice and Rep0rting*Requir_ements
U! There are no FBI notice or reporting requirements for F GJ subpoenas.
U! Grand Jury ProceedingsGenerally
l. U! Procedural Issues and Handling of FGJ Materials
t 141 .
A UNCLASSIFIED-FOR OFFICIAL USE ONLYb2
b7E
UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigationsand Operations Guide
* U! The FGJ makes its determination whetherito retum a true bill of indictment basedon evidence presented by the prosecuting attomey in an ex parte proceeding. The grandjury operates under the direction and guidance of the-United States District Court.Generally, only witnesses for the prosecution testify before the grand jury.
U! Only the United States Attomey or an assistant, other =DOJ attomeys prosecuting thematter, the witness under examination, an interpreter as needed!, and the stenographer oroperator of a recording device may be present while the grand jury is in session. No judgeispresent during the presentation of evidence although the court will sometime rule onevidentiary issues-and will provideinitial instructions to the FGJ. No person other than the grand jurors may be present while the grandjury is deliberating or voting.
U! Restrictions on Disclosure
U! As a general rule, no one other than a grand jury witness may disclose-mattersoccurring before the grandjury. Govemment agents, even if called as witnesses, may notdisclose. matters occurring before the grand jury.
_ .U!_ Excepti0ns_Permitting Disclosure ~ A ~
a. U! Disclosures by the government without the courts-permission. The
government; through its attomey, may disclose grandjury matters under thefollowing conditions;
i. U!.Under Rule 6 e!! A!, the government may disclose a grand jury matter tothe following persons and_in the following situat_ions,provided the govemmentdoes not disclose the grandjury's deliberations or any grand juror's vote and thegovernment provides the court that impaneled the grandjury with the names ofall persons to whom disclosure was made and certiesthat the govemment has
advised the receiving ~pa1tyof the obligation of secrecy under this rule.
U! Persons eligible to92receive material under this subsection are: 1! an attorneyfor the government foruse in performing that attorney's duty; 2! anygovemment personnel, including state,_local, Indian tribe, or foreigngovernment personnel that an attorney for the govemment considers necessaryto assist in performing-that attomey's duty to enforce federal law; and 3! aperson authorized under 18 U.S.C. § 3322. _
U! Note: FBI OGC attorneys and CDCs are not"'attorneys for the
govemment." Under this Rule, F RCP 1 denes attomey for the govemment as the Attomey General, an authorized assistant of the Attomey General, aUni_ted States Attorney, [and] an authorized assistant of the Un-ited'States
Attomey.
ii.. U! An attorney for the government maydisclose any grandjury matter to
another Federal Grand Jury.
f K 142 .
UN CLASSIFIED-FOR OFFICIAL USE ONLY
/-
ll.UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
iii. U! An attorney for-the govemment may disclose any grandjury matter
involving foreign intelligence, counterintelligence, or foreignintelligenceinformation to any federal law enforcement-, intelligence, protective,
immigration, national defense, or national security official to assist the officialreceiving the information in the performance of that ofcial's duties._The
government attorney must le, under seal, with the court that impaneled thegrand jury, a notice that such information was disclosed and the agencies ordepartments that received the information. As used in "Rule 6 e!, foreign
intelligence information is information that relates to the ability of the UnitedStates to protect against actual or potential attack or grave hostile acts by aforeign power or its agents; sabotage or intemational terrorism by a foreignpower or its agents or clandestine intelligence activities by an intelligenceservice or network of a foreign power or its agents, or information with respect
to a foreign power or foreign territory that relates totthe national defense orsecurity of the United States or the United States conduct of foreign affairs.
iv. U! An attorney for the govermnent may disclose any grand jury matter~ involving, either inthe UnitedStatesor elsewhereya-threat ofrattackor. other
grave hostile acts of a foreign power or its agent, atthrcat of domestic orintemational sabotage, or clandestine intelligence gathering activities byanintelligence service or network of a foreign power or by its agent to any
appropriate federal, state, local, Indian tribal, or foreign government ofcial forthe purpose of preventing or responding to such threat or activities. The
govemment attomeyrmust le, under seal, with the court that impaneled thegrandjury, a notice that such information was disclosed and theagencies or
departments that received the information. -
U! Disclosures by the government requiring the Courts permission. The
government, through its attorney, may disclose grand jury matters under thefollowing conditions only with pemtission of the court. Petitions to make thesedisclosures are-generally, but notalways, led with the courtathat impaneled thegrandjury. Unless the hearing on the governments petition i_s to be ex parte, thepetition must be served on all parties to the proceedings and the parties must beafforded a reasonable period of time to respond.
U! An attomey for thegovemment may petition for disclosure to a foreigncourt or prosecutor for use in an ofcial criminal investigation. *
U! An attomey for the govemment may petition for disclosure to astate, local,A Indian tribal, or foreign govemment official, if the govemment attomey canshow that the matter may disclose a violation of state, Indian tribal, or foreign
criminal law, and the purpose ofthe disclosure is to enforce that law.
iii. U! An attorney for the _govemment may petition for disclosure to an
appropriate military official if the government attomey-can show the matter
i 143 I
UNCLASSIFIED-FOR OFFICIAL USE ONLY
UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
may disclose a violation of military criminal law under the Uniform Code of
. Military Justice, and the purpose of the disclosure is to enforce that law.
c U//F OUO! F BIs Conduit Rule
U//FOUO! Only the federafprosecutor is authorized to make an initial disclosure ofRule 6 e!! D! foreign intelligence information. As a practical matter, such 'disclosures are ordinarily accomplished through the FBI, which may have existinginformation-sharing mechanisms with authorized receiving ofcials.,If the prosecutorintends to share infonnation directly with another. official, consultation with the FBIis required to ensure that disclosures will be consistent with the existing policy ofintelligence community a encies and" to ensure appropriate handling of ser§itive orclassied information.| . > H
U//FOUO! lf, in cases of emergency, the prosecutor must disclose information
before consulting with the FBI, theproseeutor mustnotify the FBI as soon aspracticable.
d. U! Other Limitations A
U! Rule 6 e!! D! does not eliminate certain other information protectionrequirements, such as restrictions on disclosures of tax returns, on certain nancialinformation under the Right to Financial Privacy Act, and on classied information,
to name. onlya few examples. Specic statutes may impose additional burdens of
disclosures.
e. U! Disclosure
i. U! An FBI employee may become a Receiving Ofcial, the person to whom
grand juryinfonnation has been=disclosed, if the FBI receives grand juryinformation developed duringinvestigations conducted by other agencies. AReceiving Ofcialis any federal, state, local, Indian tribal, or foreign -
govemment ofcial receiving grand jury information, disclosed by anattomeyfor the govemment, under any provision of Rule 6 e!! D!. A Receiving
Ofcial may onlyuse the disclosed material asnecessary in the conduct of
his/her ofcial duties. The Receiving_Official ordinarily must consult with the.federal prosecutor before disseminating the information publicly, including in
open court proceedings.
ii. U//FOUO! Receiving Ofcials may only use grand jury information in amanner consistent with the F GJ-Guidelines and any additional conditions placedon the use or handling of grand juiyinformation by the attomey for the '
1 govemment. _
144
UNCI.Assrirmn-mw ovitvrr "en M" "
iii.
iv
V
vi
viiUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations andOperations Guide
U//FOUO.! If dissemination is necessary to the perfonnance of his or her
official duties, a Receiving Ofcial may disseminate Rule 6 e!! D!
info_rmation outside of that official's agency to other govemment officials.
U! A Receiving» Official, other than a foreign government ofcial, must- consult
with the attomey for the government before disseminating Rule 6 e!! D!
information publicly including through its use in a court proceedingthat is
open to or accessible to the public!, unless prior dissemination is necessary to
prevent harm to life or property. In such instances, the Receiving Official shall
notifythe attorney for the govemment of the dissemination as soon as
practicable. '
U! A foreign govemment Receiving Ofcial must obtain the prior consent .
from the disclosing official where possible, or if the disclosing is unavailable,from the agency that disseminated the information to that foreign official before
dissemination of the information to a third govemment or publicly. Public
dissemination includes using the information in a court proceedingthat is open
toor accesisibleeby the public; A A A A
U! A. Receiving Official shall handle Rule 6 e!! D! information in a mannerconsistent with its sensitivity and shall take appropriate measures to restrict
access to this infonnation to individuals who require access for the performance
of official duties. '
U! A Receiving Ofcial shall .immediatelyreport to the disclosing attomey forthe govemment: any unauthorized dissemination of Rule 6 e!! D! information
or any loss, compromise, or. suspected compromise of Rule 6 e!! D!
information.
f. U! Violations
i
ii
iii U! A Receiving Official who knowingly violates Rule 6 e!! D! by using thedisclosed information outside the conduct of his or her official duties, or byfailing to adhere to any limitations on the dissemination of such "information,
maybe subject to contempt of court proceedings and fo restriction on future
receipt of Rule 6 e!! D! information.
U! A state, local, Indian tribal, or foreign govemment official who receives
Rule 6 e!! D! information, and who knowingly violates these guidelines, maybe subject to; contempt of court proceedings.
U! An attomey forthe government who knowingly violates Rule 6 e!! D!may be subject to contempt of court proceedings. '
t
145 ,7
UNCLASSIFIED-FOR OFFICIAL USEONLY7
UNCLASSIFIED -FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
g. U! Limitation on Unauthorized Disclosures.
U! Rule 6 e!! D! i! provides that Receiving Ofcials may use disclosedinformation only to conduct their ofcial duties subject to any limitation on theunauthorized disclosure of such information. This limitation on unauthorizeddisclosures? is understood to encompass applicable statutory, regulatory, and
guideline restrictions regarding classication, privacy, or other informationprotection, as well as any additional restrictions imposed by the federal prosecutor.
U//FOUO! Note: The F GJ-Guidelines do not require that the Receiving Ofcialnotify the federal prosecutor of subsequent disclosures, except for consultation forpublic disclosures and consent for certain disclosures by foreign ofcials. TheReceiving Ofcial is bound by whatever restrictions govem his or her use anddisclosure of the information as part of his ofcial duties. Memo dated 5/ l 5/08Guidelines for the Disclosure and Use of FGJ Information under Rule 6|'g]_[§l[D]!.
g h- U//FQUO! Limit=it_i.<>_n of Use- . . g e
i. U//FOUO! Because of the restrictions involved in handling information that isobtained by theuse of a grand ju __ subpoena, whenever possible;_altematives tothe grandjury subpoena, such as? " F
hould be considered as an altemative method of obtaining
evidence.
ii. U! A grand jury subpoena may only be used for purposes of gatheringinformation that is relevant to the grandjurys investigation. Grand jury secrecycontinues indenitely, regardless of whether there is an indictment, unless thematerial becomes a matter of public record, such as by being introduced at trial.
iii. U! Rule 6 e!! D! does not require notice to the court of subsequentdissemination of the information by Receiving Officials.
iv. U//FOUO! Disclosure of grandjury material cannot be made within the FBI forlunrelated investigations unless a, govemment attomey has detennined that suchdisclosure to a particular investigator is needed to assist that attorney in aspecic criminal investigation. The ability of govemment attomeys to freelyshare grand jury material with other government attomeys for related orunrelated criminal investigations does not extend to investigators without casespecic authorization from the govemment attomey and notice to the court.Therefore, grand jury material must be restricted when placed into a generalsystem of records that is freely accessible to FBI employees and others withaccess e.g., ACS!. I
v. U//FOUO! If a govemment attorney authorizes the disclosure-of grand jurymaterial in the possession of the FBI for use in an unrelated federal criminal
-146
UNCLASSIFIED-FOR OFFICIAL USE ONLYb2
b7E
vi
vii
viii.D
UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
matter, such approval should be documented in"the grand juiy subtile of boththe initiated case le and the subsequent case le. That documentation will bein addition to any necessary supplementation to the government attorney's
FRCP Rule 6 e! disclosure letter and/or to the internal disclosure list.
U//FOUO! The USAO should be consulted immediately for precautionary 7instructions if grandjury material will have application to civil law enforcementfunctions e.g., civil RICO or civil forfeiture!. There are very limitediexceptionsthat allow govemment attomeys to use grand jury material or information incivil matters e.g., civil penalty proceedings concerning banking law violations!.These exceptions do not automatically apply to investigative personnel.Therefore, any similar use of grand jury information by the FBI m'ust beapproved in advance by the govermnent attorney.
U//FOUO! Disclosure cannot be made without a court order for use in non-~criminal investigations, such as bacl<ground»_investigations or name checks.
U//FOUO! Govemment personnel who are preparing a response to a Freedomof Information-Act<orIPrivacy Act request-mayproperlyaccess grandjurymaterial underthe Rule because they are considered to beassisting the grandjury attomey by ensuring against any improper disclosure.
i. U!. Matters Occurring Before the Grand Jury I
i.
ii U!-Core Grand Jury Material: There can be no dissemination of mattersoccurring before the grand jury unless such dissemination comeshwithin one ofthe exceptions discussed above. There.is no uniform legal denitioniof what 'constitutes matters occurring before the grand jury except for what is generallyreferred to as "core" grand-jury material. Core grand jury material includesthe following: i! names of targets and witnesses; ii! grand jury testimony; iii!grandjury subpoenas; iv! documents with references to grandjury testimony including summaries and analyses!; v! documents that clearly reveal theintentions or direction of the grand jury investigation; and vi! other materialthat reveals the strategy, direction, testimony, or other proceedings of a grand
Jury-
U! Documents Created Independent of Grand Jury but Obtained byGrand Jury Subpoena: Rule 6 e! generally prohibitsdisclosing mattersoccurring before the grand jury. The rule, however, does not dene that phrase.The issue of whether pre-existing documents fall within that prohibition hasneverbeen settled conclusively by the"Supreme Court, although many lowercourts have discussed it at length. Courts generally agree that this prohibitiondoes not cover all information developed in the course of a grand juryinvestigation; rather, the secrecy rule applies only to information that wouldreveal the existence, strategy or direction of the grandjury investigation, thenature of the evidence produced before the grandjury, the views expressed by
M t 147
UNCLASSIFIED-FOR OFFICIAL USE ONLY
iiiUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
members of the grandjury, or anything else that actually occurred before thegrand jury. Ln addition, courts -have frequently held that Rule 6 e! does notprotect documents subpoenaed from the government that are sought by third-parties only for the information contained within the document rather than todetermine the direction or strategy of the grand jury investigation. Due todeveloping law on this issue, FBI personnel should consult with the AUSA
responsible to determine how to best handle these documents. r '
U//FOUO! Data Extracted from Records Obtained by Grand JurySubpoena: lnformationextracted from business records that was obtained bygrandjury subpoena is often used to facilitate investigations. Some of that typeof data is, by statute or caselaw, subject to the Rule. In other cases,determination of whether data must be considered subject to the Rule dependson the case law and local practice in the federal district. Infomiation extractedfrom grand jury subpoenaed nancial records subject to the Right to FinancialPrivacy Act of l978 2 U.S_.C. § 3420!must be treated as grand jury material unless such record has been used in the prosecution of a crimefor whichthegrjandjury issued an indictment or presentment... With the approvalof theUSAO, infor'mation_~from subpoenaedtelephone records: may beedisclosed foruse in unrelated federal criminal investigations in those districts where suchmaterial! isnot considereda matter occurring before a grand jury. If theUSAO approves generally of this procedure, suchinformation may be used inunrelated criminaltinvestigations without authorization from a govemmentattorney in each instance. .
j. U! Federal Grand Jury Physical Evidence and Statements of Witnesses
i.
ii
iii U! Physical evidence provided to theigovemment in response to a grandl jurysubpoena is-subject to the secrecy rule regardless of whether such evidence ispresented to the~grandjury. Physical evidence provided voluntarily or obtainedby means otherthan grand jury process such as by a search warrant! is not agrand jury matter regardless of whether such evidence was previously or isthereafter presentedjto the- grand jury.
U! Statements ofiwitnesses obtained as a result of grand jury process. including .grand jury subpoena, such as a 'statement.given in lieu of grand jury testimony,are matters occurring before the grand jury irrespective of whether suchwitnesses testied before the grand jury or are not required.to testify. Voluntarystatements of witnesses made outside of the grandjury context not pursuant toany grandjury processincluding a-grand jury subpoena!, including statementsmade outside the grandjury by a witness who is being prepared for grand jurytestimony, are not grand jury matters irrespective of whether the witnesspreviously testified or will thereafter testify before the grand jury.
U! Rule 6 e!! B! requires a federal prosecutor -who discloses grand jurymaterial to govemment investigators and other persons supporting the grand
148
UNCLASSIFIED-FOR OFFICIAL USE ONLY
| __ _- .
i _ i >_ l c
UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
jury investigation topromptly provide the. court that impaneled the grandjurythe names of the persons to whom such disclosure has been made and to certifythat he/she has advised such persons of their obligation of secrecy under the 'Rule. In order to document the certication required bythe Rule, govermnent
attomeys often execute and deliver to the court a form, normally referred to as a Certication or Rule 6 e! letter. A copy of this document should bemaintained with the grand jury material held in the F BI's custody.
U//FOUO! Documentation of Internal Disclosures of Grand Jury Material:Grand jury material should be kept in such as fashion as to maintain theintegrity of the evidence. Upon taking custody of grand jury material, the FBI .employee should categorize it in a manner to identify its production source andhow it was obtained, to include the identity of acustodian of record fordocumentary evidence. Practical considerations often require agents assistinggovemment attomeys to seek assistance in the same investigation from otherswithin the FBI. In many districts, support personnel and supervisors of case
agents needlnot be routinely includedinthe.list.providedFto.the court. In lieuofa Rule 6 e! letter from the USAO containing an exhaustive list of names of FBI
personnel, an FBI record of additional intemal disclosures must be maintainedby the case agentin order to establish accountability, Use of this "intemalcertication" procedure should be authorized by the appropriate USAO. Theintemal formshould record the date of disclosure as well as the identity andposition of the recipient. Such intemal disclosures may be made only in supportof the sameinvestigation in which_a federal prosecutor has previously issued aRule 6 e! letter. In addition, the intemal record should reectthat all recipientsof grand jury materials were advised of the secrecy requirements of Rule 6 e!;Whenever practicable, recipients should be listed on this internal certicationprior to disclosure. Local Rule 6 e! customs should govem the internalcertication process used. I , .
U//FOUO! Storage of Grand Jury Material: The FBI cannot make or allowunauthorized disclosure of grand jury material. Material and records obtained Ipursuant to the grand jury process are frequently stored in FBI space. FBIpersonnel should report any unauthorized disclosure to the appropriategovemment attomey -who, in tum, must notify the court. In order to protect
against unauthorized disclosure, grand jury material must be secured in thefollowing manner:
I. U//FOUO! The cover, envelope, or-container containing grand jury Imaterials must be marked with the waming: "GRAND J URYMATERIAL -IDISSEMINATE ONLY PURSUANT TO RULE 6 e!." No Grand Jurystamp or mark should be afxed to the original material. Agents, analystsand other authorized parties should work from copies of grand jury materialwhenever possible to ensure the originalcmaterial retains its integrity.
I49 - ~
l'92IiI5l' 92I' A "r urn r92" -'~
2
3
4.
5.
6.~UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
U//FOUO! Access to grandjury material must be limited to authorizedpersons e.g., those assisting an attomey for the govemment in a specic
criminal investigation!. All necessary precautions should be taken to protectgrandjury material, to include maintaining the material in a secure location
when not in use. The material must be appropriately segregated, secured,
and safeguarded. Absent chain-of-custody considerations, grandjurymaterial may be maintained in the 1A section of the le. Grand jury materialneed not be kept in an evidencelor bulky exhibit room and may be entrustedto a support servi§:es= technician SST! or evidence control technician ECT!.Shouldgrand jury material beentered into a computer database,.the data
must be marked with the 6 e! warning and maintained within the systemin a
restricted manner.
U//FOUO! Registered mail or other trac_eable courier such as FederalExpress! approved by the Chief Security Ofcer CSO! must be used to
mail or transmit to other Field Ofces any documents containing grand jury
material. Couriers and other personnel employed in these services will not
be aware of the contentsof the material transmitted because of the wrappingprocedure's=specit'1ed below,fand therefore,_then donot require a backgroundinvestigationeforlthis purpose. The names of persons who transport thematerial need notbe placed on a disclosure list, but-the receiving office mustprovide the case agent in the originating ofce with the names of personnel
in the receiving ofce to whom disclosure is made. ,
U//FOUO! Grand jury material that isto be mailed or transmitted by
traceable courier outside a facility must be enclosed in opaque inner and
outer covers. The inner covermust be a sealed wrapper or envelope that
contains the addresses of the sender and the addressee, who must be
authorized to have access to the grandjury material. The inner. cover must
be conspicuouslymarked Grand Jury Information To Be Opened By
Addressee Only." The outer cover must be sealed, addressed, return
addressed, and bear no indication that the envelope contains grandjury
material. When the size, weight, or nature of the grandjury materialprecludes the use of envelopes or standard packaging, the material used forpackaging or covering must be of sufcient strength and durability to
protect the information from unauthorized disclosure or accidental exposure.
U//FOUO! If the govemment attomey detennines that the sensitivity of, or
threats to, grandjury material necessitates a more secure transmission
method, the material may be transmitted by an express mail serviceapproved for the transmission of national security information or be hand
carried by~the assigned govemment attorney or his orher designated
representative.
U//FOUO! Grandjury material containing classified national securityinformation must be handled, processed, and storedaccording to 28 C.F.R.
. 150
_ UNCLASSIFIED-FOR OFFICIAL USE ONLY
i.UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
Part 17. Grand ju'ry material containing other types of sensitive information,
_' such as federal tax return information, witness security information, and
other types of highly sensitive information that have more stringent security
requirements than that usually required for grand jury material must bestored and protected pursuant to the security regulations goveming such
.information and any special security instructions provided by the -
organization that originated the information. '
U//FOUO! Original documents that are obtained through the grand juryprocess should be returned to the attomey for the government or, with the
government attorney's permission, to the owner if there is no indictment or
V the prosecution has concluded. -7.
U!Requests for Subpoenas in Fugitive Investigations
U//FOUO! It is generally a misuse ofthe grandjury to use the grand jury as an .investigative aid in the search for a fugitive. Therefore, with the exceptions
discussed below, grand ejuxye subpoenas for testimonyor recor_dsYrelated*to the ~
fugitives whereabouts may not be requested in FBI fugitive investigations.
U//FOUO! Grand jury process may be used to locate a fugitive if the grand juryis interested in hearing the fugitive's testimony. Thus, if the grandjury seeks thetestimony of the fugitive in an investigation that the grandjury isindicting, the
grandjury may subpoena other witnesses and records in an effort to locate thefugitive witness. However, interest in the fugitive's testimonyimust not be a
pretext. The sole motive for inquiring into the fugitivefs location must be the
potential value of fugitive's testimony to the grand jurys investigation. A
subpoena for thefugitive witness must be"approved_by the grandjury beforeseeking to subpoena witnesses or records to locate the fugitive. Further, it is-not '
properto seek to obtain grandjury testimony from any witness, including a 'fugitive, conceming an already-retumed indictment. Thus, it would notibe properto seek to locate a fugitive for the purpose of having the fugitive testify about
matters for which an indictmentihas already been returned, unless there are
additionalunindicted defendants to be discovered or additional criminal acts to beinvestigated through the testimony of thefugitive. Currentpolicy on "target"
witnesses must be observed. Grandjury subpoenas for witnesses and recordsaimed at locating a fugitive witness who is _a.target of the grandjury investigationshould be sought only where a target subpoena for the fugitive has already been
approved by the responsible Assistant Attomey General.
1i. U//FOUO! Use of the grand jury to leam the present location of a fugitive is alsoproper when the present location is an element of the offense under investigation.On adequate facts, the presentlocation of a igitive might tend to establish thatanother per'son:is harboring the fugitive, or has committed misprision, or is anaccessory after the _fact in the present concealment of the fugitive. However, thisjustification wouldlikely be viewed as a subterfuge if the suspected harborer or
151'
UNCLASSIFIED-FOR OFFICIAL USE ONLY
UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
.. the person potentially guilty of misprision or as an accessory were given
immunity in the grand jury in order to compel his/her testimony about the locationof the fugitive. With regard to escaped federal prisoner and bond default matters,the present location of a igitive is not relevant evidence in a grandjury
investigationbecause these offenses address the circumstances of a priordeparture from a known location. The fugitive's present location is not a relevantfactor as itis in harboring or as it may be in a misprision investigation. Inasmuch
as unlawful ight to avoid prosecution cases are, as a rule, not prosecuted andcannot be prosecuted without written authorization from the Attomey General oran Assistant Attomey General, any effort to use the grand jury in the investigationof such cases must be preceded by consultation with the DOJ and by writtenauthorization to prosecute from the Assistant Attomey General in charge of the
Criminal Division.
11.9.2. U! Administrative Subpoena
A. U! Summary _
U! The Attomey General of the United States is vested with the authority to issuead1l"i§FI?iiY¢ SU.bP96nas.under two provisions of th'eUnite'diStates~Code thathave-relevance Ato FBI criminal investigations, 21 U.S.C. § 876 and 18 U;S.C. § 3486. The FBI has noinherent authority to issue administrative subpoenas but relies on. delegated authority fromthe Attomey"General. The use of administrative subpoenas.is limited to three categories ofinvestigationsdrug program investigations, child sexual exploitation and abuseinvestigations, and health care fraud investigationsand may not be used for any otherpurpose. The delegated authority varies depending on the federal violation being investigated.The type of information that can'be obtained using.an administrative subpoena is also limitedby lawlor by policy of the Attorney General.
- U//FOUO! Note: Within the FBI, the authority to issue administrative subpoenas is limitedto those positions holding the delegated authority from the Attomey General; that authority
may not be redele ated.
B. U! Legal Authority and'Delegati_on
1. U! "Investigations involving the sale, transfer, manufactureor importation of
unlawful drugs -
U! Authority: 21 U.S:C. § 876 and DO]. Regulation at 28 C.F.R. App to Pt. 0, Subpt. R§ 4
U! May be issued to:.Any individual or businessholding records relevant- to the-druginvestigation. '
U! Records to be obtained: Any records relevant to the investigation.
U//FOUO! Delegated authority to issue: By DOJ regulation, the Attomey Generalsdelegation includes SACs, ASACs, SSRAs and those FBI Special Agent Squad
152
'UNCLASSIFIED~FQR OFFICIAL USE ONLYb2
b/E
__
UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
Supervisors who have management responsibilities over Organized Crime/Drug Program
investigations. u//Fouoj 5 ' h I
U//FOUO! Limitations l' ' . | ~b2
b7E
.H _ b21 ' 1 . » ' - , iThe Right to Financial Privacy Act limitations
described in paragraph D of this section app1y.,If addressed to a provider offielectronic A
communication sen/ic'é o'r~ aI fenjote computing service, provisions in the ElectronicCommunication Privacy Aet ECPA! govern, as discussed in paragraph D of this section.
U! Investigations involving the sexual exploitation or abuse of children
U! Authority: I8 U.S.C. § 3486 a! and Attomey General Order 2718-2004.
U! May be issued to:.A provider of an electronic communication service or a remote
computer service both terms "dened in Section 1 1.,9.,2.D.2.b, below! and only for theproduction of basic subscriber or customer information. The subpoena may requireproduction as soon as possible but in no event less than 24 hours after service of thesubpoena. ' H 1
U! Recordsto be obtained:| W I
Z U771? OUO! Delegated authority to issue:|
I U /FOUO! Limitations: By law, these administrative subpoenas may only be issued incases that involve a violation of 18 U.S.C. §§ 1201, 2241 !, 2242, 2243, 2251, 2251A,2252, 2252A, 2260, 2421, 2422, or 2423. in which the victim has not attained the age ofl8 years. Under the Attorney Generals delegation, an administrative subpoena in theseinvestigations may be issuedgng to providers of electronic communication services orto remote computing se1vices"to obtain the information listed above. These
153 I
OFPIFTAT TTQI7 riiur 11
I ..inn
b2
b7E
b2
b7E
UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and OperationsGuide
administrative subpoenas may not be issued to any other person or entity or to-obtain anv. other infomiation, including the content of communications] ~ C I x
3. U! Investigations involving'Federal Health Care Fraud Offenses
U! Authority: 18 U.S.C. § 3486 a! »
U! Records to be obtained: Records relevant to an-investigation relating to a. federal
health care offense. Federal health care offense is dened in 18 U.S.C. § 24
U! May be issued to: Any public or private entity or individualtwith records relevant to
the federalhealth care offense. Note: These are referred to in guidance issued by the
Attomey'General as investigative demandsi !
U/IFOUO! Delegated authority to issue: There is no delegation to~~the FBI. Delegated
topersonnel within'DOJs Criminal Division andto United States Attorneys, who may
redelegate the authority to Assistant United States Attorneys.
U! Limitations: The Right to Financial Privacy Act RFPA! limitations described in
paragraph D of this section apply. The provisions in ECPA govem, as discussed in"
* *pa"ra"g r'aphlD oftliis section, ifté request for iee6rds'isiadafes§edte a pr6videi of
electronic c_om'munication.service or a remote~comput_ing service. The subpoena maynot requireithe production of records at a place more than 500 miles frsubpoena is.served.| J
U! Restrictionon individual health care information: Pursuant to l8 U.S.C. § 3486,health information about an individual acquired through _an authorized investigative
demandmaynot be used in, or disclosed to any person for use in, any administrative,civil, or criminal action against that individual unless the action or investigation arises
from and is directly related to receipt of health care, payment for health care, or action
"involving a fraudulent claim related to, health care. . _ U//Fouoj . l V C A '
C. U! Approval Requirements A - I
U//FOUO! Use ofan administrative subpoenarequires SSA approval. The SSA may issuethe administrative subpoena if the authorityhas been so delegated. Further review and~ approval may be required depending on the delegation. Review by the CDC is appropriate if
legal questions arise in preparing and issuing the subpoena.
U//FOUO! Note: An individual designated by proper authority to serve in_an acting status
in one of the positions with delegated authority may sign and issuean administrative
subpoena. The acting -status should be documented in an appropriate Field Ofceadministrative-le and noted in the case le. For example, if the ASAC with authority to sign
is away onleave or temporary duty and another individual has been designated by the SACto serve as"acting ASAC, that individual has authority to issue the administrative subpoena.
A l54
UNCLASSIFIED-FOR OFFICIAL USE ONLYb2,
b7E
b2
b'7E'
b2
b'7E
0r
UNCLASSIFIED - FOR OFFICIAL USE ONLY
7 Domestic Investigations and Operations Guide
A-relief supervisor is not considered to be in an acting status for purposes of issuing an"T" ' administrative subpoena.
D. U! Limitations on Use of Administrative Subpoenas
l. U! Financial Privacy Limitations
a. U! Obtaining records from a nancial institution. Financial records? are those
records that pertain to a customers relationship with a nancial institution. The
term nancial institution is broadly dened as a bank, savings bank, card, issuer,
i industrial loan company, trust company, savings association, building and loan or
homestead association, credit union, or consumer nance institution, located in any
state, territory, or the District of Columbia. See 12 U.S.C. § 3401. [Notez The scope
of the RFPAs.denition ofnancial institution for this purpose, which limits the
restrictions the RFPA places on federal law enforcement in using an administrative
subpoena, is narrower than the denition of nancial institution that is used in
connection with NSLs. For that purpose, the RF PA refers to the broader denition
found in the Bank Secrecy Act BSA!. Among the entities included in the BSA
denition are money transmitting businesses, car dealers, travel agencies, and
persons involved in real estate closings. See 12 U.S.C. § 3414 d! and 31 U.S.C.
§_5312. a!!-and_ c! l-!.]-Whenseekingnancial»records-from a nancial
institution,,the FBI must send a certicate of compliance required by 12 U.S.C.
§ 3403*to the nancial institution. The certicate must indicate, among other things,
that notice has been provided by the FBI to the individual customer whose nancial
records are to be obtained. The content of the notice is set out in l2 U.S.C. _§ 3405.
A court order may be obtained that allows for delayed notice pursuant to 12"U.._S.C.
§ 3409. Notice is not required if the administrative subpoena is issued to obtain the
financial records of a corporation or for records not pertaining to a customer. Notice
is also not required if the administrative subpoena seeks only basic account
information, dened as name, address, type of account, and account number. See l2
U.S.C. § 3413 g!.
b. U! Obtainingrecords from a Credit Bureau. A credit bureau or consumer
reporting agency mayonly provide name, address, former addresses, place of
employment and former place of employment in response to an administrative
subpoena. 15 U.S.C. § 1681f. A credit bureau or consumer reportingagency may
not release nancial information in a credit report or consumer. report, or the names
and locations of nancial institutions at which the consumer has accounts pursuant
to an administrative subpoena. A court order, a grandjury subpoena, or, in an
appropriate case, a national security letter may be used to obtain this information.
l5 U.S.C. § 1681b. Notice of disclosure will be provided by the credit bureau or
consumer reporting agency to the consumer if the consumer requests thisinformation. "
2. U! Electronic Communication Privacy Act
a. U! Use of an Administrative Subpoena. The ability tp gather subscriber
information and the content of electronic communications using an administrative
subpoena is govemed by ECPA. In cases involving the sexual exploitationor abuse
of children, only basic subscriber or customer information may be obtained with an
l55 . I
UNCLASSIFIED-FOR OFFICIAL USE ONLY
UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigationsrand Operations Guide
administrative subpoena under the terms of the Attomey Generals delegation, as
described above. No content information may be obtained. In drug and health carefraud investigations, an administrative subpoena may be used to obtain basic
subscriber or customer information and certain stored communications, under
limited circumstances, from entities that provide electronic communication services
to the public. ,
U! Denitions. ECPA applies to two types of entities that provide electronic
communications to the public; The term provider of electronic communication
services is dened in 18 U.S.C. § 25l0'5! as any service that provides the user
thereof the ability to send or receive wire or electronic communications, The term
remote computing services is dened in~ l8 U.S.C. § 2711 l2! as the provision
to the public of computer storage orlprocessing services by means of an electronic
communication system. '
U! Subscriber information. t |
d.. U! Recordsior other information pertaining to a subscriber.
U .! U! Unopened e-mail held in storage for 180 days or less may not be obtained ,e. U! Content. Content is the actual substance of les stored in an account, including
the subjectline of an e-mail.
using an administrative subpoena. A searchwarrant is required. 1 -
_ ! U! Unopened e-mail that has been held in electronic storage for more than 180
days may be obtained with an administrative subpoena. In the Ninth Circuit,the opened e-mailand un-opened e-mail must have been in storage for 180 daysbefore it can be obtained with an administrative subpoena. See Theofel v.
Farey-Jones, 359 F.3d 1066.! The government must provide notice to thesubscriber or customer prior to obtaining such content. A limitedexception to
the notice requirement is provided in 18 U.S.C. §.2705.
1 ! U! E-mail that has been opened andrthe content of other electronically stored
les held in storage byan entity that provides storage services to the public. i.e.,
a remote computing service, as dened in 18 U.S.C. § 271 1!, may be obtained
using an administrative subpoena with-notice to the customer or subscriber, -unless noticeais delayed in accordance with 18 U.S.C._§ 2705.
, lS6. I
UN T.A.Q.QIIJ'TIi!n_n'nn new/Y ~ ' mi " *"'b2
b~7E
b2
b7E
_ t
1 * ii 1v A _,"92 r _ .
I UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
! U! E-mail that has been opened-and the content of other electronically stored
les held in storage by an entity that does not provide electronic communication -
services to the public, such as that on the internal network of a business, may be
obtained using an administrative subpoena. Notice to the individual is not
required because this demand is not restricted by ECPA.
~ 3. U//FOUQ!Membersofthe Media ~ _ C
U//FOUO! An administrative subpoena directed to a provider of electronic
communication services or any other entity seeking to obtain local and long distance
connection records, or records of session times of calls, made by a member of the news
media may only be issued with the specic approval of the Attorney General. Requests
for this approval should be reviewed by the CDC and coordinated with,an Assistant
United States Attomey AUSA!. The request must providejustication for issuance of
the subpoena consistent with the Department of Justice policies set forth in 28 C.F.R.
§ 50.10. Guidance onithis policy may be obtained from the Investigative Law Unit andlor
the Privacy and Civil Liberties Unit, OGC. . -"
E. U//FOUO! Compliance/Monitoring .
. 1. = u! Limits oi1~use.l ' i _ _ _ aI
b2' b/E
2. _ U//FOUOl Overproductioni
b2
b7E
Y 3. U//FOUO! Factors for compliance. The following factors should be considered to
ensure compliance with applicable laws and regulations that govem the F Bls use of
administrative subpoenas: 1
a. U//FOUO! The administrative subpoena must relate to a type of investigation for
which the subpoena is authorized; *
b. U//FOUO! The administrative subpoenamust be directed to a recipient to whom
an administrative subpoenavis authorized;
c. U//FOUO! The administrative subpoena may request only records that are
- authorized under the pertinent law;
i 157
UNCLASSIFIED-FOR OFFICIAL USE ONLY
UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
d. U[/FOUO! The administrative subpoena must be approved by an authorized
official; g
e. U//FOUO! The administrative subpoena rnust be uploaded into the Automated
Case Suppo1t ACS! system to the Subpoena SBP ! suble of the substantive
case le for record purposes;
f. U//FOUO! The retum of service information must be completed on the back of
the original administrative subpoena;
g. U//FOUO! The original administrative subpoena and completed return of service
must be maintained in a "SBP" suble of the substantive investigation; and
h. U//FOUO! The records provided in response to the. administrative subpoena mustbe reviewed to ensure that the FBI is authorized to collect the records provided. If
- an over-production has occurred, steps must be taken to correct the error. _
1129.3. U!.National Security Letter
A. U! Legal Authority .
U! 15 U.S.C. §§ l681u, 1681~v; 18 U.S.C. §2709;
U! l2U.'S.C. §3'4l4 a! ! A!; 50*U.S.C. § 436;
U! AGG-Dom, Part V
U! A National~Security Letter N SL! maybe used only to request:
l. U! Financial Records; The Right to Financial Privacy Act' RFPA!, 12 U.S.C.
§ 34l4 a!!;
2. U! -Identity of Financial Institutions: Fair Credit Reporting Act FCRA!, 150-.s.c.§ l68lu a!;~ I
3. U! Consumer Identifying Information: FCRA, 15 U.S.C. § l681u b!;
4. U! Identity of Financiallnstitutions and Consumer Identifying Information: FCRA, *
15 U.S.C. §§ l681u a!& b!;
5'. U! Full Credit Reports in International Terrorism Investigations: FCRA, 15 U.S.C.
§ I68lv; and *
6. U! Telephone Subscriber Information, Toll Billing Records, Electronic
Communication Subscriberlnformation, andElectronic Communication
Transactional Records: ElectronicCommunications.Privacv Act ECPA!, l8 U.S.C.
§2709. _
B. U! Denition of Method "
U! A National Security Letter is an administrative demand for documentsor records that canbe made by the FBI during a predicated investigation relevant to a threat to the national
security.Sample NSLs are available.
C. U//FOUO! Approval Req uirements .
U//FOUO! A request for an NSL has two parts. One is the NSL itself, and one is the ECapproving the issuance of the NSL. The authority to sign NSLs has been delegated to the
l 58 ~
UN CLASSIFIED-FOR'OFF ICIAL _USE ONLY
UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
Deputy Director, Executive Assistant Director and Assistant EAD for the National SecurityBranch; Assistant Directors and all DADs for CT/CD/Cyber; General Counsel; Deputy
General Counsel for the National Security Law Branch;1Assistant Directors in Charge in NY,
DC, and LA; and all SACs.
U//FOUO! In addition to being signed by a the statutorily-required approvcr, every NSL
rnust be reviewed and approved by a" CDC, ADC or attomey acting in that capacity, or an
NSLB att0mey._ _ __ I
.u' A
b2
bT7E
U//FOUO!| I
b2
b7E
U//Fouoj ' l
~ b2
b7E
U//Fouoj
b2 _
rm-3
kl u//1=ou0;|e * I b2
b7E '
159 "
UNCLASSIFIED-FOR OFFICIAL USE ONLY
UNCLASSIFIED - FOR DFFICIAL USE ONLY
Domestic Investigations and Operations Guidein I I
D. U! Duration of Appiovalv
E. U//FOUO! specic Procedures
,§ U//FOUO {I
§U//FOUO!|
92_ §U//FOUO 1] '
, - U//FOUO - -b2
b7E
b2
b7E
i b2
ma
B2
b7E.
b2
b7E
b2
b'7E
Q U//FOUO!
0 U//FOUOl |
0 U//FOUO]
//FOUO I
160
UNCLASSIFIED-FOR OFFICIAL IJSE ONLYb2
b'7E
b2 I
19712
b2
b'7E
b2
b7E
UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
U//FOUO!
1. U//FOUO! Cover EC- J b2I 'b7E
I I
U//Fouoj .
b2
bl7.E
a. U//1=0uo!|
A 1;. U/_/FOUO1 4 _
c. u//Fou0!| i
e. U//1=o_uo!|V b2
<1. U//Fouoj E
I I
1. U//FOUO
g.' U/H/1=ou0!|h. u//1=ouo!| 4 W I: as
1. u//1=0u0!| I
j. U//FOUO!| _
I
' ' 161
UNCLASSIFIED-FOR OFFICIAL USE ONLYb2
b7E
I ~
UNCLASSIFIED - FOR OFFICIAL USE ONLY I
Domestic Investigations and Operations Guide
1<. u//Fouol» < - _ pa
1. U//FOUO
v
U//FOUO
U! Copy of NSL ' I
U//FOUO! A copy of the signed NSL must be retained in the investigative case le and
uploaded under thelappropriate NSL document type in ACS. Documented proof of
service of NSL letters must be maintained in the case le.
U//FOUO! SecondiGeneration Information
U//rouoj ' . , ' i.
U//FOUO! Emergency Circumstances 1
U//FOUO! ECPA protects subscriber or transactionalinformation regarding
communications from disclosure by providers of telephone or other electronic ' ,
communication services. Generally, an NSL, grandjury subpoena, or other forms.of legal
process must be used to compel the communication service providerrto disclose '
subscriber or transactional information. In emergency circumstances, however, if the
provider in good faith believes that a delay in disclosure could pose a danger of death-or
serious bodily injury, the provider may voluntarily disclose information toethe FBI. As a
matter of FBI policy, when there is a danger of death or serious bodily injury that does
not pennit the proper processing, of an N SL, if approved by an ASAC, a letter to the
provider citing l8 U.SlC. § 2702 maybe used to request emergency disclosure. If timedoes not permit thesissuance of an emergency letter citing 18 U.S.C. '§2702, an.oral
request to the provider may be made, but the oral request must be followed-up with a '
letter as described herein. *
U//FOUO! '
" i 162
UNCLASSIFIED-FOR OFFICIAL USE ONLYb2
b7E
b2
b7E
b2
b7E
92
_b2
b'7E
UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
u//1=ouo1_| H
_ U//FOUO
U//FOUO! Notice and Reporting Requirements
U//FOUO! The National Security Law Branch at FBIHQ is required to report information
about NSL}1_sage to Congress_._The»data necessary for Congressional reporting is 7
automatically recorded if the NSL is createdin the NSL Subsystem FISAMS!. If the NSL is
created outside the system, the EC must include all information necessary for NSLB
accuratelyvto report NSL statistics, The EC must break down the number of targeted phone
numbers/e-mail accounts/financial accounts that are addressed toreach and every NSL .
recipient. Therefore, if there are three targets, ten accounts, and six recipients of an NSL, the
EC.must state how many accounts are the subject of the NSL as to Recipient l, Recipient 2,
etc. It is not sufcient to onlyindicate that there are ten accounts and six recipients.
U//FOUO! In addition, the FBI must report the United-States person status of the subject of
all NSL. requests as opposed to the target of the investigation to which the NSL is relevant!,
other than those seeking subscriber information. While the subject is often the target ofthe
investigation, that is_ not always the case. The EC must reflect the United States person status.
of the subject of the request the person whose information the FBI is seeking. If the NSL, is
seeking information about more than one person, theEC must reect the United States
person status of each of those persons. See the form ECs, which make clear that the United
States person status applies to the target of the request for information.!
U//FOUO! Finally, to ensure accurate reporting, the EC must accurately state the typeof
information that is being sought. NSLs for toll'billing~records or transactional records will»
include subscriber information. The EC need only state that the requestis for toll_billing -
records or-transactional records, and the reporting paragraph should state that toll billing or
transactional records are being sought for x number of accounts, and, if multiple recipients,
froineach of recipients #1, #2, etc.
U//FOUO! Receipt of NSL Information _
U//Fouoj i
l63 -
UNCLASSIFIED-F OR OFFICIAL USE ONLYb2
b7E
b2
b7E
b2
b7E
£2
ms
UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
U//rouojb2
b7E
b2
157E
U1/FQ.U9!| t
U//FOUO
U//FOUO! Dissemination of NSL material
U//FOUO! Subject to certain statutory limitations, information obtained through the use of
an NSL may be disseminated according to generaldissemination standards in the AGG-Dom.
ECPA telephone and electronic communications records! and the.RFPA nancial records!permit dissemination if consistent with the AGG-Dom and if the infonnation is clearly
relevant to the responsibilities of the recipient agency. FCRA, 15 U.S.C. §. 168lu, permits
dissemination to other federal agencies as may be necessary for the approval or conduct of a
foreign counterintelligence investigation. FCRA imposes no special rules for dissemination
of full credit reports. p ' . I ~ U//Fouoj l . I s l
t e material received in retuml, _ ~ -Lh 5 I = 2 lthe NSLs themselves are not cla ' '
l64
l'lN "I.A§§IliIIi_Iii! iPliIi"fA1' nénl rim: vb2
b'7E_
b2
b'7E
b2
b7E
UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
] A. g 5 I22.
A I. U! Payment for NSL-Derived Information ,
U//FOUO! Because there is no legal obligation .for the FBI to compensate recipients ofNSLs issued pursuant to ECPA, 18 U.S.C. § 2709 toll billing records information,subscriber, electronic communication transactional records! or FCRA, 15 U.S.Cl_.§ 1681v, full credit reports in intemational terrorism cases!, there should not be payment inconnection with those NSLs. See EC, 3 1 9X-HO-A I 487720-OGC. serial 222, fora formletter to be sentin response to demands for payment for these types of NSLs.
U! Compensation is legally required for NSLs served to obtain nancial informationpursuant to RFPA, 12 U.S.C. § 3414 a!!, and credit information pursuant to. F CRA, 15U.S.C. § 1681u. Under 12 C.F.R. .§ 219.3, Appendix A, a fee schedule has been adoptedunder which photocopying is reimbursable at $.25 per page and searching is reimbursable at$11 per hour for clerical staff. Regulations goveminga payment schedule for FCRA, 15 'U.S.C. § 1681u, NSLs has not been promulgated.
11.9.4. U! Business Record Under FISA
A, U! Legal Authority . ,
U! 50 U.S.C. §§ 1861-63
B. U! Denition of Method
. U! A FISA order for business records is an order for a third party to produce documents,records and other tangible information relevant toa predicated national security investigation.FISAfBusine_ss Record Orders may not beused to obtain information during a positiveforeign intelligence case if the material sought relates to a United States person. There is no FISA-derived impediment to the use of documents obtained pursuantto such orders.
C. //FOUO A rova R i e ~ 1
b2
_ ma
D. U! Duration of Approval
U! Duration is established by the court order.
E. U! Notice and Reporting Requirements
U! Thereareno special notice or reporting requirements.
' 165 ..
UN CLASSIFIED-FOR OFFICIAL USE ONLY v
UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domesticlnvestigations and Operations Guide
F. U! Compliance-Requirements
U! The case agent~,wh0 receives production of documents pursuant to a FISA business recordsorder mustdo thefollowing:
1. U//FOUO! Handle the productionas required by the Standard Minimization p b2Procedures Adopted for Business Record Orders| | b7E
' 2. U! Whether or not required by. paragraph 1, prior to uploading the documents or datareceived into FBI databases, review the documents produced to determine whether theyare responsive to the order. ' 4
a. U//FOUO! If the producing party has mistakenly providedmaterial thatis-entirely non-responsive. e.g., the producing party inverted numberston an account -and produced entirely irrelevant andnon-responsive material!, the case agent
must sequester the material and discuss with the CDC or NSLB the appropriateway to return the unresponsive. material to theproducing party andobtain theresponsive material. '
U/ZFIOUO! It the producing partydhas produced responsive material andmaterial that is beyond the parameters of the order issued by the FISC e.g., theFlSC ordered production of one months records and the party-produced recordsfor 6 weeks!,tthe case agent must determine whether the material produced that isoutsidethe parameters of the FISC order is subject to statutory protection e.g.,recordstthat are subject to the Right to Financial Privacy Act, the Buckley ,Amendments, the Electronic Communications Privacy Act, Fair Credit ReportingAct!. 92 .
i. U//FOUO! Ifthe overproduced material is subject to statutory
protection, then the overproduced material mustbe treated like
overproduction is treated in the contextrof a national security letter.
ii. U//FOUO! If the overproduced material is not subject to statutoryprotection, then it may be uploaded- Indetermining whether toaupload the
-overproduced, material, the case agent should consider the extent to whichthe overproduction includes non-publicinformatiori regarding UnitedStates persons who are not the subject o'fa nationalsecurity investigation;the sensitivity of the information contained within the overproduction; and
the burdensomeness of separating the overproduced material from theresponsive material. _
166
UNCLASSIFIED-FOR OFFICIAL USE ONLY
._- m in
UNCLASSIFIED -FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
11.10. U! Investigative -Method: Accessing stored wire and electronic communications andtransactional records in_ conformity with chapter 121 of title 18, United States Code
1l.10.1. U! Summary
U//FOUO! FBI employees may acquire the contents of stored wire or electroniccommunications and associated transactional recordsincluding basic subscriber informationas'.provided in 18 U.S.C. §§ 2701-2712._Reque'sts for voluntary disclosure under theemergencyauthority of l8 U.S.C. § 2702 require prior approval from the Field Ofce ASAC or FBIHQSection Chief when appropriate.
U//FOUO! Application: This investigative method may be used during national securityinvestigations and criminal investigations as authorized by statute. This method may not be usedfor assistancerto otheragencies, unless relevant to an already open predicated investigation. Thismethod cannot be used to collect positive foreign intelligence. Additionally, this method cannotbe used during an assessment.
A. U! Stored Data: The Electronic Communications Privacy Act ECPA!1 8 U.S.C.§§ 2701-27l2governs the disclosure of two broad categories of infomiation: i! thecontents of wire or.»electroniccommunicationsheldsin-electronic storage byproviders of electronic communication service or contents held by those who provide remotecomputing service to the public; and ii! records or other information pertaining to a subscriber to or customer of such services. The category of recordsor other information can be subdivided further into subscriber records listed in 18 U.S.C. 2703[c][2]! andstored trafc data or other records. '
U! Records covered by ECPA'include all records that are related to the subscriber, includingbuddy lists, friend lists MySpace!, and virtual property owned Second Life!. These othersortsof records are not subscriber records and cannot beobtained by a-subpoena under 18U.S.C. 2703 c!! or an -NSL under 18 U.S.C. § 2709.
B. U! Legal Process: The legal process for obtaining disclosure will vary dependingon thetypetof information sought and whether the infomiation is being voluntarily provided underl8 U.S.C. § 2702 e.g., with consent or when emergency circumstances require disclosure! orthe provider is being compelled to provide the information under 18 U.S.C. § 2703, asoutlined below. _
C. U! Contents held in electronic storage by a provider of electronic communicationservice for 180 days or less can only, be obtained with a search warrant based on probablecause. Accordingly, such records may only be obtained during a full inve_stigation.'
U! Contents held by those who provide remote computing service to the public andcontents held in electronic storage for more than 180 days by an electronic;communication service provider can be obtained with: a warrant;a subpoena; or an orderissued by a court under 18 U.S.C. § 2703 d! when prior notice has been provided to thecustomer or subscriber unless the court has authorized delayed notice!.
U! Title 18 United States Code Section 2705 establishes the standard to delay notice for aninitial period of up to 90 days. Records or other information pertaining to a subscriber to or
167
UNCLASSIFIED~F OR OFFICIAL USE ONLY '
I l _ A P
92 1
UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
customer of such services, including basic subscriber information can be obtained with asearch warrant or an l8 U.S.C. § 2703 d! order without notice.
D. U! Basic subscriber information, asdescribed in 18 U.S.C. § 2703 c!!, can be compelledby a grand jury or administrative subpoena without notice. .
E. U! Preservation ofStorcd Data: The government is authorized under 18 U.S.C. § 2703 t!to direct a provider to preserve records or'other information stored records or . ~
communications! in its possession for. 9_0.days which may-be extended for an additional 90-days! pending issuance of applicable legal process for disclosure. To make a preservationrequest, the FBI must believe that the records will subsequently be sought by appropriatelegal process.
l F. U! Cost rcimbursement:Tit1e 18 United States Code Section 2706 requires the lgovemment to reimburse for costs incurred in providing the contents of communications,records, or other information obtained under 18 U.S.C. §§ 2702, 2703, or 2704, except thatreimbursement is not required for records or other information maintained by acommunications common carrier that relate to telephone toll records and telephone listingsobtained under 18 U.S.C. §, 2703. In essence, the govemment does not have to reimburse forthe cost of producing records that the provider maintains in the ordinary course of its.business.. *
11.10.2_. U! Legal Authority
U! 18 U.S.C._§§ 2701-2712
, U! AGG~Dom, Part v.9 -
U! ECPA_1 8 U.S.C. §§ 2701 -27l2 creates statutory privacy rights for the contents ofcommunications in electronicstorage ~ and recordsor other information pertaining to asubscriber to or customer of an electronic communication service and a remote computingservice. The statutory protections protect the-privacy of an individuals electronic datacontained in a networked account-that may otherwise falloutside the scope of the protectionsafforded by the Fourth Amendmentwhe'n such account or its service is owned'or managed by athird-party provider. < ' 92
U! ECPA generally: i! prohibits.acc_ess to the contents of wire or electronic communicationswhile in electronic storage unless authorized I8 U.S.C. § 2701!; ii! prohibits a provider ofservice to the public from disclosingrthe contents of wire oreelectronic communications whileheld in electronic storage, and divulging to the govemment any information pertaining to asubscriber to or customer of such service unless authorized l8 U.S.C..§ 2702!; and iii!authorizes the_go.vemment to compel disclosure from a provider of stored contents of a wire orelectronic» communication and records or other ,informatior_1 pertaining to a subscriber to orcustomer 8 U.S.C. § 2703!. ECPA provides for reimbursement of costs incurred in providing _the information acquired. .
11'.10.3. U! Denition of Investigative Method i
A. _ U! Definitions: *
1
U! Electronic Storage: is "any temporary,Iintermediate storage of a'wire or electroniccommunication incidental to the electronic transinission thereof," or "any storage of suchcommunication by an electronic communication service for purposes of backup protection of
I68
UNCLASSIFIED-F OR OFFICIAL USE ONLY
B.UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domesticlnvestigations and Operations Guide
such communication." l8»U.S._C. 2510 l 7!. In short, "electronic storage" refers only totemporary storage, made in the course of transmission, by a provider of an electronic
communication service.
U! Remote Computing Service RCS!: is the "provision to the public of computer storageor processing services by means of an electronic communications system." 18 U.S._C.§ 271 1!. In essence, a remote computing service is an off-site computer that stores or
processes datafor a customer.
U! Electronic Communications System: is "any wire, radio, electromagnetic; photoopticalor photoelectronic facilities for the transmission of wire or electronic communications, andany computer facilities or related electronic equipment for the electronic storageof suchcommunications." I8 U.S.C., § 25104!.
U! Electronic Communication Service ECS!: is "any service that provides to usersthereof the ability to send or receive wire or electronic communications." 18 U.S.C.§ 2510 l 5!. For example, telephone companies and electronic mail companies generally actas providers of electronic communication services.
U! E,CPA authorities can be divided into two categories: i! compelled.disclosurelegalprocess to compelproviders to disclose.the_contents;of.storedwire or.elec'tfonic! 1communications including ,e-mail and voice mailopened and unopened! and otherinformation such as account-records andbasicsubscriber infomiation; and ii! voluntarydisclosure of such information from service providers; Each of these authorities is discussedbelow. '
. U! Compelled Disclosure: -
1'. U! Title. l8 United States Code Section 2703 lists, five types of legal process that the* govemment can use to compel a provider to disclose certain kinds of information. Theve mechanisms, in descending order of required threshold showing are as follows:
Q U! Search warrant; . I '
. ' U! I8 U.S.C. § 2703 d! court order with prior notice to the subscriber or customer;
0 U! 18 U.S.C. § 2703 d! court order without prior notice to the subscriber or
customer; -
v U! Subpoena with prior notice to the subscriber or customer; and
~ U! Subpoena without prior notice to the subscriber or customer,
I 169
UNCLASSIFIED-F OR OFFICIAL USE ONLY »b2
b7E
_14 g !,~T mu
2.
4.UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide» - b2
_ rm:
U//FOUO! NoticeOrders Not to Disclose the Existence of a Warrant, Subpoena,or Court Order: FBI employees may obtain a court order directing network serviceproviders not to disclose the existence of compelled process if the government has nolegal duty to notify the customer or subscriberof the process. lfan 18 U.S.C. § 2703 d!order or 18 U.S.C. § 2703 a! warrant is being used, a request for a non-disclosure ordercan be included in the application and proposed order or warrant. If a subpoena is beingused to obtain the information, a separate application to a court for a non-disclosure_order must be made.
U! Legal Standard: A court may order an electronic communications service provideror remote computing service notto disclose the existence of-a warrant, subpoena, orcourt order for such period as the court deems appropriate. The court must enter suchan order if it determines that there is reason to believe that notication of the existenceof the warrant, subpoena, or court order will result in:
~ U! Endangering the life or physical safety of an individual;
I U! Flight from prosecution;
Q U! Destruction of or tampering with evidence;
Q U! Intimidation of potential witnesses; or
1 U! Otherwise seriouslyjeopardizing aninvestigation or unduly delaying a trial. 18U.S.C. § 2705 b!.
U! Search Warrant: Investigators can obtain the full contents of a network account .with a search warrant. ECPA does not requirethe government to notify the customer orsubscriber when it-obtains information from a provider using a search warrant.Warrants issued under l8 U.S.C. § 2703 must comply with either FRCP Rule 41 or anequivalent state warrant. However, all warrants issued pursuant to 1,8 U.S.C. 2703 donot require personal service; those warrants issued by a federal-court have nationwidejurisdiction see below!; and the warrants may only be served on an electroniccommunication service or a remote computing service. FRCP Rule 41 also poses theadditional requirement on these warrants that a copy of the warrant be left with theprovider, and a retum and inventory be made.
U! Under l8 U.S.C. 2703 a!, with a search warrant issued based on probable causepursuant to FRCP Rule 41 or an equivalent state warrant, the govemment may obtain:
a. U! "The contents of a wire or electronic communication, that is in electronicstorage in an electronic eommunicationssystem for one hundred and eighty daysor less," and ,
b. U!=Everything that can be obtained using a 18 U.S.C. § 2703 d! court order withnotice. i
U! In other words, every record and allot the stored contents ofran accountincludingopened and unopened e-mail/voice mail- can be compelled by a search warrant basedon probable cause pursuant to FRCP Rule 41. Moreover, because the warrant is issued
no
UNCLASSIFIED-FOROFFICIAL USE ONLY
#1
UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domesticlnvestigations and Operations Guide
by a neutral magistrate based on probable, cause, obtaining a search warrant effectively
insulates the process from'challenge under the Fourth Amendment, - r
U! Nationwide.Scope: Search warrants under 18 U.S.C. § 2703 a! may be issued by a
federal "court withjurisdiction over the offense under~investigation," and maybe
executed outside the district of the issuing court for material responsiveto the warrant.
State courts may also issue warrants under 18 U.SlC. § 2703 a!, but the statute does not
give these warrants effect outside the issuing courts territorial jurisdiction. As with a
typical FRCP Rule 41 warrant, investigators must draft an affidavit and a proposed
warrant that complies with FRCP Rule 41.
U! Service-of Process: Title 18 United States Code Section 2703 a! search warrants
are obtainedjust likeany other FRCP Rule 41 search warrant but are typically sen/ed
on the provider and compel the provider to nd and produce the information described
in the warrant. ECPA expressly states thatthe presence of an officer is not requiredfor
service or execution of a search warrant issued pursuant to 18U.S.C. §2703 a!.
U! Court Order with Prior Notice to the Subscriber or Customer: Investigators
c_anobtain_ everyth_ing»i_n;a ne__tw_orl< account except for unopened e#mail or voice-mail
stored with a provider for 180 days orless usingia l8*U.'S.C. §2703 d! court order with "
prior notice to the subscriber unless they have obtained authority for delayed notice
pursuant to I8 U:S.C. § 2705. ECPA distinguishes between the contents of p
communicationsthat are in "Electronic storage" e.g., unopened e-mail! for less than
180 days, and those that-have been in "Electronic storage" for longer or that are no
longer in "Electronic storage" e.g., opened e-mail!. _
U! -FBlremployees who obtain a court order under 18 U.S.C. § 2703 d!,-andreither give
-prior notice to the-subscriber or comply with the delayedrnotice provisions of 18 U.S.C.
§ 2705 a!, may obtain:
a. U! The contents of a wire or electronic communication that has been in
electronic storage in an electronic communications system for more than one
hundred and eighty days. 18 U.S.C. § 2703 a!.
b. U! "The contents of any wire or electronic communication" held by a provider of
remote computingservice "on behalf of . . . aesubscriber or customer of such
remote computing service," l8.U.S.C. §§ 2703 b!! B! ii!, 2703 b!!; and
c. U! everything that can be obtained using a 18 U.S.C. § 2703 d! court order
without notice.
A 171
UNCLASSIFIED-FOR OFFICIAL use ONLYb2 p
ms
b2 Z
ma
6.UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
U! Legal Statidard: To order delayed notice, the court must nd that "there is reason
to believe that notication of the existence of the court order may . = . endanger[] the
life or physical safety of an individual; [lead to] ight from prosecution; [lead to]
destruction of or tampering with evidence; [lead to] intimidation of potential witnesses;
or . . . otherwise seriouslyjcopardiz[e] an investigationor unduly delay[ ] a;trial." 18
U.S.C.~§§ 2705 a!! A! and 2705 a!!. The applicant must satisfy this standard anew
each time an extension of the delayed notice is sought.
U! Nationwide Scope: Federal court orders under 18 U.S.C. § 2703 d! have effectoutside the district of the issuing court. Title 18 United States Code Section 2703 d!
orders may compelproviders to disclose information even if the information is stored
outside-the district of the issuing court. See 18 U.S.C. § 2703 d! "any court thatis a
court of compete_ntjurisdiction" may issue a 18 U.S.C. § 2703[d] order!; 18 U.S.C.
§ 2711! court of competentjurisdictionincludes any federal court havingjurisdiction
over the offense being investigated without geographic limitation!.
U! Title 18 United States Code Section 2703! orders may also be issued by state i
courts. See 18 U.S.C. §§ 2711!; 3l27! B!. Title 18 United States Code Section
2703 d! orders issued by state courts, however, do not have effect outside the I
jurisdiction of the issuing state. See 18 U.S.C. §§ 27-11!; ,
U! Court Order without Prior Notice to the Subscriber or Cust0mer:_FBI
employees needan 18 U.S.C. § 2703 d! courtorder to obtain most account logs and
most transactional records.
U! A_ court order under 18 U.S.C.i§ 2703 d! may compel disclosure of:
a. U! All "record s! or other information pertaining to a subscriber to or customer
of such service not including the contents ofcommunications [held by providers
of electronic communications service and remote computing service]!," and
b. 7 U! Basic subscriberinformation that can be obtained using a subpoena without
notice. I8 U.S.C. §2703 c! l!;
U! Types of TransactionalRecords: The broad category oftransactional records
includes all records held by a service rovider that ertain to the subscriber be ond the.specic records listed in 27?3 c! l[l I 1 p i Q l
U//FOUO!| r r 1|
c. _ U! Cell siteand Sector information: Cell site and sectorinformation is '
considered fa record or other information pertaining to a subscriber and
therefore, production of historical and prospective cell site and sectcrinformation
may be compelled by a court order under 18' U.S.C. § 2703 d!. Requests made
pursuantyto 18 U.S.C. § 2703 d!'for disclosure of prospective cell site and sector
172
UNCLASSIFIED-F OR OFFICIAL USE ONLYb2
b7E
b2
b7E
b2
b7E
UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations end Operations Guide
inf0rmationwhich is delivered to law enforcement under Communications
Assistance for Law Enforcement Act CALEA! at the beginning and end of
calls must be combined with an application for pen register/trap and trace
device. Somejudicial districts will require a showing of probable cause before
authorizing the disclosure of prospective celisite and sector infomation.
d. = -
u//E0001
vi
_ _ 2 ' E
1,73 W
IiN I.A'.QIIiIl?n_wnn 92ITIi I ZIAT TTGI7 Ann 11b2
b'7E
b2
b7E
b2
b'7»E
ll I b2
b7E
-_,d. - 1 UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
U! Legal Standard: A court order under 18 U.S.C. § 2703 d! is known as an
"articulable facts" court order or simply a "d order. This section imposes an -
intermediate standard to protect on-line transactional records. It is a standard higher
than a subpoena, but not a probable cause warrant. The intent of raising the standard for
access to transactional datais to guard against "shing expeditions" by law
enforcement. See l-l.R. Rep. No. 102-82'7_, at 31 994!, reprinted in 1994 .
U.S.C.C.A.N. 3489.! ' ' _
_U! The FBI must state sufcient specic andarticulable facts for the 'court*to nd that
there are reasonable grounds to believe that the contents of a wire or electronic
communication, or therecords or other information sought, are relevant and material toan ongoing criminal investigation T ' ' '
2 , E
U! Subpoena with Prior Notice to the Subscriber or Customer: Investigators can
subpoenaopened e-mail from a provider if they either give prior notice to the
subscriber oricomply with the delayed notice provisions of 18 U.S.C. § 2705 a!which
requires a written certification by the SACor ASAC.thatthere is*reasonto=believethat
notication 'ofthe existence of the subpoena may have an adverse result.
U! FBI employees who obtain a subpoena and either give prior notice to the subscriber
or comply with the delayed notice provisions of 18 U.S.C. § 2705 a!,»may obtain:
a. U! "The contents of any wire or electronic communication" held by a provider of
remote computing service"'o_n behalf of . . . a subscriber or~'customer of such
remote computing service." l8'U.S.C. §_2703 b!! B! i!, § 2703 b!!;
b. U! "The contents of a wire or electronic communication that has been in .
electronic storage in an electronic communications-system for more than one
hundred and eighty days." 18 U.S.C. §2703 a!; and
c. U! Basic subscriber information listedin I8 U.S.C. § 2703 c!!.
U!| - . ._ M ' _ b2
U! Noticezi
U! Legal standards for delaying_notice. The supervisory official must certify in
writing that "thereis reason to believe that notication of the existence of the court
order may . . . endanger[] the life or physical safety of an individual; [lead to] flight
174 "
UNCLASSIFIED-FOR-OFFICIAL USE ONLY I
g, ib2
b7E
b7E
b2
b7E
8.UNCLASSIFIED - FOR OFFICIAL USE ONLY
* Domestic Investigations and Operations Guide
from prosecution; [lead to] destruction of or tampering with evidence; [lead to]
intimidation of potential witnesses; or . . . otherwise seriously jcopardiz[e] an
investigation or unduly delay[] a trial." 18 U.S.C. §§ 2'705 a! l! A!, 2705 a!!.
importantly, this standard must be satised anew every time an extension of the
delayed notice is sought. _ 7
U! Subpoena without Prior Notice to the Subscriber or Customer: Investigators
can subpoena basic subscriber infomation listed in 18 U.S,C. §'2703 c!!. 1
U! The government may use an administrative subpoena authorized by a» federal or
state statute or a, federal or state grand jury or trial subpoena to compel a provider to
disclose basic subscriber information listed in 18 U.S.C. § 2703 c!!: ~ name; address;
local and long distance telephone connection records, orrecords of session times and '
durations; length of service including start date!~and types of service used; telephone"
or instrument number or other subscriber number or identity, including any temporarily
assigned network address; and means and source of payment for such service
including any credit cardor bank account number![.] _ * U , . .
See-PATRIOT Act § 210, 1.15 Stat. 272, 283 001!. _
U! Legal Standard: The legal threshold for issuing a subpoena is low. In United
States v. Morton Salt Co., 338 U.S. 632, 642-439'50!, the Court articulated the
deferential standard forjudicial review of administrative enforcement actions is a four-
factor evaluation of "good faith" issuance requiring that: i! the investigation is
conducted pursuant to a legitimate purpose; ii! the information requested under the
subpoena is relevant to that purpose; iii! the agency does not already have the
information it is seeking withthe subpoena; and iv! the agency has followed the
necessary administrative steps in issuing the subpoena. g
U//FOUO! in the event that a federal grand jury subpoena is used, however, .
appropriate protections againstdisclosure. must be followed in compliance with FRCPRule6e. , "722 I I
. Where the
telephone bil_lingrecords*being sought are thoseof a member ohe news media,
approval of the Attorney General is required.» See DIOG Section ll.9.l .E!
175 r
UNCLASSIFIED-FOR OFFICIAL USE ONLY
i .N 'b2
b'7E
b2
b"!E.
g
UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigationsand Operations Guide
C. U! Voluntary Disclosure , .
1.
2. U! Service NOT Available to the Public: Providers_of services not available "to the
public" are not prohibited from disclosure under ECPA, and so the provider may freely
disclose both contents and other records relating to stored communications. Andersen
Consulting v. UOP, 991 F. Supp. 1041 N.D. ill. 1998! giving hired consulting rm
employees access to UOP's e-mail system is not equivalent to providing e-mail to the
public!. Only providers of services to the public are prohibitedsfrom disclosing stored
contents and records, unless statutorily authorized.
U! Services That ARE Available to the Public: If the services offered by the
provider are available to the public, then ECPA precludes both the disclosure of
contents to any third party, including the govemment, and the disclosure of other
records to any governmental entity unless a statutory exception applies. The statutory
exceptions permit disclosure by a provider to the p1_1,blic,~in essence whe,n th_e<needs of
public safety and service providers outweigh privacy interests.
U! If the provider is authorized to disclose the information-to the government under 18
U.S.C. § 2702 and is willing to do so voluntarily, law enforcement does not need to
obtain a legal order to compel the disclosure.
U! If a provider voluntarily discloses under the statute, there is-no follow-up legal
process required or available. if the provider,-on the other hand, either may not or will
not disclose the information, FBI employees must rely on compelled disclosure l
provisions and obtain the appropriate legal orders.
i. U! Voluntary disclosure of Stored Contents .
U! ECPA authorizes the voluntary disclosure of stored contents when:
a! U! The disclosure is with the consent express or implied! of the originator,
addressee, intended recipient, or the subscriber inthe case of opened e-mail,
18 U.S;C. §2702 b!!;
b! U! The disclosure may be necessarily incident to the rendition ofthe service
or to the protection of the rights or property of the provider of that service," .1 8'
U.S.C. § 2702 b!!;
c! U! The provider "in good faith, believes that an emergency involving danger
of death or serious physical injury to any person requires disclosure without
delay of information relating to the emergency, 18 U.S.C. § 2702 b! 8!;
d! U! To the National Center for Missing and Exploited Children, in connection
with a report submitted thereto under Section 227 of the Victims of Child
Abuse Act of 1990. 2 U.S.C. § 13032 and I8 U.S.C. § 2702[b][6]!; or
e! U! The contents are inadvertently obtained by the service provider and
appear to pertain to the commission of a crime. Such disclosures can only-be
made to a law enforcement agency. 18 U.S.C, §2702 b!!
176
UNCLASSIFIEDFOR OFFICIAL USE ONLYb2
b'7E_.
. 7 __ ll
L _ I ,
UNCIJASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
U! Voluntary disclosure of Non~content Customer Records
U! ECPA provides for the voluntary disclosure of non-content customer
records by a provider to a governmental entity when:
a! U! The disclosureis with the consent express or implied! of the customer or
subscriber or 18 U.S.C; § 2702 c!! ; A
b! U! The disclosure may be necessarily incident to the rendition of the service
or to the protection of the rights or property of the provider of that service,Y' 18
U.S.C. § 2702 c!!;
c! U! The provider "in good faith, believes that an emergency involving danger
of death or serious physical injury to any person requires disclosure without
delay of infonnation relating to the emergency, 18 U.S.C. § 2702 c!!; or
U//FOUO! Note: an emergency disclosure under this statutory. exception is
justied when the circumstances demand immediate action on the part of the
govemment to prevent death or serious bodily injury, and does not depend on
the immediacy ofthe risk of danger itself. For example, an e-mail that
discusses a planned terroristattack but notthe timing for the attack would
constitute an emergency that threatens life or limb, even thoughthe timing of
the attack is unknown. It is the need for immediate action to prevent the
serious harm threatenedbytthese circumstances rather than the immediacy of
the threat itselfthat is the reason Congress authorized voluntary disclosures
under this exception. H.Rpt. No. 107-497 p 13-14 June l 1, 2002!
accompanying H.R. 3482, The Cyber Security,Enhancement Act of 2002,
which passed as part of the comprehensive Homeland Security Act, See P.L.
l0'_7-296 ~§ 225. ~ _
_ d! U! To the National Center for Missing and Exploited Children, in connection
with a report submitted thereto under Section 227 of the Victims of Child
Abuse Act of 1990. 2 U.S.C. § 13032 and 18 U.S.C. § 2702[c][5]!
U! Preservation of Evidence under 18 U,S.C.s§ -2703!: in 0
U! A govemmental entity is authorized to direct providers tovpreserve stored
recordsland communicationgaursuantto 18 U,.7S,C.7 § 2703 . " "
_ _ . 7_ 7_ W {Once a preservation request is made, ECPA
requires that the provider must retain the records for 90 days, renewable for
another 90-day period upon a government request. See 18 U.S.C. § 2703 i!!.
U! Specifically, 18 U.S.C. § 2703 f! l! states:
a! U! A provider of wire or electronic communication service or a remote
computing service, upon the request of a govemmental entity, must take all
177 i
UNCLASSIFIED-FOR OFFICIAL USE ONLYb2
.b7E
b2
b7E
O _ .
_ Y
UNCLASSIFIED - FOROFFICIAL USE -ONLY
_ Domestic Investigations and Operations Guide
necessary steps to preserve records and other evidence in its possession
pending the issuance of a court order or other process. K b! " U! There is no Iegally_prescribed format forl 8 U.S.C. §2703@g_requests.7 92 2%-5
U! FBI employees whosend 18 U.S.C. § 2703 t! letters to network service
providers should be aware of two limitations. First, the authority to direct _
providers to preserve records and other evidence is not prospective. That is, 18
U.S.C. § 2703 t! letters can order a provider to preserve records that have
already been created but cannot order providers to preserve records notiyet
made. If FBI employees want providersto record information about future ~
electronic communications, they must comply with the electronic surveillance
statutes. A second limitation of I8 U.S.C. § 2703 f! is that some providers
may be unable to comply effectively with § 2703 t! requests g L' i ' T i b2
b7E
U! Video Tape Rental or Sales Records I
U! Title L8 United States Code Section'2710 makesithe unauthorized
disclosure of records by any person engaged in the rental, sale, or delivery of .
prerecorded video cassette tapes or similar audiovisual materials unlawful and
provides an exclusionary rule to prohibit personally identiable-information '
otherwisetobtained from being admissible as evidence in any courtproceeding.
Personally identiablejnformation isdened as "information that identies a
personas having requested or obtained specific video material or services . . . ."
a! U! The disclosure to law enforcement of personally identifiable
information is permitted only whentthe law enforcement agency:
.1! U! Has the written consent of the customer;
! U! Obtains a warrant issued underthe FRCP or equivalent state warrant;
or »
! U! A grand jury subpoena; .
b2 b b7E:
_ U This type of information was specically not included in the denition of
"personally identiable information" to allow law enforcement to obtain
information about individuals during routine investigations such as '
neighborhood investigations.
l78
UNCLASSIFIED-FOR OFFICIAL USE ONLY
Z_{_{'x-1
-4
-UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
U/V/FOUO! The disclosure of personally identiable information in a
national security case may be compelledthrough use of the above legal
processes or pursuant to a business records order issued under 50 U.S.C.
_ § 1861.
11.10.4. U! Approval Requirements for Investigative Method
A. U! Voluntary Emergency Disclosure
U7/FOUO! ECPA protects subscriber and transactional information regarding -
communications from disclosure by providers of telephone or other electronic
communication services. Generally, an NSL, grandjury subpoena, or other form of legal
process must begused to compel the communication service provider to disclose suchinformation ' ' '
U//FOUO! T
hnmouojii * ii? * I
idnmouo I D
11.10.5. U! Duration of Approval '
U! As authorized by statute e.g., for as long as the emergency necessitating usage exists and
only in those circumstances when it is impracticable to obtain legal process! and applicable court
order or warrant.
1110.6. U//FOUO! Specific.Pr_0c'eduresAl.__ U/IFOUO! Filing _requi_rements:J A I I I 92 b2
l79
UNCLASSIFIED-FOR OFFICIAL USE ONLYb2
b'lE
b2
b7E
_b2
b'7E
b2
b7E
b"/E
j M
92 BUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide' b2l we
" U//FCOUO! Contact with Providers:[ I 7 7 I 7 ~
b2
- b7E
C. U! Cost Reimbursement:
11._10.7. U! Notice and Reporting Requirements -
A. U! Voluntary disclosures: Title 18 United States Code Section 2702 d!~requires the
Attomey Generalto report annually toCongress information pertaining to the receipt of
voluntary disclosures of the contents of stored wire or electronic communications in an
emergency under 18 U.S.C. §2702 b! 8!, specically: ~
l. U!,The number of accounts from which DOJ received voluntary disclosures under
subsection b! 8!; and V i
2. U! Summary of the basis for disclosurein those instances where the investigation
pertaining to those disclosures was closed without the ling of criminal charges.
B. U!-Roles/Responsibilities: OGC/ILB is assigned the administrative responsibility to, by
December 31' of each year:
1. U! Policy and procedures regarding cost reimbursement are described in the following: 7
U! Consistent payment procedures ' ibzi. b'IE
U! 5/25/2005 Cost Reimbursement Guidance 8 U.S.C. 2706 - ECPA! '
U_! Tabulate the number of voluntary disclosures of stored contents received under the
authority of 18 U.S.C. § 2702 b! 8! for the calendar year; - '
U! Prepare the report summarizing the basis for disclosure in those instances where the
investigationpertaining to those disclosures was closed without the ling of criminal
charges; and '~
_2.
. 3. U! Submit the repoitto OGC for review-and submission to DOJ according to the
statutory requirement for annual report by the Attorney General.
1 1.10.8.
92 U! Other Applicahle*Policies 92 b2b7 E
l 80
UNCLASSIFIED-FOR OFFICIAL USE-ONLY
1 4
UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
11.11. U! Investigative Method: Pen Registers and Trap and Trace devices in conformitywith chapter 206 of Title 18, United States Code, and the Foreign Intelligence
Surveillance Act
I1.11.1. U! Summary _ _-
U! Pen register andtrap and trace PR/TT! devices enable the prospective collectionof non- dcontent trafc information associated with wire and electronic communications, such as: thephone numbers dialed from or to a particular telephone, including electronic communications; .messages sent from or to a particular telephone; or the Internet provider IP! address ofcommunications on the lntemet and other computer networks.
U//FOUO! Application: The PR/TT may be used in preliminary and full national security andcriminal investigations. This method may notbe used for: i! targeting a United States personwhen providing assistance to other agencies, unless there is already an open FBI preliminary orfull investigation related to the request for assistance or the predicate exists to open a preliminaryor full investigation; ii! targeting a United States person when collecting against a foreignintelligence requirement; or iii! during an assessment. i
11.11.2. U! Legal Authority T I I I
U! 18 U.S.C. §§ 3 l2l »et seq. _a'nd 50 U.S.C. §§ 1842 et-seq. regulate the use ofPR/TT devices.PR/TT orders can collect IP addresses, port numbers and the. To and From information frome-m_ail;.they cannot intercept the content of a communication, suchas wordsin the subject line 'or the body of an e-mail. "
1 1.11.3. U! Definition of Investigative Method _ _
U! A pen register device records or decodes dialing, routing addressing or signaling informationtransmitted by an instrument or facility from which a wire or electronic communication istransmitted, provided that such information must not include the contents of any communication.18 U.S*.C. § 3127!. I
U! A trap and trace device captures the incoming electronicor otheriimpulses that identify theoriginating number or other dialing, routing, addressing or signaling information reasonablylikely to identify the source of a wire or electronic communication, provided that such 'information does not include the contents of any communication. 18 U.S.C. § 3127!.
11.1 1.4. U!-Standards for Use and Approval Requirements for Investigative Method
A. U! Pen Register/Trap and Trace under FISA: Applications for authority to use a PR/TTdevice can bemade to the FISC in national security investigations. .
1. U! Legal Standard: Applications to the FISC are to be under oath and must include:
a. U! The identity of the federal ofcer making the application; and
b. U! A certication by the applicant that the information likelyto be obtained is_foreign intelligence information not conceming a United States person or, ifconceming a United'States person, is information that is relevant to an ongoinginvestigation to protect the United States against intemational terrorism orclandestine intelligenceactivities; and that such investigation, if of a United States
- -_ 181 '
UNCLASSIFIED-FOR OFFICIAL USE ONLY
U"N~CLASSIFIED- FOR OFFICIAL USE ONLY
Domestic Investigations and OperationsGuide
person, is not conducted solely upon the basis of activities protected by the FirstAmendment to the Constitution.
2. U//FOUO!.Procedures: Requests for initiation or renewal of F ISA PR/TT must be madeusin l
' b2
b7E
, , EISAMS wroute the request to appropriate parties for their review and approval of the request, L W , I Routing a paper copy for 'signatures is not required. '
3. U! Emergency Authority-FISA: 50 U.S.C. § 1843
U//FOUO! Under the provisions of FISA, the Attomey General may grant EmergencyAuthority EA! for PR/IT. Requests for Emergency Authority must be referred to theappropriate'FBlHQ Division. - '
U/ZFOUO '
b2
b7E
a. . U! The Attomey General may authorize the installation and use of a PR/TT upona determination that an-emergency exists and that the factual basis exists for acourt order. The FISC must be informed at the time of the authorization and anapplication for a court order must be made to the court no more than seven !days after the authorization. Emergency-authorized PR/TT use must terminatewhen the information sought is obtained, when the FISC denies the application, orseven ! days after the Attomey General authorization is given.
b. U! If the FISC denies the application after an emergency PR/TT device has beeninstalled, no information collected asra result may be used in any manner, exceptwith the approval of the Attomey General upon a showing that the informationindicates a threat of death or serious bodily harm to any person.
U! Notwithstanding the foregoing, the President, acting through the AttomeyGeneral, may authorize the use of a PR/Tl, without a court order, for a period not toexceed l5 calendar days, followinga declaration of war by Congress. g
U/ If an emergency situationarises aft ular business hours L
. if _ at any time during anemergency. '
B. U! Criminal Pen Register/T rap and Traceunder 18 U.S.C.,§§ 3121 et seq.: Applicationsfor-the installation and use of a PR/TT device may be made to a court of competent
' l82
UNCLAS$IFIED-FOR OFFICIAL USE ONLYb2
b7E
UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
jurisdiction i.e., any district court of the United States including a magistrate judge ofsuch a court! or any UnitedStates court of appeals havingjurisdiction over the offense beinginvestigated, or any court of general criminal jurisdiction of a State authorized by the law ofthat State to enter orders authorizing the use of a pen register or trap and trace device. 18U.S.C. § 3127!. ~
1. U! Legal Standard: Applications for authorization to install and use a PR/TT devicemust include: '
a. U! The identity of the attomey for the govemment or the state 1aw_ enforcement
or investigative officer making the application and the identity of the law
enforcement agency conducting the investigation; and
b. U! A certication by the applicant that the information likely to be obtained is_ relevant toan ongoing criminal investigation being conducted by that agency.
2. U//FOUO! Procedures: An SSA must approve a request for initiation or renewal ofPR/TT use prior to submission of the request to an-attorney. for the govemment..Before_ approving such a request, the SSA_ should consider of the following:
a. ~ U//FOUO!.The.use.ofresources based=on theinvestigativepurposes§t'f9rth;_
b. U//FOUO! Whether there is sufficient factual basis for the certication to be-made in the application i.e., is the information likely to be obtained relevant to anongoing criminal investigation!; ,
c. U//FOUO! Whether the customer or subscriber has consented to the use of aPR/TT, see l8 U.S.C. §312l b!!; or -
d; U//FOUO! Whether the use of a PR/TT is the least intrusive method feasible
under the circumstances.
_ U//FOUO!,A copy of the approving EC must be maintained in the*investigative case fileand/or sub le and in the ELSUR Administrative Suble to the corresponding case le,
U//FOUO! A PR/TT order is executable anywhere within the United States and, uponservice, the order applies to any person or entity providing wire"or electroniccommunication service in the United Stateswhose assistance may facilitate the executionof the order. Whenever such an order is served on any person, or entity not specicallynamed in the order,~upon request of such person or entity, the attorney forthe
government or law enforcement or investigative ofcer that is serving the order mustprovide written or electronic certication that the order applies to the person or entitybeing served. '
3. U! Emergency AuthorityCriminal: 92 ii
U! The Attomey General, the Deputy Attorney General, the_Associate Attomey General,any Assistant Attomey General, any acting Assistant Attomey General, or any DeputyAssistant Attorney General may specially designate any investigative or law enforcementofcer to determine whether an emergency situation that requires the installation and useof a' PR/TT device before an order authorizing such installation and usecan, with duediligence, be obtained. - Q
U! An emergency situation as denedin this section involves:
. 183
UNCLASSIFIED-FOR OFFICIAL USE ONLY
1 ' i
UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
a.
'b.
c. U! An immediate threat to a national security interest;,or _
d. U! An ongoing attack on a protected computer as "dened in l8 U.'S.C. § I030!that constitutes a crime punishable by a term of imprisonment greater than one
year. - U! Immediate danger of death or serious bodily injury to any person;
U! Conspiratorial activities characteristic of organized crime;
U! If the DOJ authorizes the emergency installation of a PR/TT, the govemment has 48hours after the installation to apply for a court order according to 18 U.~S.C. § 3123. It is a -violation of law to fail to apply for a court order within this 48 hour period. Use of thePR/TT shall immediately terminate when the information sought is obtained, when the _application for a court order is denied, or if no court order has been obtained 48 hoursaer the installation of the PR/TTdevice. *
U//FOUO! As withrequesting authorization for an emergency Title III,
b2,, b'7.E
, , [Once that approval has, beenobtained, the DOJ attorney will advise theAUSAthat theemergency use has beenapproved and that the law enforcement agency may proceed with the installation and useof the PR/T T. The DOJ attorney will send a verication memorandum, signed by theauthorizing official, to the AUSA. The AUSA will include an authorization memorandumwith the application for the court order approving the emergency use.
//FOUO! If an emergency situation arises aer regular business hours' ' ' L i ' _ , b2_ , During regular pusiness hours, . ' A 1°75
11_.11.s. U! Duration of Approval
U! National Security: The use of'a PR/TT device may-be authorized by the F I SC for a periodof time not to exceed 90 days in cases targeting a United~States person. Extensions maybegranted for periods not to exceed 90 days uponire-application to the"cour_t. In casestargeting anon-United Statesperson, an order or extension may be for a period of time not to exceed oneyear. .
U! Criminal: Theinstallation and use of a_PR/TT device maybe authorized by courtorderunder 18 U.StC. § 3123 for a period not to exceed sixty days, which maybe extended foradditional sixty-day periods. 3
11.1l;6, U//FOUO! Specic Procedures " 7
A. U//FOUO! Prior to installing and using a PR/TT device whether issued in a criminal ornational security matter!, thecase agent should: ».1. U//FOUO| I I i is i I ' H
Q l84
' UNCLASSIFIED-FOR OFFICIAL USE ONLY Ib2
b'7E.
A.
B
CUNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
b2
b'!E
2. § Q//FOUOi L
3. U//FOUOIb2
b'7E
b2 b'7E
4.' U//FOUO!|
b2
b7E
5. U//FOUOI» '
'11.11.7. U! Use and Dissemination of Information Derived from Pen Register/Trap and
Trace Authorized1Pursuant to FISA
U! 50 U.S.C. § I845
U! No information acquired fromra PR/TT device installed and used pursuant to F ISA maybe used or disclosed by federal officers or employees except for lawful purposes. .
U! No infonnation acquired pursuant to a FISA authorized PR/TT may be disclosed for lawenforcement purposes unless such disclosure is accompanied by a-statement that suchinformation, or any infomiation derived therefrom, may-only be used in a criminal 'proceeding with the advance authorization of the Attomey General.
U! Whenever the Unitedi States intends to enter into evidence or otherwise use or disclose inany trial, hearing, or other proceeding in or before any court, department, officer, agency,regulatory body, or other authority of the United States against an aggrieved personranyinformation obtained or derived from the use of a PR/TT device acquired pursuant to FISA,the United States must, before the trial, hearing, or other proceeding or at a reasonableetimebefore an effort to so disclose or so use that information or submit it into evidence, notify theaggrieved person, and the court or other authority in which" the informationis to be disclosedor used, that the United States intends to so disclose or so use such information.
U! Note: 50 U.S.C. § l80l k! denes aggrieved person as: a person who is the target of anelectronic surveillance or any other person whose communications or activities were subjectto electronic surveillance.
" 185 - -
UNCLASSIFIED-FOR OFFICIAL USE ONLYb2
b7E
UNCLASSIFIED FOR OFFICIAL USE ONLY
. Domestic Investigationsand Operations Guide '
11.1l.8. U! Notice and Reporting Requirements -
A. U! Annual Report for~Criminal_Pen Register/T rap and Trace: The_Attorney Generalis
required to make an annual report to Congresson the number of criminal PR/TT orders
applied for by DOJ law enforcement agencies. 18 U.S.C. § 3126. The report is to include the
followinginformation: _
l. U! The period of interceptions authorized by the order, and the numberand duration of
any extensions;
2. U! The offense specied in the order or application, or extension;
3. U! The number of investigations involved;
4. U! The numberrand nature of the facilities affected; and 1
5. U! The identity, including the district, of the applying agency making the application
and the person authorizing the order. - *
U//FQUO! DQJ,'Crimi11a1~Divi.s_iQn, Oflce of Enforcement Operations requires that.th_e FBI ,
provide quarterly reports on penregister usage. To satisfy-DOJ data requirements and
standardize and simplify, eld reporting, Court-ordered pen re ister usage must be reported to b2FBlHQ[ H r ~ g * g_92within five workdays of the bro
expiration date of an original orderor extensions, or denialiof an application for an order. For all
criminal PR/TT orders or extensions issued on or alter January 1, 2009, ' 1 _,, __ r These reporting requirements, do not apply to Péi
authorized pursuant to consent or under the provisions of 'FlSA.
B. U! Semi-Annual Report for National Security,Pen Registers and Trap and Trace: The
Attorney General must inform the House Permanent Select Committee onintelligence,
Senate Select Committee on-Intelligence, Committee of the Judiciary of the House
Representatives, and Committeeof the Judiciaryof the Senate conceming all uses of PR/TT
devices pursuant to 50 U.S.C. § -l846.iThis-report is coordinated through DOJ NSD. A semi-
I annual report must be submitted that contains the following information:
1. U! The total number of applications madefor orders approving the use of PR/TT devices;
2. U! The total number of suchorders either granted, modied,»or denied; and
3. U! The total number of PR/TT devices whose installation and use was authorized by the
Attorney General onan emergency basis andthe total number ofvsubsequent orders
approving or denying the installation and use of such PR/T-T devices. '
11.11.9, U!Special Circumstances _ .
A. i U//FOUO! Avoiding Collection and Investigative Use of Content in the Operation of
Pen Registers and Trap and Trace Devices
1. U//FOUO! Overview: Telecommunication networks provide users the abilityito engage
in extended dialing and/or signaling, also known as "post cut-through dialed digits" or
PCTDD!, which in some circumstances are simply call-routing information and, in others,
are call content, For example, _PCTDD,occur when a party places a calling card, credit
card, or collect call by rst dialing a long-distance carrier access number and then, after
the initial call is cut through, dials the telephone number of thedestination party. In
- l86 '
n'i;92pTfT A I "l'TC I7 lint": yr
UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
other instances, PCTDD may represent call content, such as when a_ party calls an
automated banking service and enters an account number, calls a pharmacys automated
prescription rell service and enters prescription information, or enters a callrback
number whenrprompted by a voice mail service. S_ee United StatesTelecom As_sg_g,
Federal _Communications Commission. 227 F.3d 450. 462 D.C ", ' ' b2
' b7E
U//FOUO! The denition of both a pen register device and a trap and trace device
provides that the information collected by these devices "shall not include the contents of
any communication." 18 U.S.C. § 3127. In addition, l8 U.S.C. § 3121 ! makes explicit _
the requirement to "use technology reasonably available" that restricts the collection of
information "so as not to include the contents of any wire or electronic communications."
"Content" includes any information conceming the substance, purpose, or meaning of a
communication. l8 U.S.C. § 2510 8!. When the pen register denition is read, in
, Aconjunction with the limitation provision, however, it suggests that although a PR/TT
. device may not be used for the express pur pose'of collecting-content, theincidental
collection of content may occuridespite the uselof "reasonably available" technology to
minimize, to the extent feasible, any possible over collection of content while still I '
allowing the device to collect all of the dialing and signaling information authorized.
DOJ Policy: In addition to this statutory obligation, DOJ has issued a directive to all DOJ
agencies requiring that no affirmative investigative use may be made of PCTDD
"incidentally collected that constitutes content, except in cases of emergency,-to prevent
an immediate danger of death, serious physical injury, or harm to the national security.
I U//EOUO1| ' . ' I
b2
r b7 E,
2.| U//FOUO!_Collection:| b; Z b7E.
a.. U//1=0U0!| '
r r " . b2
b7E
1 87
UNCLASSIFIED-FOR. OFFICIAL USE ONLY
-0
~ __ __ i 7,. ,
92 _ L
»
92
92I
UNCLASSIFIED = FOR OFFICIAL USE ONLY
Domestic Investigations and Operzftions Guide 7| ,1
.b. O
3. U1//FOUOI Use pfPCTDD:| LI I
I I I I I
a.~ iouo " U I O
K i. {U//FOUO
ii. Qygouoj I H O
l b2
b'7E
b2
b7E
b2
b7E
b2
P751
b2.
b/E
b2
b7E
b2
b7E
iii. §U//FOUOi
}b2
. b7
92 188
UNCLASSIFIED-FOR OFFICIAL USE ONLY
IE
UNCLASSIFIED -FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
iv; U//FOUO!
b. FOUO
i. U//FOUO Ab2
b7E
b2
b7E
b2
b7E
ii, O
4. U//FOUO! What constitutes PCTDD content: In applying the above, the term
content is interpreted tomean» any information concerning the substance, purpose, or
meaning of a communication as dened in l8 U.S.C. § 2510. Questions conceming
whether specic PCTDD are content as opposed to dialing, routing or signaling
information should be addressed to the CDC or OGC for coordination with DOJ asnecessary. '
U//FOUOb2
b7E
b2
b'7E
B. U//FOUO! Use of cell site simulators/digital analyzers/wireless intercept tracking
technology. A PR/TT order or consent is required for the FBI to use equipmentto capture
any "signaling information"._~including the Mobile Station Identication Number MSIN!
and Electroriic'Seriai Number ESN! or other registration-typedataemitted from a
wireless phone into the public airspaceeven_though this can be accomplished without the
assistance of the service provider. Because 18 U.S.C. § 3127 denes PR/TT devices in
terms of recording, decoding or capturing dialing. routing, addressing, or signaling
189 '
UNCLASSIFIED-FOR OFFICIAL USE ONLY
UNCLASSIFIED e FOROFFICIAL USE ONLY
Domestic Investigations and Operations Guide
information,*the govermnents use of its own device to capture such signaling datawhether passively monitoring or actively interrogatingconstitutes the use of a "penregister"<device and requires an order or statutory exception to avoid violating the statute.The following discusses how wireless intercept tracking technology WITT! is used:
1.- U//FOUO! To Locate a Known Phone: '
a. U//FOUO! Authority: A standard PR/TT'order is adequate to authorize the use ofthis technology to determine the location of a known targeted phone,,provided thatthe language authorizes FBI employees to install or cause to be installed and use a
pen register device, without geographical limitation, at any time of day or night
within X! days from the date the order is signed, to record or decode dialing,
routing, addressing, or signaling infonnation transmitted by the SubjectTelephone. The application and order should generally also request authority tocompel disclosureof cell site location data on an ongoing basis under 18 U.S.C,
§ 2703 d!or probable cause, if such is required by the particular district courtassuch information mayassist in determining the general location of the targeted
phone.ib.1.Lm ~1,1Q,j| it E ' I D i, E _
92
1 rUnder Kyllo v. United States; 533 UIS. 27 001!, the use of equipment not in
general, public use to acquire data that is not otherwisetdetectable that emanates' ' '92 'mplicates the Fourth Amendment.|
190
UNCLASSIFIED-FOR OFFICIAL USE ONLY
v
41b2
b7E
b2
~b7E
b2
b7E
1%
if I7 -~ '
UNCLASSIFIED - FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
b2
b7E
2. U//FOUO! To Identify an Unknown Target Phone Number:
§U//FOUO!Authori§1:| "
L U//F0u0§] C
a. U//FOUO!| C
b. U//FOUO! Z
I
usI91
UNCLASSIFIED-FOR OFFICIAL USE ONLYb2
b7E
b2
b7E
b2
b'7E
b2
b7E
UNCLASSIFIED _ FOR OFFICIAL USE ONLY
Domestic Investigations and Operations Guide
C. U! PR/TT Order Language: lhe language in the order should state that "the pen register_ will be implemented unobtrusively and with minimum interference with the servicesaccorded to customers of such service."
I92
UNCLASSIFIED-FOR OFFICIAL USE ONLY ,b2
b7E