RONWYDEN COMMITTEES: OREGON COMMITTEE ON FINANCE COMMITTEE ON BUDGET RANKING MEMBER OF COMMITTEE ON COMMITTEE ON ENERGY & NATURAL RESOURCES FINANCE 355 tlnitcd ~rates ~cnatc SELECT COMMITTEE ON INTELLIGENCE WASHINGTON, DC 20510-3703 JOINT COMMITTEE ON TAXATION 221 DIRKSEN SENATE OFFICE BUILDING WASHINGTON, DC 20510 (202) 224- 5244 May 8, 2018 The Honorable Ajit Pai Chairman Federal Communications Commission 445 12th Street Southwest Washington, DC 20554 Dear Chairman Pai: I write to ask that the Federal Communications Commission (FCC) investigate abusive and potentially unlawful practices of wireless carriers, which have permitted at least one company to provide law enforcement with unrestricted access to the location data of the carriers' customers. I recently learned that Securus Technologies, a major provider of correctional-facility telephone services, purchases real-time location information from major wireless carriers and provides that information, via a self-service web portal, to the government for nothing more than the legal equivalent of a pinky promise. This practice skirts wireless carrier's legal obligation to be the sole conduit by which the government conducts surveillance of Americans' phone records, and needlessly exposes millions of Americans to potential abuse and surveillance by the government. To access this private data, correctional officers simply visit Securus' web portal, enter any U.S. wireless phone number, and then upload a document purporting to be an "official document giving permission" to obtain real-time location data. I have enclosed portions of a Securus presentation demonstrating that web portal as well as a Securus white paper documenting "success stories" where Securus customers used this turnkey service to conduct activities wholly unrelated to correctional-facility telephone services. Top officials at Securus confirmed to my office that Securus takes no steps to verify that uploaded documents in fact provide judicial authorization for real-time location surveillance, or conduct any review of surveillance requests. Securus claimed, incorrectly, that correctional facilities, not Securus, must ensure that correctional officers don't misuse the web portal. Federal law-enforced by the FCC-restricts how and when wireless carriers may share certain customer information, including location data. Wireless carriers have an obligation to take affirmative steps to verify law enforcement requests for customer information, and must further ensure they are the sole avenue for law enforcement to obtain that information. Federal law also permits the commercial disclosure of customer location data to third parties, but only with the consent of the customer. Securus does not take any of the steps required of carriers. 911 NE llTH AVENUE 405 EAST 8TH AVE SAC ANNEX BUILDING U.S. COURTHOUSE THE JAMISON BUILDING SUITE 630 707 13TH Sf, SE SUITE 2020 105 FIR ST 310 WEST 6TH ST 131 NW HAWTHORNE AVE PORTLAND, OR 97232 SUITE 285 EUGENE, OR 97401 SUITE 201 . ROOM 118 SUITE 107 (503) 326- 7525 (541) 431- 0229 SALEM, OR 97301 LA GRANDE, OR 97850 MEDFORD, OR 97501 BEND, OR 97701 (503) 589-4555 (541) 962-7691 (541) 858- 5122 (541) 330- 9142 HITP://WYDEN.SENATE.GOV PRINTED ON RECYCLED PAPER It is incredibly troubling that Securus provides location data to the government at all- let alone that it does so without a verified court order or other legal process. This clear abuse is only possible because wireless carriers sell their customers' private information to companies claiming to have consumer consent without sufficiently verifying those claims. I am also asking the major wireless carriers to investigate their own practices and the obvious potential' for abuse. I have enclosed a copy of that letter. I ask that the FCC promptly investigate Securus, the wireless carriers' failure to maintain exclusive control over law enforcement access to their customers' location data, and also conduct a broad investigation into what demonstration of customer consent, if any, each wireless carrier requires from other companies before the carriers provide them with customer location . information and other data. If you have any questions about this request, please contact Chris Soghoian in my office. Sincerely, Rolka~ United States Senator