There is a party in every modern search that the first eleven sections barely mention, and it is the one that does the collecting. In the modern context, the government almost never comes to you when it wants your data. It serves the carrier, the platform, the cloud host, sometimes the device maker. The whole architecture of digital surveillance runs through private intermediaries. A statute that governs the government’s conduct but ignores the provider in the middle is directing the play while pretending there is no stage crew. So, the last section of Pass 1 is about the choke point: when the government may compel a provider to help, what the provider must do, and what protection the provider gets for doing it.
Title III, once more, laid the template. Section 2518(4) lets an intercept order direct a provider to furnish the government the information, facilities, and technical assistance necessary to accomplish the interception unobtrusively. Section 2511(2)(a)(ii) gives the provider immunity for good-faith reliance on a facially valid order or certification. And § 2522 handles enforcement of the capability obligations Congress later imposed. The blueprint already has the two halves of the provider relationship: the government can compel assistance, and the provider who complies in good faith is shielded from the customer’s lawsuit.
That is a bargain, and it is worth naming as one. The government gets reach it could never achieve alone — it cannot tap a line it does not own or decrypt a service it did not build. The provider gets immunity and a clear safe harbor. Efficient, but dangerous, because the same bargain can become a channel for over-collection that no one answers for: the provider points to the order, the government points to the provider’s compliance, and the customer whose data flowed finds no one who will own the decision. The telecom-immunity fights of the 2000s were exactly this — a dispute over whether good-faith compliance should absolve participation in collection that may have exceeded the law.
Then there is the move that makes provider assistance structural rather than case-by-case: CALEA, the Communications Assistance for Law Enforcement Act. CALEA did not merely say “help when you are ordered to.” It required carriers to build their networks to be wiretap-capable in the first place — surveillance by design. That is an escalation in kind, not degree: not “assist with this order” but “engineer your system so that assistance is always possible.” Every digital-property statute now should decide how far that logic runs. Do we require platforms to build in a collection capability — a standing door the government can walk through with an order — or do we forbid it?
Which lands on the hardest provider question of the era: encryption. Can the government compel a provider to defeat its own encryption, or to build the capability to do so? The paradigm is the Apple–FBI fight over the San Bernardino iPhone — litigated under the All Writs Act, not Title III, but the principle is general. The government did not ask Apple for data Apple had; it tried to compel Apple to write new code to break security Apple had deliberately built so that even Apple could not break it. Notably, CALEA itself drew this line: it does not require a carrier to be able to decrypt communications it has not itself encrypted and for which it does not hold the key. That instinct is the right one, and § 12 should make it explicit.
So § 12 does five things. First, a bounded compelled-assistance authority: a provider served with a valid order must furnish the data, facilities, and technical assistance reasonably necessary to execute it — where “assistance” means giving the government access to what the provider has and can reach, not conjuring new surveillance capability. Second, a no-mandated-vulnerability rule: nothing in the Act authorizes compelling a provider to weaken, remove, or build a back door into a security feature, or to defeat encryption whose keys it does not hold. A back door built for one case is a standing vulnerability in everyone’s security, and adversaries find the doors we build. Third, good-faith immunity, but conditioned: a provider that complies with a facially valid order in good faith is immune from the customer’s suit — but the immunity is tied to the order’s facial validity and the provider’s good faith, and it does not cover a provider that over-produces beyond what the order commands. Fourth, transparency and challenge rights: a provider should be able to report aggregate demand numbers (the hook into § 11’s reporting) and to challenge an overbroad or unlawful demand, with gag orders time-limited and reviewable rather than perpetual. Fifth, particularity at the choke point: the provider produces what the order specifies, not the whole firehose — minimization enforced at the one place that sees everything.
Now the law-enforcement case, which is serious and which I will not caricature. It is the “going dark” argument: without compelled assistance, and without capability mandates, strong encryption and provider design choices can put evidence beyond reach even when the government holds a valid warrant. A warrant you cannot execute is a hollow right — for the public and for victims who are entitled to have crimes solved. And immunity is not a giveaway; without it, providers facing liability to their own customers would resist every order, and lawful surveillance would grind down. On this account, provider assistance is simply what makes a warrant mean something in a networked world.
Here is why § 12 keeps most of that and still draws the line where it does. Compelled assistance for what the provider has and can access is necessary, and the Act preserves it — a warrant that cannot be executed against the party holding the data is indeed an empty right. The line falls at manufactured capability. Forcing a provider to break its own security does not just reach this suspect; it builds a vulnerability into the product every other customer relies on, and that vulnerability does not stay in friendly hands. “Going dark” is a real cost, but the remedy cannot be a rule that everyone’s lock must be pickable on demand. And the immunity must stay conditioned, because an unconditional immunity is precisely the laundering mechanism — the device that lets the provider and the government each point at the other while the data over-flows and no one is accountable.
That accountability is why the section is titled assistance and enforcement. The enforcement runs both directions. The Act needs teeth against a provider that over-produces or ignores the order’s limits, and teeth against a government demand that exceeds its authority — with the provider positioned, and protected, to say no to the second. The goal is to make the choke point a checkpoint rather than a conduit: the one place in the system that sees all the data should be a place where the law’s limits are enforced, not quietly bypassed.
That closes Pass 1. Twelve weeks, twelve sections, the whole lifecycle of digital property in government hands: the prohibition that is the default, the authorization that is the exception, the particularity at collection, the rules for analysis where the real search happens, the limits on copying and retention, the restriction on use and disclosure, the duty of disposition, and then the enforcement spine — suppression, civil damages, reporting, and now the provider assistance that decides whether any of it binds the party in the middle. Provider assistance is the right place to end, because it is the reminder that the other eleven sections are only as real as the choke point they run through. Compel the provider quietly enough, immunize the compliance broadly enough, and every front-end protection becomes optional.Next Tuesday, Pass 1 gives way to Pass 2 — the model statutory text itself — starting back at the beginning, with a § 1 definitions section written to survive the next shift in technology.
Leave a Reply