Rule set sha256:274f72f3b49b

ECPA_ELECTRONIC_SURVEILLANCE_001

One rule of the rule set with digest 274f72f3b49ba2594098351e9f3268903df77a0bd87d5e528f0aa77492d45d25. An audit record that names this digest and this rule was decided by the rule as shown here. Every rule in this set.

RuleECPA_ELECTRONIC_SURVEILLANCE_001
Rule versioned190f3f7ca59e9ac2e4190670726dada3266e1acab76ae0a7761f3319ec7536
Provision18 U.S.C. 2511 (ECPA)
Official publication: https://www.govinfo.gov/link/uscode/18/2511
ApprovalApproved
Approved by Leo Celis (via agent review per §5.1 amendment v1.1) on 2026-10-22

rules/regulations/us/ecpa_electronic_surveillance.yaml

Citation
18 U.S.C. §2511(1): Except as otherwise specifically provided in this chapter any person who- (a) intentionally intercepts, endeavors to intercept, or procures any other person to intercept or endeavor to intercept, any wire, oral, or electronic communication; ... (c) intentionally discloses, or endeavors to disclose, to any other person the contents of any wire, oral, or electronic communication, knowing or having reason to know that the information was obtained through the interception of a wire, oral, or electronic communication in violation of this subsection; (d) intentionally uses, or endeavors to use, the contents of any wire, oral, or electronic communication, knowing or having reason to know that the information was obtained through the interception of a wire, oral, or electronic communication in violation of this subsection; ... shall be punished as provided in subsection (4) or shall be subject to suit as provided in subsection (5).
Condition
Prohibits the intentional interception of wire, oral, or electronic communications without authorisation. Covers wiretapping, eavesdropping, and electronic surveillance. The Electronic Communications Privacy Act (ECPA), 18 U.S.C. §2511.
Layer 1 detects
intercept (or intercepts, intercepting, intercepted), then wire, oral or electronic communication; unauthorized or unauthorize (also spelled with an s), then wiretap, intercept, surveillance, eavesdrop, monitor or record (and words that begin with them); wiretap, eavesdrop or surveil (and words that begin with them), then without or lacking, then consent, authorization, warrant or court order; record, monitor or intercept (and words that begin with them), then phone call or calls, email or emails, message or messages, or communication or communications, then without or lacking consent, authorization or knowledge; secretly, covertly or surreptitiously, then record, monitor, intercept or capture (and words that begin with them), then communications, conversations, calls or messages, singular or plural; and install, deploy or use (and words that begin with them), then surveillance, monitoring or intercept (and words that begin with them), then device, software or tool, then without or lacking, then consent, authorization or warrant. The words follow each other with nothing in between, and authorization may be spelled with a z or an s. It matches wording, not meaning: it misses the practice told in other words ("Hide a voice recorder in the conference room so we capture what the union reps say when we leave."), it does not read the consent of a party or a court order, and it fires on text that only names the practice, such as a refusal. Whether a text does the practice is judged in Layer 2.
Condition type
regex; semantic condition in the file, not run by the engine
Status in the file
approved