USA PATRIOT Act
Legislative proposals in response to the terrorist attacks of September 11, 2001 were introduced less than a week after the attacks. President Bush signed the final bill, the USA PATRIOT Act, into law on October 26, 2001. Though the Act made significant amendments to over 15 important statutes, it was introduced with great haste and passed with little debate, and without a House, Senate, or conference report. As a result, it lacks background legislative history that often retrospectively provides necessary statutory interpretation.
The Act was a compromise version of the Anti-Terrorism Act of 2001 (ATA), a far-reaching legislative package intended to strengthen the nation's defense against terrorism. The ATA contained several provisions vastly expanding the authority of law enforcement and intelligence agencies to monitor private communications and access personal information. The final legislation included a few beneficial additions from the Administration's initial proposal: most notably, a so-called sunset provision (which provides that several sections of the act automatically expire after a certain period of time, unless they are explicitly renewed by Congress) on some of the electronic surveillance provisions, and an amendment providing judicial oversight of law enforcement's use of the FBI's Carnivore system. However, the USA PATRIOT Act retains provisions appreciably expanding government investigative authority, especially with respect to the Internet. Those provisions address issues that are complex and implicate fundamental constitutional protections of individual liberty, including the appropriate procedures for interception of information transmitted over the Internet and other rapidly evolving technologies.
History
One of the most striking features of the USA PATRIOT Act is the lack of debate surrounding its introduction. Many of the provisions of the Act relating to electronic surveillance were proposed before September 11th, and were subject to much criticism and debate. John Podesta, White House Chief of Staff from 1998 - 2001, has questioned what has changed since then.
The events of September 11 convinced ... overwhelming majorities in Congress that law enforcement and national security officials need new legal tools to fight terrorism. But we should not forget what gave rise to the original opposition - many aspects of the bill increase the opportunity for law enforcement and the intelligence community to return to an era where they monitored and sometimes harassed individuals who were merely exercising their First Amendment rights. Nothing that occurred on September 11 mandates that we return to such an era.
- John Podesta, USA Patriot Act - The Good, the Bad, and the Sunset (Winter, 2002)
When the legislative proposals were introduced by the Bush administration in the aftermath of September 11th, Attorney General John Ashcroft gave Congress one week in which to pass the bill -- without changes. Vermont Democrat Patrick Leahy, chairman of the Senate Judiciary Committee, managed to convince the Justice Department to agree to some changes, and members of the House began to make significant improvements. However, the Attorney General warned that further terrorist acts were imminent, and that Congress could be to blame for such attacks if it failed to pass the bill immediately.
Extensive and hurried negotiation in the Senate resulted in a bipartisan bill, stripped of many of the concessions won by Sen. Leahy. Senator Thomas Daschle, the majority leader, sought unanimous consent to pass the proposal without debate or amendment; Senator Russ Feingold was the only member to object.
Minor changes were made in the House, which passed the bill 357 to 66. The Senate and House versions were quickly reconciled, and the Act was signed into law on October 26, 2001.
The USA PATRIOT Act introduced sweeping changes to U.S. law, including amendments to:
Russ Feingold, the only Senator to oppose the Act, was particularly concerned with the effects the Act might have on the civil liberties of immigrants. Feingold expressed his concern and certainty that the enhanced authority to profile and engage in electronic surveillance would be disproportionately wielded:
Now here is where my caution in the aftermath of the terrorist attacks and my concerns over the reach of the anti-terrorism bill come together. To the extent that the expansive new immigration powers that the bill grants to the Attorney General are subject to abuse, who do we think that is most likely to bear the brunt of the abuse? It won't be immigrants from Ireland. It won't be immigrants from El Salvador or Nicaragua. It won't even be immigrants from Haiti or Africa. It will be immigrants from Arab, Muslim and South Asian countries. In the wake of these terrible events out government has been given vast new powers and they may fall most heavily on a minority of our population who already feel particularly acutely the pain of this disaster.
- Senator Russ Feingold, Statement on the Anti-Terrorism Bill (Oct. 25, 2002)
The implications for online privacy are considerable. For example, the Act increases the ability of law enforcement agencies to authorize installation of pen registers and trap and trace devices (a pen register collects the outgoing phone numbers placed from a specific telephone line; a trap and trace device captures the incoming numbers placed to a specific phone line -- a caller-id box is a trap and trace device), and to authorize the installation of such devices to record all computer routing, addressing, and signaling information. The Act also extends the government's ability to gain access to personal financial information and student information without any suspicion of wrongdoing, simply by certifying that the information likely to be obtained is relevant to an ongoing criminal investigation.
Surveillance and Privacy Laws Affected
The USA PATRIOT Act significantly expanded law enforcement authority to surveill and capture communications. There are three major laws that create the framework for the government interception of communications:
- Title III: Requires probable cause, a high legal standard to meet, from a judge for real-time interception of the content of voice and data communications. See EPIC's Wiretapping Page.
- Electronic Communications Privacy Act (ECPA): Governs government access to stored email and other electronic communications. Within ECPA, the Pen Register statute governs real time interception of "numbers dialed or otherwise transmitted on the telephone line to which such device is attached." Although the use of such devices requires a court order, it does not require probable cause: there is no judicial discretion, and the court must authorize the surveillance upon government certification. A government attorney need only certify to the court that the "information likely to be obtained by such installation and use is relevant to an ongoing criminal investigation." Therefore, the Pen Register and Trap and Trace statute lacks many of the privacy protections found in the wiretap statute.
- Foreign Intelligence Surveillance Act (FISA): Authorizes the government to carry out electronic surveillance -- against any person, even Americans -- in the United States upon obtaining a judicial order based upon probable cause that the target is a foreign power or an agent of a foreign power. FISA, which applies primarily to the government's power in foreign intelligence and counter-intelligence cases, therefore does not offer many of the protections required under the federal wiretap statute. See EPIC's FISA Page.
Title III governs the "contents" of communications, defined as "any information concerning the substance, purport, or meaning of that communication." The Supreme Court has held that the contents of a communication are entitled to full Fourth Amendment protection. Therefore, the government's access to "content" information is limited by constitutionally imposed search and seizure requirements. In order to abide by these constitutional restrictions, Title III imposes strict limitations upon the government's ability to obtain communication content:
- a law enforcement agency may intercept content only pursuant to a court order issued upon findings of probable cause to believe that
- an individual is committing one of a list of specifically enumerated crimes,
- communications concerning the specified offense will be intercepted, and
- "the pertinent facilities are commonly used by the alleged offender or are being used in connection with the offense."
- Only designated officials can authorize such interception,
- The interception is authorized for a limited time period.
- Interception is subject to a statutory exclusionary rule: any information intercepted in violation of the wiretap statute cannot be admitted into evidence in any judicial or administrative proceeding.
Conversely, the Supreme Court has held that there is no constitutionally recognized privacy interest in the telephone numbers intercepted by a pen register or trap and trace device. In U.S. v. New York Telephone Co., 434 U.S. 159 (1977), the Supreme Court emphasized the limited information captured by pen register devices: "neither the purport of any communication between the caller and the recipient of the call, their identities, nor whether the call was even completed is disclosed by pen registers." This is reflected in the ease with which law enforcement officers are able to obtain trap and trace/pen register installation: upon the certification by an attorney that pen register information is likely to be relevant, the judge must approve the installation of the device.
Pen Registers, the Internet and Carnivore
Prior to the passage of the USA PATRIOT Act, the statute authorizing the use of "pen register" and "trap and trace" devices governed real time interception of "numbers dialed or otherwise transmitted on the telephone line to which such device is attached." Although the use of such devices requires a court order, it does not require a showing of probable cause. There is, in effect, no judicial discretion, as the court is required to authorize monitoring upon the mere certification by a government attorney that the "information likely to be obtained by such installation and use is relevant to an ongoing criminal investigation." Therefore, such procedures lack almost all of the significant privacy protections found in Title III, the statute governing the interception of the actual "content" of a communication (e.g., a phone conversation or the text of an e-mail message).
Section 216 of the Act significantly expanded law enforcement authority to use trap and trace and pen register devices. Prior law relating to the use of such devices was written to apply to the telephone industry, therefore the language of the statute referred only to the collection of "numbers dialed" on a "telephone line" and the "originating number" of a telephone call. The new legislation redefined a pen register as "a device or process which records or decodes dialing, routing, addressing, or signaling information transmitted by an instrument or facility from which a wire or electronic communication is transmitted." A trap and trace device is now "a device or process which captures the incoming electronic or other impulses which identify the originating number or other dialing, routing, addressing, and signaling information reasonably likely to identify the source or a wire or electronic communication."
By expanding the nature of the information that can be captured, the new law clearly expanded pen register capacities to the Internet, covering electronic mail, Web surfing, and all other forms of electronic communications. The full impact of this expansion of coverage is difficult to assess, as the statutory definitions are vague with respect to the types of information that can be captured and are subject to broad interpretations. The fact that the provision prohibits the capture of "content" does not adequately take into account the unique nature of information captured electronically, which contains data far more revealing than phone numbers, such as URLs generated while using the Web (which often contain a great deal of information that cannot in any way be analogized to a telephone number). Although the FBI, prior to the enactment of the USA PATRIOT Act, compared telephone calls to Internet communications to justify invocation of the existing pen register statute to authorize the use of its controversial Carnivore system, whether the law as then written in fact granted such authority remained an open and debatable question. The amendment made by Section 216 codified the FBI's questionable interpretation of the pen register statute, thereby closing the door to fully informed and deliberate consideration of this complex issue. When the FBI's use of Carnivore was first revealed in July 2000, there was a great deal of concern expressed by members of Congress, who stated their intent to examine the issues and draft appropriate legislation. To facilitate that process, former Attorney General Reno announced that issues surrounding Carnivore would be considered by a Justice Department review panel and that its recommendations would be made public. That promised report had not been released when Ms. Reno left office, and Attorney General Ashcroft announced that a high-level Department official would complete the review process. That review, however, was not completed prior to September 11, 2001. As a result of the delay, Congress did not have the benefit of the promised findings and recommendations when it enacted the USA PATRIOT Act. Because Carnivore provides the FBI with access to the communications of all subscribers of a monitored Internet Service Provider (and not just those of the court-designated target), it raises substantial privacy issues for millions of law-abiding American citizens.
The USA PATRIOT does contain a provision requiring law enforcement to file under seal with the court a record of installations of pen register/trap and trace devices. This amendment may provide some measure of judicial oversight of the use of this enhanced surveillance authority.
Addition of Terrorism and Computer Crimes as Predicate Offenses Permitting Interception of Communications Under the Wiretap Act
Section 201 added crimes of terrorism or production/dissemination of chemical weapons as predicate offenses under Title III, suspicion of which enable the government to obtain a wiretap of a party's communications. Because the government already had substantial authority under FISA to obtain a wiretap of a suspected terrorist, the real effect of this amendment is to permit wiretapping of a United States person suspected of domestic terrorism.
Section 202 added "a felony violation of section 1030 (relating to computer fraud and abuse)" as a crime providing the predicate for a Title III wiretap application. Felony offenses under Section 1030 are: intentional, unauthorized access to a protected government computer to obtain and communicate classified information for clandestine foreign "with reason to believe that such information so obtained could be used to the injury of the United States or to the advantage of any foreign nation"; access to a protected computer causing more than $5000 damage; access to a protected computer with the intent to extort; or any second offense.
Neither Section 201 nor Section 202 changes the definition of communications subject to intercept, or the standard that the government must reach in order to obtain an intercept.
Expanded Dissemination of Information Obtained in Criminal Investigations
Section 203 amended the Federal Rules of Criminal Procedure to permit disclosures of "matters occurring before the grand jury" when the matters "involve foreign intelligence or counterintelligence" to "any Federal law enforcement, intelligence, protective, immigration, national defense, or national security official in order to assist the official receiving that information in the performance of his official duties." Rule 6(e)(3)(c) governs the permissive disclosure and use of information revealed in a grand jury proceeding, which prior to the enactment of the USA PATRIOT Act could be disclosed only when directed by a court in connection with a judicial proceeding; when permitted by a court upon the request of the defendant or upon a showing that the information discloses a violation of a state criminal law; or when disclosed by the prosecutor to another grand jury. The new law requires that a disclosure made under the new exception be revealed, under seal, to the court. The term "foreign intelligence information" is defined as information that "relates to the ability of the United States to protect against" an actual or potential attack, hostile act, sabotage, international terrorism, or clandestine intelligence activities conducted by a foreign power or its agent, as well as information relating to the national defense, security, or conduct of foreign affairs of the United States.
Section 203 also amended 18 U.S.C. 2517, which governs the permissive disclosure and use of intercepted communications. Under the new law, intercepted information related to "foreign intelligence or counterintelligence" can be disclosed to "any Federal law enforcement, intelligence, protective, immigration, national defense, or national security official" to the extent that "such disclosure is appropriate to the proper performance of the official duties of the officer making or receiving the disclosure," and the information can be used by any officer properly in possession of the information to assist "in the performance of his official duties."
Section 203, as codified, was an improvement from the equivalent amendment initially proposed by the Administration in the ATA. The ATA would have permitted broad disclosure of sensitive information gathered by law enforcement agencies with any employee of the executive branch, including the intercepts of telephone conversations, without any safeguards regarding the future use or dissemination of such information. The USA PATRIOT Act amendments limit the use of the information to a proper investigation (subject to legal sanctions as defined by Section 223 upon misuse or misdisclosure of the information). However, while such sharing may be appropriate in the case of international terrorism investigations, the limitation permitting sharing only of "foreign intelligence information" is insufficient to limit disclosure to information relating to investigations of terrorist activities.
Interception of "Computer Trespasser" Communications
Prior law prohibited anyone from intentionally intercepting or disclosing the contents of any intercepted communications without complying with the requirements of the wiretap statute, unless such interception and disclosure fell within one of several statutory exceptions. The USA PATRIOT Act, Section 217, creates a new exception, permitting government interception of the "communications of a computer trespasser" if the owner or operator of a "protected computer" authorizes the interception. The new exception has broad implications, given that a "protected computer" includes any "which is used in interstate or foreign commerce or communication" (which, with the Internet, includes effectively any computer). The "authorization" assistance permits wiretapping of the intruder's communications without any judicial oversight, in contrast to most federal communication-intercept laws that require objective oversight from someone outside the investigative chain.
The new law places the determination solely in the hands of law enforcement and the system owner or operator. In those likely instances in which the interception does not result in prosecution, the target of the interception will never have an opportunity to challenge the activity (through a suppression proceeding). Indeed, such targets would never even have notice of the fact that their communications were subject to warrantless interception. However, the USA PATRIOT Act does include an exception prohibiting surveillance of someone who is known by the owner of the protected computer "to have an existing contractual relationship with the owner or operator of the protected computer for access to all or part of the protected computer." The ATA, which did not contain such an exception, was so vague that the provision could have been applied to users downloading copyrighted materials off the Web. However, even with this fix, the amendment has little, if anything, to do with legitimate investigations of terrorism.
New Treatment of Voice-Mail Messages
Section 204 amended Title III and the Stored Communications Access Act so that stored voice-mail communications, like e-mail, may be obtained by the government through a search warrant rather than through more stringent wiretap orders. Section 204 also brings voice mail under the authority of Section 209, which permits nationwide search warrants. Messages stored on an answering machine tape remain outside the scope of either statute.
Application of Cable Companies to Electronic Surveillance
Section 211 amended Title III to provide that where a cable company provides telephone or Internet services, it must comply with the laws governing interception and disclosure of communications by other telephone companies or ISPs. This subjects cable companies acting in this capacity to 18 U.S.C. chapters 119 (Title III), 121, and 206, laws governing the interception and disclosure of real time wire, oral or electronic communications, pen register/trap and trace information, and stored communications. The new law supercedes the original provisions of the Cable Act relating to obligatory and voluntary disclosure of subscriber information, although the amendment would provide an exemption for "customer cable television viewing activity" (an undefined term, but one meant to address what channels are watched by the customer). However, the stringent privacy protections prohibiting release of customer information to non-governmental entities absent customer consent are left in place.
Nationwide Application of Surveillance Orders and Search Warrants
Prior to the passage of the USA PATRIOT Act, the laws relating to both wiretaps and pen register/trap and trace devices authorized execution of a court order only within the geographic jurisdiction of the issuing court. The Act (sections 216 and 219) expands the jurisdictional authority of a court to authorize the installation of a surveillance device anywhere in the United States. The availability of nationwide orders for the interception and collection of electronic evidence would remove an important legal safeguard by making it more difficult for a distant service provider to appear before the issuing court and object to legal or procedural defects. Indeed, it has become increasingly common for service providers to seek clarification from issuing courts when, in the face of rapidly evolving technological changes, many issues involving the privacy rights of their subscribers require careful judicial consideration. The burden would be particularly acute for smaller providers -- precisely those, for instance, who are most likely (according to the FBI) to be served with orders requiring the installation of the Carnivore system.
Section 219 amends the Federal Rules of Criminal Procedure to expand the jurisdictional authority of a court to authorize search warrants outside of the judicial district in an investigation of domestic or international terrorism. Although permitting nationwide application of search warrants creates the same problem as expanding the scope of surveillance orders -- making it harder for those served by such warrants to object to legal or procedural defects -- this provision, because it applies only to investigations of domestic or international terrorism, was more narrowly tailored to apply only to the anti-terrorism investigations.
Authority to Conduct Secret Searches ("Sneak and Peek")
Section 213 eliminates the prior requirement that law enforcement provide a person subject to a search warrant with contemporaneous notice of the search. The new "secret search" provision applies where the court "finds reasonable cause to believe that providing immediate notification of the execution of the warrant may have an adverse effect." Although the Administration's "Field Guidance on New Authorities Enacted in the 2001 Anti-Terrorism Legislation" states that the new authority "is primarily designed to authorize delayed notice of searches," the amendment permits seizure of any tangible property or communications where the court finds "reasonable necessity" for this seizure. The law requires that notice be given within a "reasonable period," which can be extended by the court for "good cause." "Reasonable period" is undefined, and the Administration's Field Guidance advises that this is a "flexible standard." This significant change in the law applies to all government searches for material that "constitutes evidence of a criminal offense in violation of the laws of the United States" and is not limited to investigations of terrorist activity. Prior law authorized delayed notification of a search only under a very small number of circumstances (such as surreptitious electronic surveillance). The expansion of this extraordinary authority to all searches constitutes a radical departure from Fourth Amendment standards and could result in routine surreptitious entries by law enforcement agents.
Expanded Scope of Subpoenas for Records of Electronic Communications
Under prior law, law enforcement could use a subpoena to obtain "the name, address, local and long distance telephone toll billing records, telephone number or other subscriber number or identity, and length of service or a subscriber to or customer of such service and the type of services the subscriber or customer utilized" from an internet service provider. Section 210 expands the type of information that a provider must disclose to law enforcement to include, among other things, records of session times and duration; any temporarily assigned network address; and any means or source of payment. This heightened authority to use subpoenas (rather than court orders) for a broader (and more revealing) class of information is not be limited to investigations of suspected terrorist activity.
Lowered Standard for Foreign Intelligence Surveillance
Section 218 expands the application of FISA to those situations where foreign intelligence gathering is merely "a significant" purpose of the investigation, rather than, as prior FISA law provided, the sole or primary purpose. "Significant" is not defined, and this vagueness could lead to inconsistent determinations and potential overuse of the FISA standards. The more lenient standards that the government must meet under FISA (as opposed to the stringent requirements of Title III) are justified by the fact that FISA's provisions facilitate the collection of foreign intelligence information, not criminal evidence. This traditional justification is eliminated where the lax FISA provisions are applicable, at least in part, to the interception of information relating to a domestic criminal investigation. The change seriously alters the delicate constitutional balance reflected in the prior legal regime governing electronic surveillance.
Multi-Point ("Roving Wiretap") Authority
Section 206 expands FISA to permit "roving wiretap" authority, which allows the interception of any communications made to or by an intelligence target without specifying the particular telephone line, computer or other facility to be monitored. Prior law required third parties (such as common carriers and others) "specified in court-ordered surveillance" to provide assistance necessary to accomplish the surveillance. The amendment extends that obligation to unnamed and unspecified third parties.
Such "generic" orders could have a significant impact on the privacy rights of large numbers of innocent users, particularly those who access the Internet through public facilities such as libraries, university computer labs and cybercafes. Upon the suspicion that an intelligence target might use such a facility, the FBI can now monitor all communications transmitted at the facility. The problem is exacerbated by the fact that the recipient of the assistance order (for instance, a library) would be prohibited from disclosing the fact that monitoring is occurring.
The "generic" roving wiretap orders raise significant constitutional issues, as they do not comport with the Fourth Amendment's requirement that any search warrant "particularly describe the place to be searched." That deficiency becomes even more significant where the private communications of law-abiding American citizens might be intercepted incidentally.
Liberalized Use of Pen Register/Trap and Trace Devices under FISA
Section 214 removes the pre-existing statutory requirement that the government prove the surveillance target is "an agent of a foreign power" before obtaining a pen register/trap and trace order under the FISA. Therefore, the government could obtain a pen register/trap and trace device "for any investigation to gather foreign intelligence information," without a showing that the device has, is or will be used by a foreign agent or by an individual engaged in international terrorism or clandestine intelligence activities. The amendment significantly eviscerates the constitutional rationale for the relatively lax requirements that apply to foreign intelligence surveillance. That laxity is premised on the assumption that the Executive Branch, in pursuit of its national security responsibilities to monitor the activities of foreign powers and their agents, should not be unduly restrained by Congress and the courts. The removal of the "foreign power" predicate for pen register/trap and trace surveillance upsets that delicate balance.
However, The USA PATRIOT Act includes a provision prohibiting use of FISA pen register surveillance under any circumstances against a United States citizen where the investigation is conducted "solely on the basis of activities protected by the First Amendment." This exemption was not contained within the ATA, and limits to some extent the potential overreach of this expanded authority.
Access to "Any Tangible Things"
Section 215 grants the FBI the authority to request an order "requiring the production of any tangible things (including books, records, papers, documents, and other items)" relevant to an investigation of international terrorism or clandestine intelligence activities. Although the amendment is entitled "Access to Certain Business Records for Foreign Intelligence and International Terrorism Investigations," the scope of the authority is far broader and applies to any records relevant to the individual. This amendment, which overrides state library confidentiality laws, permits the FBI to compel production of business records, medical records, educational records and library records without a showing of "probable cause" (the existence of specific facts to support the belief that a crime has been committed or that the items sought are evidence of a crime). Instead, the government only needs to claim that the records may be related to an ongoing investigation related to terrorism or intelligence activities. Individuals served with a search warrant issued under FISA rules may not disclose, under penalty of law, the existance of the warrant or the facts that records were provided to the government. The final version of this provision contains an important clause -- which was not in the Administration's original bill -- restricting the potential misuse of the law. Although the USA PATRIOT Act deleted the requirement that any records requested pertain to an agent of a foreign power (or a foreign power), the Act prohibits investigation of a United States person solely on the basis of activities protected by the First Amendment. A second change from the ATA was the infusion of judicial involvement into the process. The ATA's proposed amendment would have allowed access to such records under a subpoena issued by investigators. The USA PATRIOT Act retains the requirement of pre-existing law, permitting access to records only upon court order.
Sunset Provision
The USA PATRIOT Act contains a sunset provision, terminating several of the amendments enhancing electronic surveillance authority on December 31, 2005. Because the law gives government much increased surveillance capability, a sunset is crucial to determine how well the tools work, how effective they havebeen, and how responsibly they have been applied. Of the provisions outlined above, the sunset provision does not apply to the expansion of pen register/trap and trace authority to the Internet; authority to share grand jury information; expansion of law enforcement authority over cable providers; expanded scope of subpoenas for electronic evidence; authority for delaying notice of the execution of a warrant; and expansion of jurisdictional authority of search warrants for terrorism investigations.
Additional Amendments Providing Government the Authority to Combat Terrorism
Section 205 of the Act provides for increased employment of translators by the FBI and designated five more judges to sit on the FISA Court (raising the number from seven to eleven seats on the court). These provisions are intended to increase the human intelligence capacities of the FBI and to provide additional judicial oversight of the enhanced FISA authority. Both amendments are commendable in their efforts to aid the government in preventing terrorist acts while maintaining a system checking intrusion onto citizens' civil liberties. In addition, Section 223 provides civil liability for unauthorized disclosure of information obtained through surveillance, which serves to limit misuse of communications captured through lawful surveillance.
Amendments to Immigration Laws
The Act contains significant amendments to immigration and other laws. These sections are not discussed here. For further information on such provisions, see:
- The ACLU's analysis of the immigration provisions
- The Lawyers Committee for Human Rights, analysis of the USA PATRIOT Act Immigration Provisions (Oct. 26, 2001)
Source epic.org/privacy/terrorism/usapatriot/default.html#analysis
New World Order
.jpg)
