Think you're getting the straight facts when you turn on the news?
Find out how industrial agribusiness threatens your health and safety
Bush and Big Business
The truth about Bush's special interest agenda, and the big businesses he serves
Whats In Your Water?
The EPA has identified over 800 pollutants in our waters! Do you know what is in your water?
EFF Analysis of the Provisions of the Patriot Act
The Electronic Frontier Foundation
October 27, 2003
On October 26, 2001, President Bush signed the USA PATRIOT Act
(PATRIOT) into law. PATRIOT gave sweeping new powers to both domestic law enforcement
and international intelligence agencies and eliminated the checks and balances
that previously gave courts the opportunity to ensure that such powers were not
abused. Most of these checks and balances were put into place after previous
misuse of surveillance powers by these agencies were uncovered including the
revelation in 1974 that the FBI and foreign intelligence agencies had spied on
over 10,000 U.S. citizens, including Martin Luther King.
A Rush Job
The bill is 342 pages long and makes changes, some large and
some small, to over 15 different statutes. This document provides explanation
and some analysis to the sections of the bill relating to online activities and
surveillance. Other sections, including those devoted to money laundering, immigration
and providing for the victims of terrorism, are not discussed here.
Yet even just considering the surveillance and online
provisions of PATRIOT, it is a large and complex law that had over four
different names and several versions in the five weeks between the introduction
of its first predecessor and its final passage into law. While containing some
sections that seem appropriate -- providing for victims of the September 11
attacks, increasing translation facilities and increasing forensic cybercrime
capabilities -- it seems clear that the vast majority of the sections included
were not carefully studied by Congress, nor was sufficient time taken to debate
it or to hear testimony from experts outside of law enforcement in the fields
where it makes major changes. This concern is amplified because several of the
key procedural processes applicable to any other proposed laws, including
inter-agency review, the normal committee and hearing processes and thorough
voting, were suspended for this bill.
Were our Freedoms the Problem?
The civil liberties of ordinary Americans have taken a
tremendous blow with this law, especially the right to privacy in our online
communications and activities. Yet there is no evidence that our previous civil
liberties posed a barrier to the effective tracking or prosecution of
terrorists. In fact, in asking for these broad new powers, the government made
no showing that the previous powers of law enforcement and intelligence
agencies to spy on U.S. citizens were insufficient to allow them to investigate
and prosecute acts of terrorism. The process leading to the passage of the bill
did little to ease these concerns. To the contrary, they are amplified by the
inclusion of so many provisions that, instead of being aimed at terrorism, are
aimed at nonviolent, domestic crime. In addition, although many of the
provisions facially appear aimed at terrorism, the Government made no showing
that the reasons they failed to detect the planning of the recent attacks or
any other terrorist attacks were the civil liberties compromised with the
passage of PATRIOT.
The EFF's chief concerns with PATRIOT include:
- Expanded Surveillance With Reduced
Checks and Balances. PATRIOT expands all
four traditional tools of surveillance used by law enforcement --
wiretaps, search warrants, pen/trap orders and subpoenas. Their
counterparts under the Foreign Intelligence Surveillance Act (FISA) that
allow spying in the U.S. by foreign intelligence agencies have similarly
been expanded. This means:
- Be careful what you read on the
Internet. The government may now monitor
the online activities of innocent Americans, and perhaps even track what
Web sites you read, by merely telling a judge anywhere in the U.S. that
the spying could lead to information that is "relevant" to an
ongoing criminal investigation. The person spied on does not have to be
the target of the investigation. This application must be granted and the
government is not obligated to report to the court or tell the person
spied upon what it has done.
- Nationwide roving wiretaps.
FBI and CIA can now go from phone to phone, computer to computer
without demonstrating that each is being used by a suspect or target of
an order, or even specifically identifying the person targeted. The
government may now serve a single Title III wiretap, FISA wiretap or
pen/trap order on any person or entity nationwide, regardless of whether
that person or entity is named in the order. The government need not make
any showing to a court that the particular information or communication
to be acquired is relevant to a criminal investigation. In the pen/trap
or FISA situations, they do not even have to report where they served the
order or what information they received. The EFF believes that the
opportunities for abuse of these broad new powers are immense. For
pen/trap orders, while ISPs or others who are not specifically named in
the order do have the legal right to request certification from the
Attorney General's office that the order applies to them, they have no
right to request such confirmation from a court.
- ISPs hand over more user
information. The law makes two changes to
increase how much information the government may obtain about users from
their ISPs or others who handle or store their online communications.
First it allows ISPs to voluntarily hand over all "non-content"
information to law enforcement with no need for any court order or
subpoena. 212. Second, it expands the records that the government may
seek with a simple subpoena (no court review required) to include records
of session times and durations, temporarily assigned network (I.P.)
addresses, and means and source of payments, including credit card or
bank account numbers. 210, 211.
- New definitions of terrorism expand
scope of surveillance. One new definition
of terrorism and three expansions of previous definitions also expand the
scope of surveillance. PATRIOT 802's definition of "domestic
terrorism" (amending 18 USC 2331) raises concerns about legitimate
protest activity being prosecuted as terrorism, especially if violence
erupts, while additions to three existing definitions of terrorism (int'l
terrorism per 18 USC 2331, terrorism transcending national borders per
18 USC 2332b, and federal terrorism per amended 18 USC 2332b(g)(5)(B))
expose more people to surveillance (and potential "harboring"
and "material support" liability, 803, 805).
- Overbreadth with a lack of focus on
terrorism. Several provisions of PATRIOT
have no apparent connection to preventing terrorism. These include:
- Government spying on suspected
computer trespassers with no need for court order.
- Adding samples to DNA database for
those convicted of "any crime of violence."
503. This provision allows collection of DNA for terrorists,
but then inexplicably also allows collection for the broad, non-terrorist
category of "any crime of violence."
- Wiretaps now allowed for suspected
violations of the Computer Fraud and Abuse Act.
This includes anyone suspected of exceeding authorized access to
a computer used in interstate commerce and thereby causing over $5000
worth of combined damage.
- Dramatic increases to the scope and
penalties of the Computer Fraud and Abuse Act.
These include: 1) raising the maximum penalty for violations to
10 years (from 5) for a first offense and 20 years (from 10) for a second
offense; 2) ensuring that violators only need to intend to cause damage
generally, not intend to cause damage or other specified harm over the
$5,000 statutory damage threshold; 3) allowing aggregation of damages to
different computers over a year to reach the $5,000 threshold; 4)
enhancing punishment for violations involving any (not just $5,000)
damage to a government computer involved in criminal justice or the
military; 5) including damage to foreign computers involved in U.S.
interstate commerce; 6) including state law offenses as priors for
sentencing; 7) expanding the definition of loss to expressly include time
spent on investigation, response, damage assessment and restoration.
- Allows Americans to be More Easily
Spied Upon by U.S. Foreign Intelligence Agencies.
Just as the domestic law enforcement surveillance powers have
expanded, the corollary powers under the Foreign Intelligence Surveillance
Act have also been greatly expanded, including:
- General Expansion of FISA
Authority. FISA authority to spy on
Americans or foreign persons in the U.S. (and those who communicate with
them) increased from situations where obtaining foreign intelligence
information is "the" purpose of the surveillance to anytime
that it is "a significant purpose" of the surveillance.
- Increased information sharing
between domestic law enforcement and intelligence.
This is a partial repeal of the wall put up in the 1970s after
the discovery that the FBI and CIA had been conducting investigations on
over half a million Americans during the McCarthy era and afterwards,
including the pervasive surveillance of Martin Luther King in the 1960s.
It allows wiretap results, grand jury information and other evidence collected
in a criminal case to be disclosed to the intelligence agencies when the
information constitutes foreign intelligence information.
- FISA detour around federal domestic
surveillance limitations; domestic detour around FISA limitations.
Domestic surveillance limits can be skirted by the Attorney
General, for instance, by obtaining a FISA wiretap against a U.S. person
where "probable cause" does not exist, but when the person is
suspected to be an agent of a foreign government. The information can
then be shared with the FBI. The reverse is also true.
The EFF urges the following:
- That law enforcement and the intelligence
agencies use these new powers carefully and limit their use to bona fide
investigations into acts of terrorism.
- That the courts appropriately punish those
who misuse these new laws and that Congress reexamine its decision to
grant such broad, unchecked powers.
- That if these laws are misused to harm the
rights of ordinary Americans involved in low-level crimes unrelated to
terrorism, the courts refuse to allow evidence collected through use of
these broad powers to be used in prosecuting them.
That ISPs and others served with
"roving" wiretaps and other Orders that do not specify them as
recipients require the Attorney General to certify that the order properly
applies to them.
That Congress require the law enforcement
and intelligence agencies who operate under provisions of PATRIOT that are
set to expire in December, 2005, to provide it with comprehensive reports
about the use of these new powers, so as enable Congress to reasonably
determine whether these provisions should be renewed.
- That the many vague, undefined terms in
PATRIOT be defined in a manner that protects the civil liberties and
privacy of Americans.