Surveillance Provisions in USA Patriot Act

You asked about the federal Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism (USA PATRIOT) Act's surveillance provisions.

The PATRIOT Act (P.L. 107-56) broadens the government's authority to conduct electronic surveillance, searches, and other information-gathering operations. It accomplishes this primarily by amending existing provisions of (1) the Foreign Intelligence Surveillance Act (FISA), which governs foreign intelligence investigation, and (2) Title III of the Omnibus Crime Control and Safe Streets Act of 1968 (Title III) and the federal pen register statute, which regulate surveillance in criminal investigations.

Most of the act's provisions specifically relating to surveillance are contained in Title II. This title:

1. allows federal officials to use provisions in foreign intelligence law in some criminal investigations, reducing the legal standards for, and public notification about, surveillance during such investigations;

2. relaxes restrictions on sharing intercepted communications and grand jury materials among federal officials;

3. declares it lawful for broad groups of people and entities to provide otherwise-confidential information about third parties to government officials without permission;

4. prohibits direct lawsuits against the federal government for claims that federal authorities unlawfully intercepted or disclosed communications, and instead requires exhaustion of administrative procedures under the Federal Tort Claims Act; and

5. requires that disciplinary proceedings be brought against federal employees when a court or administrative agency finds surveillance law violations and serious questions about the willfulness of the employees' actions.

Some of these provisions are effective only until December 31, 2005. But the act permits them to remain in force for operations that began before this date.

OLR Report 2001-R-0770 (copy enclosed) contains an overview of Connecticut and federal electronic surveillance laws. They remain in effect except as described below.

Federal law generally requires government officials to have the following authorizations to conduct surveillance of activities occurring inside the U.S.:

1. wiretap orders for “real time” interceptions of voice and electronic communications;

2. search warrants to conduct physical searches and seize books, records, and other “tangible things;”

3. “pen register” and “trap and trace device” orders (pen/trap orders) to record telephone numbers dialed to and from a particular communications device; and

4. subpoenas to obtain records and other tangible things.

Each procedure has its own rules and legal standards set by statute, interpretations of the U.S. Constitution's Fourth Amendment (prohibiting unreasonable searches and seizures), or both. And within these approved surveillance techniques, separate rules apply for foreign intelligence and criminal operations.

Investigations conducted to gather foreign intelligence information or to protect against international terrorism or attacks by foreign powers are governed by FISA (50 USC § 1801, et seq.). Under prior law, surveillance conducted in a criminal investigation was exclusively regulated by (1) Title III (18 USC § 2510, et seq.), (2) the Electronically Stored Communications and Privacy Act (ECPA, an amendment to Title III codified at 18 USC § 2703, et seq.), or (3) the pen register statute (18 USC § 3121, et seq.).

The PATRIOT Act now permits FISA's provisions to be followed in criminal investigations where intelligence-gathering is also a “substantial purpose” of the investigation. This section of the act sunsets December 31, 2005.

FISA generally affords surveillance targets less privacy protection than the criminal surveillance laws. It permits national security interests to override the public's interest in obtaining information about the government's surveillance activities and seeking redress for unlawful interception or use of private information. As under prior law, criminal defendants can challenge the constitutionality of the government's use of evidence obtained under FISA authorizations. And people whose communications are unlawfully intercepted or disclosed can file civil lawsuits.

Increasing the Size of the FISA Court (§ 208). In general, federal officials must submit FISA applications for permission to conduct electronic surveillance to a federal district court judge assigned by the U.S. Supreme Court's chief justice to a panel handling FISA matters. (The President and U.S. attorney general can bypass this requirement if satisfied that the surveillance or search is not reasonably likely to affect “United States persons” (see definition below) and for a short time immediately after a declaration of war.) By law, FISA judges must represent at least seven of the federal courts' 12 circuits.

The act increases, from seven to 11, the number of judges the chief justice must appoint. It also requires that at least three of them live within 20 miles of the District of Columbia.

Roving Wiretaps (§ 206). This section authorizes FISA judges to include in wiretap orders a provision that any entity on which it is served (such as a telephone company or computer service provider) assist the government in carrying it out. Unlike prior law, the order need not specifically identify the entities it covers if the court determines that the target's behavior (such as frequently switching phones) may have the effect of thwarting efforts to identify specific carriers or locations. This is similar to a provision in Title III authorizing federal judges to issue roving wiretap orders in criminal investigations.

Pen/Trap Usage (§ 214). The act eliminates the federal government's authority to use pen/traps to monitor U.S. persons in conjunction with some foreign intelligence-gathering operations. But it retains this authority for international terrorism and clandestine intelligence investigations. (The latter include activities such as spying for a foreign government.)

The act eliminates a requirement that FISA pen/trap applications include factual information demonstrating a reason to believe that a particular communications device is being used (1) to communicate with a person who is engaging, or has engaged, in international terrorism or clandestine intelligence activities that involved or may involve a federal crime or (2) by a foreign power or agent (see definitions below) under circumstances suggesting that the communication concerns or concerned international terrorism or clandestine intelligence activities.

Applicants must still include a certification that the information likely to be obtained is relevant to an ongoing investigation. This is similar to the application requirements governing the use of pen/traps in criminal investigations.

As with other FISA amendments, the act specifies that a United States person's First Amendment activities cannot be the sole basis for making him an investigation target.

Expanded Business Record Access (§ 215). Under prior law, the FBI could require public transportation and lodging providers and storage or car rental facilities to turn over records in connection with foreign intelligence or international terrorism investigations. Targets were limited to foreign powers and their agents, and the court order application had to include specific and articulable facts showing that the subject of the record request held this status.

The act, instead, makes “any tangible things” of any entity subject to FISA production orders in investigations to protect against international terrorism or clandestine intelligence activities. It removes the limitation that the target be a foreign power or agent, but specifies that United States persons cannot be targeted solely because of their First Amendment activities. It also eliminates the requirement that the applicant articulate the factual basis for selecting the target.

Lengthening Surveillance Periods (§ 207). The act also lengthens the maximum periods that certain electronic surveillance and physical searches can be carried out. Under prior law, a FISA judge could authorize electronic surveillance for up to (1) one year if the target was a foreign power, faction, or entity it openly directs or controls or (2) 90 days when the target was a foreign government's agent or an entity it did not acknowledge controlling or directing. The same limitation periods applied to orders extending surveillance periods.

The act retains the one year maximum for the foreign powers described above, but now allows initial orders to remain effective for up to 120 days when the target is not a United States person and is either a foreign power's officer or employee or a member of a group engaged in international terrorism or preparing to do so. Extensions of these orders can run for up to one year.

Maximum periods for conducting physical searches (“sneak and peek” operations) of the property of a foreign power's agent are generally increased under the act from 45 to 90 days. But it sets a 120-day maximum for the same group of foreign entities described above. Each extension may be for up to one year so long as the applicant establishes probable cause that no property belonging to a U.S. person will be acquired. This is the rule that already applies to searches of a foreign power's property.

In addition to permitting the use of FISA procedures in criminal investigations in which foreign intelligence-gathering is also a substantial purpose, the PATRIOT Act streamlines Title III, ECPA, and pen register procedures, in some cases requiring a local court's order to be given nationwide effect.

Predicate Offenses for Wiretaps (§§ 201 and 202). Title III governs the use of electronic surveillance devices to intercept conversations (face-to-face and over the phone) and electronic communications (non-voice transmissions such as e-mails and fax transmissions). By law, courts can issue Title III orders to intercept electronic communications in conjunction with any federal investigation, but can issue oral or phone tap orders only for “specifically enumerated” federal crimes.

1. the chemical weapons law (18 USC § 229) or

2. international or domestic terrorism laws (18 USC §§ 2332, 2332a, 2332b, 2332d, 2339A, or 2339B (these laws are established or amended under other sections of the act; see OLR Report 2001-R-0851)).

The act also permits wiretaps to intercept wire communications in conjunction with any felony violation of the federal Computer Fraud and Abuse Act (18 USC § 1030). Conspiracies and attempts to violate the above laws are also predicate offenses.

Search Warrants for Terrorism Investigations (§ 219). This section amends the Federal Rules of Criminal Procedure, permitting U.S. magistrates “in any district in which domestic or international terrorism may have occurred” to issue warrants authorizing property searches and seizures within or outside their district. This was allowed under prior law only if the search warrant applicant showed that the property subject to the warrant was likely to be removed from the court's jurisdiction before the warrant could be executed.

Nationwide Service of Search Warrants for Electronic Evidence (§ 220). This section permits a U.S. magistrate or district or appellate court judge to issue search warrants for stored voice or e-mail messages or customer records “using the procedures described in the Federal Rules of Criminal Procedure.” The issuing court must have jurisdiction over the offense being investigated (this can be any federal crime), and, in the case of terrorism investigations, its order may be enforced throughout the United States.

Criminal Warrants to Seize Stored Voice-Mail (§ 209). This section eliminates the requirement that law enforcement officials meet the heightened Title III standards to obtain unopened voice-mail messages that a communications provider has placed in electronic storage. Instead, it makes them subject to the same standard as applies to stored e-mail messages.

This permits governmental access to such messages in connection with any criminal investigation, rather than only those specifically enumerated in Title III. And under the new provisions, rather than obtain a Title III order, investigators may use a search warrant to obtain messages that have been stored 120 days or less. After that time, they may use an administrative, grand jury, or trial subpoena (if the law permits them to be used for this purpose) or a court order based on an articulable showing that the information is relevant to an ongoing investigation.

Criminal Pen/Trap Usage (§ 216). This section updates the pen/trap statute to reflect changes in communications technology. It adds language authorizing the use of such devices to monitor computer and other digital transmissions. When a target's communications are monitored, the act permits the device to record “routing” and “addressing” information, and specifies that this does not include the “contents” of any wire or electronic communications. It does not define these terms.

It also permits federal judges and U.S. magistrates to issue ex parte orders authorizing the installation and use of pen/traps anywhere within the U.S. when the U.S. attorney filing the application certifies that the information likely to be obtained is relevant to an ongoing criminal investigation. The authorizing court must have jurisdiction over the investigation of the underlying offense.

Such orders may be served on and apply to any person or wire or electronic communication service provider in the U.S. whose assistance may facilitate its execution. The attorney or official serving the order must give a written or electronic certification that the order applies to the entity served, if the provider requests it.

Under prior law, courts could authorize the use of such devices only within their territorial jurisdiction, and generally were required to identify by name the providers who had to provide assistance. The act retains these limits for pen/trap orders issued by state court judges.

The section also specifically authorizes court orders that permit law enforcement agencies to install their own pen/trap monitoring devices on a service provider's “packet-switched” data network (e.g., computer or digital phone lines). This authority allows the installation of devices such as the FBI's “Carnivore” (now known as “DCS 1000”), which permit agents to monitor transmissions along a provider's network from FBI field offices. The act requires that, when this is done, law enforcement must provide the issuing court sealed records showing who installed and used the device, the filter settings used, and the information it recorded. If the device can be set to keep track of this information automatically, this feature must be used.

Electronically Stored Records (§ 210). This section broadens the information about customers or subscribers that an electronic communications or remote computing service provider must disclose when served with a court order, search warrant, or legal subpoena. In addition to names, addresses, phone numbers, and length and types of service (which were already required) the act requires:

1. local and long distance telephone connection records or records of session times and durations;

2. the subscriber number or identity of the target, including any “temporarily assigned network address;” and

3. means and source of payment for such services, including credit card or bank account numbers.

The act does not define “temporarily assigned network address,” but the Department of Justice's field guidance states that these include the Internet Protocol (IP) address the provider assigns to the customer for a particular session as well as the remote IP address from which a customer connects to the provider.

Cable Act Amendment (§ 211). This section amends the law limiting a cable company's ability to disclose personally identifiable information about customers without their consent. (Cable companies include not only those offering traditional programming services but also those that offer Internet access and telephone service using cable connections.) Under prior law, a cable company could not provide criminal investigators access to subscriber records without giving the customer advance notice, a court hearing if he objected to disclosure, and a judge's ruling that the government presented clear and convincing evidence that the customer was reasonably suspected of engaging in criminal activity.

The act instead permits these companies to disclose records to investigators or prosecutors if authorized by Title III, ECPA, or the pen register statute. But it prohibits them from revealing the video programming the subscriber selected.

Delaying Notice of the Execution of a Search Warrant—“Sneak And Peak” (§ 213). This section authorizes courts to delay notifying the target of a criminal investigation as soon as a court-ordered search has been completed. They may do this when the issuing judge finds reasonable cause that providing immediate notification of the warrant's execution may have an adverse result. By law, “adverse results” include endangering a person's health or safety, seriously jeopardizing an investigation, permitting a suspect to flee from prosecution, evidence tampering, and unduly delaying trials. Delayed notification must be for a “reasonable period,” which the judge may extend for good cause. Under the act, warrants authorizing delayed notice must prohibit seizures of property, communications, or electronically stored materials (except as permitted by ECPA), unless the court finds “reasonable necessity” for the seizure.

Court decisions interpreted prior law as requiring officials to give the target notice of a search warrant's execution in a “reasonable time” and judges decided what was reasonable in light of the facts of specific cases that came before them. It is unclear how the new provisions alter this standard.

This section permits officials “acting under color of law” (i.e., working for federal, state, or local governments) to intercept a computer trespasser's electronic communications. “Computer trespassers” are defined as people who gain access to a “protected computer” (computers linked to the Internet and all bank and federal government computers) without authorization.

The protected computer's owner must give permission and the intercepting official must be lawfully engaged in an investigation (either criminal or intelligence-gathering) and have reasonable grounds to believe that the contents of the communication will be relevant to the investigation. This procedure can be used only if it is possible to avoid intercepting any transmission that is not going to or from the trespasser.

Under prior law, it appears that the protected computer's owner could report the crime, but could be sued for disclosing any more information to the police without the appropriate court order or other legal authorization.

Section 203 relaxes prior confidentiality and restricted-use laws, permitting government officials, communications providers, and private parties to share foreign intelligence or counterintelligence information with federal officials in more situations. It incorporates statutory definitions for these terms from the National Security Act of 1947 and a modified version of FISA's definition of “foreign intelligence information” (see definitions below). The act's information-sharing provisions appear to substitute attorney general guidelines for judicial oversight over dissemination of information acquired through secret grand jury and criminal investigation surveillance activities.

Grand Jury Disclosures (Subsection (a)). The act creates an exception to the general rule requiring court permission to disclose federal grand jury materials to entities other than other federal grand juries or certain law enforcement officials. It does this by allowing disclosures to certain federal officials when the materials involve foreign intelligence, counterintelligence, or foreign intelligence information.

Those authorized to receive such information under the act are all other federal law enforcement, intelligence, protective, immigration, national defense, or national security officials. The purpose of the disclosure is to assist them in the performance of their official duties. They may use the information only as necessary in the conduct of their official duties, “subject to any limitations on the unauthorized disclosure of such information.”

A U.S. attorney must file a court notice under seal within a reasonable time after information has been shared stating that this occurred and identifying the departments, agencies, or entities that received the information.

Title III Disclosures (Subsection (b)). Another provision amends Title III's disclosure and use provisions by giving law enforcement officials, investigators, and U.S. attorneys the authority to share foreign intelligence information if they learn of it while engaged in operations authorized by Title III. It specifies the same federal officials to whom disclosures may be made and the use to which the information may be put, but it does not require that those disclosing information notify the target or court.

Prior law authorized disclosures only when they constituted evidence of independent crimes. In those cases, the intercepting party could share information with other law enforcement personnel when appropriate for the conduct of their official duties.

Attorney General to Establish Procedures (Subsection (c)). The act requires the U.S. attorney general to establish procedures for the disclosure of the above-described information when it identifies a United States person.

Foreign Intelligence Information (Subsection (d)). Finally, this section appears to override other confidentiality laws, by making it lawful for people to disclose foreign intelligence, counterintelligence, or “foreign intelligence information” to any federal law enforcement, intelligence, protective, immigration, national defense, or national security official in order to assist the official receiving that information perform his official duties. It directs any federal official who receives this information to use it only as necessary in the conduct of that person's official duties, “subject to any limitations on the unauthorized disclosure of such information.”

ECPA Disclosures (§ 212). This section expands the authority of electronic communications and remote computing service providers to voluntarily share information or records with law enforcement personnel. It permits providers to disclose to law enforcement either officials non-content information (e.g., address and routing information) or the content of records in emergencies when any person is in risk of death or serious physical injury. It specifies that this does not impose a duty on providers to monitor or search customer records or messages for this purpose. It also authorizes them to disclose otherwise-confidential records “to protect their rights and property.”

Prior law contained no exception from civil liability provisions for such disclosures.

This section alters the procedure for suing the federal government for damages when it unlawfully intercepts or discloses an aggrieved person's communications. The act makes the government liable only for willful or intentional violations and requires aggrieved parties to first present their claims to the offending agency using Federal Tort Claims Act procedures. If the agency denies the claim, the injured party can file suit in federal court and a judge may award him (1) the greater of actual damages or $10,000 and (2) reasonable litigation costs.

The section also includes provisions allowing the court to restrict disclosure of FISA materials for national security reasons and requiring lawsuits to be stayed when disclosing surveillance operations could adversely affect an ongoing, related investigation.

It also requires agencies to conduct internal investigations and hold disciplinary hearings whenever a court, department, or agency determines that the U.S. or any of its agencies violated the surveillance laws and the surrounding circumstances raise serious questions about whether a U.S. officer or employee acted willfully. If such investigation or hearing does not result in discipline, the agency head must provide an explanation to the U.S. Inspector General's Office.

Under prior law, those claiming to be aggrieved by unlawful surveillance or disclosures could go directly to court. The act apparently does not alter this rule where the claim seeks damages for willful violations committed by specific federal officials, state agencies and officials, or from communications providers.

This section specifies that the act does not impose any additional technical obligations or requirements on wire or electronic communications providers or others to furnish facilities or assistance.

The PATRIOT Act uses existing statutory definitions of foreign intelligence and counterintelligence. In some sections, it uses the existing FISA definition of “foreign intelligence information,” but for information sharing purposes, it re-defines this term.

“Foreign intelligence” means information relating to the capabilities, intentions, or activities of foreign governments or their elements, foreign organizations, or foreign persons. “Counterintelligence” is information gathered and activities conducted to protect against espionage, other intelligence activities, sabotage, or assassinations conducted by or on behalf of foreign governments or their elements, foreign organizations or people, or international terrorist activities (50 USC §§ 401a(2) and (3)).

“Foreign intelligence information,” for information sharing purposes, is defined as information, whether or not concerning a United States person, that relates to the ability of the United States to protect against:

1. actual or potential attack or other grave hostile acts of a foreign power or an agent of a foreign power;

2. sabotage or international terrorism by a foreign power or an agent of a foreign power;

3. clandestine intelligence activities by an intelligence service or network of a foreign power or by an agent of a foreign power; or

4. information, whether or not concerning a United States person, with respect to a foreign power or foreign territory that relates to (a) the national defense or the security of the United States or (b) the conduct of affairs of the United States (§ 203).

By law, “United States persons” are citizens, permanent residents, businesses incorporated in the U.S. with a substantial number of U.S. employees, and unincorporated associations to which a substantial number of U.S. citizens, businesses, or permanent residents belong. “Foreign powers” are (1) foreign governments and components, (2) national or multi-national government factions and foreign-based political organizations, (3) entities directed and controlled by foreign governments, and (4) groups engaged in international terrorism or preparing to do so.

“Agents of foreign powers” are (1) non-U.S. persons acting in the U.S. as a foreign power's officer or employee or present in the U.S. under circumstances indicating that they may engage in clandestine intelligence activities contrary to U.S. interests or aid or conspire with someone else to do so and (2) any person who knowingly engages in (a) clandestine intelligence activities at the direction and on behalf of a foreign power which involves or may involve a crime; (b) sabotage or international terrorism or preparations; (c) using fraudulent documents to enter the United States on behalf of a foreign power or assuming a false identity in the United States on behalf of such power; and (d) aiding, abetting, or conspiring with someone to do any of the above.

This definition differs from FISA's general definition. That law regulates electronic surveillance of the same entities and for the purposes described above, but restricts such activities where interceptions may involve the communications of United States persons. In those situations, information that identifies a United States person may be gathered and shared only if necessary to the United States' ability to carry out activities authorized by FISA (18 USC § 1801(e)).

FISA judges must review and approve the government's proposed plan to minimize the acquisition and dissemination of information relating to United States persons in FISA surveillance orders. Under the act, attorney general guidelines govern the dissemination of this information when gathered in criminal investigations.


November 30, 2001		2001-R-0871
SURVEILLANCE PROVISIONS IN USA PATRIOT ACT

By: Susan Price-Livingston, Associate Attorney