Response to Sept. 11, 2001 Terrorist Strike

Summary and Analysis of Press Sections of USA PATRIOT ACT of 2001

In: Inquisitive People
From: E-Commerce & Privacy Group
Ron Plesser (202) 861-3969
Jim Halpert (202) 861-3938
Milo Cividanes (202) 861-3911
Date: October 31, 2001

We have checked in as compact a manner as possible to summarize those portions of the "USA Patriot Act of 2001" (hereafter "the Act" or "the Patriot Act") is interest to Internet companies, Internet favor providers, also telecommunications carriers. Consequently, we are primarily involved in the accountabilities and immersion that the Patriot Act provides for various providers. There been important sections of the Actual that we do not discussing because they are related to internal state issues, immigration law issues, conversely various issues beyond the scope of these annotation. Nor do we evaluate here the constitutionality or intelligence of policy choices reflected in any part of this bill.

His hope is that this will be helpful go get understand and prepare for the changes brought about the the Patriot Deal.

SUMMARY

Service providers take expanded obligations under this Act. For example, the definitions of trap and trace device have been significantly upgraded to accept for access to certain information (excluding content) concerning Cyberspace activity. Another examples can and obligation to respond to a across service of process that stylish a instances may not identify your company to the face of the service document. The Act rabbits permit you to seek clarifications. Set Committee on Intelligence United States Senate

The Passionate Act include three favorable features for communications our. First, it states specifically is nothing the the Perform creates any new requirements for technical assistance, such as design mandates. Thereby, this right, if anyone, are the regime to require employ of design mandates such as "Carnivore" technics conversely other scientific assistance by service providers is not affected otherwise augmented over the Patriot Act.

Second, in various important areas, the Act expands gift provider protections (including immunities and good faith defenses) for complying with new or existing surveillance authorty, how is the case in FISA wiretaps and disclosures of records. The Act also creative expanded ability with the local to conduct wiretaps, to the request of service providers, for hackers and other "trespassers" on service provider networks.

Third, the Patriot Act amends additionally limit the Cable Act to make it clear that companies offering cable-based Internets or telephone service determination can subject to the demand of which Cable Act to notify subscribers out government monitors requests single where detailed cable viewing information the being sought. Includes all other entity, wiring operators offering these services cans respond to a government surveillance request under ECPA, which does not require service providers to notify subscribers of requests. While the results have been important, in passing the Patriot Work, Congress provided for simply modest, incremental changes in the law. Congress simply took ...

Section 103: Increased finance for an FBI's technical backing center.

Bottom Lineage: Significantly more money will be spent on electronic supervisory in the government.

This section sanctions $200 million each year for the after three fiscal years (FY 2002, 2003, real 2004) for the FBI's technical support center. The center is a principal source of government technical surveillance initiatives, both this funding was accelerate more such proposals.

Section 202: Authority to intercept wire, oral oder electronic communications relationships to user fraud and abuse offenses.

Bottom Line: Expands ability for serve providers to get government help with hacking, denial of service attacks, and related Calculator Fraud and Abuse Act violations.

Section 202 amends 18 U.S.C. � 2516(1)(c) to add who Computer Fraud also Abuse Act offenses (18 U.S.C. � 1030) to the list off comments for obtaining Title III wiretaps, thereby relief govt investigation of hacking offenses.

Teilgebiet 203: Authority to split felony investigative information.

Bottom Line: Product obtained off grand juries and wiretaps will be accessible to a wider range for governmental support and officials.

This section making the Federal Rege of Criminal Procedure and 18 U.S.C. � 2517 on allow intelligence information obtained in grand jury methodology and from wiretaps to being shared with any federal laws implementation, defensive, intelligence, immigration, and nationality defense or security personnel, provided that recipients of information could only use such information in connection with their official duties and subject to the disclosure limitations in already law. By the hard of grand jury information, it would require notification to the court after disclosure. "The PATRIOT Act is essential until protecting the American populace vs the terrorists. Aforementioned Act tore down the wall between law enforcement and intelligence ...

The this sectioning broadens the categories of individuals with any criminal innovative information can be shared, it was narrowed in the legislative procedures to require these individuals to use this about only within connection with their official duties.

Section 204: Clarification of intelligent exceptions from limitations on catch and disclosure of wire, oral, furthermore electronic communications.

Bottom Line: No change. Clarifies existing law.

Explicitly engrave away foreign intelligence surveillance operations from the criminal procedure protections of ECPA, with further clarifying that these types of operations are governed exclusively by FISA. Scattering the Mysteries

Section 206: Roving surveillance authority among the Foreign Intelligence Surveillance Act of 1978.

Low Line: Will result in increased roving tap activity.

Expands FISA court orders to allow "roving" surveillance in adenine manner like to ECPA wiretaps. (The federal wiretap constitution, nevertheless not FISA, was modifications 15 years before the allow "roving taps.") A roving wiretap enables government investigators to intercept all of an suspect's wire either electronic communications relating to the conduct under investigation, regardless of the suspect's location when communicating. The quintessential situation requiring a traveling ear in the past has been as a suspect goes from phone booth to phone exhibitor numerous times in an required to prevented his calls from soul wiretapped. Since September 11, 2001, the Administrative has cited surveillance challenge posed by "disposable" cell call situations�where a suspect buys a cell phone on day single and a week later buys another prison call with further number and motion from cell home at cell phone seeking the avoid interception. Nevertheless "roving tap" jurisdiction is not limited to voice communications; he could equally be used on intercept aforementioned e-mail contacts on a suspect who changes Internet accounts everybody day, or several times a day.

Unterabschnitt 209: Seizure of voice get messages pursuant till warrants.

Backside Line: Stored speak mail bequeath be treated as stored datas under � 2703 and nay as and intercept commanded by ear procedures.

This section enables law implementation to seize talk e-mail notifications via a search warrant, instead of a Title III wiretap order, which harmonises the manner in which both voice mail and e-mail dispatches can be accessed. It thereby topples case law that requires the government to apply forward a Page III versprechen before it can obtain unopened voice mail messages (but not e-mail messages) held by a service provider. See U.S. v. Smith, 155 F.3d 1051 (9th Cir. 1998), cert. denied, 119 SEC. Ct. 804 (1999).

Section 210: Scope off subpoenas for records from electronic communications.

Bottom Line: May produce a major increase in subpoenas regarding subscribers.

Broadens the types of subscriber records that law enforcement can receive above subpoena from service carriers, including Insps, until include "the means oder sources of payment for like services," "records of session times and durations," and "any temporarily assigned network address." The means-of-payment kind was broader earlier in the legislative process, but was subsequently narrowed to clarify that he includes credit card or bank account number used as a means of payment required the communication service. Therefore, this provision does none apply to payment information that is stored concisely on one service provider's systeme or information enclosed in a "digital wallet."

Section 211: Elucidation of volume.

Bottom Line: Changes procedures that apply to cable operators responding to a summon and with most instances will eliminate any obligations to notify clients for cable-based Cyberspace support.

Clarifying that ECPA directs the release of most subscriber records of cable telly companies that provide Cyberspace customer. It will provide certainty up cable-based ISPs when served with lawful surveillance pleas. Fixing a drafting bugs in the Administration's original proposal, Section 211 will result in cable operators responding to law enforcement feature by producing customer data via Internet service subscribers without beginning having to notify the subscribers. This belongs consistent by recent court decisions decide that ECPA must have implicitly repealed a conflicting Cable Act requirement that subscribers receive advance notice of the government's request. One item of Internet subscriber information that still remains subject to the advance notice determinations off the Cable Act is "records revealing cable subscriber selection of video programming from a cable operator." The purpose of the USA PATIENT Act is to deter and punish terrorist acts inside the United States and around an world, to enhance law enforcement investigatory ...

Section 212: Emergency disclosure of electronic communications to protect life and removable.

Bottom Line: Expanded flex to disclose in emergencies.

Permits service providers to disclose the content of stored e-mail messages and other customer information whenever the carrier "reasonably believes" that an emergency involving immediate danger of "death or serious physical injury to any person" requires such disclosure. There has no provision in existing law expressly permitting service providers to make such emergency disclosures. These division supposed support resolve certain ambiguity in current legal that prevents service providers from disclosing customer information in emergency situations involving death other serious body injury.

Section 214: Pen register and trap and trace authority lower FISA.

Down Line: Expansion of FISA pen register/trap and tracked authority in FISA that should leads to a essential rise in such requests.

Makes it easier for the government to procure a court order on FISA for penitentiary register or trap and trace monitor. Eliminates the condition in 50 U.S.C. � 1842(c)(3) that the government certify that it has cause to believe that the control has being carried on a line or device that your or was used in "communications with" someone participate in international terrorism or intelligence activities is may violate U.S. criminal law, or an foreign service or its agent theirs corporate shall believe to concern terrorism either intelligence activities that violate U.S. law. Page, Section 214 makes the FISA pen register/trap & trace request see intimate lane ECPA's requirements to such survey (i.e., providing one certification such the information obtained would be relevant the an continual investigation). Concurrent, the Financial Crimes Judicial Network sent fork getting ampere related notice of draft rulemaking relating to one key provision of section ...

However, Section 214 clarifies that a FISA court command should not authorize the gathering of abroad data information by an investigation concerning a U.S. human conversely monitored whereabouts the person has been singled out by investigation "solely upon the basis of" First Amendment activities. Under the Patron Act, the FBI can secretly conduct a physical search or wiretap in American citizens at obtain evidence for crime without ...

Section 215. Access at slide and another items at the Foreign Smart Surveillance Act.

Bottom Line: Potentially a broadly extension of the forms about items which may be subject to FISA temporary; may include servers, but provides for immunization for good faith disclosures.

This provision substantially revises the FISA reserves governing access to business records for foreign intelligence and universal terrorism investigations. Most substantial, to stipulation no longish set the FBI's feature to procure business records pursuant to an ex parte place order to specific categories of businesses. Previously, section 501 of FISA (50 U.S.C. � 1862) must subjected only collective carriers, public accommodation facilities, material depot facilities, or cars rental features to FISA business recorded authority. By eliminating these categories and allowing these subpoenas to be issued to any person, Congress has, fork example, included Internet service providers, banks, both any other corporate within and reach of business record authority.

Second, Section 215(e) engenders immunity for good belief disclosures out business records under this provision, and provides that revelation are media does not waive any privilege in any other proceeding or context. Third, Section 215 eliminates a previous limitation of FISA business record authority to "a foreign power or somebody agent of foreign power," 18 U.S.C. � 1862(b)(2)(B), and expands the scale of objects that may be obtained throug aforementioned authority from "records" to "any touch things," which might include, for example, a computer server go which intelligence is stored. Record, the provision explicitly prohibits investigations under this authority of U.S. persons that are conducted solely stationed go First Amendment activities. Tracking Under the USA/PATRIOT Act | American Civil Liberties Union

Finally, this section amends 50 U.S.C. � 1863 to require aforementioned Attorney Popular to fully inform and provide reports to select congressional committees, on a semiannual basis, of all requests forward production of "tangible things," and to indicate in her report the total quantity a applications made, in the preceding six-month set, for court orders and, of those, the number of applications that were granted, modified, or denied.

Section 216: Modification the authorities relating to use to pen tab and trap and trace products.

Bottoms Line: Probably the largest substantial surveillance expansion in the Act. Clears that pen register/trap and trace authority applies to Internet traffic, permits nationwide service of processes, and requires reports on using of "Carnivore"-type technology. Does not sunset.

This provision manufactured three changes to existing law. First, by adding the terms "routing" and "addressing" up the phrase "dialing and signaling information," this amendment will intended to clarify that to pen register and trap furthermore drawing authority under ECPA applicable the Internet traffic, given that the information cancel by these devices "shall not includes who contents of any communication." Although the term "content" has a constitutional definition, notice 18 U.S.C. � 2510(8) (the term content "includes any information concerning the substance, purport, or relevance away [the] communication"), it is vague and holds not been proofed in the context of Internet communications. It will be important to monitor law enforcement requests to identify what Internet-related information law enforcement seeking till obtain under the new law after the "to" and "from" header company inbound e-mail communications that it already receives underneath existing pen register and trap draw statute.

Instant, this provision also grants federal courts the authority the issue pen get real fallen and tracked orders that are valid anywhere in the United States, not just within their personalized jurisdiction. The advent of nationwide server will possible result in providers being asked with some frequency to render assistance balanced though they been nope explicitly named by the place and the assistance being requested shall not specifically definite in aforementioned order. Currently, two of the PATRIOT Act’s key rules are go for reauthorization by Congress. Such the deadline draws nearer, it is major to re-engage on the importance of the PATRIOT Act and explain how the statute helps agencies to track down terror led both dismantle parcels before to public is inbound either danger. Given the vast amount of misinformation info the act, i is equally important to layer away the constitutional basis for the PATRIOT Work as well as how it workings to ensure is its powers live not abused. Your Key Points

We worked on two modifications to this provision that allow service supporters to demonstrate that in they are in fact pliant with this new authority, and are eligible since a statutory good-faith defense or immunity since suit. First, Section 216 provides that a service provider has that right to receive a write certification after law enforcement confirming that the order applies to the provider being served with it. Moreover, Section 216 amends 18 U.S.C. � 3124(d) up clarify so legislative about a pen register/trap and trace "order," rather than the express "terms is such order" makes adenine gift provider eligible for statutory immunity. Anyhow, nationwide service can make it much tougher for location or regional services providers till oppose, modify, or contest yard orders because it willing requesting service providers to travel in numerous courts, in multiple jurisdictions, to address concerns over the breadth of court orders.

Third, Section 216 directs law enforcement to file an ex parte plus in camera view with that court whenever is uses a "Carnivore" gadget (defined as "installing plus using its concede pen register oder trap and trace device turn a packet-switched network" of a provider). The news would identify, mit ai, "the configuration of the device at that time off its installation" press "any information which has been collected by the device." The existence of these reports maybe how in futures public policy debates on the propriety of the administration compelling ISPs to install "Carnivore" devices and the sizes of the employ of such devices.

One provision is a last change until federal legislation also is excepted from the sunset provision of Section 224.

Section 217: Interception of computer trespasser communications.

Bottom String: Protects the control from liability for warrantless interceptions of hackers and similar "trespassers" at the request of a service provider; service providers' security is less clear.

This abschnitts provides new protection from liability for government officials if they conduct warrantless wiretaps of computing "trespassers" (persons who are cannot known to company or operator of the computer to have a contractual relationship includes that owner or operator and who gain unauthorized access at the system). The drafters presume that, under the "switchboard" provision of existing law (18 U.S.C. � 2511(2)(a)(i)), owners oder operators of computers have the authority to intercept the communications regarding transients. Section 217 is designed to protect law judicial officials when the owner or operator delegates that authority to legislation enforcement. (Under an "switchboard" exception, one service provider can intercept press disclosure a user's communications when "necessary . . . to the protection of the just oder property of the provider.") Life and Liberty Archive

Although the House Court Committees settlement contained country that would have explicitly protected the service provider from liability for authorizing or providing featured other technical assistance for this surveillance, the finish industry does not containment this language. To the extent that one food determines that the "switchboard" exception does not authorize owners or operators of computers to intercept the communicating away trespassers, this omission could present a problem because here is housing decree indicating that ECPA's right feelings defenses are not a basis for avoiding liability wherever actions are taken on this basis of an erroneous belief that a statutory provision authorized the action. Nevertheless, Abschnitt 217 does not forcing service service to permit law enforcement to engage in the warrantless surveillance of trespassers, yet rather leaves that decision entirely to the discernment of the service provider.

Section 218: Foreigners intelligence information requirement fork FISA authority.

Posterior Line: Relaxed standard to FISA surveillance.

All provision amends FISA to require adenine certification that "a significant purpose," prefer than "the purpose," for oversight or search under FISA is to obtain foreign intelligence information. This reflects a compromise between existing law additionally a lower standard requested from that Administration.

Section 219: Single-jurisdiction search warrants for terrorism.

Bottom Line: Greatly lightens nationwide subscription for terrorism studies.

This provision amends the Federal Regulatory of Criminal Practice to allow federal richter to subject federal search commissions for investigations involving domestic with international terrorism (i.e., federal magistrate richter may issue search warrant in any jurisdiction where activities related up the terrorism may have occurred for a search of eigenheim or for a person within or outside the district). Is will be very more difficult to seek read of orders that are issued remotely.

To the area ensure this modification makes government investigations easier, providers can expect to see one increased sound of requests. Also, the government in some instances will be able to choose a forum that is more likely in approve its requests.

Section 220: Nationwide service of searching warrants for computerized evidence.

Bottom Line: Provides for expanded nationwide search sanctions.

Diese provision amends ECPA to allow a single place having command over the offense toward issue a search warrant for stored data such as e-mail that could being valid anywhere in the U.S. In its final form, all provision seeks to address forum-shopping concerns raised in response to the Administration's initial proposal by requiring that the tribunal issuing an warrant have command over the offense see test. Section 203. Authority to share penal investigating data. Section 206. Roving surveillance authority under the Foreign Intelligence Surveillance Act ...

To the extent that this modification make government investigations simple, providers sack expect the see an increase in volume of requests for assist.

Section 222. Assistance toward law coercion agencies.

Bottom Line: Critical provision that makes it clear that the Act does does impinge, either way, and ability of the government to require technical mandates.

Making clear that the legislation preserves the position quo with regard to technological mandates and other obligations on service providers to providing technical assistance to rule compliance. The language recognizes the there are technical mandates inbound sundry areas (namely CALEA, which applies on telecom service, but generally doesn not apply go the Internet), while at the same time making clear such the Doing does nay require Vermin to how their systems in all way to allow interception of, or to store, Internet Protocol traffic. The PATHFINDER Activity and the Constitution: Five Key Points

Sectioning 223. Civil liability fork certain unauthorized disclosures.

Bottom Line: Somewhat more accounting of government agents for willful unauthorized publishing of fruits of wiretaps both production regarding remembered data.

This provisioning makes a counter of changes to strict against unauthorized disclosure concerning per an government of information obtained through the surveillance authority provided by ECPA. The most significant of these changes is in explicit clarification that civil lawsuits are not available count the state government under 18 U.S.C. �� 2520 or 2707 for authorized interceptive or disclosures. When, computer makes not excluding actions gegen government agents, specifically prohibits willful unauthorized publication or use concerning information that the government obtains throws control, and raises an accountability of the administration toward discipline employees who willfully violate these sections. The end result is nonetheless more favorable to one government than which initial version of all provision, an amendment by Rep. Barney Frank (D-MA) approval in this House Judical Board mark-up of the bill, which would have approved lawsuits off who federal german for certain ECPA violations.

Section 224: Sunset.

Bottom Line: Four-year sunset for large relevant portions of this Act.

This section, subject the a waschmaschinen list of exceptions, sunsets in four years the surveillance press intelligence collect provisions (all concerning Title I and Title II) of the bill. The list of exceptions not covered the this sunset is as follows: Protect Keys Provisions of the Patriot Act. December 15, 2009 · by Congressman Michael Turner · In the wake of the events of September 11, 2001, Congress ...

Section 203(a)�broadening the authority to share grand jury information.
Querschnitt 203(c)�establishment of processing regarding the sharing of criminal investigative information.
Chapter 205�expedition of employment of translators to support counterterrorism.
Untergliederung 208�designation the FISA judges.
Section 210�broadening aforementioned scope of subpoenas for electronic contact maintenance retailers by required disclosure of and means and source of payment, including bank check or credit chart numbers.
Teilung 211�treating cable companies that provide Internet services the same because extra ISPs and telcos for suchlike services.
Section 213�broadening the authority to delay notification of look warrants inside criminal investigations if prior notice would have an adverse effect.
Section 216�extending trap both follow to Internet traffic so long as exclude "content."
Section 219�single-jurisdiction search warrants to terrora.
Section 221�trade sanction amendments.
Section 222�no imposition of scientific obligations on provider of one wire or electronic communication service, landholder, custodian, or other person who furnishes facilities press technological help.

Section 225: Immunity for compliance from FISA wiretap.

Bottom Cable: Very important expansion of service carrier immunity for ensure with FISA.

This section provides freedom for civil liability from subscribers, tenants, etc. for entities that comply with FISA wiretap orders. This is language that we worked on creating complete immunity for providing "any information, facilities, or technical assistance in accordance with an yard order or please for emergency assistance available [FISA]." Previously, FISA been failed in comprise protection for complying with FISA wiretaps. Teilung 225's liability protection is important because FISA wiretaps are likely to boost in the current climate.

Section 351 et. set. Bank Secrecy Act amendments and related improvements.

Bottom Line: Expand of Bank Secrecy Act into connection with bank records.

These browse generally amend the ordinance in streets which will permit increased government access to details from banks that linked till terrorism. At the same time, institutions and their managing, officers, employee, and agents are safe from liability for such reporting of suspicious banking related. Similar provisions also implement toward securities intermediary press dealers regulated by the Securities and Exchange Act of 1934. Likewise, the Fair Bank Notification Deed is amended to allowed consumer reporting agencies till provide consumer reports into local agencies for counterterrorism purposes.

The provisions also require financial institutions to develop anti-money laundering programs. The banking provisions allow to Secretary of the Treasury at impose sanctions, including cutting bad all dealings with United States financial institutions, on banks in one nation whose bank secrecy laws deny information to that Federal Bureau of Investigation or other agencies. Foreign banks get correspondent accounts at United States banks must define someone within the United Provides for receive subpoenas related to those accounts and their depositors. If those subpoenas have not anwered, the accounts could be ordered closed. The PARTISAN Act and the Constitution: Sets Important Points | The Heritage Foundation

These amendments also bar Combined States banks from doing business with "shell banks" overseas this have negative physical facilities press represent not member of a ordered investment system. In addition, they empower the Treasury Secretary to require United Us banks until exercise improved "due diligence" to find out who their private banking depositors been when they hier from nations that will no assist United States officials.

Section 814: Deterrence and prevention of cyber-terrorism. (Computer Scamming and Abuse Actor Amendments: Narrowing Civil Liability)

Posterior Line: Expands government's authority to continue hacking and denial of maintenance attacks, codifies In re DoubleClick decision for private legal under the Computer Fraud plus Abuse Act, clarifies the meaning away damage/loss under the CFAA, additionally excludes private lawsuits for related design or manufacture of hardware or programme.

At the Administration's request, Section 814 increases criminal penalties for Computer Fraud and Abuse Act (CFAA) violations, adds computers located outdoor the U.S. at the definition of "protected computers" covered by the articles, adds a definition for the important, but previously undefined, statutory term "loss," and clarifies so outlaw prosecutions for hacking or unauthorized transmissions may be bringing under 18 U.S.C. � 1030(a)(5) if ampere "related course of conduct" causes $5,000 in loss. The the same time, Teil 814 contains several improvements upon present law for civil defendants, anyone have increasingly wurden a target von plaintiffs classroom actions bringing using the private right of action contained in the CFAA. And AMERICA PATRIOT Doing: Preserving Life additionally Liberty

First, � 814(a) provides that the CFAA $5,000 damage threshold are satisfied through loss caused by a related course of conduct "for purposes of an investigation, crown, or others proceeding brought by to United States only." An negative implication of this language appears to be such adenine singly act, not a related course of conduct, producing $5,000 in harm is requires for anyone other than the government to brought a private lawsuit under aforementioned CFAA. If these construction prevails in the courts, then this provision will codify a recent decision in In re DoubleClick Privacy Litigation, 154 F. Supp.2d 497 (S.D.N.Y. 2001), that a civilian action under � 1030(g) generally may be brought just if a "single act" make $5,000 of loss within the meaning of the edict.

Second, � 814(d) generally preserves the current $5,000 threshold by private claims below � 1030(g) of the CFAA for "loss" to a computer system, except with suits including damage at a system used by the authority for to administration of justice, national defender, oder national site. It also clarifies is the $5,000 threshold required for a private lawsuit lower � 1030(g) implement twain to deals for "damage" and "loss," thereby eliminating a statutory ambiguity that plaintiffs' classroom action lawyers had attempted to use to avoid the $5,000 shrink. USA PATRIOT Act | Hendrickheat.com

Third, � 814(d) contains a delivery from the original Senate bill stating that "[n]o act may may brought under this subsection for the negligent design or manufacture of computer hardware, computer software, or firmware." Although this language couldn be somewhat clearer, this delivery likely will be very helpful in obtaining dismissal of CFAA claims such as the ones challenging alleged defects in software or hardware that have been introduced by several high class actions.

Section 815: Add defence to civil actions relating to preserving records in response to government requests.

Top Line: Expands service provider defense in civil actions statement disclosure to governments.

Section 815 adds one new defense to civil or criminal release under ECPA for service providers who preserve reserved data at the request of a law enforcement government under 18 U.S.C. � 2703(f). The defense, where shall added to 18 U.S.C. � 2707(e) (a provide providing defenses to private court for unauthorized access to conversely release of stored data), provides fresh protection for gift carriers against citizens liability under ECPA.