USA PATRIOT Act of 2001

From The IT Law Wiki

Citation: USA PATRIOT Act, Pub. L. 107-56, Oct. 26, 2001.

[edit] Overview

Following the 9/11 terrorist attacks, Congress passed the Uniting and Strengthening America by Providing Appropriate Tools to Intercept and Obstruct Terrorism Act of 2001, (USA PATRIOT Act). The Act substantively amended Title III of the Omnibus Crime Control and Safe Streets Act of 1968, the Electronic Communications Privacy Act of 1986, and the Foreign Intelligence Surveillance Act of 1978. The Act authorized the disclosure of wiretap and grand jury information to “any federal, law enforcement, intelligence, protective, immigration, national defense, or national security official” for the performance of his duties. It permitted use of FISA surveillance orders when foreign intelligence gathering is “a significant” reason for the order rather than “the” reason. Finally, it authorized FISA orders for access to any tangible item rather than only business records held by lodging, car rental, and locker rental businesses.

The Act also expanded law enforcement’s ability to monitor Internet activities. Inter alia, the law modifies the definitions of “pen registers” and “trap and trace devices” to include devices that monitor addressing and routing information for Internet communications. Carnivore-like programs may now fit within the new definitions.

[edit] Key Provisions

The Internet privacy-related provisions of the Act, included as part of Title II, are as follows:

• Section 210, which expands the scope of subpoenas for records of electronic communications to include records commonly associated with Internet usage, such as session times and duration.

• Section 212, which allows ISPs to divulge records or other information (but not the contents of communications) pertaining to a subscriber if they believe there is immediate danger of death or serious physical injury or as otherwise authorized, and requires them to divulge such records or information (excluding contents of communications) to a governmental entity under certain conditions. It also allows an ISP to divulge the contents of communications to a law enforcement agency if it reasonably believes that an emergency involving immediate danger of death or serious physical injury requires disclosure of the information without delay. This section was amended by the Cyber Security Enhancement Act.

• Section 216, which adds routing and addressing information (used in Internet communications) to dialing information, expanding what information a government agency may capture using pen registers and trap and trace devices as authorized by a court order, while excluding the content of any wire or electronic communications. The section also requires law enforcement officials to keep certain records when they use their own pen registers or trap and trace devices and to provide those records to the court that issued the order within 30 days of expiration of the order. To the extent that Carnivore-like systems fall with the new definition of pen registers or trap and trace devices provided in the act, that language would increase judicial oversight of the use of such systems.

• Section 217, which allows a person acting under color of law to intercept the wire or electronic communications of a computer trespasser transmitted to, through, or from a protected computer under certain circumstances, and

• Section 224, which sets a four-year sunset period for many of the Title II provisions. Sections 210 and 216 are excluded from the sunset. Sections 212 and 217 are not.