Memo to Interested Persons Outlining What Congress Should Do About the Patriot Act Sunsets

To: Interested Persons

From: Timothy H. Edgar
National Security Policy Counsel

Re: Patriot Act sunsets - What Congress should do

The USA PATRIOT Act was passed by Congress in 2001 just six weeks after the terrorist attacks of September 11. Although the act passed both Houses by wide margins, members on both sides of the aisle expressed reservations about its impact on fundamental freedoms and civil liberties. As a result, Congress included a ""sunset clause"" providing that over a dozen provisions will expire on December 31, 2005, if Congress does not act to renew them.

Congress should use the upcoming debate over the renewal of parts of the Patriot Act as an opportunity to reassert its rightful role in determining law enforcement and national security policy in the post-9/11 context, which has waned as the power of the Executive Branch has waxed. Before re-authorizing any power, Congress should require the Executive Branch to meet the standard articulated by the bipartisan 9-11 Commission.

• First, Congress should re-examine the specific provisions that sunset, taking care not to renew any provision unless the government can show ""(a) that the power actually materially enhance security and (b) that there is adequate supervision of the executive's use of the powers to ensure protection of civil liberties.""[1]
• Second, ""[i]f the power is granted, there must be adequate guidelines and oversight to properly confine its use.""[2]
• Third, because the issues of national security and civil liberties posed by anti-terrorism powers that are not part of the Patriot Act sunset are at least as serious as any posed by those provisions that do sunset, Congress should undertake a broader review of anti-terrorism powers, both within and outside of the Patriot Act, using the same standard of review.
• Fourth, Congress should resist efforts by the Executive Branch to evade searching review of its existing powers, both under the Patriot Act and under other legal authorities, by shifting the debate to new anti-terrorism legislation, such as proposals for administrative subpoenas or new death penalties.

Congress may not be able to fully review or assess the effectiveness, and impact on civil liberties, of some anti-terrorism powers that the Executive Branch was granted in the Patriot Act. Congress may also decide that some powers outside of the Patriot Act's sunset provisions should be reviewed at a later time.

The lack of meaningful information about many powers is a direct result of the excessive secrecy of the Executive Branch. In any case where sufficient information is not available to undertake a thorough review, Congress should either allow the provisions to expire or set a new sunset date, with additional reporting requirements to facilitate a proper review, rather than cede those powers permanently to the Executive Branch.

Patriot Act: Greater Secrecy, Less Meaningful Review

In reviewing those provisions of the Patriot Act that are set to expire at the end of the year, Congress should reserve its most searching review and examination for those provisions that pose the greatest challenges to civil liberties.

A number of these provisions share certain common themes. As a result of gag orders, or delayed notification, they permit surveillance with a far greater degree of secrecy than is common in most government investigations. They do not allow affected parties the opportunity to challenge government orders before a judge. Finally, because the substantive standards for some forms of surveillance have been modified, weakened, or even eliminated, the role of a judge in checking government abuse has been made less meaningful.

The Patriot Act adds to the government's surveillance powers in both criminal and foreign intelligence investigations, and makes it easier for investigators to share information between these two types of investigations. It is important to understand the difference between the two.

• Criminal investigations are investigations of federal crimes, using powers like criminal search warrants and grand jury subpoenas. Criminal investigations are not limited to ""ordinary"" street crime or the Mafia, but can and do include investigations of terrorists, including Al Qaeda. Criminal investigations are also not limited to crimes that have already happened, but can also include the investigation and prevention of what are called ""incohate"" crimes, including conspiracy, attempt, and solicitation. The guidelines for conducting criminal investigations (including what level of suspicion is required for certain intrusive techniques) are public.
• Foreign intelligence investigations are domestic investigations of the activities of foreign governments or organizations, including foreign terrorist organizations, often using the special powers of the Foreign Intelligence Surveillance Act (FISA). Foreign intelligence investigations may involve investigation of criminal activities, such as espionage or terrorism, but may also involve intelligence gathering for foreign policy or other purposes involving lawful activities. The guidelines for conducting foreign intelligence investigations (including what level of suspicion is required for certain intrusive techniques) are classified.

Congress should not accept the superficial argument that every power that is available in a criminal investigation should be available to the same extent in a foreign intelligence investigation, and vice versa. For example, traditional law enforcement warrants are properly executed openly as a general rule, even though intelligence searches have long been conducted in absolute secrecy. Conversely, grand juries have extraordinary powers to compel documents and testimony for investigative purposes that would be entirely inappropriate in the hands of intelligence agents. Criminal and foreign intelligence investigations are simply different, and pose very different dangers to civil liberties.

In the upcoming debate over the Patriot Act, Congress should pay particular attention to the following surveillance techniques:

Secret Searches of Homes and Offices

A government search of a home or office requires a warrant based on probable cause under the Fourth Amendment. As a general rule, the owner of the home or office is entitled to a copy of the warrant and notice of the search. Two sections of the Patriot Act erode this general rule.

• Section 218 lowers the standards for using secret ""foreign intelligence"" physical search powers (as well as wiretaps) in federal investigations. Section 218 is subject to the Patriot Act's sunset clause.
• Section 213 makes criminal search warrants more like intelligence ""black bag jobs"" because it makes it easier for the government to delay notice of the execution of a search warrant. Section 213 is permanent. Congress should examine both sections and act to restrain this trend of making searches of a home or office more and more secret.

Section 218: foreign intelligence ""black bag jobs."" Foreign intelligence investigations include special powers to secretly search a home or office, without ever notifying the owner, where there is probable cause that the home or office contains information about the activities of an agent of a foreign power (but not necessarily any evidence of crime) and agents obtain a special warrant from the secret court established by FISA. One limit on this power, prior to the Patriot Act, was that government officials had to certify that the primary purpose of the search was for ""foreign intelligence."" Section 218 of the Patriot Act weakened this standard, allowing agents to obtain these warrants so long as they certify that ""a significant purpose"" of the search is foreign intelligence.

When examining section 218, Congress should explore ways to tighten the use of ""foreign intelligence"" searches for other purposes, such as criminal investigations. Without re-building the much-maligned ""wall"" between foreign intelligence and criminal investigations, Congress should clarify that foreign intelligence investigations should not be directed by federal prosecutors, although prosecutors and criminal investigators should be allowed to be fully briefed on such investigations. Congress should also explore making available to the defense more information, using the carefully-crafted Classified Information Procedures Act (CIPA), than is currently allowed when the fruits of foreign intelligence investigations are used in criminal trials.

Section 213: secret criminal search warrants. Because of section 213 of the Patriot Act, notice of criminal search warrants can now be delayed for an indefinite ""reasonable time,"" if the judge finds an ""adverse result"" could occur if notice is given. ""Adverse result"" includes certain specific harms but also includes a ""catch-all"" standard of ""otherwise seriously jeopardizing an investigation or unduly delaying a trial."" The power to indefinitely delay a search based on a ""catch-all"" standard poses the danger of transforming ordinary criminal searches into intelligence ""black bag jobs.""

Congress should insist on taking another look at section 213, although that section does not sunset. Congress should restore the safeguard required by some federal courts that was overturned by section 213: that notice of federal criminal search warrants usually should not be delayed for longer than seven days. Congress should also eliminate the ""catch-all"" provision for obtaining a secret search warrant, allowing such warrants only when specific harms would otherwise result.

Congress can put responsible limits on secret criminal search warrants without doing away with the intrusive practice altogether. In the 108th Congress, bipartisan legislation amending the Patriot Act would have put such limits on secret criminal search warrants.[3] Similar legislation is expected to be introduced in the 109th Congress.

Wiretapping and Electronic Surveillance Without Judicial Safeguards Limiting Orders to the Targets of an Investigation

Congress has authorized federal judges to issue electronic surveillance orders in serious federal criminal cases and in foreign intelligence cases- including wiretaps of telephone conversations and intercepts of the content of other electronic communications (faxes, e-mail, etc.). Such wiretaps are subject to the Fourth Amendment's demands for a judicial warrant, based on probable cause. ""General warrants"" - blank warrants that do not describe what may be searched - were among those oppressive powers used by the British crown that led directly to the American Revolution. As a result, the framers required all warrants to ""particularly describ[e] the place to be searched, and the persons or things to be seized.""

The same ""particularity"" requirements apply to wiretap orders. In the landmark case United States v. Donovan, 429 U.S. 413 (1977), a majority upheld the federal wiretap law, noting that Congress had redrafted the law to include safeguards regarding, among other things, the need to identify targets of surveillance in response to the ""constitutional command of particularization.""[4]

The Patriot Act erodes this basic constitutional rule:

• Section 206 creates ""roving wiretaps"" in foreign intelligence cases. As amended by later legislation, these wiretaps do more than allow the government to get a single order that follows the target of surveillance from telephone to telephone. The government can now issue ""John Doe"" roving wiretaps that fail to specify a target or a telephone, and can use wiretaps without checking that the conversations they are intercepting actually involve a target of the investigation. Section 206 is subject to the Patriot Act's sunset clause.
• Section 207 greatly increases the length of time that foreign intelligence wiretaps may be used without any judicial oversight - from 90 days to 6 months for the initial order, with renewals allowing surveillance to continue for a year before require judicial approval. Section 207 is subject to the Patriot Act's sunset clause.

In examining these and other electronic surveillance provisions of the Patriot Act, Congress should pay special attention to dangers posed to civil liberties by expanding secret, foreign intelligence wiretap powers not subject to the normal criminal probable cause requirements of standard wiretaps.

Federal criminal wiretaps - also called ""Title III wiretaps"" because they were first authorized by title III of the 1968 Omnibus Crime Control and Safe Streets Act - require a judicial order based on probable cause that the communications to be intercepted will reveal activity relevant to one of a list of federal crimes called wiretap predicates. Foreign intelligence wiretaps require no such finding. Instead, wiretaps may be authorized based on the finding of the secret FISA court that the there is probable cause the target of surveillance is a ""foreign power"" or an ""agent of a foreign power"" - that is, is acting for a foreign government or organization (including, but not limited to, a foreign terrorist organization).[5]

Section 206: Foreign intelligence ""roving wiretaps."" ""Roving wiretaps"" are a particularly potent form of electronic surveillance, allowing the government to obtain a single wiretap order that follows a target as the target uses different telephones or devices to communicate. Prior to the passage of the Patriot Act, roving wiretaps were available in criminal investigations (including criminal investigations of terrorists), but were not available in foreign intelligence investigations.

Because roving wiretaps are much more intrusive than traditional wiretaps, which apply to a single telephone or other device, when Congress considered whether to enact roving wiretaps for criminal investigations, it insisted on important privacy safeguards. First, a criminal wiretap must specify either the identity of the target or the communications device being used. In other words, a surveillance order may specify only the target, or only the phone, but it must specify one or the other. Second, a criminal wiretap that jumps from phone to phone or other device may not be used unless the government ""ascertains"" that the target identified by the order is actually using that device.

When Congress enacted the Patriot Act, it extended ""roving wiretap"" authority to FISA investigations, but did not include the common sense ""ascertainment"" safeguard. Shortly thereafter, the newly enacted roving wiretap authority was made even worse by the Intelligence Act for FY 2002, which authorized wiretaps where neither the target nor the device was allowed. As a result, FISA now allows ""John Doe"" roving wiretaps - wiretaps that can follow an unknown suspect from telephone to telephone based only on a potentially vague physical description, opening the door to widespread surveillance of anyone who fits that description, or anyone else who might be using that telephone.

Congress should tighten the FISA roving wiretap so that it has the same safeguards for privacy as criminal roving wiretaps. Supporters of the Patriot Act often argue that changes to the law were needed to give the government the same powers in foreign intelligence investigations that it already had in criminal investigations. To the extent that is appropriate, it is fair to insist that the same safeguards apply as well.

Section 207. The time periods for foreign intelligence surveillance orders were already much longer than for criminal surveillance orders even before the passage of the Patriot Act. Permitting surveillance to continue for a year with no judicial review opens the door for abuse. Congress should shorten these periods to something more reasonable -- certainly no more than six months. If the problem is a lack of resources, the solution should not be to shortchange judicial oversight. Precisely because there is increased pressure to engage in surveillance early to prevent terrorism before it happens, there is an increased danger of abuse and an increased need for judicial oversight. Congress should provide sufficient funds both to the Department of Justice and to the Foreign Intelligence Surveillance Court to handle the important work of reviewing surveillance orders.

Internet Surveillance without Probable Cause: Web Browsers, E-Mail, and ""Pen/Trap"" Devices

While the ""probable cause"" standard has long applied both to physical searches and electronic intercepts of the content of conversations, surveillance techniques that monitor only who is sending or receiving information (often called ""routing information""), but do not intercept the content of communications, do not require probable cause.

For telephones, pen registers and ""trap and trace"" devices have long been available to track the telephone numbers dialed, and the telephone numbers of incoming calls. These numbers could then be cross-referenced, through a reverse telephone directory, to identify to whom a target of a pen/trap device is calling. A similar technique, ""mail covers,"" is used to track the outside cover of an envelope sent through the mail. Neither technique requires probable cause, although a court order may be needed.

Prior to the passage of the Patriot Act, it was unclear how the law allowing pen/trap devices for telephone communications applied to communications over the Internet. Federal agents argued they should be allowed, without showing probable cause or obtaining a surveillance order, to monitor the ""header"" information of an e-mail and the URL of a web page.

Privacy advocates urged caution, noting that Internet communications operate very differently than traditional mail or telephone communications. For example, the ""header"" information of an e-mail contains a wealth of information, such as a subject line or an entire list of thousands or even hundreds of thousands of addressees. A monitoring order would allow the government to obtain, without probable cause, a political, charitable or religious organization's electronic mailing list. In short, e-mail headers provide far more content than is typical on the outside of an envelope.

Likewise, the ""link"" at the top of a web browser contains not only the website visited, but also the precise pages viewed, or the search terms or other information entered by the user on a web-based form. For example, in the popular search engine ""google,"" a user looking for information about a drug such as ""viagra"" generates the web address http://www.google.com/search?hl=en&lr=&q=viagra.

The Patriot Act contains two sections that broaden the use of Internet surveillance, without probable cause, by extending the pen/trap surveillance technique from the telephone world to the Internet world. Section 214 broadens pen/trap authority under FISA. Section 214 is subject to the sunset clause. Section 216 broadens pen/trap authority for criminal investigations. Section 216 is permanent.

Both sections suffer from the same basic flaw. In extending this intrusive surveillance authority to the Internet, Congress did not adequately take account the differences between the Internet and traditional communications that make intercept of Internet ""routing information"" far more intrusive as applied to Internet communications. To right this balance, Congress should:

• Clearly define content for Internet communications. Congress should be specific. For e-mails, at the very least, the subject line and any private (i.e., ""bcc"") list of addresses should be off limits without a surveillance order based on probable cause. For Internet browsing, obtaining any information behind the top level domain name should likewise be barred without probable cause. For example, an agent could obtain a list of websites visited (like www.aclu.org) but not of webpages visited (like www.aclu.org/patriotact ) or search terms entered (like http://www.google.com/search?hl=en&q=aclu+craig+durbin+safe+act ).
• Prevent techniques that acquire content from being used in the absence of an order based on probable cause. The Internet does not work like traditional telephones or the mail. The constitutionally protected content of communications may be difficult, or even impossible, to separate from the ""routing information."" For example, e-mail may be sent through the Internet in discrete ""packets,"" rather than as a single file, to permit the information to be sent along the most efficient route, then reassembled at the destination, using codes that are attached to the packets of information. The burden should be on the government to develop techniques that do not incidentally acquire content. In the absence of those techniques, a surveillance order based on probable cause should be required. Federal agents should not be put in the untenable position of incidentally gathering constitutionally-protected content in the course of obtaining ""routing information,"" and then being forced to delete or ignore the content information.

The debate over extending pen/trap authority, which is not based on probable cause, to Internet communications, is not about whether criminals or terrorists use the Internet. Of course they do. The question is how to ensure that Congress does not erode the privacy of everyone by authorizing surveillance techniques, not based on probable cause, that fail to account for the differences between traditional communications and Internet communications.

Secret Records Searches Without Probable Cause or an Ability to Challenge: Library Records, Other ""Tangible Things,"" and National Security Letters

Perhaps no section of the Patriot Act has become more controversial than the sections allowing the government secretly to obtain confidential records in national security investigations - investigations ""to protect against international terrorism or clandestine intelligence activities.""

National security investigations are not limited to gathering information about criminal activity. Instead, they are intelligence investigations designed to collect information the government decides is needed to prevent - ""to protect against"" - the threat of terrorism or espionage. They pose greater risks for civil liberties because they potentially involve secretly gathering information about lawful political or religious activities that federal agents believe may be relevant to the actions of a foreign government or foreign political organization (including a terrorist group).

The traditional limit on national security investigations is the focus on investigating foreign powers or agents of foreign powers. Indeed, the ""foreign power"" standard is really the only meaningful substantive limit for non-criminal investigations given the astonishing breadth of information a government agent might decide is needed for intelligence reasons. The Patriot Act eliminated this basic limit for records searches, including the power under the Foreign Intelligence Surveillance Act to obtain any records or other ""tangible things"" and the FBI's power to obtain some records without any court review at all.

• Section 215 of the Patriot Act allows the government to obtain any records, e.g., library and bookseller records, medical records, genetic information, membership lists of organizations, and confidential records of refugee service organizations, as well as any other ""tangible things"" with an order from the Foreign Intelligence Surveillance Court. The order is based merely on a certification by the government that the records are ""sought for"" a national security investigation and the judge is required to issue the order. The order contains an automatic and permanent gag order. Section 215 is subject to the sunset clause.
• Section 505 of the Patriot Act expanded the FBI's power to obtain some records in national security investigations without any court review at all. These ""national security letters"" can be used to obtain financial records, credit reports, and telephone, Internet and other communications billing or transactional records. The letters can be issued simply on the FBI's own assertion that they are needed for an investigation, and also contain an automatic and permanent nondisclosure requirement. Section 505 is permanent.

Although such demands never required probable cause, they did require, prior to the Patriot Act, ""specific and articulable facts giving reason to believe"" the records pertain to an ""agent of a foreign power."" The Patriot Act removed that standard for issuing records demands in national security investigations.

As a result, a previously obscure and rarely used power can now be used far more widely to obtain many more records of American citizens and lawful residents. Because the requirement of individual suspicion has been repealed, records powers can now be used to obtain entire databases of private information for ""data mining"" purposes - using computer software to tag law abiding Americans as terrorist suspects based on a computer algorithm.

These records search provisions are the subject of two court challenges by the ACLU - one in New York and one in Michigan. In the New York case, Doe v. Ashcroft, 334 F. Supp. 2d 471 (S.D.N.Y. 2004), a federal district court ruled against a ""national security letter"" records power expanded by the Patriot Act, agreeing with the ACLU that the failure to provide any explicit right for a recipient to challenge a national security letter search order violated the Fourth Amendment and that the automatic secrecy rule violated the First Amendment. The case is now on appeal before the United States Court of Appeals for the Second Circuit. In Muslim Community Association of Ann Arbor v. Ashcroft, No. 03-72913 (E.D. Mich.), the ACLU has challenged section 215 of the Patriot Act on similar grounds. The district court has not yet decided in the Michigan case.

While national security letters are secret, the press has reported a dramatic increase in the number of letters issued, and in the scope of such requests. For example, over the 2003-04 holiday period, the FBI obtained the names of over 300,000 travelers to Las Vegas, despite casinos deep reluctance to share such confidential customer information with the government. It is not clear whether the records were obtained in part with a national security letter or only with the threat of such a letter.

Both FISA records demands and national security letters can be used to obtain sensitive records relating to the exercise of First Amendment rights. A FISA record demand could be used to obtain a list of the books or magazines someone purchases or borrows from the library. A FISA record demand could be used to obtain the membership list of a controversial political or religious organization. A national security letter could be used to monitor use of a computer at a library or Internet café under the government's theory that providing Internet access (even for free) makes an institution a ""communications service provider"" under the law.

While both national security letters and FISA records demands cannot be issued in an investigation of a United States citizen or lawful permanent resident if the investigation is based ""solely"" on First Amendment activities, this provides little protection. An investigation is rarely, if ever, based ""solely"" on any one factor; investigations based in large part, but not solely, on constitutionally protected speech or association are implicitly allowed. An investigation of a temporary resident can be based ""solely"" on First Amendment activities, and such an investigation of a foreign visitor may involve obtaining records pertaining to a United States citizen. For example, a investigation based solely on the First Amendment activities of an international student could involve a demand for the confidential records of a student political group that includes United States citizens or permanent residents.

The expanded scope and broader use of both FISA records demands and national security letters has exacerbated other constitutional problems with the statute under both the First Amendment and the Fourth Amendment. Unlike almost every other type of subpoena or records demand, neither statute contains any explicit right to file a motion to quash the demand before a court on the ground that the demand is unreasonable or seeks privileged information. Similarly, both types of records demands bar the recipient from disclosing that the demand has been issued. This permanent secrecy order is imposed automatically, in every case, without any review by a judge, without any right to challenge. The district court ruling in Doe v. Ashcroft makes clear these problems are severe enough to invalidate the entire national security letter statute - not just the portions amended by the Patriot Act.

Congress should restore the requirement of ""specific and articulable facts giving reason to believe"" the records involve an ""agent of a foreign power"" for both FISA records demands and national security letters. In addition, Congress should take the opportunity to fix the additional problems of the FISA records law and national security letters. Congress should make explicit the right to file a motion to quash the records demands because they are unreasonable, contrary to law, or seek privileged informatio