Access to Business Records under FISA ("Libraries Provision")
Pen Register and Trap and Trace Authority under FISA
A Summary by Mary DeRosa
Section 215 revises substantially the authority under the FISA for seizure of business records, including third party records of individuals' transactions and activities. Previously, FISA section 501 permitted the FBI to apply to the Foreign Intelligence Surveillance Court ("FISC") for an order to seize business records of hotels, motels, car and truck rental agencies, and storage rental facilities. Section 215 broadens that authority by eliminating any limitation on the types of businesses or entities whose records may be seized. In addition, the section expands the scope of the items that the FBI may obtain using this authority from "records" to "any tangible things (including books, records, papers, documents, and other items)." The recipient of the order may not disclose the fact that the FBI has sought or obtained records.
Section 215 also eases the requirements for obtaining an order to seize business records. Previously, FISA required the FBI to present the FISC "specific articulable facts giving reason to believe" that the subject of an investigation was a "foreign power or the agent of a foreign power." After section 215, the government is required only to assert that the records or things are sought for a foreign intelligence investigation or to protect against international terrorism or clandestine intelligence activities, although the investigation of a United States person may not be "solely upon the basis of activities protected by the first amendment to the Constitution." There is no requirement for an evidentiary or factual showing and the judge has little discretion in reviewing an application. If the judge finds that "the application meets the requirements" of the section, he or she must issue an order as requested "or as modified."
Section 214 makes similar changes to procedures for obtaining pen register or trap and trace orders under FISA." Pen registers" and "trap and trace" devices record information about the recipient and source, respectively, of a communication. They do not intercept the contents of communications. Previously, FISA section 402 required the government to certify to the FISC that there was reason to believe a line monitored by one of these devices would be used by an individual or a foreign power engaged in international terrorism or spying that violates U.S. criminal laws. After section 214, there is no such certification required. Instead, the certification requirements are similar to those described above for business records.
Section 216, which does not sunset, changed the definitions of "pen register" and "trap and trace" to clarify that they apply to email and internet, as well as telephone communications.
Sections 214 and 215 of the Patriot Act expanded the government's authority under the Foreign Intelligence Surveillance Act (50 U.S.C. 1801 et seq. (2000 ed.)) to, respectively, conduct pen register/trap-and-trace surveillance, and compel production of business records. The lion's share of this discussion will focus on Section 215.
None of the Patriot Act's enhancements of government's investigative arsenal has been more assiduously libeled than Section 215. Indeed, in the public mind, it has become the "library records' provision notwithstanding that libraries are nowhere mentioned. While there are points of legitimate concern, most of the controversy is a tempest in a teapot. Section 215 is a good law. It merits being made permanent, albeit with some tailoring to provide expressly for the now-implicit ability of production-order recipients to seek judicial narrowing. Beyond that, altering this provision out of overwrought suspicions about potential abuse would likely, and perversely, result only in greater potential abuse.
Section 215 modified FISA in two ways. The first relates to what information may be compelled. Formerly, this was restricted to travel, lodging and storage records. Section 215 broadens the scope to include not merely such business records but "any tangible things (including books, records, papers, documents, and other items).'
This is not nearly as dramatic as it appears. For decades, Rule 17 (c), Fed.R.Crim.P., has authorized compulsory production of "any books, papers, documents, data, or other objects' to criminal investigators by mere subpoena. Given the incontestable breadth of the federal criminal statutes implicated by terrorism and espionage, coupled with the broad license grand juries have to conduct investigations, there is no item now obtainable by Section 215 that could not already be compelled by simple subpoena (and thus made accessible to intelligence agents, who are now permitted to share grand jury information).
Why such extensive access with virtually no court supervision? Because the items at issue here are primarily activity records voluntarily left in the hands of third parties. As the Supreme Court has long held, such items simply do not involve legitimate expectations of privacy. See, e.g., Smith v. Maryland, 442 U.S. 735, 744 (1979). This renders them categorically different from the private information at issue in the context of search warrants or eavesdropping, in which the court is properly imposed as a bulwark, requiring a demonstration of cause before government may pierce established constitutional safeguards.
Thus while the Patriot Act plainly expanded FISA powers, the reality is that prior law governing national security investigations was unnecessarily stingy, especially in contrast to rules that empower criminal agents probing far less serious matters, like gambling. Such incongruities are intolerable in the post-9/11 world, where public safety is critically dependent on intelligence.
Here, one must address the theater over library records, risibly evoking visions of DOJ Thought Police monitoring, and thus chilling, the reading preferences of Americans. First, as demonstrated above, government has long had the authority to compel reading records by subpoena; yet there is no empirical indication of systematic prying into private choices—else we'd surely have heard from the robustly organized librarians. Second, leaving aside that agents (who are also Americans) generally lack voyeuristic interest in the public's reading and viewing habits, investigations in the Information Age are simply too demanding for such shenanigans. Naturally, one could never eliminate the occasional rogue—no matter what precautions were in place; but in the 21st Century, voluminous information streams and finite resources leave no time for this sort of malfeasance. Third, and most significantly, it does not diminish our society's high regard for personal liberty to observe that an a priori ban on investigative access to reading records would be both unprecedented and dangerous.
In point of fact, literature evidence was a staple of terrorism prosecutions throughout the 1990's. Terrorists read bomb manuals, and often leave fingerprints on pages spelling out explosive recipes that match the forensics of particular bombings (like the 1993 attack on the World Trade Center). Possession of jihadist writings is also relevant in the cases of accused terrorists who, having pled not guilty, put the government to its burden of proving knowledge and intent. Of course we don't want FBI agents snooping around libraries for no good reason; but do we really want terrorists immunized from the properly prejudicial effects of probative evidence—evidence that has proven key to past convictions? Americans value many species of privacy but sensibly allow them to be overcome when relevant evidence of even minor crime is at stake. It would be extremely unwise to create hurdles for library evidence that don't exist for items stored in a person's own bedroom, or to create impediments in national security cases that don't exist in, say, routine drug investigations.
The second major change wrought by Section 215 involves the showing required before a FISA production order is issued. Previously, agents were called on to provide "specific and articulable facts giving reason to believe that' the records pertained to an agent of a foreign power. Now, the order must issue upon the government's representation that it seeks to obtain intelligence concerning non-U.S. persons, or to protect against international terrorism or espionage.
Practically speaking, this change is, again, less dramatic than appears on the surface. Consider the contrast: in criminal investigations, there is no court supervision at all over government's issuance of subpoenas. Section 215, moreover, expressly prohibits FISA investigations based "solely on ... activities protected by the First Amendment'; criminal probes carry no such protection.
Concededly, however, defenders of Section 215, rather than explaining why court supervision of investigations would be improper, tend counterproductively to stress the court-order requirement. Illustrative is the Justice Department's highlighting that "Section 215 requires FBI agents to get a court order.' (See "Dispelling the Myths' (emphasis in original).) Though accurate, this assertion may inadvertently imply searching judicial review. In fact, Section 215 provides no such thing: if the government makes the prescribed representations, the FISA court is without discretion to deny the order. This is precisely as it should be, but people who have assumed a degree of judicial scrutiny understandably become alarmed upon learning it is a false assumption.
Yes, Section 215's judicial exercise is ministerial, but that does not make it unique or inconsequential. It is analogous to familiar pen register law, under which a judge must issue the authorization upon the request of criminal investigators, with no demonstration of cause. Why? Because our system is premised on separation of powers. Investigation is an executive function. The judicial role is not to supervise the executive but to protect U.S. persons against improper invasions of legitimate expectations of privacy. People do not have such expectations regarding the phone numbers they dial, thus a ministerial judicial role is appropriate: the order issues on the court's power, but it is not the judiciary's place to question bona fides of a co-equal branch carrying out its own constitutional function.
In matters of national security more than any other investigative realm, it is crucial to remain mindful of the court's institutional competence. The judiciary's limited role is to protect established constitutional interests, not create new ones as a means to micromanage investigations. When neither U.S. persons nor legitimate expectations of privacy are involved, as is generally the case with Section 215, a court has no cause to demand an explanation of the basis for the FBI's application.
So why require going to the court at all? Because, as is the case with grand jury subpoenas (which are court orders though issued without court supervision), it is appropriate that the directive to comply comes from the judicial power. Moreover, Section 215 prudently charges Congress with the responsibility of ensuring that the executive branch is not abusing its authority. By requiring the FBI to make solemn representations to the court, and mandating that the Attorney General report semi-annually on this provision's implementation, Section 215 provides suitable metrics for oversight and, if necessary, reform.
Finally, the formerly mandated articulation hinders proper investigations. Emblematic is the pre-9/11 Zacharias Moussaoui scenario. There are times when the FBI will have solid reason to suspect that a person is a terrorist operative (as Moussaoui's flight school behavior aroused suspicion), but not yet have developed enough evidence to tie the suspect to a particular foreign power (such as al Qaeda). In such a case, given that the Fourth Amendment poses no obstacle to the FBI's access to third party records, the safety of Americans assuredly should not be imperiled for the benefit of a non-U.S. person by burdening investigators with a legally unnecessary showing it will not be possible for them to meet.
Section 215 should be amended to clarify that order recipients may move the FISA court to quash or narrow production. This remedy is available in the analogous context of grand jury subpoenas, the Justice Department has appropriately taken the position that it is implicit in Section 215, and it will incentivize investigators to minimize their applications responsibly.
Further modification would be legally unnecessary, as well as unwise policy. Raising the access bar would simply encourage government to proceed by grand jury subpoena or national security letter—guaranteeing less judicial participation, more difficult congressional oversight, and the inefficiency of quash litigation in district courts throughout the country, rather than in the FISA court (a salient reason for whose creation was to develop specialized expertise in the sensitive issues unique to intelligence investigations).
In light of its relatedness to Section 215, Section 214 need not detain us long. This provision sensibly extends the pen register/trap-and-trace device procedures already available for telephone communications to the newer technologies of email and Internet. Importantly, this does not permit government to invade the content of communications; all that is at stake here is routing and addressing information.
Prior FISA law required government to certify that the monitored communications would likely be those either of an international terrorist or spy involved in a violation of U.S. criminal law, or of an agent of a foreign power involved in terrorism or espionage. This was an unnecessary and imprudently high hurdle. The Supreme Court, as noted above, has long held that pen registers do not implicate any Fourth Amendment interests—they are not searches, they do not invade legitimate expectations of privacy, and there is no constitutional reason to require investigators to seek court authorization for them at all.
Consequently, Section 214's modification of prior law is both modest and eminently reasonable. Agents are still required to obtain a court order before installing a pen register. In addition, they are still required to make a solemn representation to the court; now, however, that is limited to certifying that the information sought would be relevant to an investigation to protect against international terrorism or clandestine intelligence activities. Though less extensive than before, this still easily passes constitutional muster. It is also comfortably analogous to criminal practice, where investigators must be granted pen register authority upon merely certifying that "the information likely to be obtained is relevant to an ongoing criminal investigation[.]' (18 U.S.C. Section 3122 (b)(2)). And, as was the case with Section 215, Section 214 may not be employed to conduct an investigation based solely on activities protected by the First Amendment—a safeguard that does not exist in criminal investigations.
Section 214 should neither be modified nor permitted to sunset.
Andrew McCarthy has presented a defense of Sections 214 and 215 of the Patriot Act essentially as drafted, and stated that they should be renewed permanently rather than being allowed to sunset at the end of 2005. Mr. McCarthy gives a clear and articulate statement of positions that the U.S. Department of Justice has presented on these issues. In this response, I explain reasons for considerably greater skepticism toward the current Section 215, especially with respect to the so-called "gag rule" provision that Mr. McCarthy does not discuss. I also explain, much more briefly, some concerns with the current Section 214. My discussion here builds on my study on "The System of Foreign Intelligence Surveillance Law," published in the George Washington Law Review and available in the publications section of my web site at www.peterswire.net. It also builds on my experience chairing a White House Working Group in 2000 on how to update wiretap and surveillance laws for the Internet age.
The much broader scope of records searches under Section 215. Section 215 of the Patriot Act expanded the sweep of Foreign Intelligence Surveillance Act ("FISA") orders to compel production of business records and other tangible objects. The original FISA had focused on electronic surveillance and had not created a FISA mechanism for the government to get business records. After the Oklahoma City and first World Trade Center bombings, Congress authorized the use of FISA orders for travel records only.Section 215 contained two statutory changes that greatly expanded this power. First, the type of records subject to the order went far beyond travel records. Now the search can extend to "any tangible things (including books, records, papers, documents, and other items) . . . ." By its terms, the statute apparently would allow a FISA order to trump other laws that usually govern the release of records, including for medical records and other categories of records that are generally subject to privacy protections.
Second, the legal standard changed for obtaining the order. Previously, the application had to show "specific and articulable facts giving reason to believe that the person to whom the records pertain is a foreign power or an agent of a foreign power." This standard, although less than probable cause, is relatively strict. The Patriot Act eliminated the need for any particularized showing. The application need merely "specify that the records concerned are sought for an authorized investigation . . . to protect against international terrorism or clandestine intelligence activities." What counts as an authorized investigation is within the discretion of the executive branch.
Under this change in the text, FISA orders can now apply to anyone, not only the target of the investigation. Previously, the records or other objects sought had to concern either a foreign power or the agent of a foreign power. Now, the FISA order can require production of records about persons who have nothing to do with a foreign power. The only weak restraints include the need for "an authorized investigation" and the requirement that surveillance of U.S. persons not be based solely upon First Amendment activities This is a significant change, permitting seizure of records of persons who are not the target of an investigation and not an agent of a foreign power. Similarly, by permitting the order to cover records of all persons, the literal terms of Section 215 would permit an entire database to be the subject of a FISA order. So long as there is "an authorized investigation" the statute does not set any limits on the type or number of records subject to the FISA order.
Mr. McCarthy makes two principal arguments to support the expansion. First, he explains how the government has similarly broad powers to get records for criminal investigations. One crucial limit applies, however, to criminal investigations but not to Section 215 searches -- showing that a crime has been, is, or will be committed. In addition, as discussed further below, Section 215 contains what is often called a "gag rule"—"No person shall disclose to any other person (other than those persons necessary to produce the tangible things under this section) that the Federal Bureau of Investigation has sought or obtained tangible things under this section." No similar rule applies to business records produced in the course of a criminal investigation.
Mr. McCarthy's other key argument is that the Supreme Court has found no Fourth Amendment "reasonable expectation of privacy" in records about an individual held by third parties. He describes the records as "voluntarily left in the hands of third parties" such as banks, hospitals, schools, and other record-holders, and thus the records should be readily available to the government with far less than a probable cause order. The problem with this constitutional argument—an argument repeatedly made by the Department of Justice—is that it mistakenly asserts that something that is constitutional is also desirable policy. To see this mistake, consider that a 90 percent income tax is almost certainly constitutional, but few people think it therefore would be a wise policy. Especially for sensitive records held by libraries, hospitals, and others, better policy is to have significant oversight by the courts.
A short discussion is necessary on the topic of searches of library records. Mr. McCarthy complains that the "theater" of that debate has been "risibly evoking visions of DOJ Thought Police monitoring." In my view, the debate about access to library records has been important as a symbol of possible over-reaching in government surveillance, much as the Patriot Act itself has become a symbol of that concern. The debate over library records, moreover, goes to one important reason why we should be concerned about possible government over-reaching. The Foreign Intelligence Surveillance Act was passed in 1978 in the wake of Watergate and revelations about systematic surveillance of journalists and of political opponents of the government. Standard First Amendment jurisprudence recognizes the chilling effect on expression and political activity that can result from such surveillance. The debate over library records, then, provides an important way to articulate what is at risk if surveillance expands too far.
In response to public concern about use of Section 215 to gather library records, Attorney General Ashcroft reported in September, 2003 that the section had never been used since passage of the Patriot Act for library or any other records. This lack of usage is reassuring because it shows that the Justice Department has not been using the new power for routine surveillance of library and other sensitive records. The lack of usage also supports the position that the Justice Department has not made the case for renewing Section 215 when the sunset expires. There are existing procedures for gathering records without using the extraordinary scope of Section 215. Absent some new showing by the Justice Department of the specific circumstances where Section 215 is needed, the provision should be allowed to sunset.
If the decision is made to keep some form Section 215, however, then there are various reforms that would cabin some of the most disturbing aspects. For instance, there could be a specific carve-out from Section 215 for library records. There could be deference to the medical, financial, and other privacy laws on the books, so that the specific statutes would govern categories of records rather than using the lower standard of Section 215. Next, the standard could return to the "specific and articulable facts" standard that existed before 2001, rather than leaving unchecked access to records that simply are part of an investigation. Perhaps most compellingly (and suggested also by Mr. McCarthy) there should be a procedure for record-holders to claim that a request is unduly overbroad and burdensome. The Foreign Intelligence Surveillance Court (or federal district court) could provide the same oversight of overbroad and burdensome requests as exists currently for requests in criminal investigations.
The unjustified expansion of the "gag rule". An especially troubling aspect of Section 215 (and the expanded use of so-called "National Security Letters" under Section 505 of the Patriot Act) is the provision that makes it illegal for individuals or organizations to reveal that they have been asked by the government to provide documents or other tangible objects. The law makes it criminal for a librarian or any other person even to say that there has been a FISA request, without saying more about the nature of the request or the name of the target. This "gag rule" is an unjustified expansion of a special rule for wiretaps, and is contrary to the rules that have historically applied to government requests for records.
There has long been a specialized rule for wiretaps, under both Title III and FISA, that the telephone company and others who implement the wiretap are required to keep the wiretap secret while it is in operation. The need for secrecy flows from the special nature of wiretaps—they don't work nearly so well when the target knows someone is listening. By contrast, a records search (such as under Section 215) ordinarily secures the available information for the investigator. Unlike the initiation of the wiretap, the search is complete once the records are produced.
The secrecy requirement for those implementing the wiretap is a special case, entirely different than the legal rules that apply to ordinary government investigations. Suppose that a landlord is interviewed by police about the whereabouts of a tenant or a company is asked for records about its sales to a particular individual. The American approach in such instances is that the landlord or the company is permitted to talk about the investigation with the press or other persons. This ability to speak to the press or others is an important First Amendment right. Under the "gag rule" approach, that right is taken away and individuals subject to excessive searches must risk criminal sanctions even to report over-reaching or abuses of government authority.
The general American approach also places key limits on what a landlord or company may say. If a landlord tips off a tenant that the police are trying to catch the tenant, then the landlord is subject to punishment under obstruction of justice, conspiracy, or similar statutes. This kind of targeted criminal sanction permits citizens to keep watch on possible over-reaching by the government, while also empowering the government to punish those who assist in criminal activity.
The furor about FISA access to library and other records is based in part on the recognition that this sort of broad search power could expand over time into a routine practice of intrusive domestic surveillance. The combination of this essentially unlimited search power with the "gag rule" means that the most basic check against abuse—publicity—is removed. Similar "gag rules" have recently spread into other statutes.
What to do about the gag rule? Quite possibly it simply is not needed. Tips to suspects can be handled under conspiracy and other existing law. If some sort of gag rule is kept for records searches (for fear of tipping off terrorists), then the suppression of speech should be minimized by easily-implemented rules. One approach would be to say that the gag order lasts for six months, with the order renewable if the FISC agrees. Another approach is to say that the fact of a search can be announced, but not the name of the suspect. More generally, the FISC judges can use their Article III experience to exercise the same oversight over the gag rule that they do under criminal investigations. Procedures can be added to the FISA so that the FISC can keep information secret where appropriate, but with presumptions that the nature of the search can be made public over time, consistent with free speech and accountability on government.
The current "gag rule" for records was never the subject of hearings or public debate. It is the most objectionable part of Section 215.
Section 214. The standard for getting a FISA pen register or trap-and-trace order was simplified in the Patriot Act. Previously, these orders could be issued only if there was reason to believe that the telephone line subject to the order had been or was about to be used in communications involving international terrorism or an agent of a foreign power. That requirement was dropped in the Patriot Act, with the standard becoming essentially the same as for domestic orders. In 2000, the House Judiciary Committee voted overwhelmingly to raise the standard for a pen register order from "any authorized investigation" to "specific and articulable facts." The issue for both criminal and FISA pen register orders is whether the Committee got it right at that time—whether the standard for such orders is simply too low.
Professor Peter Swire's thoughtful response goes wrong in three major respects.
First, he gives short shrift to the national security threat. If we were not actually facing a public safety challenge, individual interests in the privacy of financial, medical and reading records could sensibly be elevated. But national security is the highest public interest, and when it is truly threatened, as it is now, it makes no sense to give individual interests primacy over the public's need to have foreign enemies thoroughly checked—particularly when the Supreme Court has made plain that there are no expectations of privacy in third-party records.
This failing infects even the worthy concern over Section 215's "gag rule." The desirability of openness as a check on government over-reaching is unassailable if national security is not threatened. A public safety threat, however, requires reasonable balance between the public interest in disclosure and the reality that disclosure makes our enemies, to be blunt, more efficient at killing us. The appropriate balance is to presume that Justice Department personnel will perform their functions honorably, but to expect searching congressional oversight.
In reality, the vast majority of third-party subpoena recipients have no interest in disclosure. Given the stakes involved, any modification of the gag rule should put the onus on the few who do to explain why they should not remain mum. As for the suggestion that prosecution is an adequate check on irresponsible disclosures, that is classic pre-9/11 mindset. If a terror organization lives to kill another day because a subpoena recipient compromised an investigation, it will be cold comfort that the recipient can be prosecuted for obstruction of justice.
The second error is an inaccurate portrait of how government actually works. It begins the regulator's common failure to perceive that when government's hands are tied out of a hyper-fear of corrupt behavior, the only hands being tied belong to the honest people—the occasional rogue will be a rogue no matter what the rules are. Again, when public safety is at issue, it is perilous to hamper responsible officials in pursuit of an illusion that the few bad people will conform.
Further, there isn't time, in the information age, for investigators to be looking at everything we actually want them to look at. The thought that they have the time and inclination systematically to snoop on people's private affairs for illegitimate reasons is not reality, and is not an appropriate operating assumption. Watergate-era abuses are frequently raised in this context, betraying a counterfactual notion that we stopped growing in the 1970's. The executive branch knows that history as does the congress. Mindful of it, they perform and oversee. Complemented by the political check of the ballot box, this is our best assurance that the mistakes of the past will not recur.
Finally, the suggested regulations will not have the desired effect. They will merely chase investigations into the criminal justice system where none of the oversight mechanisms inherent in Section 215 exist. The claim that the criminal sphere somehow limits executive action because of a requirement "that a crime has been, is, or will be committed" is wrong. Grand juries may investigate on the rankest suspicion or even to satisfy themselves that no crime has been committed. Assuming arguendo that Justice Department practice could temper this limitless authority, the fact is that terrorist conspiracies (al Qaeda, Hezbollah, etc.) are ongoing. Crimes are being committed, the criminal statutes are tremendously broad, and there simply is no matter remotely touching on terrorism that a grand jury is barred from investigating.
Although Andrew McCarthy begins by describing my essay as "thoughtful,' he unfortunately then descends into rhetoric that has been far too common in the debates about the Patriot Act: my writing reveals "a classic pre-9/11 mindset"; it gives "short shrift to the national security threat"; and the documented history of abuse in Watergate and other eras is irrelevant because "the executive branch knows that history" and so abuses of power won't happen again. In fact, as Mr. McCarthy knows, my short essay draws on a much longer law review article, and that article addresses each of those points in detail.
Let's sum up the debate on Section 215. Mr. McCarthy and I agree that the law should be changed to allow lawyers to be contacted by the party who receives the order. We agree that the law should be changed to permit that party to go to court to seek to narrow an overbroad or unduly burdensome governmental request. (Although he does not address the issue, I hope he would agree that the same rights are appropriate for parties who are subject to National Security Letters.)>
On the gag rule, Mr. McCarthy relies on executive branch restraint and Congressional oversight. Under the gag rule as currently written, it is likely a crime for persons to tell Congress that they have been subject to a 215 order or National Security Letter. That leaves us with only executive branch self-restraint. I have proposed a number of possible modifications to the gag rule. All of them are designed to provide public accountability while minimizing the likelihood of leaking information to terrorists. I try in my writings never to be alarmist. That said, the current gag rule is wildly outside of the American tradition and should be amended.