How bin Laden and 9/11 attacks shaped electronic privacy

Nearly 10 years ago, Osama bin Laden changed the way many of us lived.

The coordinated suicide attacks on September 11, 2001, began what would become known as the War on Terror. They led directly to the invasion of Afghanistan and the formation of the Department of Homeland Security, and indirectly to the Guantanamo Bay prison and a rise in government centralization and secrecy.

What's not as obvious is how al Qaeda's attacks, at least in technology and political circles, shifted the discussion from protecting electronic privacy to facilitating government surveillance.

Bin Laden was killed yesterday in Pakistan by U.S. special forces after a nearly 10-year manhunt.

By early 2001, bipartisan support had gradually coalesced around the concept of upgrading privacy laws to shield Americans' civil liberties. The White House decided to relax encryption regulations. A Privacy Caucus formed in the U.S. Congress. The FBI's Carnivore wiretapping utility came under attack.

In the House of Representatives, one committee took the unprecedented step of approving legislation requiring a court-issued warrant before police could read e-mail or track mobile phones. The final vote was an overwhelming 20-to-1. The measure even included an amendment from Rep. Zoe Lofgren (D-Calif.) specifying that police couldn't use illegally disclosed electronic communications as evidence in court.

"This was the first Congress that took privacy seriously," I wrote at the end of 2000.

The conventional wisdom is that this felicitous trend ended with the Patriot Act, which Congress overwhelmingly approved as the World Trade Center still smoldered from the September 11 attacks. But that's not quite right.

Long before 9/11, the U.S. Department of Justice drafted the so-called Enhancement of Privacy and Public Safety in Cyberspace Act (PDF), which goes by the awkward and not very memorable acronym of EPPSCA. In July 2000, the Clinton administration forwarded EPPSCA to Congress, where it was introduced by Sen. Patrick Leahy (D-Vt.) and met with a generally chilly response.

Leahy himself said that while portions seemed reasonable, "the merits of other provisions in this legislation would benefit from additional scrutiny and debate."

EPPSCA was designed to give police more authority to conduct Internet surveillance, not thwart terrorists armed with box cutters. In a July 2000 speech at the National Press Club, White House chief of staff John Podesta included only a single reference to "cyber-terrorism," and nothing about the non-cyber sort.

But within hours of the 9/11 attacks, the Justice Department had dusted off EPPSCA as a way to respond to bin Laden. On September 13, 2001, two days after the worst terrorist attack in U.S. history, the U.S. Senate approved the "Combating Terrorism Act of 2001," which includes portions copied directly from EPPSCA.

Over the next 43 days, the Combating Terrorism Act of 2001 morphed into the Patriot Act, which was broadened to address unrelated topics such as immigration and financial institutions. Portions of EPPSCA survived verbatim. (See related graphic.)

When the final vote on the Patriot Act was held the following month, members of Congress were required to vote on the bill without time to read it. The measure "has been debated in the most undemocratic way possible, and it is not worthy of this institution," Rep. Barney Frank (D-Mass.) said at the time. Rep. Ron Paul (R-Texas) added later: "Almost all significant legislation since 9/11 has been rushed through in a tone of urgency with reference to the tragedy."

The ACLU calls that process "an overnight revision of the nation's surveillance laws that vastly expanded the government's authority to spy on its own citizens, while simultaneously reducing checks and balances on those powers like judicial oversight, public accountability, and the ability to challenge government searches in court."

Only now, nearly a decade later, is the political pendulum swinging back to privacy. It's being driven by concerns over mobile device tracking, government access to data, airport body scanners -- and, in a bit of historical irony, the Patriot Act itself.