Patriot Act renewed despite warnings of 'secret' law

news analysis The U.S. Congress has approved a four-year extension of the Patriot Act despite warnings from senators that the Justice Department has twisted the 2001 law into a "secret" surveillance mechanism far broader than Americans realize.

"I believe that when more of my colleagues and the American public come to understand how the Patriot Act has actually been interpreted in secret, they will insist on significant reforms too," said Sen. Ron Wyden, an Oregon Democrat who tried to block the renewal. Sen. Mark Udall, a Colorado Democrat, offered a similar warning.

The cautionary note from two members of the Senate Intelligence committee -- who are briefed on classified activities and are tasked with overseeing the NSA, CIA, and the Justice Department's "intelligence activities" -- is highly unusual, and perhaps even unprecedented.

And it's prompted intense speculation about what kind of constitutionally dubious surveillance, which could include vacuuming up cell phone location records, the Obama administration might be engaging in.

By now it's clear that of the three sections of the Patriot Act that would have expired last night, the Democratic senators are concerned with Section 215 of the law, better known as the "business records" portion. It allows FBI agents to obtain any "tangible thing," including "books, records, papers, documents, and other items," a broad term that includes dumps from private-sector computer databases, with limited judicial oversight.

The Justice Department confirmed in March that Section 215 "has been used to obtain driver's license records, hotel records, car rental records, apartment leasing records, credit card records, and the like." Todd Hinnen, acting assistant attorney general for national security, told a House of Representatives committee at the time that such directives were constitutional because they are "not a 'search' within the meaning of the Fourth Amendment." (The Fourth Amendment, of course, prohibits "unreasonable" searches and seizures.)

A month earlier, FBI director Robert Mueller elaborated on how Section 215 is used, saying it lets the bureau obtain "records relating to the purchase of hydrogen peroxide." According to a transcript (PDF), Mueller told the Senate Intelligence committee that a secret foreign intelligence court has approved over 380 uses of Section 215 since 2001. Hydrogen peroxide can be used in bomb-making.

Mueller hinted that there was a secret legal memorandum prepared by the Justice Department's Office of Legal Counsel that authorized a broader use of Section 215 than is publicly known. That would echo a series of Top Secret legal memos prepared by the Office of Legal Counsel under President Bush. One said waterboarding was not torture (PDF). Another (PDF) claimed that the NSA's warrantless wiretapping program "is lawful."

Wyden, who was present at the February 2011 hearing, told Mueller that he was "increasingly troubled" that intelligence agencies are "relying on a secret interpretation" of the Patriot Act. "I believe that the American people would be absolutely stunned," Wyden said, if they knew what was actually going on.

At the moment, Section 215 says that an order must be approved by the secret FISA court if the FBI shows the data "sought are relevant to an authorized investigation" dealing with terrorism -- a requirement that provides little privacy protection in practice.

Wyden has proposed rewriting Section 215 to add some teeth to the privacy protections. Instead of mere relevance, he suggested requiring that the investigation fall into one of three categories: relating to a foreign government, an espionage investigation, or "an individual in contact with, or known to, a suspected agent of a foreign power."

That's much more limiting. More precisely, it would curb use of Section 215 as a data vacuum cleaner that the FBI may be using to hoover up customer databases from companies such as pharmacies, bookstores, retailers, credit card providers, telephone companies, and so on.

It's true that exabytes upon exabytes of data could, in theory, be helpful in investigating terrorism and other crimes. This was the motivation behind the Total Information Awareness idea, after all. But it's also true that nobody in the U.S. Congress believed that they were giving the FBI such sweeping authority when enacting the law nearly a decade ago.

Udall, who with Wyden proposed a series of unsuccessful pro-privacy amendments, said his recommended change to Section 215 would "require the FBI to show a nexus to terrorism when seeking a court order requesting access to business records. This is currently not a requirement, meaning the government may demand access to business records ranging from a cell phone company's phone records to an individual's library history."

At the moment, Udall said this week, the FBI can "collect business records on law-abiding Americans" who have no connection to terrorism. "We ought to be able to at least agree that the source of an investigation under Patriot Act powers should have a terrorist-related focus," he said. "If we can't limit investigations to terrorism, where do they end?"

Julian Sanchez, a policy analyst at the libertarian Cato Institute, believes the use of Section 215 that so alarmed the Democratic senators relates to the warrantless tracking of the locations of Americans' mobile devices. In a blog post, Sanchez suggests that Section 215 could be creatively interpreted by the Justice Department "to enable physical tracking of anyone with a cellphone," and subsequent data-mining could indicate whether two people are sharing the same physical location.

It's a plausible explanation, perhaps even the most plausible one. Wyden has drafted legislation that would curb warrantless access to location histories by police (see CNET Q&A with him). Wyden's so-called GPS Act says that, in general, it's illegal to track someone wirelessly except with a warrant signed by a judge, permission of the Foreign Intelligence Surveillance Court, or during an emergency situation -- language that would curb any such use of Section 215.

Another hint about what the FBI is doing comes from former Sen. Russ Feingold, a Democrat who was defeated last fall. He said in a February 2010 floor speech that:

Section 215 has been misused. I cannot elaborate, but I believe that the public deserves some information about this. I and others have also pressed the administration to declassify some basic information about the use of section 215, and it has declined... We must find a way to have an open and honest debate about the nature of these government powers, while still protecting national security secrets, and under current conditions that simply isn't possible... Lawyers in the Office of Legal Counsel looked for every possible loophole in statutory language to justify what I believe were clearly illegal wiretapping and interrogation programs. That should also teach us that we must be extraordinarily careful in how we draft these laws: We must say exactly what we mean and leave no room for reinterpretation.

One of the Wyden-Udall amendments (PDF) divulged a bit more detail about the Section 215 timeline. It said on February 2, 2011, the House and Senate "intelligence committees received a secret report from the Attorney General and the Director of National Intelligence" relating to "intelligence collection authorities" relying on portions of the Patriot Act that were about to expire. That amendment would have required the Justice Department to describe "the legal basis for the intelligence collection activities" described in that report.

Those amendments failed. So did similar amendments proposed by Sen. Rand Paul, the Kentucky Republican.

The Senate approved the final version of the Patriot Act extensions by a 72 to 23 vote on Thursday. The House followed with a 250 to 153 vote, and President Obama "signed" it into law that evening.