Want CNET to notify you of price drops and the latest stories?

Judge disarms Patriot Act proviso

Ruling nixes a key aspect of Patriot Act that let the FBI secretly demand data from Internet providers.

Declan McCullagh Former Senior Writer
Declan McCullagh is the chief political correspondent for CNET. You can e-mail him or follow him on Twitter as declanm. Declan previously was a reporter for Time and the Washington bureau chief for Wired and wrote the Taking Liberties section and Other People's Money column for CBS News' Web site.
Declan McCullagh
5 min read
A key part of the USA Patriot Act that allows the FBI to secretly demand information from Internet providers violates the U.S. Constitution, a federal judge said Wednesday in a ruling that could have a broad impact on government surveillance.

U.S. District Judge Victor Marrero barred the FBI from invoking that portion of the law in the future, saying the mandatory gag orders amount to an "unconstitutional prior restraint of speech in violation of the First Amendment."

The 2001 law requires Internet service providers and any other type of communication provider--including telephone companies--to comply with secret "national security letters" from the FBI. Those letters can ask for information about subscribers--including home addresses, what telephone calls were made, e-mail subject lines and logs of what Web sites were visited.

In a lawsuit filed in April, the American Civil Liberties Union challenged the law on behalf of an unnamed Internet company as an undue restriction on free speech and privacy rights. The recipient of a national security letter (NSL) is forever gagged against disclosing its existence "to any person"--a strict requirement that the ACLU argued could not be squared with the U.S. Constitution.

"All but the most mettlesome and undaunted NSL recipients would consider themselves effectively barred from consulting an attorney or anyone else who might advise them otherwise," Marrero concluded, "as well as bound to absolute silence about the existence of the NSL...For the reasonable NSL recipient confronted with the NSL's mandatory language and the FBI's conduct related to the NSL, resistance is not a viable option."

Such letters are not new: Before the Patriot Act was enacted a few weeks after the Sept. 11, 2001, terrorist attacks, they could be used in investigations of suspected terrorists and spies. But after the change to the law, the FBI needed only to say that a letter may be "relevant" to a terrorist-related investigation. No court approval is required.

Marrero said his order blocking the FBI from using national security letters--a type of administrative subpoena--would not take effect for 90 days, so the government would have time to appeal.

A Justice Department spokesman said late Wednesday that "we are reviewing the ruling" and no decision had been made about what to do next.

Political setback?
Wednesday's decision could prove to be an embarrassing election-season setback for President Bush, who has campaigned as a wartime leader and rarely misses an opportunity to argue that the Patriot Act should be renewed. Some portions are scheduled to expire Dec. 31, 2005.

"Every action in the Patriot Act requires a court order, before the government can move," Bush said at a rally in Derry, N.H., last week. "In other words, your rights are protected...We need to extend the Patriot Act, with the constitutional safeguards for our U.S. citizens."

This is not the first rebuff related to the Patriot Act that the Bush administration has encountered. In June, the U.S. Supreme Court said that prisoners held in Guantanamo Bay can ask American judges to review their confinement--a blow to Bush's assertion that "enemy combatants" can be held indefinitely without judicial review.

Concerns over the sweeping powers that the Patriot Act granted to federal police are prompting action in Congress.

Last year, the U.S. House of Representatives voted 309 to 118 for legislation that would essentially block part of the Patriot Act that permitted law enforcement officials to seek a court order that would let them surreptitiously enter a home or business. One proposal in the Senate, called the Safe Act, would amend the Patriot Act by slapping limits on current police practices relating to surveillance and search warrants.

In the past few weeks, Bush and his allies have invoked the Patriot Act when stepping up their attacks on Democratic presidential hopeful John Kerry. "He has been for the Patriot Act--and against it," Vice President Dick Cheney said in Tulsa, Okla., on Friday. "Senator Kerry says he sees two Americas. It makes the whole thing mutual--America sees two John Kerrys."

Kerry supported the 2001 law, and his campaign says the senator "stands by his vote for the Patriot Act...He even wants to strengthen some aspects of it relating to terrorism, such as improving intelligence information sharing."

Kerry has argued that the problem with the Patriot Act is not the law, but the "abuse" of the law by Attorney General John Ashcroft. That's why, Kerry says, he supports the Safe Act's proposed amendments.

The long arm of the court
If upheld on appeal, Wednesday's decision could have a far-reaching impact on the way the FBI conducts investigations. Other portions of federal law that let the FBI serve secret national security letters to banks, financial firms and credit reporting companies are now vulnerable to court challenge, Washington attorney Stewart Baker said.

"This could have significant impact on a whole host of other statutes," said Baker, a former general counsel to the National Security Agency who now advises Internet providers. "This is really the first core provision of the USA Patriot Act that's run into constitutional trouble. It will certainly play into the debate."

FBI agents can, however, continue to use other mechanisms to obtain data from communications firms, including a subpoena, warrant or court order after the 90-day period elapses.

The impact of Wednesday's decision extends beyond the Patriot Act. NSLs to telecom firms originated with a 1986 law called the Electronic Communications Privacy Act, which permitted them only in relation to an investigation of "an agent of a foreign power." That once-strict requirement was broadened in 1993 and again by the Patriot Act eight years later.

It's unclear how often NSLs are sent to communications firms. The FBI redacted every line in one such document released to the ACLU through the Freedom of Information Act. But the number of records implies that hundreds of NSL requests were made between October 2001 and January 2003. Judge Marrero said that, to the best of his knowledge, this is the first time an NSL has been challenged in court.

Marrero said another reason to halt the use of NSLs to communications firms was the worrisome potential for misuse. "For example, the FBI theoretically could issue to a political campaign's computer systems operator a (letter) compelling production of the names of all persons who have e-mail addresses through the campaign's computer systems," he wrote. "The FBI theoretically could also issue an NSL (to learn) the identity of someone whose anonymous Web log, or 'blog,' is critical of the government."

Kurt Opsah, an attorney at the Electronic Frontier Foundation, which filed a brief in the case opposing the government's position, said that line of thinking could eventually could provide a precedent that would give more legal protection to online anonymity. "That analysis could be more broadly applied than just to the NSL context as a protection to subscriber privacy," Opsah said.

Three bills currently in Congress, HR3179, HR3037, and S2555, would clear up some of the murkiness surrounding national security letters by clarifying what procedures would be used and imposing penalties on those who disclosed the existence of such a letter.

One reason NSLs are particularly disturbing when sent to Internet providers, Marrero wrote, is that so much more information may be on file than in an analog age: "Internet records of the type obtained via (an NSL) could differ substantially from transactional bank or phone records (and disclose) a log of e-mail addresses with whom a subscriber has corresponded and the Web pages that a subscriber visits."