EFF Analysis of "Patriot II,"

Provisions of the Domestic Security Enhancement Act of 20031 that Impact the Internet and Surveillance

Read the bill

With the full effect of the USA Patriot Act (USAPA) on civil liberties in the United States still unknown, and without a shred of evidence that USAPA was required to help fight terrorism, the Bush Administration has been preparing a second piece of legislation. Tentatively titled the "Domestic Security Enhancement Act of 2003," it was instantly dubbed Patriot II or Son of Patriot. For purposes of this report, it's called USAPA II. Recently Attorney General Ashcroft denied that a bill was in the works, although he admitted that the leaked document is "what we've been thinking."2

Whether or not USAPA II is introduced, it's clear that the Patriot Act is casting a long shadow in Washington, D.C. For instance, Attorney General John Ashcroft recently told the Senate Judiciary Committee that he had authorized more than 170 "emergency" FISA searches since 9/11. In the previous 20 years, attorneys general had only authorized a total of 47 emergency FISA searches.

The first Patriot Act assumes that lack of information caused by laws that restricted government information-gathering was a major reason for the September 11 terrorist attacks. But nothing could be further from the truth. The most objective analysis -- that of the congressional joint inquiry committee focused on the government's failure to "connect the dots."3 It noted poor coordination between the many government agencies responsible for intelligence and counter-intelligence and poor sorting of the information it did have.

Simply collecting more information cannot solve this problem. But USAPA II makes the same mistake: it seeks more power to gather information with less oversight. Meanwhile, more agencies or task forces that you've never heard of are being created.

Let's be frank. The government has an insatiable appetite for data. But the mindless accumulation of data is not intelligence. Intelligence requires focused thinking and focused questions. Instead, we're building a Tower of Babel. If this continues, we'll get the worst of both worlds -- all the disadvantages of widespread privacy invasion with none of the security benefits.

Executive Summary

USAPA II, like its predecessor, is a grab bag of provisions spread throughout the legal landscape. One clear difference exists however. Unlike USAPA, USAPA II has no provisions that "sunset" after a certain time. All of its changes are permanent.

The breadth of USAPA II does make it difficult to break the bill down into neat categories. Nonetheless, many of the changes do fall into general areas. These are: 4

  1. Privacy Invasions. USAPA II dramatically widens the powers of government to invade the privacy of Americans and others living here. This includes:
    • Broad new authority to compel information from ISPs, friends, relatives, businesses and others, all without informing you.
    • Immunity for businesses that voluntarily turn over your information to law enforcement.
    • Extra punishment for use of cryptography-- no connection to terrorism needed.
    • Instant police access to your credit reports upon certification that they are sought "in connection with their duties" -- again, with no connection to terrorism needed.
    • Relaxed requirement of specificity for warrants for multi-use devices like PDAs and computers with telephonic capabilities.
    • DNA collected from all terrorism suspects/DNA database information open to all law enforcement.
    • Less judicial oversight of surveillance.
  2. More "End Runs" Around Limitations on Surveillance and Information Sharing. Federal, state and local officials can now freely share information, regardless of the original reason for gathering it. This includes information in your credit reports, educational records and visa records. It also includes information obtained by administrative subpoenas of any business, from your ISP to your credit card company to your grocer. It also includes DNA database information and information obtained through the secret court processes of the Foreign Intelligence Surveillance Act (FISA). Much of this sharing need not have any relationship to terrorism investigation.
  3. Gag Orders and Increased Governmental Secrecy. The "sunshine of public review" is a key check on abuses of governmental power. But USAPA II makes it even harder for the public to evaluate what the government is doing with its broad new powers. USAPA II allows gag orders for subpoenas that force third parties to turn over information about their friends, loved ones or customers while making it unlawful for them to tell anyone except their lawyers about the subpoena. In a similar vein, the law creates broad new exceptions to the Freedom of Information Act for terrorism detainee information, prevents the Environmental Protection Agency from warning the public about environmental dangers from chemical releases and reduces the ability of judges to force the government to present its evidence in open court.
  4. Expanded Reach of Powers under the Control of Secret Courts. The Foreign Intelligence Surveillance Act (FISA) was enacted more than 20 years ago to handle the special problem of non-criminal investigation of foreign intelligence activities in the United States. For this limited purpose, Congress established an unprecedented secret court system. USAPA expanded the reach of FISA and the secret court dramatically, and USAPA II goes even further. Under USAPA II, the secret court will be able to authorize searches of individuals with no connection to foreign governments or even terrorist organizations. It will increase the length of surveillance and decrease court oversight from the already low levels set by USAPA.
  5. Not Targeted to Terrorism. As with its predecessor, USAPA II contains many provisions that appear to be nothing more than an opportunistic attempt to increase governmental powers in areas unrelated to terrorism. In other areas, while terrorism is included, the provisions are not limited to terrorism-related investigations. These include government access to credit reports, sentence enhancements for using encryption, and sharing of some FISA-obtained information.

Analysis

  1. Shrinking Privacy Protections

    1. Everyone Else Turns Over Information About You.

      1. Increasing Amounts of Our Personal Information Is Held by Others.

        Even before USAPA's passage, Americans found their privacy increasingly eroded through the stockpiling, aggregating, selling and spilling of their personal information by third parties. The government5 has long argued, and several courts have accepted, the proposition that if you reveal this information to one private entity for one purpose (like an ISP storing your e-mail or a mortgage company offering you a loan), you no longer have a Fourth Amendment right to protect the information from unfocused, unchecked law enforcement fishing expeditions.

        The danger of this is clearly demonstrated by events in recent memory. In the 1970s Americans discovered that the FBI had maintained dossiers on more than a million of us, including Martin Luther King and Truman Capote, and used the information to harass and threaten innocent people.6 Yet the information available to J. Edgar Hoover and his associates is nothing like the range of information about Americans that exists now and can be easily collected and organized now. Some examples of the increase in third-parties holding once-private information include:

        • Correspondence Contents. Letters written on paper were traditionally stored in the home or business. The post office neither kept nor stored your letters. To be able to read them, the government normally had to get a warrant to search your home or office by proving "probable cause" that you had done something wrong.
          • Now, an increasing number of Americans store their correspondence on computers at their ISPs where it can be obtained by law enforcement on much lower standards than those required for a physical search of your home, depending on whether the e-mail has been opened by and how old it is. And while you'd usually know whether someone had invaded your home and rummaged through your papers, you're unlikely to ever find out that your e-mail had been searched while it was sitting on your ISP's mail server.
        • Envelope Info. As with the content of your letters, the Post Office did not routinely gather or store the information contained on the front of your envelopes, i.e. who you communicate with and when. If law enforcement wanted this information gathered, it had to make a specific request and the information was only gathered after the request was received.
          • Now this "envelope" information is automatically gathered and stored by your ISP for every e-mail you send and receive. Because of this, the government can now have access to your past as well as future communications records based only on a statement that it is relevant to a criminal investigation; you don't even have to be the target of the investigation.
        • Activities in the Non-Digital World. Your daily activities, whether wandering through a shopping mall, doing errands down a busy street, stopping for a burger or crossing a local bridge or toll road, used to be largely anonymous -- the only way someone could know where you had gone was to follow you.
          • Now the ubiquitous use of surveillance cameras and data collection devices like EZ-Passes means that a record of your activities is created almost everywhere you go. That information is completely outside your control and can be obtained by government or even volunteered to them with no notice to you.
        • Online. All of your activities on the web are generally recorded, from the Google search where you locate information, to the various websites you visit while shopping, researching, or discussing, to your purchases, downloads and printing of information. Nearly all websites keep both a record of what you do while visiting them and your IP address, which can easily be used to identify and locate you. This information can be (and sometimes is) aggregated over time and various web locations creating a mini-dossier of your activities available to law enforcement with a simple subpoena under USAPA II (or in the case of websites such as e-Bay.com, simply handed over to law enforcement upon request).7

        Ultimately, this problem seems unlikely to be addressed in any significant way without broad recognition that the Fourth Amendment guarantees against unreasonable search and seizure include limitations on the government's ability to gather and aggregate personal information about Americans that third parties gathered for other purposes.8

      2. USAPA II expansion. So more information about you is in the hands of third parties than ever before. USAPA II grants the government even more powers to gather and compile this information and reduces the safeguards intended to prevent its misuse. Specifically, USAPA II provides:
        1. Third Parties can be Compelled by Merely An Administrative Subpoena (secs. 128 & 129). Administrative subpoenas can be issued by government without prior court approval and are not even reviewed by a court unless the subpoenaed party (not you) objects. Under USAPA II, rather than seek a court order, the government will be able to issue a simple subpoena to require a third party such as your ISP, library, doctor, friend or loved one, to turn over information about you to the government. The government need only assert, if challenged, that the information was sought "with respect to an investigation" into any one of the broad category of offenses related to domestic or international terrorism. Another provision makes it easier to use "National Security Letters" (like subpoenas) to get information from ISPs, credit reporting firms, and financial institutions for "counter-intelligence" purposes. Additionally, USAPA II allows:
          1. Gag orders for those required to turn over information about you with penalties for telling anyone about the subpoena, including the target. 18 USC §1510(e) (secs 128 & 129)(see below)
          2. Judicial enforcement for noncompliance. Those subpoenaed can make a motion with the court to resist the subpoena on your behalf, but you'll never know if they do.

        2. TIPS is back. Businesses encouraged to volunteer information about you (sec 313). This provision strengthens government's ability to pressure businesses into giving information about their customers to law enforcement without a court order or subpoena. It also creates an incentive for snooping (or fulfilling a grudge). The provision creates civil liability protection for businesses and their personnel who voluntarily provide information to federal law enforcement agencies to assist with terrorism investigations. This would overrule many privacy laws, like the Electronic Communications Privacy Act provisions that prevent your ISP and other hosts of your communications from simply turning this information over to the police except in emergency situations.

          The EFF and many others were highly critical9 of the dive certifying organizations PADI, NAUI and SSI when they turned over information about all certified divers to the FBI without requiring any legal process. Indeed, when EFF challenged a similar request on behalf of a Beverley Hills dive shop, the US Attorneys office backed down10, apparently recognizing that it would be difficult to convince a judge of the need for this sort of broad, unfocused information. This provision would create an additional incentive for the businesses to yield to unreasonable fishing expeditions for data by law enforcement.

        3. Instant Police Access to Credit Reports With No Limits or Oversight (sec. 126). USAPA II would allow law enforcement to obtain your credit reports upon a simple certification that they will use the information only "in connection with their duties to enforce federal law." The provision does not require that the investigation be related to terrorism or even to a violent offense. And the requirement of consumer notice is lifted, so you'll never know when they pull your credit rating. 15 USC §1681b(a)(1).
      3. You Shouldn't Protect Your Privacy: Cryptography Sentence Enhancements. (sec. 404). Just as the government encourages Americans to lock their doors and take other personal precautions against crime and terrorism, it should encourage Americans to use encryption. USAPA II steps in exactly the opposite direction, creating a five-year sentence enhancement for any person who, while committing or attempting to commit a federal felony, knowingly and willfully uses encryption technology to conceal any incriminating communication or information relating to that felony. This provision creates a disincentive for Americans to protect their data and information from identity thieves, stalkers and other criminals. It applies to any federal felony, most of which have nothing to do with terrorism. It creates the spectre of sentence enhancements for business travelers who use VPN systems to gain access to their data remotely or those who use file-sharing systems that utilize cryptography to protect the contents of a file.
      4. New Devices, Less Privacy. (sec. 124). This provision applies to those who have multi-function devices such as a BlackBerry or a computer with voice over IP or even a computer with a modem. It would eliminate the traditional rule that if the government wants to surveil or search you, it must specify "with particularity" what it is planning to search or listen to. That is, if the government gets a search warrant to monitor your e-mail it does not also get to monitor your telephone conversations unless the warrant says that too. This rule is designed to ensure that surveillance doesn't become a "fishing expedition" and that law enforcement only does what it tells the court it is going to do. This provision would eliminate that limitation where the two functions are in one device.
        1. That is, a court order allowing the FBI to monitor your e-mail can also be used to monitor your telephone conversations if you use your computer for those calls, even if this sort of surveillance isn't specified in the order and the "predicates" for wiretapping telephone conversations have not been met. This weakens privacy because telephone wiretaps are only allowed for investigating specified "serious" crimes, while e-mail intercepts are allowed for investigating any federal felony.
        2. Similarly, if the FBI gets an order to wiretap your modem line, they also have access to the stored data on your hard drive even if the information they discover is about a completely unrelated crime.
      5. DNA Database (secs. 302) EFF has long noted the dangers of centralized databases of information about Americans, ranging from the vulnerabilities of such databases to corruption, hacking and information leakage to the inevitability of bad data in large databases and the risk in relying upon them for such important issues as deciding who is a terrorist. USAPA II, by expanding the national DNA database in some extremely suspect ways, exacerbates these problems,
        1. Dramatic expansion of collection from "terrorism" suspects, not just those convicted (sec. 302, 303, 306) Previously DNA samples could only be taken from those convicted of terrorism. 42 USC. §14132. USAPA II allows collection and use of DNA samples of mere suspects, including suspected terrorists and persons suspected of being members of a terrorist organization. The Attorney General has tremendous discretion to designate someone as a "suspected terrorist." It also allows collection from aliens engaged in activity that endangers national security and those designated "enemy combatants."
        2. Collection from and Use of Database Info Beyond Terrorism (sec. 303). Creation of DNA database for terrorists includes input from all federal agencies -- that is, if the Park Ranger decides that you are a suspected terrorist he can take a DNA sample. USAPA II also grants authority to use all federal biometric databases, including fingerprints, DNA and other identifying information to investigate terrorism or "other unlawful activities by suspected terrorists."
        3. Sharing of DNA Information with State, Local or Foreign Agencies (sec. 303). USAPA II allows sharing of information with federal, state, local or foreign agencies to investigate terrorism or "other unlawful activities by suspected terrorists."
        4. Coerced DNA Samples In Exchange for Release on Bail (sec. 306). USAPA II requires those terrorists or suspected terrorists in custody to give DNA samples as a condition of release.
      6. More Surveillance, Longer Surveillance, Less Privacy.
        1. Non-supervised Surveillance of Churches, Mosques, Protesters Returns (sec. 312). In many cities throughout the United States, past police abuses of surveillance authority, including the keeping of dossiers on innocent individuals, harassment of political activists and other constitutional rights violations have resulted in consent decrees and other court provisions preventing the wholesale, unsupervised surveillance of groups and organizations. Such surveillance continues today: last December, it was discovered that the Denver Police Department had kept thousands of dossiers on peaceful groups.11 USAPA II would repeal all of those decrees, allowing police to keep dossiers on innocent people and peaceful protest groups. It also allows police to attend community meetings, religious services and other associational activities as a matter of course with no judicial oversight to prevent abuse.
        2. Extended time for "domestic terrorism" searches and surveillance (sec. 123). Federal law has long maintained strict rules about law enforcement surveillance. USAPA II would relax those rules for investigations into domestic terrorism.
          1. Electronic surveillance can continue for 90 days without need for court reauthorization. The previous limit was 30 days. 18 USC §2518(5)
          2. Courts currently can order periodic progress reports from law enforcement to protect against abuses. The schedule of these reports is set by the judge, based upon his or her evaluation of the individual situation. USAPA II would restrict a court's ability to monitor potential law enforcement abuse by preventing a judge from ordering reports for periods less than 30 days. §2518(6)
          3. USAPA II creates another way for law enforcement to delay telling you that your stored electronic communications have been searched. This is accomplished by adding "national security" to the list of specified "adverse results" that allow delay in notification. §2705
          4. Surveillance of "envelope" information (see above) has been extended to 120 days without court review rather than the previous 60 days. This surveillance, called pen/trap surveillance, involves the tracking of messages to and from a person, including sender/recipient, size, date, and all other "non-content" information. 18 U.S.C. §3213
        3. Nationwide search warrants for nonviolent acts (sec. 125) Issuance of terrorism-related search warrants by far away courts used to be limited to situations involving "violent acts." Now, any court in the country may issue warrants that can be executed anywhere else in the country for any non-violent offense in the growing terrorism-related crimes list in §2332b(g)(5)(B), including computer crimes, harm to the communications infrastructure and providing material support to terrorists. 18 USC §2331.
        4. Allows full panoply of electronic surveillance techniques for not just terrorism crimes, but any offense in the broader list of "terrorist activities" (sec. 121 & 122). This provision allows the full use of electronic surveillance techniques against not just terrorism crimes but also acts of international or domestic terrorism. Under USAPA, the concept of "terrorism" was expanded dramatically to include any violation of federal or state law committed with the intent of affecting government policy and that is potentially dangerous. Obviously this sweeps in much activity formerly treated as civil disobedience and even activities where there is no intent to break the law, such as political protests, if someone gets hurt.
          1. The provision also allows for surveillance (wiretaps and pen traps) without a court order in emergency situations. 18 USC §2518(7) and § 3125.
          2. It also allows wiretaps and pen/traps orders for "envelope" information to be issued either where the order is to be executed or in the place where the alleged offense occurred or where the activities are being investigated. The goal is to make it easier to get jurisdiction for foreign wiretap requests, which don't usually have a US jurisdiction for the investigation.
  2. End Runs Around Limitations on Various Forms of Surveillance. USAPA created a series of "end runs" around the checks and balances of various forms of surveillance, such as by removing limitations on the use of information gathered for one purpose for other purposes. This was given a boost recently by the FISA Court of Appeal, which held that the 30-year long assumption that there was a "wall" between domestic and national security surveillance was just a figment of the joint imaginations of several judges and hundreds of attorneys both inside and outside of government. But apparently even this is not sufficient for the Bush Administration. USAPA II authorizes even more information "sharing" and sets up so many easy ways for law enforcement to evade the strictures of traditional surveillance that it's getting hard to keep track. And while some information sharing may be appropriate for legitimate terrorism investigations, USAPA II eliminates most of the USAPA I provisions that limited such sharing to terrorism investigations.
    1. Information sharing (Sec. 311). Consumer credit information, visa-related information, educational records can now be sent to state and local law enforcement with no limitations except "guidelines as the Attorney General shall issue to protect confidentiality." The "sharing" need not be part of a terrorism investigation.
    2. DNA Database of Suspected Terrorists (sec. 303). Information in the DNA database, fingerprints or other "identifying information" may be shared by all federal and local agencies, and even foreign agencies if used to investigate terrorism or "other unlawful activities by suspected terrorists."
    3. National Security investigations (Sec. 129) Information obtained through third-party administrative subpoenas issued by FBI officials for use in national security may be shared with federal, state and local law enforcement "as provided in guidelines approved by the Attorney General." This information previously could not be shared unless the information was related to foreign intelligence collection and counterintelligence investigations. 18 USC. §2709.
    4. Free-flowing FISA Information
      1. FISA Information flows more easily to law enforcement (sec. 105). Any Deputy, Associate or Assistant US Attorney may authorize use of FISA-derived information in a criminal proceeding. Previously only the Attorney General himself could authorize such use. 50 USC §1806.
      2. Law enforcement can be given FISA pen register information about US citizens for any purpose, not just terrorism. (sec. 107). USAPA allowed this information to be given only for the purposes of investigating international terrorism. This limitation is removed.
        1. For telephones, this is the numbers you call and that call you along with dates and times and lengths of calls
        2. For e-mails, after USA Patriot Act, this is all non-message information including sender, recipient, date, size of message, existence of attachments and routing information-- essentially, all header information except the subject line.
  3. Gag Orders Increased.
    1. Administrative Subpoenas Gag Orders (sec. 128 & 129). Those who are forced to give information to the government pursuant to administrative subpoenas, a list that could include everyone who you come into contact with or do business with, are forbidden from telling you or any other person (except counsel).
    2. Credit reports (sec. 126). When your bank or mortgage company seeks your credit report, notice to you is required. This requirement of consumer notice is lifted for government. 15 USC §1681b(a)(1).
    3. Grand jury subpoena gag orders (sec. 206): The Reef Seekers Rule. Subpoena recipients may now have secrecy imposed on them (except for counsel) in cases where serious adverse consequences may otherwise result. Fed. Rule Crim. P. 6(e)(2)(B). This provision would gag businesses like Reef Seekers Dive Shop which sought to draw attention to a grand jury subpoena seeking the names of all students who had not finished scuba classes. http://www.eff.org/Privacy/Surveillance/20021021_eff_pr.html
  4. Government information black hole. Even while the privacy of Americans is being relentlessly reduced, the Bush Administration continues its assault on public access to information. In addition to the gag orders mentioned above, USAPA II contains several provisions that reduce transparency in government:
    1. Detainee Information Exempt from the Freedom of Information Act (sec. 201). The Government continues its cynical argument that the basis for refusing to give any public information about its detention policies, even to terrified friends and family, is to protect the privacy of those detained.
    2. Gagging the Environmental Protection Agency from informing us of dangers of chemical releases (sec. 202) EPA requires reports on dangers of chemical releases. 42 USC §7412(r). USAPA II limits both what information is given out and who can get it. Only those who live and work in the geographic area likely to be affected can see the reports, and access is "read-only," so they cannot send it on to friends or loved ones (or the press). Additionally, the public is not allowed to see any information that might allow someone to deduce the location of the potential chemical threat.
    3. Capital buildings information exempt from FOIA (sec. 203).
    4. Reducing Judicial Oversight of Classified Information Requests (sec. 204). This provision increases the government's ability to use secret evidence. It allows government shall be able to make a request for Classified Information Act procedures without notice to the other side and in the judge's chambers rather than in the public courtroom. It reduces a judge's ability to force the government to make its case in open court, even if the judge believes that this is necessary or appropriate.

  5. FISA on steroids. USAPA greatly expanded the power and scope of the once- limited secret court. In addition to the FISA provisions listed above that allow the information to be widely shared, USAPA II expands FISA authority to include:

    1. Individual with no connection to anyone else can now be deemed an "agent of a foreign power." The FISA process of secret courts and surveillance was originally created to allow surveillance of agents of foreign governments -- spies, foreign embassy officials and others affiliated with a foreign government. It was also limited surveillance on Americans who helped foreign agents to those who broke or were likely to break U.S. law. Only persons in these two categories qualified as "agents of a foreign power" who could be subject to the secret court processes. Under USAPA II, FISA jurisdiction can be invoked in almost any situation that can be linked to international terrorism, thus circumventing the protections and openness of regular court processes. Instead of the protections of domestic law, a person is subject to FISA's broad, longer-term surveillance, reduced oversight and one-sided review before a secret court that never says no.

      1. Individuals can be foreign powers (sec 101). USAPA II allows an individual with no affiliation with a foreign government or a terrorist organization to be deemed a "foreign power" for purposes of FISA surveillance of that person and those associated with him or her.
        1. This provision was introduced as a separate measure, entitled, , and recently passed through a key Senate Committee.
      2. Reduced standards for surveillance (sec. 102) Americans who are deemed to be "agents of a foreign power" but who don't break the law can now be subject to FISA surveillance. Previously there had to be a showing at the agent did or might break the law before these broad powers could be invoked.
        1. Longer wiretaps=Less court oversight (sec. 111). Organizations, corporations and associations of international terrorism used to be subject to wiretaps for no longer than 90 days before reauthorization by the FISA Court was required. They could also be treated as "U.S. Persons" under the law. Under USAPA II these groups are treated as "foreign powers," the same as foreign governments, so wiretaps are allowed up to a year without court review. 50 USC §1801(i)(1)-(3) instead of (4)-(6). Note that this change only applies if the group is not substantially composed of US persons or if there is probable cause to believe that no communication or property of a U.S. person will be acquired.
    2. FISA Court oversight reduced other ways too (secs. 103-104). FISA allows the Attorney General to act without any court oversight in rare circumstances. 50 USC § 1802. USAPA II broadens those situations:
      1. the Attorney General may act without any court oversight for fifteen days after Congress authorizes any military force or after the US has suffered an "attack creating a national emergency," in the purview of the Attorney General. Previously this sort of surveillance free for all was only allowed after a Congressional declaration of war.
      2. With only presidential authorization, the Attorney General may now wiretap foreign governments for all communications within the broad category of "technical intelligence." Previously the Attorney General could not wiretap for spoken communications.
    3. No Accountability for Breaking the Rules (sec. 106). FISA has long provided a defense of "good faith reliance" on a FISA order even if the officer engages in unauthorized surveillance or searches or discloses information improperly. This defense is extended to situations where there is no FISA court order, but surveillance is allowed, such immediately after the United States has been attacked by terrorists or after war has been declared (see secs 103-104 above).

  6. Law Enforcement Powers Not Limited to Terrorism. As with USAPA before it, USAPA II does not limit the scope of the powers to those necessary or even related to terrorism. This includes:

    1. Information sharing (sec. 311). Consumer credit information, visa-related information, educational records may be freely shared. No relationship to terrorism is required.
    2. FISA Information may be shared to officials conducting any kind of criminal proceedings, not just terrorism (sec. 105).
    3. National Security investigation subpoena information can be shared without limitation as to its use (sec. 129)
    4. Law enforcement can be given FISA pen register information about US citizens for any purpose. (sec. 107).
    5. Grand jury subpoena gag orders are not limited to situations involving terrorism (sec. 206).
    6. Cryptography Sentence Enhancements apply without limitation to terrorism (sec. 404).
    7. The Environmental Protection Agency is prohibited from informing us of dangers of chemical releases (sec. 202). While the justification of this is to prevent terrorism, it is not limited to situations where terrorism is suspected.
    8. Information from multi-function devices is not limited to terrorism-related surveillance. (sec. 124).
    9. Reduced judicial oversight of classified information requests is not limited to terrorism (sec. 204).
    10. Autopsy Orders are not limited to terrorism investigations (sec. 127)
    11. Surveillance done at the request of foreign governments is not limited to either US or foreign terrorism investigations (sec. 313)

  7. Grab Bag: Widens Scope of Laws/More Penalties/More Power for the Attorney General.

    1. Broaden scope of "Material support to terrorism." (sec. 402) This provision eliminates the requirement of criminal intent for those charged with "material support of terrorism" under 18 USC §2339A. It now allows conviction if the acts "by their nature" appear to intended for the terrorism purposes. USAPA II would broaden the definitions of "training" and "personnel," further expanding the reach of the statute. The provision also attempts to create a constitutional justification for making mere "support" of terrorists a federal criminal offense. In general, such a broad, unfocused term as "support" would not be sufficient to criminalize activities under federal law. The statute tries to create this justification by tying the need to criminalize "support" to interstate and foreign commerce and the federal government's need to control activities of Americans outside the United States.
    2. Additional Crimes on Death Penalty List (sec 411) Approximately fifteen additional crimes could trigger the death penalty under the category of "terrorist murders"
    3. 410. Expanded list of crimes with no statute of limitations. USAPA II eliminates the requirement that only crimes with a foreseeable risk of death or serious injury have no time limit for prosecution. Now all crimes included in the list at 18 USC. §2332b(g)(5)(B) list have no time limit. This includes "cyberterrorism" that causes financial damages only and "material support" for terrorism even if the activities are completely free of the risk of violence.
    4. 408. Increased supervised release for terrorism offenses. USAPA II allows increased times of supervised release, including up to life, for those convicted of a terrorism-related crime even if the crime does not involve risk of or actual death or serious injury. This includes cyberterrorism and material support for terrorism, even if no injuries occurred.
    5. Increased federal jurisdiction (sec. 403, 407). USAPA II attempts to shore up the arguments for federal (rather than state court) jurisdiction for any case involving terrorism (407), or weapons of mass destruction (403). It claims that federal jurisdiction is proper whenever the property that is attacked is used in interstate commerce or when any perpetrator crosses state line in furtherance of the offense or whenever foreign government owned property in the US is involved.
    6. Reduce Judicial Discretion (sec. 405) USAPA II creates a presumption of pre-trial detention in cases involving terrorism.18 USC 3142(e). This is a bit puzzling since it doesn't appear that any judges have been unreasonably allowing terrorism suspects to go free on bail pending trial.
    7. Aviation Licenses Revoked more easily (sec. 409). USAPA II allows immediate suspension, revocation or denial of certificate for civil aviation for national security reasons if risk of air piracy or terrorism or a threat to airline or passenger safety.
    8. "Beijing Orders United States to Wiretap Chinese Democracy Activists" (sec. 321) USAPA II allows U.S. law enforcement to seek and execute search warrants and pen/trap orders on behalf of foreign governments. Previously the United States could only execute subpoenas for foreign governments. 28 USC §1782.
    9. Attorney General can override extradition treaties (sec. 322). Extradition for anything the U.S. Attorney General and Secretary of State want, even if not on the list of offenses where extradition is allowed under the treaty. For instance, the United States routinely refuses to extradite individuals who would be prosecuted for offenses that are protected by the First Amendment here. Under this provision, the Attorney General could decide, perhaps out of a desire to encourage an extradition back from a country, to extradite an American to Saudi Arabia who is being sought for speaking out against that government's repression of women.

  8. Is there anything decent in there? As with USAPA before it, USAPA II does contain some provisions that are welcomed. It also includes several clarifications to USAPA provisions that were causing confusion (not included in this report) and several items that are unobjectionable, including:

    1. FISA Court of Review appointed counsel (sec. 108). Allows the Court to appoint an attorney to defend a lower FISA court judgment that the Attorney General chooses to appeal. This is a good start, but the statute should also provide for representation for the target of the surveillance, even if by an interest group, and should also provide for more transparency in the rules of the Court and for amici participation.
    2. Security provisions for governmental officials are not "income" to them (sec. 205). This provision would stop counting cost of security provisions for senior governmental officials as part of their income for tax purposes. Civil servants who require extra protection because of their duties should not be penalized in the tax code.
    3. Terrorism Hoaxes penalized even if no threats (sec. 401). Require reimbursement if expenses caused and authorize a civil action for such expenses.
    4. Autopsy Orders (sec. 127) The government can order autopsies whenever "necessary or appropriate in the conduct of federal criminal investigations."
    5. FISA court compliance powers (sec. 109). While the EFF believes that the FISA court itself should be rethought and that its jurisdiction has become grossly overbroad under both USAPA and USAPA II, granting the court the authority to enforce its own orders makes sense as a matter of judicial efficiency.
    6. Airlines are "mass transportation" (sec. 406) This provision is expressly tied to the Richard Reid "shoe bomber" case. While Mr. Reid was charged with many offenses and ultimately pled guilty, the Court did dismiss one charge, that of using a "mass transportation vehicle." This provision will allow an enhancement of sentence under 18 USC §1993 to up to life imprisonment for terrorist attempts on commercial airplanes, even if no death resulted.

Conclusion

USAPA II would create grave new violations of the privacy of ordinary Americans and place even more unchecked power into the hands of law enforcement and the intelligence community. We're only beginning to see the effects of USAPA and the administration has not made the case that we are safer as a result of it. Now is certainly not the time to take even further steps down this dangerous path, especially when some of the steps may not be reversible. Massive governmental databases, for instance, are not easily destroyed.

[1] This analysis is of the draft of January 9, 2003.

[2] http://www.politechbot.com/p-04519.html

[3] http://www.eff.org/Privacy/Surveillance/FISA/hill3.pdf
http://www.eff.org/Privacy/Surveillance/FISA/Leahy.pdf

[4] This analysis only discusses the portions of USAPA II where EFF has expertise, mainly surveillance, general civil liberties and governmental transparency.  USAPA II also has some extremely troubling provisions that increase the ability for the US to strip an American of his or her citizenship and prosecute individuals based upon financial activities, among others.  Those provisions are outside the scope of this report but have been well discussed by others, including the ACLU at: http://www.aclu.org/SafeandFree/SafeandFree.cfm?ID=12166&c=206

[5] While this loss of privacy is something to be concerned about even when the entity seeking the information is a spammer hoping to sell you stuff or an ex-husband or stalker with darker intentions, it is equally if not more, troubling when the information is sought by governmental officials with the many more legitimate powers, including the power to throw Americans in prison and even strip Americans of their citizenship, if one of the USAPA II provisions is passed.

[6] Church Commission member Walter F. Mondale, "Democracy's Challenge: Balancing Personal Liberty and National Security" June 6, 2000, at Macalister College. 2nd in the series Fifty Years: The Mondale Lectures on Public Service, available on the internet at:
http://lists.extension.umn.edu/pipermail/mnlre/2000-May/000001.html

[7] http://research.yale.edu/lawmeme/modules.php?name=News&file=article&sid=925

[8] See, e.g. sec. 101 of Erights bill introduced by Senator Leahy in 1999. http://www.cdt.org/crypto/legis_106/ERIGHTS/sectionanaly.shtml

[9] http://www.eff.org/EFF/Newsletters/EFFector/HTML/effect15.19.html#III

[10] http://www.eff.org/Privacy/Surveillance/20021021_eff_pr.html

[11] http://www.aclu-co.org/newsletters/2002Apr/spy_files.htm
http://seattletimes.nwsource.com/text/134533962_denver12.html