Source: https://www.llrx.com/2002/02/features-the-usa-patriot-act-and-patron-privacy-on-library-internet-terminals/?share=twitter
Timestamp: 2019-04-24 06:33:06+00:00

Document:
Mary Minow is a library law consultant with librarylaw.com. She is currently writing a book on library law for the American Library Association with Tomas Lipinski. This librarylaw.com column is not intended to replace legal advice. For a particular fact situation, consult an attorney.
Within hours after the September 11 attacks, the FBI began serving search warrants to major Internet Service Providers to get information about suspected electronic communications.2 Within a week, police and FBI agents received tips that some suspects used libraries in Hollywood Beach and Delray Beach, Florida. FBI agents have since requested computer sign-in lists from other libraries. President Bush signed the USA PATRIOT Act into law on October 26, 2001. This law is expected to greatly increase the number of requests for sign-in lists at libraries.
The USA PATRIOT Act stands for the Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001. The legislation is broad and changes immigration laws, tightens controls on money laundering, and greatly expands the legal use of electronic surveillance.
The Act greatly expands the use of “roving wiretaps.” This means that a wiretap order targeted to a person is no longer confined to a particular computer or telephone. Instead, it may “rove” wherever the target goes, which may include library computers. The new law allows a court to issue an order that is valid anywhere in the U.S. This greatly increases a library’s exposure to court orders. Further, the use of pen/trap orders is now “technology neutral” and applies to the Internet as well as telephones. Whereas incoming and outgoing phone numbers have long been available upon the mere showing that they are relevant to an ongoing investigation, now email headers and URLs visited are available under the same low standard. Civil liberties advocates argued that such information is not analogous to phone numbers, but far more revealing (including, for example, the keywords used in Google searches such as http://www.google.com/search?hl=en&q=mary+minow).
Much of the Act expands the Foreign Intelligence Surveillance Act (FISA), in which the standards for courts to approve surveillance of foreign intelligence gathering are far less demanding than those required for approval of a criminal wiretap, which requires a showing of probable cause.
What does the USA PATRIOT Act mean for libraries?
The upshot is that there will be a great many more surveillance orders, everywhere in the country, and in turn there will be more requests for library records, including Internet use records. Think of law enforcement as needing to enter two doors to apprehend a suspect.
Door One leads to the computer server. Law enforcement can find electronic tracks through email or Internet history logs. They may have intercepted messages through surveillance or other means. This leads to a particular computer terminal, date and time.
Door Two leads to the individual. This person could be someone using the Internet in a library, particularly someone who wishes to remain anonymous. The FBI (or others) will want to see a library record of who was using the library’s terminal(s) at a particular date and time. If the library keeps sign-up records, law enforcement will want to see those records.
Will the FBI (or other law enforcement) ask to put surveillance technology on library computers?
In many cases, the surveillance technology will be placed elsewhere, and lead law enforcement directly to Door Two. However, it is possible that the FBI will approach the library and ask to place software (such as the controversial DCS1000 (also known as Carnivore) on library servers.4 Libraries should be sure to insist on a court order before complying. Note that libraries that share servers with cities or others may not be directly approached.
Should a library cooperate with the FBI (or other law enforcement) in giving library Internet sign up lists?
Yes, but advisedly with a court order. This is where the library’s individual policies and procedures will become increasingly important. Does the library require sign-ups? If there are no sign-up lists, the inquiry essentially halts. Does the library allow first names only, or made-up names? Does it require identification? Library cards with addresses? Does it keep sign-up records, and if so, for how long? Does it use an automated system that ties library card numbers (tied to registration information) to Internet use? Is such information electronically disengaged after use and electronically shredded? Is it backed up on computer tapes? How long are backup tapes kept?
Should my library use sign-ups for Internet terminals? If we use sign-up records, are they subject to the California Public Records Act, making us at risk if we destroy them?
Libraries generally decide on whether and how to use sign-up procedures based on the supply and demand of Internet terminals. Sometimes libraries want identification to afford a measure of accountability i.e. prevent hacking. Libraries should be aware, however, that the sign-up procedure has considerable privacy implications. If records are kept, it is best if precise information can be extracted (e.g., user at Terminal #2 on November 13, 2001 at 1 p.m.) without giving out other patron’s data.
In addition, local ordinances may apply. Check with the library’s attorney.
I read that the USA PATRIOT Act allows federal agents to get court orders for the production of “business records.” Does that include library records?
This provision is designed to get ISP records of user billing information. Library patrons who are merely accessing information on Internet terminals should have strong First Amendment arguments. Nevertheless, it’s not clear whether they would win. Senator Russ Feingold tried to get an amendment to clarify that the Act would not preempt existing federal and state privacy laws, by maintaining existing criteria for records, such as library records. This amendment failed. Also, it should be noted that this “business records” provision is an amendment of the FISA law, which means that court proceedings are not open and are sealed.
I read that a research librarian tipped off the police in Florida. Can I do that, or must I wait for them to come to me?
If you recognize a picture in the newspaper as one of your patrons, that is not divulging a library record. If, on the other hand, you recognize a suspect’s names from library records, you should definitely check in with your attorney before deciding whether to call the police.
Recall that the vast majority of library patrons are not terrorists, and libraries should make all efforts to protect patron privacy.
Wasn’t there an FBI program years ago that sent FBI agents into libraries asking for reading habits of suspicious looking people?
Yes. The FBI Library Awareness Program was a program that ran for about 25 years, in which FBI agents tried to enlist the assistance of librarians in monitoring the reading habits of “suspicious” individuals. Such individuals were variously defined as people with Eastern European or Russian-sounding names or accents, or coming from countries hostile to the U.S.12 During the Library Awareness Program, some FBI agents wrongly claimed that they were not subject to statutes protecting library records.13 The efforts were largely unsuccessful, due to the tremendous outrage and resistance from those in the library profession.
The most important lesson that libraries learned was the importance of training the “friendly front desk clerk” and even volunteers not to hand over the information, but to refer all inquiries, even by badged FBI agents, to the library director.
How is the library community responding to the anti-terrorism legislation?
The American Library Association joined with the Association of Research Libraries and the Association of American Law Libraries in issuing a statement on the proposed anti-terrorism measures. It says that libraries do not monitor information sought or read by library users. To the extent that libraries “capture” usage information of computer logs, libraries comply with court orders for law enforcement.
Where should libraries go to get guidance on FBI search warrants?
2. “FBI turns to Internet for terrorism clues,” http://www.cnn.com/2001/TECH/internet/09/13/fbi.isps/ (visited November 15, 2001).
3. See United States. Department of Justice. Computer Crime and Intellectual Property Section. Field Guidance on New Authorities that Relate to Computer Crime and Electronic Evidence Enacted in the USA Patriot Act of 2001, http://www.usdoj.gov/criminal/cybercrime/PatriotAct.htm (visited November 13, 2001).
4. For more on current software/hardware surveillance technology, see Jack Karp, Chewing on Carnivore, TechTV, October 16, 2001 (visited November 13, 2001).
5. See Calif. Gov’t. Code §6254 and §6267 (2001). The library may not disclose these records except to a) staff within the scope of administrative duties, b) with written consent from the patron, or c) by order of the appropriate superior court. Although California law refers to the “appropriate superior court,” the USA PATRIOT Act still requires court orders, but allows courts in any jurisdiction to issue orders. Federal law will supercede state law in this case (unless the Act is later found unconstitutional).
6. Calif. Gov’t. Code, § 6254(c) (2001).
7. See Mary Minow, “Library patron internet records and freedom of information laws,” California Libraries, April 4, 1999, pp. 8-9, reprinted at http://www.librarylaw.com/publicrecords.html (visited October 3, 2001).
8. James M. Knight v. School Administrative Unit #16 Docket No. 00-E-307, Rockingham, SS. Superior Court, New Hampshire. See “Exeter Internet Ruling, Complete Ruling,” Portsmouth Herald, January 8, 2001 at http://www.seacoastonline.com/news/1_8special.htm (visited November 15, 2001).
10. Florida Statute 257.261 The Florida Statute is very similar to the Calif. Gov’t Code §6254 and §6267.
11. John Holland, Paula McMahon, Fred Schulte and Jonathon King, “Library computers targeted in terrorism investigation, “Sun-Sentinel, September 18, 2001 at http://www.sun-sentinel.com/news/southflorida/sfl-culprits918.story (visited October 3, 2001).
13. Senator Simon, Academic Libraries Must Oppose Federal Surveillance of Their Users, 100th Cong. 2nd Sess., 134 Cong Rec. S 4806 (1988)(republishing an article by Gerald R. Shields, Chronicle of Higher Education) cited in Mark Paley, The Library Awareness Program: The FBI in the Bookshelves at http://hometown.aol.com/paleymark/library.htm (visited October 1, 2001).
14. Library Community Statement on Proposed Anti-Terrorism Measures and Library Community Letter to Congress on Anti-Terrorism Legislation (pdf file) at http://www.ala.org/washoff/ (visited October 4, 2001).
15. American Library Association. Office for Intellectual Freedom Alert: USA Patriot Act http://www.ala.org/alaorg/oif/usapatriotact.html (Editor’s noted (SP), this link changed after publication, and has been corrected).
Copyright © 2001-2002 Mary Minow.

References: §6254
 §6267
 § 6254
 v. 
 §6254
 §6267