The Internet and the USA PATRIOT Act: Potential Implications for Electronic Privacy, Security, Commerce, and Government
Released: 2002-03-04T00:00:00

Introduction

The September 11, 2001 terrorist attacks prompted congressional action on many fronts,including passage of the Uniting and Strengthening America by Providing Appropriate ToolsRequired to Intercept and Obstruct Terrorism (USA PATRIOT) Act. The Act is broadlyscoped, (1) and some of itsprovisions may affect use of the Internet, computer security, and critical infrastructure protection.

The legislation initially passed the Senate (96-1) as S. 1510 on October 11,2001. The House passed H.R. 2975 (337-79) on October 12. A compromise bill, H.R. 3162 , passed the House (under suspension) on October 24 and the Senate (98-1)on October 25. The President signed it into law on October 26 ( P.L. 107-56 ).

The implementation of the Act will be carefully scrutinized. While law enforcement officialsheralded the passage of what they regard as necessary provisions for counteracting terrorists andother criminals, civil liberties groups urged caution in passing a new law in an emotionally chargedenvironment. During debate, some Representatives raised concerns about the process used to bringthe bills to the floor. In the House, for example, the version of H.R. 2975 as reportedfrom the Judiciary Committee on October 11 ( H.Rept. 107-236 , Part 1) was replaced by the text ofa new bill, H.R. 3801 , for the purposes of debate. (2) H.R. 3801 wasvery similar, but not identical, to S. 1510 as it had passed the Senate hours earlier. Hence, some Representatives felt they had insufficient time to review the legislation they were beingasked to vote on. Among the changes in H.R. 3801 was an extension of the sunsetperiod on several of the electronic surveillance provisions from 2 years to 5 years. Some Membershad argued for a short sunset period, maintaining that the changes in the law were being madehurriedly. In light of this history, it appears that oversight of the Act's implementation will be ofconsiderable interest to Congress and a broad range of interest groups.

This report summarizes the potential effect of the Act on electronic privacy, security,commerce, and government, and identifies issues that are arising.

Computer Security and Critical Infrastructure Protection(3)

Every day, persons gain access (or try to gain access) to other people's computers withoutauthorization to read, copy, modify, or destroy the information contained within--webpages aredefaced, unwanted messages and pictures are conveyed, information (or money) is stolen,communications are jammed and services denied. The list of perpetrators includes juveniles,disgruntled (ex)employees, criminals, competitors, politically or socially motivated groups, andagents of foreign governments. For the purposes of this report, people who engage in such activitieswill be called computer trespassers (adopting a term which the USA PATRIOT Act defines, asexplained below). The damage computer trespassers can inflict, either knowingly or unwittingly,often goes beyond merely being a nuisance and in most cases rises to the level of a federal crime(pursuant to 18 U.S.C. 1030). It is also conceivable that under certain conditions such actions couldbe considered a terrorist act or rise to the level of endangering national security by threatening thefunctioning of the country's critical infrastructure.

For the most part, law enforcement agencies seem to have had adequate tools to investigate,prosecute and penalize these offenses. One area where officials have sought improvement for sometime, however, is in streamlining their ability to track computer trespassers, both in real time or afterthe fact. Prior to passage of the USA PATRIOT Act, procedures required investigators to requestcourt orders, warrants, subpoenas, etc. from a multitude of jurisdictions, since most computertrespassers will route their communications around the world. While the USA PATRIOT Act isdirected primarily to improve the ability of the government to detect, prevent, and respond to thekinds of terrorist attacks experienced last September and October, a number of the provisions affectthe government's law enforcement surveillance and investigatory powers more generally. Those thatdirectly and indirectly affect the ability of the government to investigate, prosecute, and perhapsdeter computer trespassers, whatever their intent, are listed below.

Provisions of the USA PATRIOT Act Affecting Computer Security

Section 105 expands upon the U.S. Secret Service's National Electronic CrimeTask Force Initiative. The U.S. Secret Service has been leading a New York Electronic Crime TaskForce that has been held up as a model of success for investigating a variety of electronic crimes,ranging from "cloning" cell phones to denial-of-service attacks against on-line tradingcompanies. (4) The taskforce includes experts from other government agencies as well as the private sector. Section 105directs the Director of the Secret Service to develop a national network of such taskforces.

Section 202 and Section 217 clarify that law enforcement officials may seekpermission to intercept electronic communications of "computer trespassers." Section 202 adds 18U.S.C. 1030 (computer fraud and abuse) offenses to the list of offenses for which the AttorneyGeneral, or other designated officials, may authorize a request for a court order to intercept targeted communications. Section 217 defines a "computer trespasser" as someone "who accesses a protectedcomputer (5) withoutauthorization and thus has no reasonable expectation of privacy in any communication to, through,or from the protected computer." Section 217 also specifies the conditions under which thecommunications of a computer trespasser may be intercepted. Those conditions are: the owner oroperator of the protected computer authorizes the interception; the person acting under color of lawis lawfully engaged in an investigation; the person acting under color of law has reasonable groundsto expect the content of the computer trespasser's communication is relevant to the investigation; andthe interception acquires only the trespasser's communications within the invaded computer. (6) Prior to the Act, the statutewas less explicit in specifying the terms under which a computer trespasser's communications couldbe intercepted.

Section 210 expands the information that law enforcement officials may obtain(with appropriate authorization) from providers of electronic communications service or remotecomputing services regarding a subscriber or customer of those services. The information may nowinclude a subscriber's or customer's means and source of payment. The language is also modifiedto include information more clearly related to Internet use (e.g. session times and temporarilyassigned network addresses). These changes are to improve the ability of law enforcement officialsto track the activity and identity of suspects concerning a wide range of offenses, including terroristactivities and those of computer trespassers.

Section 211 clarifies that in the deregulated telecommunications environment,cable providers that also provide communication services are governed by the same statutes as otherelectronic communication providers in regard to interception of communications, disclosure ofcustomer records, and application of pen registers and trap and trace devices. (7) Prior to deregulation, cableproviders followed different rules. Therefore, law enforcement officials now have the samesurveillance and investigatory powers in regard to cases involving cable internet services.Information regarding a subscriber's selection of video programming, however, continues to begoverned separately.

Section 216 modifies the authorities relating to use of pen registers and trapand trace devices. As a result of Section 216, a single court order authorizing the use of a penregister or trap and trace device can be used to apply those devices to any computer or facilityanywhere in the country. Prior to the Act, authorization had to be obtained in each jurisdiction wherethe devices needed to be applied. Also, the availability of this authority with respect to computercommunications was unclear. It was generally thought that these devices could only be used ontelephone equipment.

Section 220 allows a single court with jurisdiction over the offense underinvestigation to issue a warrant allowing the search of electronic evidence anywhere in the country. Prior to this, the warrant needed to be issued by a court within the jurisdiction where the informationresided.

Section 808 adds certain computer fraud and abuse offenses to the list ofviolations that may constitute a federal crime of terrorism. The new provisions apply to: anyone whoknowingly accesses a computer without authorization and obtains classified information; and,anyone who knowingly causes the transmission of a program, information, code, or command, andas a result intentionally causes damage to a protected computer. The inclusion of these offenses inthe definition of a federal crime of terrorism in Section 2332b(g)(5)(B) relates primarily to who hasinvestigatory authority over the offenses (the Attorney General, in this case). However, by virtueof cross-references in other parts of the Act, including these offenses in the definition of terrorismalso affects: the extension of their statute of limitations (Section 809 of the Act); post-releasesupervision of someone convicted of these offenses under certain circumstances (Section 812 of theAct); and, applicability of the racketeering statutes (Section 813 of the Act). According to Section809, should these computer offenses result in or create a foreseeable risk of death or serious bodilyinjury, there is no statute of limitations. Under similar conditions, Section 812 could lead tolife-time post-release supervision. The cross-reference to racketeering statutes gives lawenforcement officials more tools with which to prosecute computertrespassers.

Section 814 increases the penalties for certain computer fraud and abuseoffenses. The penalty for a first offense of causing the transmission of a program, information, codeor command that intentionally causes damage to a protected computer increases from 5 years to 10years. The penalty for a second such offense or a second offense of intentionally gainingunauthorized access to a protected computer and, as a result, recklessly causing damage is increasedfrom 10 years to 20 years. Also, it is now an offense to attempt to commit these offenses. Thissection also redefines "damage." Damage is now defined as: i) loss to one or more persons duringany 1-year period aggregating at least $5,000 in value; ii) modification or impairment, or potentialmodification or impairment, of the medical examination, diagnosis, treatment, or care of one or moreindividuals; iii) physical injury to any person; iv) a threat to public health or safety; v) damageaffecting a computer system used by or for a government entity in furtherance of the administrationof justice, national defense, or national security. Item "v" is new. Also, item "i" is rewritten. Priorto this, it was not clear whether the $5,000 threshold was per person affected or the total value ofdamages caused to all people affected. The new language clarifies that it is the latter. Finally, theSection also modifies the language in 18 U.S.C. 1030 regarding civil suits. This includes newlanguage that says victims suffering damages resulting from an offense listed in section 1030 maynot sue under this section for negligent design or manufacture of hardware, software, or firmware. This is a broad immunity that protects manufacturers should any design or manufacture problemlead to damages, including, one would expect, security vulnerabilities which are a common problemin trying to make information systems more secure.

Section 816 authorizes the expenditure of $50 million to develop and supportregional cybersecurity forensic capabilities. There are already a number of computer forensiclaboratories established. This would encourage the establishment of additional ones. In addition toassisting federal authorities to investigate and prosecute computer crimes, the laboratories are to trainfederal, state and local officials in computer forensics, to assist state and local officials ininvestigating and prosecuting state and local computer offenses, and to share expertise andinformation on the latest developments in computer forensics.

Provisions Affecting Critical Infrastructure Protection

Since information networks (including the Internet) are considered critical infrastructures,the above sections are also relevant to this discussion. However, there are two additional provisionsthat affect the protection of other critical infrastructures more generally.

Title VII is entitled Increased Information Sharing for Critical InfrastructureProtection. However, the lone section in the Title (Section 701) really addresses a set of illegalactivities much broader than attacks on critical infrastructures. There exists, within the Departmentof Justice, a Bureau of Justice grant program that helps establish information sharing systemsbetween federal, state, local and non-profit entities for the purpose of identifying, targeting, andremoving criminal conspiracies that cross jurisdictional boundaries. These information sharingsystems are to include a number of capabilities, such as rapid information retrieval and systematizedupdates. Section 701 would add that the information sharing system be secure. The Section alsoadds multi-jurisdictional terrorist conspiracies to the list of activities tracked by the informationsharing system.

Section 1016 puts into statute elements of the critical infrastructure policy thathave been articulated by both the Clinton and the Bush Administrations. (8) That is, to ensure that anyphysical or virtual (i.e. computer-induced) disruption of the nation's critical infrastructures be rare,brief, geographically limited, manageable, and minimally detrimental to the economy, human andgovernment services, and national security of the United States. The section defines criticalinfrastructure as "systems and assets, whether physical or virtual, so vital to the United States thatthe incapacity or destruction of such systems and assets would have debilitating impact on security,national economic security, national public health or safety, or any combination of those matters." The Section also establishes a National Infrastructure Simulation and Analysis Center. The Centeris to support related counter-terrorism, threat assessment, and risk mitigation activities. In particularthe Center is to model and analyze the large-scale complexity of critical infrastructures, and usethose models and analyses to train authorities in incident response, to recommend changes in systemdesigns or protections, and to provide recommendations to policymakers. The Center is to receivedata from state and local governments and the private sector to assist in developing its models. TheSection also authorizes the appropriation of $20 million through the Department of Defense'sDefense Threat Reduction Agency to support activities at the Center.

Policy Issues

Many of the provisions related to the surveillance and investigatory powers of lawenforcement have raised concerns within the privacy and civil liberties communities. These arediscussed in more detail later in this report. Some of the provisions do not necessarily grant lawenforcement officials more power in practice, but clarify that those powers exist and put them on asounder basis. Many observers believe that the most important changes affecting law enforcementofficials are those provisions allowing for nationwide warrants, court orders, etc. to facilitate thetracking of computer trespassers. In the case of investigating offenses after the fact, these provisionsmay save more resources than time. However, in cases where officials are trying to track computertrespassers in real time, time is of great importance and the provisions should be that much moreeffective. In regard to increasing the penalties for computer trespassers, there is some debate aboutwhether doing so will have the hoped for deterrent effect. (9) Others suggest that, deterrence aside, increasing penalties betterreflects the seriousness of the offenses. (10) The Act primarily strengthens law enforcement's tools to policewhat many believe is a network ill-designed for security. Aside from the provision to develop aNational Infrastructure and Analysis Center, none of the provisions relate to providing for orensuring more secure systems.

Electronic Commerce(11)

The convergence of computer and telecommunications technologies has revolutionized howwe get, store, retrieve, and share information. Commercial transactions on the Internet, whetherretail business-to-customer or business-to-business, are commonly called electronic commerce, or"e-commerce." Since the mid-1990s, commercial transactions on the Internet have grownsubstantially. (12) AJanuary 2002 study by the Pew Internet and American Life Project found that overall, 29 millionAmerican shoppers made purchases on-line during the fourth quarter of 2001, spending an averageof $392, up from $330 in the fourth quarter of 2000. A quarter of all Internet users did someshopping on the Internet last year, up from one-fifth of Internet users in 2000.

Provisions of the USA PATRIOT Act Affecting Electronic Commerce

The USA PATRIOT Act does not address e-commerce directly; (13) however Title III of theAct, International Money Laundering Abatement and Financial Anti-Terrorism Act of 2001,addresses concerns of policymakers that, in the wake of the September 11 terrorist attacks, more canbe done to prevent, detect, and prosecute international money laundering and the financing ofterrorism. Title III contains three subtitles with provisions that address international moneylaundering, voluntary disclosure by U.S. banks of suspicious financial activity, and the bulksmuggling of currency across U.S. borders and counterfeiting.

Subtitle A, International Counter Money Laundering and Related Measures,has among its many provisions requirements that U.S. financial institutions do more to prevent anddetect money laundering actions.. It requires that financial institutions provide greater monitoringand due diligence concerning certain foreign financial activities, including wire transfers, interbankaccounts, and correspondent accounts involving foreign financial institutions.

Subtitle B, Bank Secrecy Act Amendments and Related Improvements, amendsprevious law by revising immunity and liability provisions for financial institutions which mightdisclose suspicious activities and persons to the federal government, including those which mayconstitute an "underground" system of financial transactions.

Subtitle C, Currency Crimes and Protection, provides new penalties for bulkcash smuggling in and out of the United States as well as counterfeiting activities.

Many of the provisions in Title III do not go into effect until regulations arepromulgated. (14)

Policy Issues

Upon signing the USA PATRIOT Act, President Bush said "this legislation gives lawenforcement officials better tools to put an end to financial counterfeiting, smuggling and moneylaundering." The President added: "We're making it easier to seize the assets of groups andindividuals involved in terrorism." (15) Among the many provisions in Title III, law enforcementofficials point to two of the Act's objectives--establishing new standards and requirements forincreased cooperation by financial institutions when responding to federal government requests forinformation; and extending the federal jurisdiction over non-U.S. financial institutions in moneylaundering--as particularly vital to U.S. counter-terrorism efforts. (16)

However, some have raised concerns that Title III (as well as other provisions) may have abroader scope than many of its supporters intend. (17) While many are concerned that the civil liberties of individualsmay be compromised if law enforcement officials extend their reach, Title III may also haveimplications for a wide range of e-commerce activities. It is unlikely that the Act will immediatelyaffect retail e-commerce (e.g., online catalogue orders) or business-to-business e-commerce (e.g.,the use of the Internet for inventory ordering and management). While these forms of e-commerceare growing very rapidly, to date they have not been identified as being particularly susceptible tomisuse by terrorists. Retail e-commerce and business-to-business e-commerce require verifiableinformation between parties that may include names, addresses, credit card numbers and otherinformation, and can be traced relatively easily. However, some observers have not ruled outterrorists using existing e-commerce exchanges to facilitate their activities in the future. (18)

The more common method of using e-commerce for illicit and terrorist purposes is throughfinancial transactions. For example, the terrorists involved in the September 11 attacks reportedlyused wire transfers routinely to fund their activities in the United States. Most money transfers,even relatively small amounts transferred as money orders by firms like Western Union, MoneyGram, and other smaller companies, are done electronically. There is no need to establish a bankaccount or fill out credit reporting forms, identification requirements are minimal, a money wirefirm's outlet may be located in a supermarket or drugstore and staffed by store employees, and it cantake less than fifteen minutes to send money around the world. (19) The USA PATRIOT Actaddresses wire transfers and money orders by requiring, among other provisions, the registration ofall money order agents by December 31, 2001, and increasing the criminal penalties for those whoknowingly conduct or assist in transferring money that is intended to promote or support an illegalactivity. These provisions not only cover the physical transfer of money for these purposes, butelectronic transfers as well. (20)

Larger financial institutions which conduct much of their business electronically--andtherefore are part of the e-commerce business sector--are also affected by the USA PATRIOT Act. Among the provisions affecting large multinational financial corporations are increased authorityfor U.S. law enforcement officials to gain access to institutions' records and data bases; due diligenceby U.S. financial institutions concerning money laundering by non-U.S. persons; enhanced standardsfor correspondent accounts held by U.S. banks; and prohibition of correspondent accounts with shellbanks (banks which have no physical presence in their chartering country). (21)

Critics contend that the USA PATRIOT Act will not prevent nor prohibit the types ofactivities that terrorists engaged in before September 11. While U.S. money order and wire transfer firms will have greater reporting responsibilities and tighter restrictions under the Act, the sheervolume of transactions, many under $3,000, is enormous--in 2000, Western Union alone did 89million wire transfers of money. Particularly in the Middle East a significant amount of money istransferred or exchanged by hawla , a remittance system outside of, and running parallel to, thebanking system. Whether the USA PATRIOT Act can be effectively applied to terrorists' use of hawla is not clear. Some also question whether the time and cost to track large portions of electroniccommerce conducted through hawla will prove to be an efficient use of government and privatesector resources. (22)

Others contend that large U.S. financial institutions may also expend significant time andresources to comply with the Act without providing any assistance in the war against terrorism. According to Ellen Zimiles, a partner in KPMG's forensics practice, a large U.S. bank spends $10million per year to fight money laundering--and the Act may add to that cost, as well as adding newcosts for brokers, insurers, and others connected with the financial industry. (23) According to anotherexpert, a U.S. bank typically has one million to five million ATM transactions daily, and 100,000wire transactions per day. U.S. financial institutions will likely have to address how they willbalance increased security provisions, broader access to their accounts by law enforcement officials,and ensuring customers that the privacy and integrity of financial accounts will not be compromisedby compliance with the Act. (24)

Abroad, many U.S. financial institutions and multinational organizations routinely transfercurrency internally and externally, often crossing national borders. These institutions andcorporations often engage in routine short-term lending or borrowing to balance accounts or tofinance projects. There are several established mechanisms and procedures for these transactions. The London Interbank Offering Rate (LIBOR) is an overnight lending rate by which multinationalcorporations electronically borrow or lend money to balance their accounts. The LIBOR is set bythe largest banks, and the transactions are usually made with "Eurodollars." (25) These transactions occuron a daily basis and range in the trillions of dollars. There is no indication that any U.S. institutionsusing the LIBOR to settle accounts have aided or abetted terrorist activities. Still, these transactionscould fall under the USA PATRIOT Act. If U.S. law enforcement officials begin to examineaccounts, or even seize funds, under the Act, how might multinational corporations react-- may theyeven attempt to avoid compliance to the Act? Will foreign banks and governments acquiesce to U.S.actions?

Still, it is important to note that, to date, most (if not all) of the concerns raised by critics,other than those of costs of compliance, have been hypothetical. There have been no reported widespread law enforcement intrusions into financial institutions' databases, nor have there been anyreported e-commerce or electronic fund transfers disruptions linked to the war on terror since theAct was signed into law. The events of September 11 resulted in a fundamental change in the waythe United States views its defense and security. Over time, Title III of the USA PATRIOT Act mayaffect e-commerce broadly, and electronic transfers specifically. How this Act will affect lawenforcement and security efforts in the Internet Age and its actual impact on privacy rights and dataintegrity remains to be seen.

Electronic Government(26)

A significant component of many of the initiatives regarding the USA PATRIOT Actspecifically, and homeland security generally, involves the use of information technology to enhanceexisting government processes or create new ones. Some of these initiatives may contribute to thegrowing effort to implement e-government projects by both Congress and the Bush Administrationthrough enhanced data sharing and greater confidence in the security and reliability of the networks. Other initiatives may inadvertently create obstacles by restricting access to information flows andreducing privacy protections.

Provisions of the USA PATRIOT Act Affecting Electronic Government

There are a number of provisions in the USA PATRIOT Act that are relevant toe-government interests. E-government involves using information technology, and especially theInternet, to improve the delivery of government services to citizens, business, and other governmentagencies. (27) Most ofthese provisions are independent of one another, reflecting the often disparate and disconnectednature of e-government initiatives. Many of the provisions in the USA PATRIOT Act related toe-government focus on government-to-government (G2G) relationships, both within the federalgovernment, and between federal, state, local, and foreign governments. Fewer of the provisionsfocus on government-to-business (G2B) or government-to-customer (G2C) interactions. Therelevant provisions can be found in titles III, IV, VII, IX, and X, and are briefly discussed in turn.

Section 361 supercedes Treasury Order Number 105-08, establishes theFinancial Crimes Enforcement Network (FinCEN) in statute, and charges the bureau with, amongother things, establishing a financial crimes communication center to facilitate the sharing ofinformation with law enforcement authorities. This section also requires FinCEN to maintain agovernment-wide data access service for information collected under anti-money launderingreporting laws, information regarding national and international currency flows, as well asinformation from federal, state, local, and foreign agencies and other public and privatesources.

Section 362 seeks to enhance cooperation between the federal government andthe banking industry by directing the Security of Treasury to establish a "highly secure network" inFinCEN to enable financial institutions to file reports required by the Bank Secrecy Act and receivealerts regarding suspicious activities electronically.

Section 403 emphasizes interagency data sharing and technology standardsdevelopment. It authorizes appropriations to enable the State Department and the Immigration andNaturalization Service (INS) to access the Federal Bureau of Investigation's (FBI) National CrimeInformation Center's Interstate Identification Index (NCIC-III) database. It also directs the NationalInstitute of Standards and Technology (NIST) to "develop and certify a technology standard that canbe used to verify the identity of persons applying for a United States visa or such persons seekingto enter the United States pursuant to a visa for the purpose of conducting background checks,confirming identity, and ensuring that a person has not received a visa under a different name or suchperson seeking to enter the United States pursuant to a visa."

Section 405 directs the Attorney General to carry out a study on enhancing theFBI's Integrated Automated Fingerprint Identification System (IAFIS) to improve screening offoreign nationals applying to enter the country.

Section 413 authorizes the State Department to share, with other countries,information from its visa outlook database for the purpose of investigating or preventing crimes andto "deny visas to persons who would be inadmissable to the United States."

Section 414 directs the Attorney General to fully implement an "integratedentry and exit data system for airports, seaports, and land border ports of entry," with a particularfocus on the use of biometric technology and tamper-resistant documents.

Section 701 authorizes the Office of Justice Programs to expand informationsharing with state and local law enforcement agencies and nonprofit organizations to fightmulti-jurisdictional criminal conspiracies. It also calls for the establishment of a secure informationsharing system.

Section 906 emphasizes the potential consolidation of data collectionresponsibilities by requiring the Attorney General, the Director of Central Intelligence, and theSecretary of the Treasury to submit a report to Congress "on the feasibility and desirability ofreconfiguring the Foreign Terrorist Asset Tracking Center and the Office of Foreign Assets Controlof the Department of Treasury in order to establish a capability to provide for the effective andefficient analysis and dissemination of foreign intelligence relating to the financial capabilities andresources of international terrorist organizations." The report is also to examine "to what extent thecapabilities and resources of the Financial Crimes Enforcement Center of the Department of theTreasury may be integrated into the capability contemplated by the report."

Section 1008 also focuses on the potential for data sharing between agencies. It calls for a study directed by the Attorney General in consultation with the Secretary of State andthe Secretary of Transportation "on the feasibility of utilizing a biometric identifier (fingerprint)scanning system, with access to the database of the Federal Bureau of Investigation IntegratedAutomated Fingerprint Identification System, at consular offices abroad and at points of entry intothe United States to enhance the ability of State Department and immigration officials to identifyaliens who may be wanted in connection with criminal or terrorist investigations in the United Statesor abroad prior to the issuance of visas or entry into the United States."

Section 1009 focuses on potential information sharing between federalagencies and airlines. It directs the FBI to study "the feasibility of providing airlines access viacomputer to the names of passengers who are suspected of terrorist activity by federalofficials."

Section 1012 focuses on enhancing the cooperation between federal and stateofficials to limit the issuance of licenses to transport hazardous materials in commerce (hazmatlicenses). It allows states to request the Attorney General to conduct a background check onapplicants using "relevant international databases through Interpol" and othermeans.

Section 1015 also focuses on intergovernmental relationships by expandingthe scope and lengthening the authorization of appropriations of the Crime Identification TechnologyAct ( P.L. 105-251 ), which allows the Office of Justice Programs to issue grants to state and localentities to develop integrated information and identification systems.

Policy Issues

The e-government policy implications associated with the USA PATRIOT Act are centeredaround three primary issues; knowledge management/data sharing, information security, and privacy.

Knowledge Management. Knowledgemanagement (KM) has been defined as "the process through which an enterprise uses its collectiveintelligence to accomplish its strategic objectives." (28) As the above summary of the relevant provisions suggests,enhanced data sharing and knowledge management techniques are expected to play a significant rolein homeland security efforts. Several of the provisions focus on improving access and the sharingof centralized databases by federal, state, and local law enforcement agencies. Some of theprovisions also seek to establish a more fully integrated database system for processing and trackingthe granting of visas, as well as the entry and exit of foreign nationals in the United States. In manycases these provisions are designed to rectify the problems associated with having multiple,incompatible, and sometimes overlapping databases, which have been identified as one of thecontributing factors to the difficulties law enforcement and intelligence agencies have had trackingsuspected terrorists. (29) Just as knowledge management has been recognized as an important component of improvedhomeland security, its proponents argue that knowledge management could play a significant rolein e-government initiatives generally. Knowledge management efforts involving e-government haveso far encountered a variety of obstacles. (30) Some of these obstacles include creating the appropriatetechnical and support infrastructure, achieving user "buy-in," and managing the development and useof specialized information. Some have suggested the creation of the position of chief knowledgeofficers (CKOs) at the agency, department, and/or federal level to facilitate the execution of specificknowledge-intensive projects and support larger government reform efforts. The success ofknowledge management/data sharing efforts in the homeland security area could affect the adoptionof these proposals.

Ensuring Information Security. Heavy relianceon centralized databases with wider access by more actors (both governmental andnon-governmental) will require careful attention to data protection and the authentication of users. One way this may be achieved is through the use of public key infrastructure (PKI) encryptionsystems. (31) PKI systemsare generally considered the most reliable means to ensure the security of online transactions. (32) However, implementinga PKI system can be a very difficult, time consuming, and expensive process. Moreover, in the caseof federal e-government projects, the PKI systems used by different departments and agencies wouldneed to be interoperable in order to realize the efficiencies hoped for, and convenience necessary,to achieve the desired citizen usage levels. So far, no such standards have been established.

The challenge of establishing a large scale PKI system raises many issues. Some of theseinclude the lack of federal interoperable standards, the feasibility of implementation, and highcosts. (33) First, the lackof federal interoperable standards raises the question of who would be responsible for developingand promulgating such standards. The National Institute of Standards and Technology (NIST) oftenworks with industry to facilitate and develop technical standards and measurements. However, itis currently unclear what role NIST would play in developing any PKI standards. Assuming theacceptance of the PKI approach, it is also unclear whether the federal government should work tocreate a standard for its own use, or if it should rely on the development of an industry standard,which may take longer to emerge. Second, large scale, full-featured PKI systems are not common,raising questions regarding the scalability of the technology and the resources needed to accomplishthe task. Implementation of such a system would require policy makers to decide if the federalgovernment has sufficient expertise and resources to create a large scale PKI system in-house, or ifit will need to be outsourced to one or more private contractors. Third, the largely uncharted natureof such an undertaking and the high costs of PKI systems generally, raises concerns for budgetplanning and oversight. Proponents of a government-wide PKI system maintain that if these issuescan be adequately addressed, the creation of a single government-wide PKI system could promotethe utilization of secure Web portals to ensure the data integrity of transactions between thegovernment and citizens and business.

Privacy. In contrast to the two previouslydiscussed issues, the implications of the USA PATRIOT Act on privacy could have a negative effecton e-government initiatives. Surveys have shown that the loss of privacy as a result of e-governmentis a significant concern among citizens. (34) As mentioned in the earlier section on computer security, the Actexpands the type of information that may be collected by law enforcement officials from providersof electronic communications services or remote computing services. It also allows for the issuanceof nationwide search warrants to facilitate the tracking of computer trespassers. Concerns aboutpotential misuse of these data collection provisions could dampen citizen enthusiasm for carryingout electronic transactions with the government.

Internet Privacy: Law Enforcement Monitoring of Internet Usage(35)

Until the September 11, 2001 terrorist acts, the Internet privacy debate focused on consumerprivacy issues sparked by the collection, use, and dissemination of personally identifiableinformation by commercial Web site operators. (36) The practices of law enforcement agencies in monitoring theactivities of individuals as they use the Internet for electronic mail (e-mail) or visiting Web sites wasan important, but less visible, issue. Congress addressed it primarily in the context of ensuring thatthe Federal Bureau of Investigation (FBI) did not overstep its authority in using a software programcalled Carnivore (later renamed DCS 1000). (37) With a court order, the FBI could install Carnivore on theequipment of an Internet Service Provider (ISP) to monitor a suspect's Internet activity, which raisedconcern about whether the software was sufficiently precise to avoid monitoring the activity of otherISP customers and hence impinging on their privacy.

While Congress remains interested in overseeing the FBI's use of Carnivore, the September11 terrorist attacks sharpened the debate over how to strike a balance between law enforcement'sneed to investigate criminals and protecting what most citizens believe to be their "right" toprivacy. (38) Congressincluded provisions in the USA PATRIOT Act that make it easier for law enforcement to monitorInternet activities. Also, many ISPs that opposed law enforcement monitoring of their customers'Internet activity reportedly have been quite willing to assist law enforcement in its search for e-mailand other Internet evidence relating to the attacks. (39)

Provisions of the USA PATRIOT Act Affecting Internet Privacy

Title II of the Act, Enhanced Surveillance Procedures, includes provisions that affectmonitoring of Internet activities.

Section 210 expands the scope of subpoenas for records of electroniccommunications to include records commonly associated with Internet usage, such as session timesand duration.

Section 211 clarifies that cable companies offering Internet services are subjectto 18 U.S.C. ch. 119 (Wire and Electronics Interception and Interception of Oral Communications),18 U.S.C. ch. 121 (Stored Wire and Electronic Communications and Transactional Records Access),and 18 U.S.C. ch. 206 (Pen Registers and Trap and Trace Devices) in their provision of thoseservices. Cable companies had sought, in particular, to clarify their obligations with regard to releaseof personally identifiable information about subscribers and whether they were required to notify thesubscriber that the information had been requested by a governmental entity as required under the1992 Cable Act. Under this section, no notification is required, but disclosure specifically does notinclude a subscriber's video programming choices.

Section 212 allows ISPs to divulge records or other information (but not thecontents of communications) pertaining to a subscriber if they believe there is immediate danger ofdeath or serious physical injury or as otherwise authorized, and requires them to divulge suchrecords or information (excluding contents of communications) to a governmental entity undercertain conditions. It also allows an ISP to divulge the contents of communications to a lawenforcement agency if it reasonably believes that an emergency involving immediate danger of deathor serious physical injury requires disclosure of the information without delay. (40)

Section 216 adds routing and addressing information (used in Internetcommunications) to dialing information, expanding what information a government agency maycapture, as authorized by a court order, using pen registers and trap and trace devices. (41) The content of any wireor electronic communications is excluded. A court shall enter an ex parte order permittinginstallation and use of a pen register or trap and trace device if it finds that an attorney for thegovernment or a state law enforcement or investigative officer has certified that the informationlikely to be obtained is relevant to an ongoing criminal investigation. Law enforcement officials mustkeep certain records when they use their own pen registers or trap and trace devices and providethose records to the court that issued the order within 30 days of expiration of the order. To theextent that Carnivore-like systems fall with the new definition of pen registers or trap and tracedevices provided in the Act, that language would increase judicial oversight of the use of suchsystems.

Section 217 allows a person acting under color of law to intercept the wire orelectronic communications of a computer trespasser transmitted to, through, or from a protectedcomputer under certain circumstances.

Section 220 allows for nationwide search warrants for e-mail instead ofrequiring separate search warrants for each jurisdiction in which the e-mail may be located, such asat the ISP's location rather than where a crime was committed.

Section 224 establishes a 4-year sunset period (until December 31, 2005) formany of the Title II provisions, but among the sections excluded from the sunset are Sections 210,211, and 216.

Policy Issues

As noted, the challenge for policy makers is balancing the needs of law enforcement with thedesire by the public to maintain its privacy. In the wake of the terrorist attacks, the public appearsmore willing to make sacrifices in the privacy arena to protect the country against further attacks andbring the perpetrators of the September 11 assault to justice. Criticism of the USA PATRIOT Actfrom a privacy standpoint has been relatively muted, possibly because of the perception that thepublic is willing to accept such measures at this time. An October 2001 Harris Poll found that 63%of Americans favored monitoring of Internet discussions and chat rooms, and 54% favoredmonitoring cellphones and e-mail. (42)

However, privacy advocates worry that, in this emotionally charged climate, Congress ispassing legislation that it later will regret. Groups such as the American Civil Liberties Union(ACLU), Center for Democracy and Technology (CDT), Electronic Privacy Information Center(EPIC), and Electronic Frontier Foundation (EFF) urge caution, fearful that, in an attempt to trackdown and punish the terrorists who threaten American democracy, one of the fundamental tenets ofthat democracy--privacy--may itself be threatened. The ACLU issued a press release (43) on October 24 stating thatit was deeply disappointed with the House passage of H.R. 3162 , and, after the billcleared Congress, vowed to monitor its implementation. (44) CDT's Executive Director said on October 25 that "This bill hasbeen called a compromise but the only thing compromised is our civil liberties." (45) Among CDT's concernsis that Section 216, which is not subject to the sunset provision, allows law enforcement officials tocollect information about Internet usage without what CDT considers to be meaningful judicialreview. (46)

There are other privacy issues, too. Peter Swire, who served as privacy counselor at theOffice of Management and Budget during the Clinton Administration, worries that the Act does notinclude sufficient provisions to deal with potential abuses by law enforcement of the new authoritiesgranted in the Act. (47) Federal Trade Commission (FTC) Commissioner Orson Swindle has suggested that ISPs relook attheir privacy policy statements in the wake of passage of the Act, particularly with regard to ISPs'new authority under Section 212 to voluntarily disclose information. (48) The FTC oversees howbusinesses, including ISPs, adhere to their privacy policies. Mr. Swindle also pointed out that it ishis understanding that the law does not cover Web sites, only ISPs. He wondered if an onlinebookseller received many requests for books on, for example, how to make bombs or fly an airplane,"and the name of the purchasers reflected one or another ethnic group, would that be alarming underconcern for terrorism? ... It would seem to me that common sense would say that would be alarmingbut they're not covered by this." (49) John Kamp, an attorney with Wiley, Rein & Fielding,commented that the definitions in the Act were murky and Web sites might be covered, but that "Itis clear that this law wasn't designed to go there." (50)

The question of definitions is raised by others, including EFF. In particular, EFF cites thelack of definitions of "content" of e-mails that cannot be retrieved without a warrant, and the term"without authority" in the definition of a computer trespasser. (51) Packets of data thatcomprise e-mail messages may contain both content and non-content information (such as routinginformation). The Act allows law enforcement officials access to non-content information, but notto content. Thus this definition could be quite important. Regarding computer trespassers, Section217 defines a computer trespasser as a person who accesses a protected computer withoutauthorization, but it does not include a person with an existing contractual relationship with theowner or operator of the computer. EFF wants that term to mean only individuals who intentionallybreak into computers with which they have no relationship.

Some ISPs express satisfaction that guidance issued by the Justice Department implementingthe USA PATRIOT Act clarifies that ISPs may use their own tools to obtain information requiredby law enforcement officials rather than rather than being required to allow the FBI to installsoftware such as DCS 1000. EarthLink executive David Baker called it a "silver lining in what manyotherwise describe as a cloud...." (52)

Like the ACLU, most of the privacy advocate groups assert that they will closely monitorhow law enforcement officials implement the Act and try to ensure that the law is not misused.Congress may conduct oversight of the Act's implementation, both from the standpoint of the valueof providing law enforcement officials with these additional tools to combat crime and terrorism,and in terms of any detrimental consequences that could arise.