Berkman Center for Internet & Society.
BOLD:
Berkman Online Lectures & Discussions

Harvard Law School > Berkman Center > Open Education >

 

PRIVACY IN CYBERSPACE

Intro
Online Profiling
Employees Privacy on the Net
Governmental Collection of Data - Part I
Governmental Collection of Data - Part II
Cryptography and other Self-Help Mechanisms

Module V -
Governmental Collection of Data - Part II: USA Patriot and Foreign Intelligence Surveillance

Assigned Reading:

1. Please read the Introduction to this Module.

The Introduction to Module V describes key features of the comprehensive statute enacted in the wake of the September 11 tragedy known as USA Patriot, and how that Act has softened the requirements for U.S. government surveillance of internet traffic. The Introduction also introduces a key statute, the Foreign Intelligence Surveillance Act (FISA), and describes how recent amendments to that statute may transform governmental power to tap web traffic not only domestically but internationally as well.

2. Articles:

Electronic Frontier Foundation (EFF) Analysis of The Provisions Of The USA PATRIOT Act That Relate To Online Activities (Oct 31, 2001)
http://www.eff.org/Privacy/Surveillance/Terrorism_militias/20011031_eff_usa_patriot_analysis.html

Ronald L. Plesser, James J. Halpert, Emilio W. Cividanes, USA Patriot Act For Internet And Communications Companies, Computer and Internet Lawyer (March, 2002) [section by section analysis of USA Patriot]

Terror's Confounding Online Trail, New York Times Article, March 28, 2002 [Also assigned in Module IV. Note that the article indicates that cyberspace spying oftentimes doesn't work since the determined terrorist has many ways to avoid detection.]
http://www.nytimes.com/2002/03/28/technology/circuits/28TERR.html?ex=1018333699&ei=1&en=d7b0237f9318b34d


Discussion Topics/Assignment:
Please read through the following discussion questions. Use the links after each question to submit your thoughts to the discussion board. Feel free to address as many questions as you like.

1. As described in the assigned materials, USA Patriot gives law enforcement authorities access to "dialing, routing and signaling" information with a trap/trace order. The Act expressly states that "contents" of communications may not be obtained with trap/trace orders, but USAPA does not define the term "content" in reference to the internet. With telephone calls, the "content" of the communication can be readily separated from the "communication attributes" (e.g., numbers dialed, time, length and date of call). Thus, a trap/trace order that only permits the government to obtain the communication attributes of a telephone call does not run the risk that the content of the communication is also being trapped.

However, with internet use content cannot easily be separated from internet routing information. When Arthur Googles "jihad.com" followed by a search for "bombs.com," "Osama.org," and then "ACLU," it is no longer possible to separate the routing information from the content of pages Arthur downloaded in response to his Google search. The "content" is revealed by the website routing and webpages URL's that Arthur has obtained.

HYPOTHETICAL E
Suppose that the FBI installs Carnivore [described on the Module IV Homepage] on Arthur's Internet Service Provider (ISP) server after obtaining a judicial order permitting it to trap "routing" but not "content" information sent to or from Arthur's computer. If reports about Carnivore are accurate, this device permits the FBI to see the information such as the IP address of the sender & recipient of the web addresses Arthur contacts. Carnivore also permits the FBI to see the URL addresses of every website Arthur visits. Although the FBI does not literally "see" the pages Arthur visits (e.g., "osama.org" "bombbuild.com") by obtaining the addressing information it can easily and independently view the same webpages Arthur downloaded.

Would such a use of an intercept Order violate USA Patriot? Would it violate the Fourth Amendment?

HYPOTHETICAL F
Assume that Chuck also uses GoNet as his ISP. Chuck is an upstanding citizen who no one believes is, has been, or will be committing criminal acts. The FBI does not have a court order pertaining to Chuck. The FBI does, however, obtain a proper court order to install Carnivore to review Arthur's routing information. Assume, however, that since Chuck's search and browsing requests must go through the same Carnivore filter that Arthur's does, Carnivore necessarily reads at least the IP addresses sought by Chuck and all of Chuck's neighbors who use GoNet.

Would such a use of Carnivore violate Chuck's Fourth Amendment rights even if no human actually tracks Chuck's browsing habits?

2. Should citizens and residents of countries other than the U.S. be concerned about the expansion of surveillance powers of the United States government, especially under the Foreign Intelligence Surveillance Act? In this regard, note that USA Patriot by its terms makes clear that Congress desired to protect American citizens from FISA searches unless Americans were suspected as foreign agents. Citizens of other countries do not receive the same treatment.

3. Should one be concerned about the expansion of jurisdiction of the FISA secret court? Unlike other judicial proceedings in the United States, in which openness is helps assure accountability, there is little to hold the secret court accountable: no appeals, no published opinions, no representation by anyone other than the government. At the same time, the shocking events of September 11, 2001, have caused many to believe that whatever cybersurveillance government needs to prevent similar events should be authorized. Is the expansion of surveillance capability under FISA appropriate in these circumstances?

4. Many provisions of USA Patriot allow or even encourage ISP's voluntary to disclose private information including customer records as well as content of electronic transmissions. ISPs are given broad latitude to make such disclosures either to protect themselves against cyber-trespassers, or to provide information to the government that they believe might be relevant to government investigations. Under the indicated circumstances, the ISP would be immune from civil liability for disclosing such information. Do these provisions raise any concerns about privacy of the customers of ISP's (i.e., just about everyone who accesses the internet)? Or, is it appropriate to encourage ISP's voluntarily to cooperate with government investigations?

Go to Discussion Summary


Additional Readings & Resources (optional):

1. Center for Democracy & Technology's (CDT) Government Surveillance Page, http://www.cdt.org/wiretap/
2. Final Version USA Patriot:
http://www.cdt.org/security/usapatriot/011026usa-patriot.pdf
3. Department of Justice's Section-by-Section Summary of the USA PATRIOT ACT
http://freecongress.org/911/patriot.htm
4. Congressional Research Service Analysis of USA PATRIOT [pdf], December 10, 2001
http://www.cdt.org/security/usapatriot/011210crs.pdf
5. DOJ Field Guidance on New Authorities Enacted in the 2001 Anti-Terrorism
Legislation [pdf] Oct 2001.
http://www.cdt.org/security/011030doj.pdf
5. ACLU on USA Patriot
http://www.aclu.org/issues/privacy/hmprivacy.html
6. Electronic Frontier Foundation (EFF) on USA Patriot
http://www.eff.org/privnow/
7. Electronic Privacy Information Center (EPIC)
http://www.epic.org/privacy/wiretap/


RETURN TO COURSE HOMEPAGE AND SYLLABUS

 

 

 
Please send all inquiries to: BOLD@cyber.law.harvard.edu

Welcome | Registration | Discussion | Reference |

The Berkman Center for Internet & Society