Bush Signs Broad Anti-Terrorism Bill

washingtonpost.com: Bush Signs Into Law New Enforcement Era

Bush Signs Into Law New Enforcement Era
U.S. Gets Broad Electronic Powers

By Jonathan Krim and Robert O'Harrow Jr.
Washington Post Staff Writers
Saturday, October 27, 2001; Page A06

President Bush yesterday handed law enforcement broad new investigative and surveillance powers, signing legislation aimed at helping authorities track and disrupt the operations of suspected terrorists in the United States.

"Today, we take an essential step in defeating terrorism while protecting the constitutional rights of all Americans," Bush said at a White House ceremony. "This government will enforce this law with all the urgency of a nation at war."

The new law gives the government a freer hand to conduct searches, detain or deport suspects, eavesdrop on Internet communication, monitor financial transactions and obtain electronic records of individuals. At the same time, it reduces the need for subpoenas, court orders or other legal checks to enable law enforcement to move more quickly. Convinced that the steps were necessary, Congress overwhelmingly approved the legislation this week.

The government is moving aggressively on a number of technology fronts to more efficiently collect and evaluate information about people and their movements as they seek to combat terrorism.

The Defense Department, for instance, announced this week that it is seeking proposals from companies on an array of new surveillance products such as portable polygraph machines and systems that can see through walls at night.

And with Attorney General John D. Ashcroft promising an anti-terrorist campaign reminiscent of the war on organized crime in the days of Al Capone, the FBI will increasingly demand personal information held by banks, Internet service providers and credit bureaus.

In many cases, those businesses will not be allowed to tell clients that they have turned over medical, financial or other personal records to investigators.

With new law enforcement powers to monitor computer use, sometimes without a warrant, Internet users will have to decide whether they want to rely more on ways of encrypting their e-mail or otherwise disguising their identities online.

And with new abilities to share data between federal agencies, including the CIA, law enforcement will be able to build more robust, centralized stores of intercepted information. The law provides no guidelines for how long such data can be kept, or what happens to it after a particular investigation is concluded.

"It was inevitable that we would have much more data collection, more data sharing, more data storing" as a result of technology, said Jeffery Eisenach, president of the Progress and Freedom Foundation, a conservative think tank. "And thinking through the privacy implications of what was happening was fine on a 20-year schedule." Now, he said, "this much broader set of privacy concerns is suddenly upon us."

After weeks of struggle on Capitol Hill, civil libertarians lost the argument that the government will gain too many new police powers to potentially examine the activities of innocent individuals and erode personal privacy.

Senate Judiciary Committee Chairman Patrick J. Leahy (D-Vt.), who helped craft the legislation, said the current crisis requires aggressive action. Although he expressed concern about giving authorities too much power, Leahy said he was satisfied with provisions limiting the duration of some of the new surveillance rules to four years, subject to congressional review. Leahy said he expects frequent detailed reports about the expanded use of surveillance.

"They won't get the sunset extended if they're not doing the right thing," he said.

The sunset provision does not apply to all provisions in the bill, and it wasn't enough to satisfy Sen. Russell D. Feingold (D-Wis.), who cast the lone vote in the Senate against the legislation on Thursday, a day after the House approved it by 356 to 66. "There have been periods in our nation's history when civil liberties have taken a back seat to what appeared at the time to be the legitimate exigencies of war," he said on the Senate floor. "Our national consciousness still bears the stain and the scars of those events: The Alien and Sedition acts, the suspension of habeas corpus during the Civil War, the internment of Japanese Americans, German Americans and Italian Americans during World War II, the blacklisting of supposed communist sympathizers during the McCarthy era, and the surveillance and harassment of antiwar protesters, including Dr. Martin Luther King Jr."

Jonathan Band, a lawyer specializing in technology issues, said the most troubling elements of the new law are likely to play out in more subtle ways.

For example, part of the law enabling expanded monitoring or interception of online communications defines an eligible suspect not as a terrorist, but as a "trespasser." But the definition of trespasser is murky, Band said, creating "a huge civil liberties hole."

A trespasser can be anyone without authorized access to a machine or network. As a result, Band said, the FBI could compel a company, or Internet service provider, to allow it to monitor communications for someone who violated terms of service agreements, including being late on payments.

Or a company could give permission for the FBI to monitor an employee's computer use if the person used a company computer to shop online, in violation of company policy.

Supporters of the law say these objections are an overreaction and misinterpret the intent and consequence of the legislation. "We've had a lot of these recommendations for years," said Sen. Jon Kyl, (R-Ariz.). "They are not radical or new."

Band said that businesses, Internet service providers and large employers are going to have to start thinking: "They have to come up with a policy on how to deal with these requests. Who makes the decision in the company?"

Many companies might also need to alter their privacy policies, Band said, so that their users know in advance how the company would react in such situations. Otherwise, he said, they could be accused of unfair trade practice for violating their policies.

A spokesman for America Online, the online division of AOL Time Warner Inc., declined to comment on the new law. The company's current privacy policy states that the company will "release specific information about your account only to comply with valid legal process such as a search warrant, subpoena or court order, or in special cases such as a physical threat to you or others."

The new law's requirements that phone companies and Internet providers turn over customer information and activity to the government if the case involves suspected terrorism are not subject to the sunset provisions.

Banks, especially those that cater to high net-worth clients whose privacy is sacrosanct, will be subject to new scrutiny under tougher money-laundering provisions in the law.

And the ability for the FBI to get customer information from credit bureaus has been eased, although full credit reports still require a court order.

Leahy said he doubted the legislation would force businesses to rework privacy policies. Businesses already have to comply with government subpoenas, he said.

"Like everything else, your records can be subpoenaed," Leahy said.

Some in the privacy community believe that expanded surveillance powers will have an unintended consequence for the government: increased demand for easy-to-use encryption products that will make monitoring more difficult.

"The communication networks generally are going to be perceived as more vulnerable" to snooping, said David Sobel, general counsel for the Electronic Privacy Information Center.

Products that integrate encryption capability into e-mail or word processing would be popular, Sobel said.