Surveillance by default: PATRIOT Act extended?

On 15 March, Section 215 of the USA PATRIOT Act, and several other similar legal provisions, were due to expire and begin the process of reform and review to incorporate new legal protections of privacy. However, as a result of a coordinated effort by both chambers of the US Congress, the provisions may be extended for at least 77 days.

Section 215 was originally introduced in 2001 as part of the USA PATRIOT Act, a landmark piece of legislation passed soon after the September 11^th attacks as an amendment to the Foreign Intelligence Surveillance Act
of 1978 (FISA). The PATRIOT Act was designed to strengthen national security and law enforcement capabilities. It gave federal agencies like the Federal Bureau of Investigation (FBI) new and expanded competences like the permission to search a home or business without consent from the owner, indefinite detention of immigrants, etc.

Section 215 is a provision of the PATRIOT Act known as the “business records” provision. It allows the government and law enforcement agencies to order third parties to produce “specific and tangible” things such as books, records, papers, documents, and other items, when the FBI is conducting either an investigation into a “foreign intelligence,” or an investigation to protect against “international terrorism” or “clandestine intelligence activities” (even if the investigation targets US citizens).

It has been at the centre of many controversies of government overreaching and privacy violations. As EDRi member the Electronic Frontier Foundation (EFF) explained:

In the hearings last year, witnesses confirmed that the 215 ‘business records’ provision may allow the government to collect sensitive information, like medical records, location data, or even possibly footage from a Ring camera.

Section 215 had been the centrepiece of Edward Snowden’s leaks to The Guardian in 2013, where he revealed that the Bush and Obama administrations had been abusing the aforementioned provision to obtain phone data of US citizens in bulk.

It was the most egregious violation of privacy by the US government in recent history; and it happened in
secret. The Snowden leaks provoked a legislative reaction by Congress with the passage of the USA FREEDOM
Act, which took several measures to curtail the authority of law enforcement agencies, though extended Section 215 almost in its entirety to the end of 2019, and later to March 2020.

The threat has not gone away

Section 215, along with at least two other provisions (the roving wiretap and lone wolf surveillance authorities), were meant to be included in FISA reform legislation designed to introduce amendments and changes that would increase protections of individual privacy against governmental intrusion. This was the hope of a host of activist groups, non-profit organizations, etc., that saw the expiration of these provisions as a chance to overhaul the information access system in the US. The reforms were timed to take advantage of FISA’s expiration date of March 15, 2020.

However, last week the House of Representatives passed a bill that essentially extended Section 215 for three more years through 2023 – though this House bill did include several minor changes that took some of the criticism into account, like extending prison penalties for engaging in secret surveillance. When the bill went to the Senate for final approval, however, Majority Leader Mitch McConnell (Republican) and the Senate, instead of voting on the bill and debating its proposed changes, decided to punt any decision regarding this legislative proposal and unanimously passed an extension of Section 215 of the USA PATRIOT Act for 77 days, though it would still be subject to opposition from recessed House members and to presidential approval. What would this extension mean? It would essentially delay any kind of discussion on whether Section 215 will be allowed to expire and what kind of replacement parameters will be introduced.

What happens now?

It remains unclear what will happen to Section 215, now that the COVID-19 crisis has thrown the political landscape into disarray.

But, as the USA FREEDOM Act bipartisan effort demonstrates, the push to maintain this overbearing and invasive legislation endures. EDRi member EFF, who has been regularly advocating for privacy and
legislative reform, is actively pushing for change:

It is past time for reform. Congress has already extended these authorities without reform once, without debate and without consideration of any meaningful privacy and civil liberties safeguards. If Congress attempts to extend these authorities again without significant reform, we urge members to vote no and to allow the authorities to sunset entirely.

What matters now is that this landmark legislative provision is allowed to sunset, and the reform process for the authority to access private data by law enforcement agencies begins anew. Whether we will see this hope come to fruition, however, remains to be seen.

Read more:

Reform or Expire (26.02.2020)
https://www.eff.org/deeplinks/2020/02/reform-or-expire

Enough is enough: Let it expire (18.03.2020)
https://www.eff.org/Enough-is-enough-let-215-expire

Congress extends Section 215 surveillance program (29.11.2019)
https://epic.org/2019/11/congress-extends-section-215-s.html

EPIC to Congress: End Section 215 Surveillance Program (10.12.2019)
https://epic.org/2019/12/epic-to-congress-end-section-2-1.html

Three FISA authorities sunset in December: Here’s what you need to know (16.01.2019)
https://www.lawfareblog.com/three-fisa-authorities-sunset-december-heres-what-you-need-know

What happened to FISA reform? (17.03.2020)
https://www.lawfareblog.com/what-happened-fisa-reform

(Contribution by Rafael Hernández, communications intern, EDRi)