Information at a price: liberty vs. security: follow-up legislation proposes to increase the sweeping domestic intelligence and surveillance powers granted to the U.S. federal government by the USA PATRIOT Act--but will it be at the cost of civil liberties? (Capital Edge: legislative & regulatory update).

A sign posted at 10 public libraries in Santa Cruz, California, warns patrons that the government may be watching what they read:

   Warning: Although the Santa Cruz
   Library makes every effort to protect
   your privacy, under the federal USA
   PATRIOT ACT (Public Law 10756),
   records of the books and other
   materials you borrow from this
   library may be obtained by federal
   agents. That federal law prohibits
   library workers from informing you
   if federal agents have obtained
   records about you. Questions about
   policy should be directed to Attorney
   General John Ashcroft, Department
   of Justice, Washington D.C. 20530.

The United and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism (USA PATRIOT) Act of 2001 allows Federal Bureau of Investigation (FBI) agents to obtain warrants allowing access to the library or bookstore records of anyone connected to an international terrorism or spying investigation.

In Santa Cruz and around the world, many are questioning whether the legislation, which rushed through Congress in the wake of September 11, 2001, is a powerful tool in the war against terrorism or an assault on Americans' most basic rights.

The first major legislative initiative passed by Congress since the horrific 9/11 attacks, President Bush signed H.R. 3162 into law on October 26, 2001. After more than six weeks of discussions and negotiations, members of Congress and the Bush administration reached agreement on the legislation that granted broad new powers to domestic law enforcement and international intelligence agencies to use wiretaps, electronic and computer eavesdropping, searches, and a wide range of other information-gathering techniques to investigate and prosecute domestic acts of terrorism.

Because the legislation also eliminated many checks and balances that courts previously used to ensure that such powers were not abused, critics say its passage dealt a large blow to Americans' civil liberties. The PATRIOT Act raises a valid question: whether the government's need for information outweighs an individual's right to privacy. And, as the administration seeks legislation that will expand the first act's broad intelligence and surveillance powers, this question must be answered.

PATRIOT II on the Horizon

For months, the U.S. Department of Justice and Attorney General John Ashcroft have been drafting the Domestic Security Enhancement Act of 2003. Justice Department officials have repeatedly denied the existence of the draft legislation, dubbed the PATRIOT Act II, but a "confidential--not for distribution" copy recently appeared on the Web site of the Center for Public Integrity (www.publicintegrity.org), a non-profit, non-partisan public interest organization.

Soon after the leak, House Judiciary Committee Democrats called on Ashcroft to explain the draft legislation. He has said publicly that no decisions have been made on final proposals for the PATRIOT Act's expansion. The Justice Department declined to comment on the posted draft but did not dispute its authenticity. Currently, the Office of Legal Policy is developing the draft.

Detentions, Databases, and Decreased Civil Liberties

According to the Center for Public Integrity, the new legislation would give the U.S. attorney general and the federal government sweeping domestic intelligence-gathering, surveillance, and law enforcement powers, while simultaneously decreasing judicial review and public access to information. Some privacy advocates are concerned about the proposal's effect on detention of non-citizens, telephone and Internet surveillance, secret searches and seizures, access to financial and personal information, targeting of Arab, Muslim, and South Asian immigrant communities, large-scale investigations of U.S. citizens for "intelligence" purposes, and the designation of certain activist groups as "domestic terrorists."

More specifically, under the draft's provisions the government would be allowed in terrorism cases to

* wiretap a suspected terrorist for 15 days without a judge's approval

* demand personal information such as credit records without a subpoena

* keep arrests secret until criminal charges are brought, no matter how long that takes

* ease restrictions on the use of secret evidence

* strip Americans of their citizenship if they even unwittingly help a group the Justice Department determines to be terrorist-related

Since 9/11, the U.S. government has detained hundreds of people and refused to disclose their names on the grounds of protecting their privacy. As drafted, PATRIOT II's Section 201 would remove existing Freedom of Information Act (FOIA) protections for individuals detained in terrorism investigations, making it easier for officials to withhold detainees' identities and the reason they are held, thereby precluding charges of overreaching authority.

PATRIOT II would significantly expand the federal government's power to secretly investigate, detain, and punish suspected terrorists without court supervision. It would authorize the Justice Department to conduct clandestine searches or eavesdrop on any suspected terrorist or foreign agent for 15 days after the beginning of a military conflict or national emergency, rather than after a formal declaration of war, as current law provides. The legislation also would permit wiretaps of U.S. citizens in terrorism cases for longer periods and with less judicial oversight than is now permitted.

The measure further proposes to create a DNA-sample database of suspected terrorists (and anyone whose DNA might assist terror investigations), force suspects to prove why they should be released on bail rather than allow the prosecution to prove why they should be held, and allow the deportation of U.S. citizens who become members of, or offer help to, terrorist groups. DNA of convicted and suspected terrorists would be stored in a "Terrorist Identification Database." Terrorists would include anyone associated with, or providing money or other support for, groups designated terrorists. Under the first PATRIOT Act, "domestic terrorism" was defined broadly as "any action that endangers human life that is a violation of any federal or state law."

In addition, the draft proposes to strip U.S. citizenship from anyone who serves in an enemy army or gives "material support" to any group designated a terrorist organization. Under current law, such service must be done with clear intent to renounce citizenship. While it is already illegal to support terrorist groups, such support is considered grounds only for criminal prosecution, not for the loss of citizenship. The U.S. Constitution states that Americans cannot be deprived of their citizenship and the rights that go with it, unless they voluntarily give it up. But PATRIOT II states that someone's intent to relinquish citizenship can be inferred from conduct.

Increased Surveillance and Secrecy

Under current law, the Justice Department can secure data from the private sector and review agency databases such as the Department of Education's. It can order libraries, universities, and retail stores to turn over citizens' and non-citizens' records. Under PATRIOT II, federal agents would not need subpoenas or court orders to access Americans' credit card reports. The measure would make easier surveillance of U.S. citizens without first establishing traditional probable cause under the Fourth Amendment. It also would provide law enforcement with immunity from liability when engaging in spying operations.

The draft also seeks greater Internet surveillance. PATRIOT II would make it a new, separate crime to use encryption technology in the commission of a crime. To be convicted, an individual must be shown to have "knowingly and willfully use[d] encryption technology to conceal any incriminating communication" relating to a federal felony. The proposal suggests that illegal encrypting carry a mandatory five-year prison term. This represents the first attempt to regulate encryption domestically--and the new encryption crime is not limited to terrorism.

Wiretap Changes and Decreased Privacy

PATRIOT II seeks to expand Title III wiretaps, those issued by federal courts for use in criminal investigations. One new provision would establish a terrorism exception to Title III, requiring little or no court supervision and expanding the wiretap's duration from 30 to 90 days.

In addition, a warrant covering one function of a multi-function device (e.g., a cell phone with e-mail) would allow access to all its functions.

PATRIOT II also contains provisions that would allow information to be withheld from the public in the name of protecting them from terrorists. Section 128 would prohibit subpoena recipients in terrorism investigations "from disclosing to any other person (except to a lawyer) the fact that he has received a subpoena." Such gag orders on witnesses would profoundly impact public knowledge of these matters.

Section 202 would allow private companies that are required to file "worst-case scenarios" with the Environmental Protection Agency (EPA) to withhold information about a nearby company's use of hazardous materials from public release. It would also prevent the EPA from distributing such information to the public. Section 203 allows congressional officials to withhold information about compliance with Occupational Safety and Health Administration standards that could include "security-sensitive information."

Moving Forward Cautiously

If PATRIOT II is introduced in Congress, opponents expect the debate over the proper balance between civil liberties and security to be renewed. Civil liberties groups representing diverse political viewpoints have formed an informal coalition--including immigrant groups, religious organizations, and Internet privacy groups--to fight the legislation.

So far, more than 40 municipalities have passed resolutions expressing concern about the first PATRIOT Act's implementation. Members of both parties have criticized the Bush administration for its lack of openness about how the legislation has been implemented and the lack of information about how it has been used.

When asked in a National Journal interview about further expansion of the police powers granted by the PATRIOT Act, Congressional Internet Caucus Chairmen Rick Boucher (D-Va.) and Robert Goodlatte (R-Va.) indicated that such expansion would likely be met with skepticism by both parties in the House Judiciary Committee. "We will look at [PATRIOT Act II] closely, but there isn't predisposition that there are things out there that we hadn't already taken care of in the PATRIOT Act," Goodlatte said.

Critics contend that, as written, PATRIOT II threatens First Amendment rights, statutory and common law privacy rights, the right to challenge government illegality in court, and the Fourth Amendment right against unreasonable searches and seizures. While the original PATRIOT Act contains sunset provisions for some sections to expire in 2005, PATRIOT II includes no such provisions.

In response to the criticism of the draft version of PATRIOT II, Barbara Comstock, director of public affairs for the Justice Department, released the following statement:

   "The President expects all his cabinet
   departments that are involved
   in homeland security, including the
   Department of Justice, to make
   sure we are doing everything we
   can to protect the American people.
   It should not be surprising that the
   Department of Justice takes that
   responsibility seriously and discusses
   additional tools to protect
   the American people. We are continually
   considering anti-terrorism
   measures and would be derelict if
   we were not doing so. The
   Department's deliberations are
   always undertaken with the
   strongest commitment to our
   Constitution and civil liberties."

But Sen. Patrick Leahy (D-Vt.) has argued that before the Justice Department asks Congress for more power, it must disclose how it is using the sweeping powers it already has been given. But so far, the department has balked repeatedly at FOIA requests from the press and the public and at Congress' requests for more details about the first PATRIOT Act.

Regarding PATROIT II, Sen. Chuck Grassley (R-Iowa) said: "I'm going to be very cautious about that legislation. Quite frankly, I'm not going to be for dramatic expansion of it, even knowing the environment of terrorism I know is now a threat to Americans. I think we need to move very cautiously. And I think we've had about enough expansion as we should have for a while."

Libraries, for one, are challenging the PATRIOT Act's civil-liberty threat head on. Rep. Bernie Sanders (Ind.-Vt.) recently introduced a bill (H.R. 1157) to repeal the library and bookstore provisions--the first House bill, and the second in Congress, seeking to roll back any part of the legislation.

Sanders' proposed Freedom to Read Protection Act, which has 58 co-sponsors, would allow library and bookstore searches only if federal agents first showed they were likely to find evidence of crimes. To date, the Bush administration has refused to say how it has used Section 215, prompting a FOIA lawsuit by library and bookseller organizations. In addition, leaders of the American Library Association passed a resolution in January calling the PATRIOT Act "a present danger to the constitutional rights and privacy rights of library users" and urging Congress to change the law.

If PATRIOT II becomes law, even with modifications, records and information managers could find themselves involved with requests for private information about employees, customers, and partners. Standards for authenticating that such requests are legitimate, and internal procedures for releasing the information will take time to formulate and will most likely involve the constituents that records managers deal with in their day-to-day activities: lawyers, information technologists, and compliance officers. But, unlike more mundane information requests, those under PATRIOT Act I or II are more likely to evoke a far more personal, conflicted reaction.

RELATED ARTICLE: U.S. will profile flyers.

The U.S.Transportation Security Administration (TSA) is developing a sophisticated screening system designed to identify potential terrorists by profiling everyone who buys tickets for commercial flights.

TSA officials say the Computer Assisted Passenger Prescreening System (CAPPS II) will use databases that already operate in line with privacy laws and will not profile based on race, religion, or ethnicity.

According to The New York Times, in addition to evaluating certain travel-related behavior and checking passenger names on watch lists, the new system will give the TSA access to numerous public and private databases the moment passengers book flights. Exactly which databases has yet to be determined, but they could conceivably include the records of motor vehicle offices, banks, and credit-rating agencies.

From there, the TSA will assign each passenger a risk level: green, yellow, or red. Green passengers will not require further checks, yellow ratings will get extra screening, and red won't be allowed to fly. When travelers check in, their names will be checked in the system. But travelers will not be informed of their designations, which will be encrypted onto their boarding passes for TSA screeners to check.

Civil liberties groups say the creation of a highly intrusive federal surveillance system raises serious privacy and due process concerns that must be addressed. They cite the potential for unconstitutional invasions of privacy and for database mix-ups that could lead to innocent people being branded security risks.

There is also concern that the TSA is not revealing how information will be gathered and how long it will be kept. Brian Roehrkasse, Department of Homeland Security spokesman, told the media that a priracy officer will be assigned to safeguard civil liberties. In addition, an oversight panel that will include a member of the public is being formed, and the TSA will set up procedures to resolve complaints.

Airlines already do rudimentary checks of passenger information, such as method of payment, address, and date of ticket purchase. But the TSA will manage the new system, and the data, which formerly remained with the airlines' reservation systems, may now be shared with other government agencies.

The program could be in place as early as year's end. Delta Airlines recently tested the system at three undisclosed airports. As we go to print, however, the Office of Management and Budget announced it will not let the plan go forward until key questions about its effectiveness are answered. (A 1996 law allows the budget office to cut funds for information technology projects that it does not consider efficient or effective.)

RELATED ARTICLE: A Data-sharing solution.

To fight future terrorist threats, the U.S. government will need to rely on more than just legislation.

Federal agencies long have been hampered by information silos, or immense databases of diverse information that are not connected, shared among departments, or analyzed. This lack of coordination severely restricts the government's ability to detect and prevent terrorist threats and to rapidly communicate in response to attacks. In addition, agencies now must coordinate communications among and across multiple channels, including phone, fax, Web, e-mail, branch offices, and field agents. These challenges stem from current existing problems, such as incompatible information systems, legal and privacy restrictions on information sharing, and organizational barriers between agencies.

As the events of September 11 demonstrated, however, enabling the databases of the Central Intelligence Agency (CIA) and the Federal Bureau of Investigation (FBI) to communicate just may mean the difference between life and death. Thus, the fundamental challenge the government faces is overcoming the lack of coordinated information sharing among dozens of its federal agencies involved in homeland security, as well as among numerous state governments, local agencies, and private entities. In short, federal agencies must tear down information silos and organizational roadblocks and work as a team.

Current solutions can gather data from multiple sources and make it available within an agency's existing systems, allowing multiple agencies to exchange information. This would provide agencies with a comprehensive view of all data related to a suspect or potential terrorist threat. To get to this point, experts say, the United States must build a decentralized computer system for tapping into information stored in multiple government and private-sector databases. To turn all that data into knowledge, agencies must learn to collaborate and filter information on a higher level than has ever been attempted before.

The government has so much information at its disposal, however, that the first step should be to review the current state of its knowledge. Some agencies also will need to review their internal information architectures. Insiders say the fact that some have many different databases reflects how the federal government grew up and operates--around specific programs, rather than around the agencies themselves. A large corporation could address that problem by getting rid of its information silos and merging the data into a new, integrated system. But that option would be difficult for the government, which has lots of big, expensive legacy computer systems it cannot afford to replace quickly. However, it can use enterprise data-management systems to help unite many sources of data and achieve integration.

Still, insiders say the biggest challenge may be institutional, not technological, because agencies that have traditionally viewed one another as rivals will be forced to share information and technology. Another challenge for government information architects who want to enable information sharing across dozens of agencies is to avoid logjamming the interagency data flow by closing off too many areas, while still protecting sensitive information. Different users must be able to browse secured databases to see different sets of information according to their need to know.

Help may be on the way in the form of the Comprehensive Homeland Security Act of 2003, an add-on to the 2003 federal information technology budget. If passed, it is expected to create a $1 billion fund to improve the government's information security system and enable federal agencies to take advantage of data-sharing technologies.

Nikki Swartz is Associate Editor of The Information Management Journal. She may be contacted at [e-mail].