The PATRIOT Act’s Poisoned Tree

American history neither began nor ended on 9/11. That day’s vile events shoved the nation down a darker path than it might otherwise have trod, but just as the attack inflicted on America was the poisoned fruit of past policy crimes and mistakes, the resultant flowering of government surveillance and information cap-ture grew from roots set far deeper than the rubble from the Twin Towers.

Within a month of the assault, a bill called the Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act, giving the federal government vast new snooping powers, appeared on the floors of the House and the Senate. The USA PATRIOT Act, soon to lose the USA in standard usage, was signed into law by President George W. Bush on October 26, 2001. Voting against it were 66 House members and just one senator: Russ Feingold (D–Wisc.).

Two decades down the line, after a confusing array of follow-on intelligence-gathering laws (including the 2015 USA FREEDOM Act, which supplanted various PATRIOT Act provisions), it is not obvious that America has indeed been “strengthened.” The law has been used overwhelmingly to prosecute the war on drugs, not the war on terror, during a time when the country began moving away from prohibitionism. The new tools are error-prone, have not been shown to have prevented terrorism on U.S. soil, and have nonetheless been used as a pretext for successive administrations to construct vast, constitutionally dubious secret surveillance networks.

But efficacy wasn’t a big part of the original debate; the preventive utility of an information-gathering dragnet was widely—and wrongly—assumed. Back then, supporters and opponents were more apt to argue over the impact on civil liberties.

A common argument defense lawyers make when trying to get courts to dismiss evidence obtained illegally against their client is that it was the “fruit of the poisoned tree.” The PATRIOT Act itself was the fruit of the tree of law enforcement’s relentless desire to be free of the inconveniences of the Fourth Amendment and its guiding principles of privacy and due process.

The Wish List

Critics of the law warned that it heralded the “death of privacy.” Proponents retorted that, in fact, the law wasn’t some huge departure for American surveillance. On that narrow point at least, the hawks weren’t wrong.

For example, the controversial “national security letters”—warrantless demands for data about people from third parties such as phone companies, without notifying the target of the investigation—had already been in use, authorized by the 1978 Right to Financial Privacy Act (RFPA) and the 1986 Electronics Communication Privacy Act (ECPA). The shadowy Foreign Intelligence Surveillance Court (FISC), which many Americans discovered was the provider of judicial fig leaves for PATRIOT fishing expeditions, had been operational since the passage of the 1978 Foreign Intelligence Surveillance Act (FISA), an intended bulwark against previous surveillance abuses.

As former G-man Michael J. Woods wrote in a 2005 Journal of National Security Law & Policy article, the FBI before 9/11″had five separate legal authorities that addressed the need to compel production of transactional information in counterintelligence investigations: three types of national security letters (under RFPA, ECPA, and FCRA [Fair Credit Reporting Act]), the FISA pen register/trap and trace authority”—i.e., grabbing the numbers for incoming and outgoing calls from a phone or browser history from a computer—”and the FISA business records authority. All of these authorities specified the types of records that could be obtained, and all the records specified were, according to the reasoning of the Supreme Court…outside the protection of the Fourth Amendment.” In the controversial 1976 Miller case, the Court decided that if you willingly gave up information to a third party, such as a credit reporting agency, ISP, or telco, you no longer had a privacy right under the Fourth Amendment regarding that information.

The PATRIOT Act made it somewhat easier to obtain approval for surveillance meant to focus on a foreign national, changing the standard for tracking an individual from foreign intelligence being the “primary purpose” of an investigation to just a “significant purpose.” (U.S. citizens who communicated with said foreigners were also fair game for scrutiny, particularly if any aspect of that communication took place outside of the country.)

The FISA court, which had always been deferential to intelligence agencies, became even more of a rubber stamp, issuing approvals the public was never allowed to read. Even so, in the gung-ho spirit of the times, Bush administration Department of Justice official David Addington crowed that they were just “one bomb away from getting rid of that obnoxious court.” Even the flimsy paper barrier between the executive branch and its maximum security desires was considered too much of an irritant.

Though 9/11 provided the impetus and urgency, none of the PATRIOT Act powers were dreamed up solely in response to that terrible day. Rather, the attacks on the World Trade Center and Pentagon provided an expedient excuse to fulfill law enforcement’s longstanding wish list. And one of the principal keepers of that list now resides in the White House.

As a senator, Joe Biden initially bragged about the PATRIOT Act like a proud papa, clucking that then–Attorney General John Ashcroft had essentially “sent up…my bill”—a grab bag of expanded police authority that Biden had been pushing since the Oklahoma City bombing in 1995.

That grafting of domestic law enforcement concerns onto the response to a foreign-originating attack should give us pause, especially in 2021. “Domestic terror” was a category specifically enumerated in the PATRIOT Act, and the one most likely to be used by a president intimately familiar with those law enforcement tools. At a time when “Islamic terror” has faded as an existential threat, PATRIOT’s most immediate relevance in this administration might just be its potential weaponization against the president’s political opponents.

PATRIOT’s overall spirit and intent was to widen the circumstances, places, and targets for which the government didn’t need to worry about the niceties of the Fourth Amendment and its attendant legal tradition and practice about warrants, notice, meaningful judicial oversight, and particularity. PATRIOT struck critics as unconstitutionally invasive of citizens’ privacy, allegedly in the name of fighting foreign terror, and over time didn’t seem to deliver any goods, especially regarding the latter point, that justified the unconstitutionality.

What PATRIOT Allowed

The PATRIOT Act expanded the potential criminal exposure of everyone living in the United States, whether or not we were involved in terrorist plots. Noncitizen residents could now be faced with indefinite detention without conviction. U.S. citizens who took more than $10,000 out of the country were no longer guilty of a paperwork crime; they were subject under Section 371 to having their money seized by the government (this among other tightening of the informational reins on banks in the name of stopping terror financing via “money laundering”).

Parts of PATRIOT were controversial enough that they were passed with built-in “sunsets” requiring them to be reapproved by Congress every five years. Since those sections generated political conflict, they tended to be the most discussed aspects of the sprawling law.

The most controversial, both at the time and as a result of later revelations about how it was used, was Section 215, which expanded the definition of the “business records” that government snoops could snatch under FISA authority. Before, the capturable records had to be provided by common carriers: providers of public accommodation, storage, or vehicle rental operations. Now they could mean “any tangible thing” that the feds could convince the FISA court was relevant to a terror investigation.

And convincing the FISA court turned out to be about as easy as saying, “Because we say so.” As the FBI’s Woods spelled out, “the judge has no meaningful discretion in considering a §215 application. While the plain language of §215 directs the judge to issue the business records order if the judge finds ‘that the application meets the requirements’ of the section, the only ‘requirement’…is that the application specify that ‘the records concerned are sought for an authorized investigation.'”

There was also the “roving wiretap” authority under Section 206, allowing surveillance to follow a target without any additional permission when a target changed communication methods. (Privacy rights groups felt this was in conflict with the Fourth Amendment requirement that a legal warrant “particularly describ[e] the place to be searched.”)

The “lone wolf” provision allows for tracking individuals suspected of terrorist intentions who are not known to be associated with any known foreign organization or government. It was added in 2004, but the government claims it has never been used.

All of these controversial sections were reauthorized in 2006 and again in 2011, under both Bush and President Barack Obama. Bush additionally made sure to let us know in his signing statement that his administration would only report what it felt like reporting to the public about PATRIOT use, saying that he “shall construe” requirements “that call for furnishing information to entities outside the executive branch…in a manner consistent with the President’s constitutional authority…to withhold information the disclosure of which could impair foreign relations, national security, the deliberative processes of the Executive, or the performance of the Executive’s constitutional duties.” And it was his lawyers’ considered opinion that once the Authorization for Use of Military Force that launched the war on terror was declared that the president could do whatever he wanted to defend this nation, and that any attempt to stop him was the true blot on the Constitution.

Other troublesome parts of PATRIOT were not subject to sunset or reauthorization. Confusingly similar to these Section 215 powers is Section 505’s “national security letters.” These may be issued solely by the FBI and allow the taking of records from third parties who are then forbidden to discuss having ratted out their customers.

Section 213 authorized what privacy advocates called “sneak and peek” searches and seizures, in which the typical prior notification involving a judge-authorized warrant was replaced with letting targets know “within a reasonable period of its execution, which period may thereafter be extended by the court for good cause shown.” Reasonable here is both undefined and unlikely.

Did PATRIOT Help?

The FISA process was known to be error-prone even prior to its post-9/11 expansion. According to a report issued in 2006 by the Justice Department’s Office of Inspector General, 75 errors were made in 2000–01 regarding a target’s asserted connections to foreign terror. A 2007 report from the same office found that FBI agents produced a similar pattern of exceeding their authority with national security letters, including aiming them at the wrong people, taking things the national security letters did not specify, and executing them past the stated time period in the request.

Bush administration officials liked to keep their secret investigations and secret laws as secret as they could, frequently stonewalling even relevant congressional committees about how the act’s provisions were being used and often revealing details only behind closed doors to Congress members and staffers with relevant top-secret clearance. (Many offices, having no such credentialed staff, just had to stay in the dark.) Intel folk in the executive branch seemed to think the obligations of informed democracy were met by an elite of intelligence committee muckety-mucks in Congress knowing (some of) what the administration was up to, with the actual electorate kept rightly in the dark.

Such obscurity, coupled with the vague catchall of “information sharing” across intel agencies, helped spread the notion that the PATRIOT Act was vital for national security. But as the American Civil Liberties Union (ACLU) argued on its website, “the Patriot Act is not the reason for improvements in information sharing…FISA information, properly obtained for foreign intelligence purposes, could always be shared with criminal investigators if relevant to crime. Rather, the Patriot Act is about making it easier to use FISA as an end-run around the Fourth Amendment.” 

The ACLU further noted that “a list obtained by the Justice Department defines only 361 cases defined as terrorism investigations from September 11, 2001 to September 2004” and that “only 39 of these individuals were convicted of crimes related to terrorism.” And how earthshaking were these terror arrests? One indication: “The median sentence for these crimes was 11 months.”

PATRIOT’s terror-fighting record did not improve much over time, either. Critics thought that practices such as sneak-and-peek searches meant to make end-runs around the Fourth Amendment would become common law enforcement practice, not just for urgent emergency needs to shut down a terror plan. And they were right. As Lee Tien of the Electronic Freedom Foundation wrote in 2014, “Exactly what privacy advocates argued in 2001 is happening: sneak and peek warrants are not just being used in exceptional circumstances…but as an everyday investigative tool.”

Tien pointed out a consistent pattern from 2009 to 2013 of the use of them for terrorism-related cases being consistently less than 1 percent of total uses, with narcotics cases in each of those years being over 70 percent. That pattern can still be seen in the 2020 figures, with 71 percent for drugs. The pie chart on a federal court report on that year’s use of what they call “delayed notice” warrants does not even have anything related to terror as a listed category.

As much as PATRIOT did, for the Bush administration it didn’t do enough—so officials quickly, and covertly, went beyond even its expanded tools and authorities. These surreptitious mission creeps were known under various names, including the colorful “Stellarwind,” a program uncovered in 2005 by The New York Times. (Those overly optimistic about the watchdog press should note that the paper held that information for a year over national security concerns before publishing it.) As the Times eventually reported, Stellarwind had “monitored the international telephone calls and international e-mail messages of hundreds, perhaps thousands, of people inside the United States without warrants over the past three years.”

Yet the excesses of the information-gathering machine enabled by the PATRIOT Act were only just beginning to shock the conscience of the world.

The Snowden Effect

Those keeping a close eye on the security state already knew by the turn of the 2010s that the government was doing disturbing things, such as having secret rooms built in a major AT&T center in San Francisco from which to grab internet traffic (enabled by another pre-PATRIOT authorization, the 1994 Communications Assistance for Law Enforcement Act, which mandated that telecom companies deliberately design their systems to aid in government eavesdropping). The search engine company Yahoo! was already complaining in 2009 (while asking the government to reject a FOIA request regarding what Yahoo! got paid to give up information on their customers to the feds) that letting the world know how much they delivered regarding their customers would successfully “shame Yahoo!” and “shock” their customers, as they accuse the FOIA requester of wanting to do.

The journalist James Bamford, who has written multiple books about the National Security Agency (NSA), concluded as early as 2008 that “the idea of communications privacy in the United States has literally become a joke.” By then, pranksters from the San Francisco Billboard Liberation Front had already altered an AT&T billboard to read: “AT&T works in more places, like NSA HEADQUARTERS.”

Even then, the spooks’ appetite for making sure they were capable of maximum snooping without pesky encryption or civil liberties getting in the way could not quite be sated. In 2013, that pathological drive would finally become common knowledge.

The breakthrough came with the colorful espionage tale of former CIA man and then–NSA contractor Edward Snowden. After leaking gigabytes of info grabbed from within one of the feds’ Hawaii data warrens and then hightailing it to Hong Kong as an international fugitive, he eventually wound up in Russia after the U.S. cancelled his passport. Suddenly, it began to sink in that the government wanted to know everything it possibly could about us—and that it was using the PATRIOT Act’s Section 215 as legal justification for acting on that desire.

The surveillance machine was scooping up staggering amounts of metadata—records of which phone numbers were calling which, when, and for how long, and the analogous information generated by internet use—under the belief that, well, it might prove relevant to some terror or foreign-espionage investigation. FISA judges, compliant as always, agreed. While intelligence apologists stressed that no actual content was being retained or read, very full accounts of one’s private doings can be easily gleaned from knowing every phone number a person calls and every website a person visits.

In Barton Gellman’s 2020 Snowden book Dark Mirror, former NSA deputy director Rick Ledgett offered the best defense intel pros could come up with to appease outraged Americans: “I get that they are concerned that the government is listening to their communications, but the government just doesn’t care. Things they’re doing are not interesting enough from a national security perspective.”

The Privacy and Civil Liberties Oversight Board, a bipartisan executive branch agency, determined in a 2014 report after the Snowden revelations that NSA’s bulk telephone records program “has shown minimal value in safeguarding the nation from terrorism. Based on the information provided to the Board, including classified briefings and documentation, we have not identified a single instance involving a threat to the United States in which the program made a concrete difference in the outcome of a counterterrorism investigation.” 

Because of the secrecy surrounding most aspects of the program, it’s next to impossible to assess the tangible harms from PATRIOT and post-PATRIOT surveillance. Still, we know that as Obama left office he made it easier for the NSA to share information it grabbed overseas with American law enforcement, even if those communications involve American citizens. As the ACLU of Massachusetts warned in 2016, this allowed domestic law enforcement “to poke around in your private information in the course of totally routine investigations. And if they find something that suggests, say, involvement in illegal drug activity, they could send that information to local or state police. That means information the NSA collects for purposes of so-called ‘national security’ will be used by police to lock up ordinary Americans for routine crimes.”

To legally cover their tracks about potentially ill-gotten evidence—the NSA was specifically known to share information with the Drug Enforcement Administration—law enforcement agencies often feel obliged to come up with what they call “parallel construction”: an alternate, untrue story for how they learned the information that doesn’t involve relying on warrantless NSA procedures.

And no matter what paper barriers exist to protect Americans from surveillance abuse, the work is done by actual human beings who often do whatever they want to, and can. ABC News reported in 2008 about NSA whistleblowers with tales of giggling over salacious personal details revealed in phone calls from Americans in the Middle East whose actual content they amused themselves by listening in on. This included eavesdropping on soldiers in Baghdad “calling home to the United States, talking to their spouses, sometimes their girlfriends,” with staffers taking as a perk of their NSA job the power to overhear “personal, private things with Americans who are not in any way, shape or form associated with anything to do with terrorism.”

The mass phone metadata program, the most memorable and understandable symbol of post-PATRIOT government overreach, was finally reined in legislatively with 2015’s USA FREEDOM Act, which changed NSA access to the phone records from “they take it all from telcos” to “telcos keep it but run searches for the NSA on demand.” The searches were now supposed to be limited to two “hops” from the targeted phone number (to every number called from it, and then to every number called from all of those), which still could turn dozens of targeted numbers into millions of records, involving countless people with no connection to any sinister foreign behavior.

The Age of Terror Never Ended

President Donald Trump and his administration added a new wrinkle to the usual Washington reauthorization dance, combining official support for keeping as much surveillance power as possible with sporadic declarations from the president himself, often in tweets, that FISA-approved surveillance may have bedeviled his own communications. Trump railed against the “deep state” while continuing to empower it: Even after the NSA itself had (at least officially) abandoned it, for example, the Trump administration, in an August 2019 letter to Congress signed by then–Director of National Intelligence Dan Coates, asked for an eternal commitment without further sunsetting to the USA FREEDOM Act version of the call-records program.

But there was one silver lining in Trump’s zigzag: After the Department of Justice’s inspector general slammed the FBI in a 478-page December 2019 report over a dubiously sourced warrant to conduct surveillance against low-level Trump campaign staffer Carter Page (that surveillance having been the spark that lit the Justice Department’s two-year special Russia investigation), the Republican Party no longer had the stomach for automatic renewals of PATRIOT’s sunset provisions. In March 2020, Section 215, the roving wiretap authorization, and the lone wolf provision all legally expired.

The irregularities in the Carter Page FISA application were no unique artifact of a deep state out to gut Trump. According to a 2019 article published on the Electronic Frontier Foundation website, “Over the past twenty years, federal agencies have repeatedly misled the FISC about the nature and scope of FISA surveillance. For example, in one opinion from 2009, a FISC judge recounted how the NSA had ‘repeatedly submitt[ed] inaccurate descriptions’ of the way the NSA was conducting surveillance. In another opinion from 2011, another FISC judge wrote that he was ‘troubled’ by the government’s ‘substantial misrepresentations regarding the scope of a major collection program’—the ‘third instance in less than three years’ of the government misleading the FISC about a significant aspect of the government’s surveillance programs.”

But the surprising death of Section 215 is no reason for privacy-conscious Americans to believe the post-9/11 surveillance hangover is gone. As Timothy Edgar, author of Beyond Snowden: Privacy, Mass Surveillance, and the Struggle to Reform the NSA (Brookings Institution Press), wrote in World Politics Review in April, “The NSA’s most sweeping surveillance powers involve its collection of data outside the United States—powers that are not affected by the expiration of a few provisions of the Patriot Act. In the internet age, this data can and does include the communications of both Americans and others, and the NSA can collect it without a court order or meaningful oversight from Congress.”

The mentality of the post-9/11 surveillance state has not gone away, even if the weird political exigencies of one Congress in the latter days of the Trump administration let some of its legal authority lapse. The PATRIOT Act built a machine designed to exaggerate and exploit fears of dangerous Others. That sort of weaponized anxiety tends to become free-floating and self-perpetuating.

The PATRIOT Act was the fruit of a poisoned tree, and we can still see the shadow of its overgrowth in 2021 as the Biden administration transfers its own “domestic terror” anxieties onto anything related to Trumpism following the January 6 melee. The administration in June issued a new strategy report on domestic terrorism, and while so far it seeks no new lawmaking power, that report troublingly insists that “it is equally important that the Federal Government engage in efforts to prevent individuals from being drawn into the grip of domestic terrorism in the first instance. That means reducing both supply and demand of recruitment materials by limiting widespread availability online and bolstering resilience to it by those who nonetheless encounter it, among other measures.” That smacks of the sort of infiltration and harassment of people who have, as of yet, merely engaged in First Amendment protected activities.

Also alarming for those who want their online lives free from content-based snooping is the declaration that “the widespread availability of domestic terrorist recruitment material online is a national security threat whose front lines are overwhelmingly private-sector online platforms, and we are committed to informing more effectively the escalating efforts by those platforms to secure those front lines.”

Hugh Handeyside, a senior staff attorney with the ACLU’s National Security Project, says those sorts of emphases means Biden’s plan “relies on tools and structures that have proven deeply harmful to Muslim and immigrant communities and have focused on speech and other constitutionally protected activities as a basis for investigation.”

Feingold, now head of the American Constitution Society, warned his former Democratic colleagues on Capitol Hill in a February Wall Street Journal op-ed not to let fear of a Trumpist threat convince them that more expanded legal powers are needed. He wrote there that “the overwhelming tendency in domestic antiterrorism has been to use invasive and unconstitutional surveillance techniques to criminalize legitimate dissent” and in an interview stresses that progressive activists have as much of a chance as being ensnared in any new emphasis on fighting domestic terror inspired by January 6. Indeed, two people who harmed empty portions of the controversial Dakota Access Pipeline have already been hit with enhanced sentences this year, based on the claim that they were domestic terrorists.

The PATRIOT Act defines “domestic terror” as breaking the law in a manner that “involves acts dangerous to human life” in order to “influence the policy of a government by intimidation or coercion.” Given how easy it is to break some law while protesting, especially if police come to disperse you, this interpretation has alarming implications for the right to speak out against government actions in a public setting. This can affect Black Lives Matter as easily as Team MAGA.

Online activity and metadata and even private papers stored on our devices are still quite vulnerable to prying eyes, both private and federal—and the former can too easily become the latter. In August, Apple announced that it intended to pre-load its devices with a tool allowing the company to search for signs of child pornography, encrypted or not. Alliances between the government and the companies that make the devices we all use to communicate, whether those alliances are eagerly embraced or coerced, are not going away post-Snowden. New motives will always arise to justify the government’s desire to annihilate our information privacy. The PATRIOT Act was not the source of that government compulsion to snoop, nor will the expiration of some of its most controversial provisions mark the end of it.