Most notably, Section 215 of the PATRIOT Act expanded the government’s ability
to obtain business records held by third parties. Before the 2001 Act, the FBI could
petition the FISA Court to obtain an order to require third parties to turn over the
business records of transport companies, hotels and motels, car and truck rental
agencies, and storage rental facilities if the government certified that the records
were sought for a foreign intelligence or international terrorism investigation being
conducted by the FBI and that it had “specific and articulable facts giving reason to
believe” that the subject of the records was a foreign power or agent of a foreign
power.
217
The Patriot Act’s Section 215 amended Section 501 of the Foreign Intelligence
Surveillance Act and greatly expanded the types of records the government could
obtain while relaxing the requirement that the investigation be connected to a foreign
power or its agent as long as the information did not concern U.S. persons. Critically,
instead of obtaining individualized court orders, the government began obtaining
FISA orders to permit the bulk collection of “telephony metadata” from telecommunications companies under the FISA pen register and trap and trace authority and
the National Security Letter statutes.
218 Under provisions of several pieces of
legislation, the FBI had right to demand that the relevant organizations produce
telecommunications records,
219
financial records,
220 credit records,
221 as well as
consumer reports
222 when that information was relevant to foreign intelligence
gathering or for purposes of a terrorism investigation without a showing of probable
cause.
223 In the years following the passage of the Patriot Act, the FBI’s use of
national security letters grew exponentially. For example, between 2003 and 2006,
the Justice Department’s Inspector General has reported that the FBI issued nearly
200,000 NSLs.
224 While the metadata collection program operated without much
fanfare for years that changed when Edward Snowden blew the whistle on the
program’s existence in 2013.
225 One of the reasons why the program was able to
operate under the radar for so long is that the law blocked anyone who had received
an NSL from telling anyone about it for an indefinite period.
226 Two years after the
Snowden disclosures Congress moved to prohibit the bulk collection of metadata by
enacting the USA Freedom Act of 2015.
227
217 Goitein and Patel (2015), p. 21.
218 Mann (2014).
219 18 U.S.C. §2709 [The Stored Communications Act].
220 12 U.S.C. §3414(a)(5)(A). [The Right to Financial Privacy Act of 1978].
221 15 U.S.C. §1681u. [The Fair Credit Reporting Act of 1970].
222 Id.
223 Solove and Hartzog (2014), p. 88.
224 “National Security Letters”, ACLU Website. Available online at: https://www.aclu.org/other/
national-security-letters [hereinafter National Security Letters].
225 Lynch and Flint (2017).
226 “National Security Letters”, supra note 224.
227 H.R. 2048, Pub.L. 114–23.
Data Protection in the United States: U.S. National Report
439
to obtain business records held by third parties. Before the 2001 Act, the FBI could
petition the FISA Court to obtain an order to require third parties to turn over the
business records of transport companies, hotels and motels, car and truck rental
agencies, and storage rental facilities if the government certified that the records
were sought for a foreign intelligence or international terrorism investigation being
conducted by the FBI and that it had “specific and articulable facts giving reason to
believe” that the subject of the records was a foreign power or agent of a foreign
power.
217
The Patriot Act’s Section 215 amended Section 501 of the Foreign Intelligence
Surveillance Act and greatly expanded the types of records the government could
obtain while relaxing the requirement that the investigation be connected to a foreign
power or its agent as long as the information did not concern U.S. persons. Critically,
instead of obtaining individualized court orders, the government began obtaining
FISA orders to permit the bulk collection of “telephony metadata” from telecommunications companies under the FISA pen register and trap and trace authority and
the National Security Letter statutes.
218 Under provisions of several pieces of
legislation, the FBI had right to demand that the relevant organizations produce
telecommunications records,
219
financial records,
220 credit records,
221 as well as
consumer reports
222 when that information was relevant to foreign intelligence
gathering or for purposes of a terrorism investigation without a showing of probable
cause.
223 In the years following the passage of the Patriot Act, the FBI’s use of
national security letters grew exponentially. For example, between 2003 and 2006,
the Justice Department’s Inspector General has reported that the FBI issued nearly
200,000 NSLs.
224 While the metadata collection program operated without much
fanfare for years that changed when Edward Snowden blew the whistle on the
program’s existence in 2013.
225 One of the reasons why the program was able to
operate under the radar for so long is that the law blocked anyone who had received
an NSL from telling anyone about it for an indefinite period.
226 Two years after the
Snowden disclosures Congress moved to prohibit the bulk collection of metadata by
enacting the USA Freedom Act of 2015.
227
217 Goitein and Patel (2015), p. 21.
218 Mann (2014).
219 18 U.S.C. §2709 [The Stored Communications Act].
220 12 U.S.C. §3414(a)(5)(A). [The Right to Financial Privacy Act of 1978].
221 15 U.S.C. §1681u. [The Fair Credit Reporting Act of 1970].
222 Id.
223 Solove and Hartzog (2014), p. 88.
224 “National Security Letters”, ACLU Website. Available online at: https://www.aclu.org/other/
national-security-letters [hereinafter National Security Letters].
225 Lynch and Flint (2017).
226 “National Security Letters”, supra note 224.
227 H.R. 2048, Pub.L. 114–23.
Data Protection in the United States: U.S. National Report
439