'Patriot Act' Opens ISPs to Monitoring

Under the newly enacted Patriot Act of 2001, ISPs and network administrators may give law enforcement agents access to their networks without a warrant in order to track hacker activities.

The legislation is known as the Patriot (Provide Appropriate Tools Required to Intercept and Obstruct Terrorism) Act. It expands the government's ability to monitor communications, including e-mail and cell phone conversations, and share that information among agencies. Its aim is to "provide law enforcement agencies with the appropriate tools to prevent" terrorism like that which occurred on September 11, with the attack on the Pentagon and World Trade Center, according to F. James Sensenbrenner, Jr. (R-Wisconsin), chair of the House Judiciary committee.

Now, law enforcement may not compel an ISP to grant access without a warrant. Under previous law designed to protect user privacy, ISPs were specifically forbidden to grant network access without customer permission or a judge's order.

Agents can monitor hackers without a warrant, but cannot monitor an ISP's bill-paying customers without one. Even if a customer is engaged in illegal activity, law enforcement must get a pen register--a judge's authorization equivalent to what's needed for reading incoming and outgoing phone numbers--to track the user's Web surfing habits and e-mail addresses, and a wiretap warrant to read e-mail or monitor other communications.

Uncaging Carnivore

In addition, the U.S. attorney general is required to report semiannually to Congress on its use of the so-called Carnivore e-mail and Internet surveillance system, renamed DCS 1000.

The law requires agencies keep a record of who installed e-mail taps, when and for how long, how Carnivore was configured, and what was recorded.

Carnivore can be used only after a judge signs a pen register, and the records must be given under seal to a judge 30 days after the court order for e-mail filtering expires.

For agents to tap without a warrant, an ISP must own its network, law enforcement must be involved in a lawful investigation, and only the suspect's communications can be intercepted. While the police must have "reasonable grounds to believe that the contents of the computer trespasser's communications will be relevant to the investigation," the law is not specific to hacker terrorists and can be applied to any computer crime investigation.

ISPs are not compelled to furnish facilities or technical assistance without being "reasonably compensated."

Privacy advocates have reacted strongly to the antiterrorism bills, arguing that civil liberties are at stake. The Electronic Privacy Information Center has urged lawmakers not to limit civil liberties in its attempt to investigate terrorists. EPIC has focused specifically on computer and communication monitoring.