www.wired.com/news/privacy/0,1848,56234,00.html

Stage Set for Homeland Act

By Ryan Singel

09:00 AM Nov. 06, 2002 PT

As Congress prepares to reconvene in a lame-duck session after Tuesday's election, one of the largest pieces of legislation on the Senate's agenda is the controversial and deadlocked Homeland Security Act, which the House
passed Sept. 9.

A little-known amendment in the Senate version of the bill makes it much easier for ISPs to disclose e-mail communications without being served with a warrant, which had been prohibited before the Patriot Act of 2001.

Critics such as Lee Tien of the Electronic Frontier Foundation consider the amendment a "recipe for privacy abuse."

According to a press release from Senator Orrin Hatch's (R-Utah) office, his amendment intends to provide "greater flexibility to communications providers and law enforcement when necessary to prevent and protect against devastating cyber attacks."

Under the Patriot Act, ISPs were given the right to disclose to a "law enforcement agency" the private communications of a customer if the company "reasonably believes that an emergency involving immediate danger of death or serious physical injury to any person requires disclosure of the information without delay."

The new rules, if adopted, would modify the Patriot Act's fairly strict "reasonable belief" test with a "good faith" provision, allow disclosure to "any federal, state or local governmental entity," not just law enforcement agencies, and removes an "immediacy" requirement.

According to Tien's analysis, the "good faith" provision "would probably allow providers to rely on government assertions of an emergency even if no facts were presented," and lead to "aggressive behavior on the part of law enforcement."

"When the government knows it has loopholes, they will use them," Tien said. "They will try to bully ISPs."

Tien also argues that the amendment's language would allow "public schools, social services departments, the IRS or the local tax assessor" access if they "can persuade your ISP that there is an emergency."

In June, the House Judiciary Committee asked the Attorney General's office whether law enforcement had used such tactics under the more stringent rules
of the Patriot Act.

In a written response, the Attorney General's office did not deny this might be happening, writing: "There are no statistics detailing the number of times disclosures have occurred or the basis for such disclosures."

Jennifer Garnick, director of Stanford Law School's Center for Internet and Society, believes the Patriot Act has "had little judicial oversight and review" and that the new regulation's "definition of emergency is so broad, it's a case of the exception swallowing the rule."

Other provisions of the amendment ease the restrictions on law enforcement's ability to install trap-and-trace devices such as the FBI's Carnivore pack-sniffing software without getting a warrant beforehand.

The EFF mounted a campaign against these provisions when they were part of the Cyber Security Enhancement Act, which passed the House, 385-3, in July. That bill did not make it out of the Senate Judiciary committee.

The EFF has not targeted the Homeland Security Act since many political analysts believed the bill would not be passed in the upcoming lame-duck session.

However, Ivo Daalder, a senior fellow at the Brookings Institution, ties the fate of the Homeland Security bill to control of the Senate, of which the Republicans resoundingly gained control on Tuesday.

Democrats have been pushing for a version of the bill that guarantees civil service protection to the estimated 170,000 employees of the proposed agency, while Republicans and the administration want flexibility to promote and fire employees.