The USA Patriot Act: How Will Your Library Respond?

The attacks of September 11, 2001 marked a turning point in the tension between personal rights and governmental intrusion in the United S tates. Ever since that time there has been a gradual increase of governmental access to previously private information about citizens’ personal beha vior. One manifestation of this increase is the Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism (USA PATRIOT) Act of 2001 (Public Law 107-56),¹ signed into law on October 26, 2001. Clearly, the general trend toward the collection and dissemination of personal information about students and faculty has been more and more protective. In most situations, institutions of higher education do not have the right to reveal information about students even to their own parents. The Family Educational Rights and Privacy Act of 1974 as Amended (1995), commonly known as FERPA or the Buckley Amendment, affords students the right to inspect and review their educational records, the right to seek to have their records amended, and, significantly in terms of the PATRIOT Act, the right to have some control over the disclosure of information from their records.² In fact, FERPA is more permissive than the privacy and public information laws of some states. In terms of libraries, forty-eight states and the District of Columbia have laws that afford some level of protection for the confidentiality of library records.

The PATRIOT Act enhances and strengthens the powers of law enforcement and intelligence agencies to investigate criminal acts, especially domestic acts of terror. In particular, it amends the Foreign Intelligence Surveillance Act of 1978 (FISA) and lowers the standards for courts to approve surveillance of foreign intelligence gathering. The PATRIOT Act eases the federal requirements for warrants to search records, including library records. Rather than having to meet the historical standard of “probable cause,” the Justice Department need only go to the FISA Court, rather than a regular federal court, and show not probable cause, but merely that the subject of the search is part of a terrorism investigation. The Act also allows individual employees to voluntarily disclose the contents of an electronic communication and/or information about a customer to law enforcement officials without a court order. The only requirement is that the employee reasonably believes that an emergency involving immediate danger of death or serious physical injury requires disclosure without delay. The criminal code pertinent to disclosure of information by providers of electronic communication services is similarly amended.

Issues for Academic Libraries: Statutes and Ethics

The PATRIOT Act flies in the face of the trend to treat personal information as private, and has serious implications for academic freedom, the confidentiality of records in our institutions, and training for front-line staff. Will your school be embroiled in a controversy caused by staff members revealing what ought to be confidential personal information to government agents? On the other hand, will staff act in ways they believe to be consistent with FERPA or state law only to be portrayed in the media as cavalierly refusing to cooperate with law enforcement when such cooperation is legally mandated? Freedom of inquiry is at the heart of academia, and academic freedom, as represented by the free expression and exchange of ideas, is explicitly protected in the Bill of Rights. Anything that chills free inquiry undercuts the work of our institutions. Protecting the confidentiality of patron records is a long-established library tradition, which is intended to foster freedom of inquiry by preventing governmental monitoring of reading habits and other intellectual endeavors. The privacy of library records is therefore a central tenet of the library profession and is expressed in the American Library Association’s Code of Ethics.

This principle would seem to be respected, theoretically, in the USA PATRIOT Act in a number of ways. For example, Section 501 recognizes that investigations may be carried out under the provisions of the Act “. . . provided that such investigation of a United States person is not conducted solely upon the basis of activities protected by the first amendment to the Constitution.” Section 223 describes civil liability for certain unauthorized disclosures as “Any willful disclosure of a `record,’ . . . that is not a disclosure made in the proper performance of the official functions of the officer or governmental entity making the disclosure, is a violation of this chapter.” In practice, however, the PATRIOT Act puts the principle of user privacy at risk. Although libraries are not specifically mentioned in the Act, libraries and their governing bodies should know that Section 215 amended the business records provisions of FISA to include “any relevant tangible item” and it may be used to obtain library records. In the June 13, 2003 issue of The Chronicle of Higher Education, Michael Arnone reported that “Viet Dinh, a former assistant attorney general who is one of the authors of the PATRIOT Act . . . [said that] Law-enforcement agents had visited about 50 libraries as part of terrorism investigations . . . He did not specify whether any of them were college libraries.”

“Administrators and legal departments must educate library staff to help them respond appropriately to sudden visits by government agents, as well as to help them in developing policy for dealing with the USA PATRIOT Act.” Attorney-General Ashcroft has stated that the Act has not been used to investigate library borrowing and other records, but he has also chided librarians for being “hysterical” in defense of user privacy, while former Attorney-General Edwin Meese has accused librarians of being more interested in advocating pornography than in defending national security. Meanwhile, the PATRIOT Act remains on the books, and though it is scheduled to sunset in 2005, the bill’s life can always be extended. One of the more troubling aspects of the PATRIOT Act is that a FISA Court-issued search warrant contains a “gag order” prohibiting the person or institution served with the warrant from disclosing that the materials pursuant to the warrant were produced or even that the warrant was served. Violation of this law carries a federal criminal penalty. This seems to mean that unlike the situation which would obtain in a normal warrant situation, libraries must both reveal privileged user information, and keep totally silent about the very fact that an investigation is underway. FISA, as amended, also expands the use of “roving wiretaps.” Taps are no longer confined to a particular line, but can rove wherever the target of the investigation goes and can be applied to computers using the Internet. Library computers could be used to track the behavior of any user, whether or not that person is really a security threat. The potential for abuse is clear.

Ensuring a Reasonable Institutional Response

The PATRIOT Act represents a significant change in the ways in which libraries may be required to provide information to law enforcement. Administrators and legal departments must educate library staff to help them respond appropriately to sudden visits by government agents, as well as to help them in developing policy for dealing with the USA PATRIOT Act. As a starting point to assist libraries and their governing bodies in developing their own policies and procedures, we have provided a model on the next page. In developing institutional policy following the model provided below or any other model, key areas for consideration include the following.

1. Become familiar with the provisions of the USA PATRIOT Act. There are numerous sources of information and interpretation including the American Library Association’s Washington Office, which has multiple links to information about the Act, and sites with specific perspectives such as the Justice Department’s Preserving Life & Liberty website and the Electronic Privacy Information Center.
2. Find out whether a state statute exists that protects the confidentiality of library records in your state. One starting place is a compilation of state laws regarding library records maintained by Paul Neuhaus, Social Sciences Librarian at Carnegie Mellon University. Mr. Neuhaus’ website also includes the text of proposed relevant legislation.
3. Consider your institution’s organizational structure and identify those individuals or departments with whom you might consult about information requests under the USA PATRIOT Act. At a minimum, institutional Counsel and Campus Police must be consulted, as they are likely to have direct responsibilities for responding to subpoenas or court orders. The list may also include others who routinely respond to information requests including Public Information Officers, Official Spokespeople, and Media Relations Departments.
4. Determine who will be responsible for responding to records requests and how that individual will be contacted during days, evenings, and weekends.
5. Ensure that every staff member and volunteer fully understands the policy and procedures as well as what to do if approached by a law enforcement officer with a records request. Include this information in new employee orientation.
6. Discuss the draft policy and procedure widely within your organization especially with any 1 advisory boards or Friends groups, and with the library’s governing body. Libraries are required to perform a balancing act, invisible to most people outside of the library, between protecting the confidentiality of patron records and compliance with law enforcement information requests. Taking the time to build an understanding of the multiple roles the library is called upon to fulfill may be valuable in avoiding future controversies.