Summary of Federal Laws
The U.S.A. PATRIOT Act: Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001. (HR3162) (Public Law 107-56; 115 Stat. 272.)
The U.S.A.Patriot Act is a broad reaching law that amends many areas of U.S. law, with a specific focus on enhancing the ability of law enforcement to combat terrorism. A number of different areas of higher education law were affected by passage of the PATRIOT Act. What follows is a quick summary of the various higher education laws (or areas of operation) that were affected by this law.
FERPA: The amendment to FERPA permits educational agencies and institutions to disclose -without the consent or knowledge of the student- personally identifiable information from the student's education records to the Attorney General of the United States or his designee, but only in response to an ex parte order in connection with the investigation or prosecution of terrorism crimes specified in sections 2332b(g)(5)(B) and 2331 of title 18, U.S.Code. An ex parte order is an order issued by a court without notice to an adverse party.
In order to obtain the order, the Attorney General must certify that there are specific and articulable facts giving reason to believe that the education records are likely to contain relevant information. The new law gives schools immunity when the institution releases information in good faith under this provision. Records obtained under this provision are not subject to the FERPA requirement that records be kept of each request for access to and each disclosure of personally identifiable information from the education records of each student. 
Although the Family Policy Compliance Office has stated the health and safety emergency provision can be used in national emergencies such as the September 11th attacks, release of records under that provision are limited to situations where there is imminent danger and an immediate need for the release of records. Now that this legislation has been adopted, schools met with requests for student record information in connection with the terrorist attacks should expect to be served with a court order.
The text of the amendment is as follows:
SEC. 507. DISCLOSURE OF EDUCATIONAL RECORDS. [115 Stat. 367-68]
Section 444 of the General Education Provisions Act (20 U.S.C. 1232g), is amended by adding after subsection (i) a new subsection (j) to read as follows:
``(j) Investigation and Prosecution of Terrorism.-
``(1) In general.--Notwithstanding subsections (a) through (i) or any provision of State law, the Attorney General (or any Federal officer or employee, in a position not lower than an Assistant Attorney General, designated by the Attorney General) may submit a written application to a court of competent jurisdiction for an ex parte order requiring an educational agency or institution to permit the Attorney General (or his designee) to-
``(A) collect education records in the possession of the educational agency or institution that are relevant to an authorized investigation or prosecution of an offense listed in section 2332b(g)(5)(B) of title 18 United States Code, or an act of domestic or international terrorism as defined in section 2331 of that title; and
"(B) for official purposes related to the investigation or prosecution of an offense described in paragraph (1)(A), retain, disseminate, and use (including as evidence at trial or in other administrative or judicial proceedings) such records, consistent with such guidelines as the Attorney General, after consultation with the Secretary, shall issue to protect confidentiality.
``(2) Application and approval.-
``(A) In general.--An application under paragraph (1) shall certify that there are specific and articulable facts giving reason to believe that the education records are likely to contain information described in paragraph (1)(A).
``(B) The court shall issue an order described in paragraph (1) if the court finds that the application for the order includes the certification described in subparagraph (A).
``(3) Protection of educational agency or institution.-An educational agency or institution that, in good faith, produces education records in accordance with an order issued under this subsection shall not be liable to any person for that production.
``(4) Record-keeping.--Subsection (b)(4) does not apply to education records subject to a court order under this subsection.''.
The effect of the changes to foreign student monitoring are not so much a change in the law (although a few changes have been made) but rather a mandate to implement earlier legislation by Jan. 1, 2003. A 1996 law, the Illegal Immigration Reform and Immigrant Responsibility Act required implementation of an electronic record keeping system for data on foreign students. The PATRIOT ACT appropriated $36,800,000 to the Department of Justice to fully implement by January 1, 2003 the foreign student visa monitoring program (which is now known as SEVIS).
Expansion of Biological Weapons Statute
Section 817 of the PATRIOT ACT makes it a crime punishable by fine or up to 10 years in prison to knowingly possess a biological agent, toxin, or delivery system of a type or in a quantity not "reasonably justified" by research or other peaceful purposes. The law also prohibits possession of "select agents" (biological agents or toxins as defined in 42 CFR Part 72 Appendix A) by an alien (other than an alien lawfully admitted for permanent residence) who is a national of a country as to which the Secretary of State has determined is a country supporting terrorism This list currently includes Cuba*, Iran, Iraq, Libya, North Korea, Sudan and Syria. (15 CFR 742.8-10, 742.19, 746.2-7)
Note the related law entitled Public Health Security and Bioterrorism Preparedness and Response Act of 2002.
President Obama Announces Significant Easing of Sanctions and Export Controls Applicable to Cuba (Hogan Lovells, Dec. 17th, 2014) Not yet fully implemented, but coming soon. Article is a good summary of changes in the works.
Electronic Communications Privacy Act Amendments
The changes made by the PATRIOT Act to ECPA address two situations, one, the manner in which government authorities can compel disclosure, and two, whether or not an organization can make a voluntary disclosure to government authorities. A chart detailing what type of legal process and standard must be met for various disclosures compelled by the government (e.g. a search warrant instead of a court order) is online at the American Library Association web site. See the ALA USA Patriot Act web page for updated provisions.
Section 212 of the USA-Patriot Act amends ECPA by adding a new voluntary disclosure exception for emergency situations. Under this exception, if a provider reasonably believes that an emergency involving immediate danger of death or serious physical injury to any person justifies disclosure of certain information without delay, the provider may disclose that information (content or non content records) to a law enforcement agency. Also, and this was not clear under the law before, under the USA PATRIOT Act an Internet Service Provider may authorize federal law enforcement to investigate computer trespass by someone outside the system, e.g. a person that does not have an existing relationship with the owner or operator of the system. (Section 202 amends 18 U.S.C. § 2516(1)(c) to add the Computer Fraud and Abuse Act offenses (18 U.S.C. § 1030)).
In light of the changes made by the law, it is advisable for colleges and universities to review their procedures and protocols regarding release of information. Tracy Mitrano, the Policy Advisor for Cornell's Office of Information Technologies, has been advising colleges and universities on this topic, and a full set of her materials, including a Q and A, and policies and procedures, can be found online at Cornell Office of Information Technologies USA Patriot Act page.
Selected Case Law
Doe. v. Gonzales, 126 S. Ct. 1, Oct. 7, 2005
In ruling on this emergency application to vacate the stay granted in the case below by the United States Court of Appeals for the 2nd Circuit, Justice Ginsburg declined to vacate the stay, noting the expedited briefing schedule the Second Circuit had imposed in the case.
Doe v. Gonzales, 05-CV-1256
In this ruling issued Sept. 9, 2005 on the plaintiffs' motion for a preliminary injunction, the judge held that the gag order associated with the National Security Letter received by an anonymous American Library Association member violated the First Amendment. The plaintiffs challenged the consitutionality of 18 USC § 2709, which requires any wire or electronic communication service provider to comply with the requests of the FBI for information (specifically name, address and length of service of subscriber). Plaintiffs claim that 2709 violates the First Amendment by prohibiting the recipient of the letter from disclosing that the FBI seeks information, and by authorizing the disclosure of information without tailoring the demand to a demonstrable compelling need. The plaintiffs also challenged the constitutionality of the lack of a mechanism by which the recipient can challenge the NSL's validity, and the lack of prior notice to the person whose information was being disclosed.
Specifically, the court held that the plaintiffs had established irreparable injury as a result of the enforcement of
§ 2709 with regard to Doe's identity. The inability to speak out on the subject as an NSL recipient was a real and present loss of a First Amendement right, and was both a prior restraint on speech, and a content based ban, and as such, is subject to strict scrutiny. In relevant part, the court noted as follows:
The government argues that it has an interest in preventing the disclosure of Doe's identity because disclosure of the NSL recipient's identity may, inter alia, permit the subject of the NSL, or those involved in the subject matter of the NSL, to deduce that the government is aware of their/his/her identity, leading them to flee or go deeper under cover. Defs.' Mem. Opp'n. at 2-3; see also Szady Decl. ¶¶ 29-30. Even affording the government deference in its judgment about national security concerns, the court cannot conclude on the record in this case that, in these circumstances, the government has a compelling interest in barring the disclosure of Doe's identity. Nothing specific about this *77 investigation has been put before the court that supports the conclusion that revealing Does' identity will harm it. The record supplied by the defendants suggests that the disclosure of Doe's identity "may" or "could" harm investigations related to national security generally. See Szady Decl. at ¶¶ 20-29. Just such a speculative record has been rejected in the past by the Supreme Court in the context of a claim of national security. See New York Times Co., 403 U.S. at 725-26, 91 S.Ct. 2140 (Brennan, J. concurring) ("[T]he First Amendment tolerates absolutely no prior judicial restraints of the press premised upon surmise or conjecture that untoward consequences may result.").
Further, the information that is before the court suggests strongly that revealing Doe's identity will not harm the investigation.
Second, § 2709(c) creates a unique situation in which the only people who possess non-speculative facts about the reach of broad, federal investigatory authority are barred from discussing their experience with the public. This ban is particularly noteworthy given the fact that advocates of the legislation have consistently relied on the public's faith in the government to apply the statute narrowly in order to advocate for passage and reauthorization of various provisions of the Patriot Act. See, e.g., "Attorney General John Ashcroft, Protecting Life and Liberty" (Address in Memphis, Tennessee, Sept. 18, 2003), http://www.usdoj.gov/archive/ag/speeches/2003/091803memphisrem arks.htm (accusing those who fear executive abuse of the increased access to library records under the PATRIOT Act of "hysteria" and stating that "the Department of Justice has neither the staffing, *82 the time nor the inclination to monitor the reading habits of Americans. No offense to the American Library Association, but we just don't care.") The potential for abuse is written into the statute: the very people who might have information regarding investigative abuses and overreaching are preemptively prevented from sharing that information with the public and with the legislators who empower the executive branch with the tools used to investigate matters of national security.
While the court concluded that the government, in the face of plaintiffs as applied challenge, had not demonstrated a compelling interest in preventing disclosure of the recipient's identity, the court did grant defendant's request for a stay.
John Doe and ACLU v. Ashcroft, 2004 WL 2185571 (S.D.N.Y) (Sept. 28, 2004)
In this sealed case, the ACLU had filed a complaint challenging the FBI's authority under 18 USC § 2709 (as modified by the PATRIOT Act) to compel communication firms, such as ISP's, to provide certain customer records upon issuance of a national security letter. The lead plaintiff in the case, John Doe, was an internet access firm that had received a national security letter. The plaintiff first received a call from an FBI agent, informing him that he would be served with an NSL. Then the plaintiff received a document, printed on FBI letterhead, that stated that pursuant to 18 USC 2709, the plaintiff was directed to provide certain information to the government that was relevant to an "authorized investigation against international terrorism or clandestine intelligence activities." Doe was prohibited by the terms of the letter from disclosing its receipt to any person and was requested to personally provide the records to the designated individual. The plantiff decided to consult the ACLU instead of responding to the letter.
The Judge in the case, Federal District Judge Marrero, found a number of provisions in the law troubling. Some of the key holdings in the case are below: (*21 and *22 in Westlaw)
The crux of the problem is that the form NSL, like the one issued in this case, which is preceded by a personal call from an FBI agent, is framed in imposing language on FBI letterhead and which, citing the authorizing statute, orders a combination of disclosure in person and in complete secrecy, essentially coerces the reasonable recipient into immediate compliance. Objectively viewed, it is improbable that an FBI summons invoking the authority of a certified "investigation to protect against international terrorism or clandestine intelligence activities," and phrased in tones sounding virtually as biblical commandment, would not be perceived with some apprehension by an ordinary person and therefore elicit passive obedience from a reasonable NSL recipient. The full weight of this ominous writ is especially felt when the NSL's plain language, in a measure that enhances its aura as an expression of public will, prohibits disclosing the issuance of the NSL to "any person." Reading such strictures, it is also highly unlikely that an NSL recipient reasonably would know that he may have a right to contest the NSL, and that a process to do so may exist through a judicial proceeding.
Because neither the statute, nor an NSL, nor the FBI agents dealing with the recipient say as much, all but the most mettlesome and undaunted NSL recipients would consider themselves effectively barred from consulting an attorney or anyone else who might advise them otherwise, as well as bound to absolute silence about the very existence of the NSL. Furthermore, it is doubtful that an NSL recipient, not necessarily a lawyer, would be willing to undertake any creative exercises in statutory construction to somehow reach the Government's proposed reading of § 2709, especially because that construction is not apparent from the plain language of the statute, the NSL itself, or accompanying government communications, and any penalties for non-compliance or disclosure are also unspecified in the NSL or in the statute. For the reasonable NSL recipient confronted with the NSL's mandatory language and the FBI's conduct related to the NSL, resistance is not a viable option.
The evidence in this case bears out the hypothesis that NSLs work coercively in this way. The ACLU obtained, via the Freedom of Information Act ("FOIA"), and presented to the Court in this proceeding, a document listing all the NSLs the Government issued from October 2001 through January 2003. Although the entire substance of the document is redacted, it is apparent that hundreds of NSL requests were made during that period. Because § 2709 has been available to the FBI since 1986 (and its financial records counterpart in RFPA since 1978), the Court concludes that there must have been hundreds more NSLs issued in that long time span. The evidence suggests that, until now, none of those NSLs was ever challenged in any court. First, the Department of Justice explicitly informed the House Judiciary Committee in May 2003 that there had been no challenges to the propriety or legality of any NSLs. Second, the Government's evidence in this case conspicuously lacks any suggestion either that the Government has ever had to resort to a judicial enforcement proceeding for any NSL, or that any recipient has ever resisted an NSL request in such a proceeding or via any motion to quash.
The court found that section 2709 posed a threat to the First Amendment rights of Internet subscribers. (Westlaw *28)
The Court reaches this conclusion by determining that NSLs issued pursuant to § 2709 may seek information about or indirectly obtained from subscribers that may be protected from disclosure by the First Amendment or other rights-protecting constitutional provisions or statutes. Echoing the Supreme Court's observation that "differences in the characteristics of new media justify differences in the First Amendment standards applied to them," the Court concludes that even though Smith and Miller might suggest that there is no First Amendment interest at stake in compelling the disclosure by telephone companies and banks of certain transactional information derived from customer records, in deciding this case the Court must take account of the unique features of internet communications that may warrant application of different rules. The Court is persuaded that, for First Amendment purposes, internet records of the type obtained via a § 2709 NSL could differ substantially from transactional bank or phone records.
The evidence on the record now before this Court demonstrates that the information available through a § 2709 NSL served upon an ISP could easily be used to disclose vast amounts of anonymous speech and associational activity. For instance, § 2709 imposes a duty to provide "electronic communication transactional records," a phrase which, though undefined in the statute, certainly encompasses a log of email addresses with whom a subscriber has corresponded and the web pages that a subscriber visits. Those transactional records can reveal, among other things, the anonymous message boards to which a person logs on or posts, the electronic newsletters to which he subscribes, and the advocacy websites he visits. Moreover, § 2709 imposes a duty on ISPs to provide the names and addresses of subscribers, thus enabling the Government to specifically identify someone who has written anonymously on the internet. As discussed above, given that an NSL recipient is directed by the FBI to turn over all information "which you consider to be an electronic communication transactional record," the § 2709 NSL could also reasonably be interpreted by an ISP to require, at minimum, disclosure of all e-mail header information, including subject lines.
In stark contrast to this potential to compile elaborate dossiers on internet users, the information obtainable by a pen register is far more limited. As the Supreme Court in Smith was careful to note:
[Pen registers] disclose only the telephone numbers that have been dialed--a means of establishing communication. Neither the purport of any communication between the caller and the recipient of the call, their identities, nor whether the call was even completed is disclosed by pen registers.
The Court doubts that the result in Smith would have been the same if a pen register operated as a key to the most intimate details and passions of a person's private life.
The Court also found section 2709 unconstitutional on its face. Especially troubling was the permanent bar on disclosing receipt of a national security letter. (From WL *36)
The Government's claim to perpetual secrecy surrounding the FBI's issuance of NSLs, by its theory as advanced here an authority neither restrained by the FBI's own internal discretion nor reviewable by any form of judicial process, presupposes a category of information, and thus a class of speech, that, for reasons not satisfactorily explained, must forever be kept from public view, cloaked by an official seal that will always overshadow the public's right to know. In general, as our sunshine laws and judicial doctrine attest, democracy abhors undue secrecy, in recognition that public knowledge secures freedom. Hence, an unlimited government warrant to conceal, effectively a form of secrecy per se, has no place in our open society. Such a claim is especially inimical to democratic values for reasons borne out by painful experience. Under the mantle of secrecy, the self-preservation that ordinarily impels our government to censorship and secrecy may potentially be turned on ourselves as a weapon of self-destruction. When withholding information from disclosure is no longer justified, when it ceases to foster the proper aims that initially may have supported confidentiality, a categorical and uncritical extension of non-disclosure may become the cover for spurious ends that government may then deem too inconvenient, inexpedient, merely embarrassing, or even illicit to ever expose to the light of day. At that point, secrecy's protective shield may serve not as much to secure a safe country as simply to save face.
The court could not separate Section 2709(c) (the nondisclosure provision) from sections 2709(a) and (b), and thus the court also invalidated sections 2709(a) and (b) of the law.
(1) See 34 CFR §99.32 which contains other exceptions from the record-keeping requirement, including requests from the student, school officials, subpoenas that by their terms require non-disclosure, directory information, and requests accompanied by consent from the student.
 Determination under the Export Administration Act; The Foreign Assistance Act, or the Arms Export Control Act.
ALA Patriot Act Page (current)
CRS Report on National Security Letters March 17, 2006
Complete text (30 pages) of report prepared by the Congressional Research Service (CRS) of the Library of Congress reviewing the five types of National Security Letters authorized by various federal statutes including the USA PATRIOT Act and the attributes (Addressees and Certifying Officials; Purpose, Standards, Information Covered; Confidentiality; Judicial Review and Enforceability; Dissemination; and Liability, Fees and Oversight) of each, including changes implemented by recent amendments to the USA PATRIOT Act.
Higher Education Issues After the USA Patriot Act NACUA Paper by David Lombard Harrison, UNC
March 13, 2003 Advisory Report on Compliance with New Domestic Security Legislation prepared by Hogan and Hartson for ACE and NACUBO.
CCR updated CFR link 6/30/15
* see HL article