Networking 2002 USA-Patriot Act Tracy Mitrano Cornell University Copyright Tracy Mitrano, 2002. This work is the intellectual property of the author. Permission is granted for this material to be shared for non-commercial, educational purposes, provided that this copyright appears on the reproduced materials and notice is given that the copying is by permission of the author. To disseminate otherwise or to republish requires written permission from the author.

Policy Implications for Higher Education The USA-Patriot Act Policy Implications for Higher Education

USA-Patriot Act: Basics Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Acts Signed into law on October 26, 2001 One of the longest pieces of emergency legislation passed in one of the shortest periods of time in American history Copyright Tracy Mitrano 2002

USA-Patriot Act: Basics Ten Sections covering a variety of areas, including banking, money laundering, surveillance, border protection, victims’ support, information sharing within the infrastructure and the strengthening of criminal laws against terrorism. Severability clause To protect against the whole the potential constitutional violation of a single section Copyright Tracy Mitrano 2002

Issues for Higher Education: (Not Including Bio-terrorism) Family Education Records Privacy Act New “emergency” exception For terrorism specifically No notice to student Foreign Intelligence Surveillance Act “Hostile foreign power” No traditional constitutional protection Business records Disclosure illegal Copyright Tracy Mitrano 2002

Copyright Tracy Mitrano 2002 IT Systems Two most common questions: Does Patriot Act require re-architecting of system? No, but can with specific authorization for pen registers and trap and trace Compensation offered Does Patriot Act require retention of logs? Not as a rule, but up to 180 days with authorization Copyright Tracy Mitrano 2002

ECPA: To Whom Does It Apply? Statutory Language: “…providers of Internet service to the public” Does it apply to colleges and universities? No case law on point Anderson Consulting: EPCA does not apply Digital Millennium Copyright Act as potential “safe harbor” model of distinction between students and staff/faculty? Areas where there is service to the public, i.e. list serves? General Rule Act as if it does, but hold question as potential defense Copyright Tracy Mitrano 2002

Issues for Higher Education Electronic Communications Privacy Act New “emergency” disclosure “Danger to life and limb New “required disclosure” “Rubber-stamping subpoenas” Below “probable cause” “Routing:” Pen registers and trap and trace devices Content is the constitutional question Copyright Tracy Mitrano 2002

Issues for Higher Education Electronic Communications Privacy Act Computer Trespass Owner/Operator consent for federal intervention So long as owner/operator reasonably believes investigation is relevant to computer trespass Investigation of it and no other No authorization required No limits set, e.g. stop No restraint on return with authorization based on information gathered during the invited investigation No guarantee it is constitutional Sunset provision Copyright Tracy Mitrano 2002

Copyright Tracy Mitrano 2002 Policy Implications Electronic Communications Privacy Act Routing procedures for request of legal papers Procedures for “emergency” disclosure Police IT officials, potential damage control Procedures for computer trespass Disallow random requests Identify offices to be notified Identify officers to be consulted Identify check-list of issues to consider Copyright Tracy Mitrano 2002

Copyright Tracy Mitrano 2002 Policy Implications What are the issues to consider for computer trespass? Why federal intervention? Insufficient resources at home Help in investigation Connections to other cases In concert with the degree of damage In contemplation of civil action for damages Find the perpetrator Copyright Tracy Mitrano 2002

Copyright Tracy Mitrano 2002 Policy Implications What are the issues to consider for computer trespass? How well can your organization control the investigation? Previous relationship and experience with federal investigators Degree of oversight afforded your organization Check points in the investigation Ability established at the outset to call off at any time Copyright Tracy Mitrano 2002

Copyright Tracy Mitrano 2002 Policy Implications What are the issues to consider for computer trespass? Constitutionality of the measure No fourth amendment protections Innocent defendant and false prosecution Guilty defendant and the exclusionary rule Potential civil liability for university Copyright Tracy Mitrano 2002

Copyright Tracy Mitrano 2002 Conclusion Should Americans find that the Patriot Act is being used against us instead of for us, we must revisit it in the name of the constitution. In the meantime… Copyright Tracy Mitrano 2002

Copyright Tracy Mitrano 2002 Conclusion Policy, protocols and procedures that engage the law in concert with the special mission of American higher education and the particular cultures of our colleges and universities go a long way to preserve our traditional autonomy. www.cit.cornell.edu/oit/PatriotAct/ (Full presentation available at this site.) Copyright Tracy Mitrano 2002