FTC'S SWINDLE: PATRIOT ACT MAY REQUIRE UPDATED ISP PRIVACY POLICIES

One issue for ISP lawyers to think about is that “they may now wish to make some modifications that would indicate that under the Patriot Act there would be some provision there for voluntary disclosure,” Swindle said. FTC authority to ensure that businesses stand by commitments they make in privacy policies remains unchanged by act, he said. While Patriot Act has bolstered law enforcement authority in many areas, EarthLink Vp-Law & Public Policy David Baker said it had at least one “silver lining": Justice Dept. guidance issued in wake of act’s passage has clarified scenarios under which ISPs could provide law enforcement with required information without installing Carnivore surveillance system.

DoJ field guidance has clarified responsibilities of ISPs under Carnivore, Baker said. Document addresses Sec. 216 of Act, which involves law enforcement’s use of pen- register and trap-&-trace devices on computer networks, he said. DoJ document said generally that when law enforcer initiated pen-trap order on communications service provider that provided Internet access, ISP itself should be able to collect information and pass it along to the agency, Baker said. “In certain rare cases, however, the provider may be unable to carry out the court order, necessitating installation of a device such as Ether peak or the law enforcement agency’s DCS-1000,” he said, referring to updated govt. name for Carnivore. “Perhaps the silver lining in what many otherwise describe as a cloud is the fact that this makes clear that ISPs should be given every reasonable opportunity to provide information to law enforcement pursuant to a legitimate request without the need to resort to Carnivore or other devices that compromise network security and the privacy of all the other network users,” he said.

Aside from continuing controversies over Carnivore and attention being focused on Patriot Act, “I think we will soon be looking at a CALEA that not only applies to common carriers but that the FBI wants to apply to ISPs also,” said Wiley, Rein & Fielding attorney John Kamp. Kamp said he was recommending that clients take certain steps in new environment: (1) To look at privacy policy and all confidentiality agreements to make sure they align with each other, particularly as they involve disclosures that may be required by law enforcement. (2) To develop clear practices that give one ability to respond to subpoenas and law enforcement orders to comply with relevant laws and liability protection. (3) To look carefully at systems so that disclosures under surveillance can be made without disruptions in business or degradation in network. “Essentially, if Carnivore is what it has to be, they do it quickly and not have any disruption of service,” Kamp said. Panelists said Patriot Act raises new questions about extent to which new media -- such as IP telephony -- that move between PCs, or viewing choices made by MSO customers who used broadband service are covered under federal surveillance requirements that historically applied only to telephony communications.

Patriot Act also broadens reach of law enforcement agencies over information kept by ISPs in several critical ways, Kamp said. Law alters certain subpoena provisions under Foreign Intelligence & Surveillance Act, which is relevant for confidentiality agreements that ISPs sign with customers. “Any business can be served with a court order” to provide enforcement agencies “with any tangible thing,” Kamp said. “It’s very broad and it goes well beyond an ISP just giving a subscriber name, address and tracking stuff. They can be required to do additional things such as connection times, duration and subscriber information.” He also pointed out the coverage of cable companies that are broadband providers. “It goes further and includes a lot more people in the scope of the law.”

Swindle noted that voluntary disclosure provisions of Patriot Act raise interesting questions for Web sites such as online booksellers that aren’t ISP covered under law. If online bookstore was besieged by requests “for a single book or a group of books on how to make a bomb or fly an airplane and the name of the purchasers reflected one or another ethnic group, would that be alarming under concern for terrorism?” he asked. “It would seem to me that common sense would say that would be alarming but they're not covered by this,” Swindle said. Kamp said, however, that definitions become murkier if Web site is covered under communications activity as defined by federal law, including routing, addressing and signaling. “It could be that the book-sellers on line do some of that stuff; it’s not clear that they don’t,” Kamp said. “It is clear that this law wasn’t designed to go there.” -- Mary Greczyn

[Publisher’s Note: For those of our readers who were unable to take part in the audio conference, audio tapes are available for purchase. Call our Sales Dept. at 800-771-9202 for details.]