Computer Trespass Clarification Act of 2007

Mr. President, I am pleased to introduce the Computer Trespass Clarification Act of 2007, which would amend and clarify section 217 of the USA PATRIOT Act. This bill is virtually identical to a bill I introduced in the 109th Congress.

Section 217 of the Patriot Act addresses the interception of computer trespass communications. This bill would modify existing law to more accurately reflect the intent of the provision, and also protect against invasions of privacy.

Section 217 was designed to permit law enforcement to assist computer owners who are subject to denial of service attacks or other episodes of hacking. The original Department of Justice draft of the bill that later became the Patriot Act included this provision. A section by section analysis provided by the Department on September 19, 2001, stated the following:

Current law may not allow victims of computer trespassing

to request law enforcement assistance in monitoring

unauthorized attacks as they occur. Because service providers

often lack the expertise, equipment, or financial resources

required to monitor attacks themselves as permitted under

current law, they often have no way to exercise their rights

to protect themselves from authorized attackers. Moreover,

such attackers can target critical infrastructures and engage

in cyberterrorism. To correct this problem, and help to

protect national security, the proposed amendments to the

wiretap statute would allow victims of computer attacks to

authorize persons ``acting under color of law'' to monitor

trespassers on their computer systems in a narrow class of

cases.

I strongly supported the goal of giving computer system owners the ability to call in law enforcement to help defend themselves against hacking. Including such a provision in the Patriot Act made a lot of sense. Unfortunately, the drafters of the provision made it much broader than necessary, and refused to amend it at the time we debated the bill in 2001. As a result, the law now gives the government the authority to intercept communications by people using computers owned by others as long as they have engaged in some unauthorized activity on the computer, and the owner gives permission for the computer to be monitored--all without judicial approval.

Only people who have a ``contractual relationship'' with the owner allowing the use of a computer are exempt from the definition of a computer trespasser under section 217 of the Patriot Act. Many people-- for example, college students, patrons of libraries, Internet cafes or airport business lounges, and guests at hotels--use computers owned by others with permission, but without a contractual relationship. They could end up being the subject of Government snooping if the owner of the computer gives permission to law enforcement.

My bill would clarify that a computer trespasser is not someone who has permission to use a computer by the owner or operator of that computer. It would bring the existing computer trespass provision in line with the purpose of section 217 as expressed in the Department of Justice's initial explanation of the provision. Section 217 was intended to target only a narrow class of people: unauthorized cyberhackers. It was not intended to give the government the opportunity to engage in widespread surveillance of computer users without a warrant.

Another problem is that unless criminal charges are brought against someone as a result of such surveillance, there would never be any notice at all that the surveillance has taken place. The computer owner authorizes the surveillance, and the FBI carries it out.

There is no warrant, no court proceeding, no opportunity even for the subject of the surveillance to challenge the assertion of the owner that some unauthorized use of the computer has occurred.

My bill would modify the computer trespass provision in the following additional ways to protect against abuse, while still maintaining its usefulness in cases of denial of service attacks and other forms of hacking.

First, it would require that the owner or operator of the protected computer authorizing the interception has been subject to ``an ongoing pattern of communications activity that threatens the integrity or operation of such computer.'' In other words, the owner has to be the target of some kind of hacking.

Second, the bill limits the length of warrantless surveillance to 96 hours. This is twice as long as is allowed for an emergency criminal wiretap. With four days of surveillance, it should not be difficult for the government to gather sufficient evidence of wrongdoing to obtain a warrant if continued surveillance is necessary.

Finally, the bill would require the Attorney General to report annually on the use of Section 217 to the Senate and House Judiciary Committees. Section 217 was originally subject to the sunset provision in the Patriot Act and therefore would have expired at the end of 2005. However, the USA PATRIOT Improvement and Reauthorization Act, which became law in March 2006, made this provision permanent. Congress needs to do more oversight of the use of this provision.

The computer trespass provision now in the law as a result of section 217 of the PATRIOT Act leaves open the potential for significant and unnecessary invasions of privacy. The reasonable and modest changes to the provision contained in this bill preserve the usefulness of the provision for investigations of cyberhacking, but reduce the possibility of government abuse. I urge my colleagues to support the Computer Trespass Clarification Act.

Mr. President, I ask unanimous consent that the text of the bill be printed in the Record.

Mr. President, today I will reintroduce in the Senate the Reasonable Notice and Search Act. This bill is nearly identical to a bill I introduced in the 109th Congress, S. 316. It addresses Section 213 of the USA PATRIOT Act, a provision passed in the wake of the 9/11 attacks that has caused serious concern among Members of Congress and the public. Section 213, sometimes referred to as the ``delayed notice search provision'' or the ``sneak and peek provision,'' authorizes the government in limited circumstances to conduct a search in a criminal investigation without immediately serving a search warrant on the owner or occupant of the premises that have been searched.

Prior to the Patriot Act, secret searches for physical evidence were performed in some jurisdictions under the authority of Court of Appeals decisions, but the Supreme Court never definitively ruled whether they were constitutional. Section 213 of the Patriot Act authorized delayed notice warrants in any case in which an ``adverse result'' would occur if the warrant was served before the search was executed. ``Adverse result'' was defined as including: endangering the life or physical safety of an individual, flight from prosecution, destruction of or tampering with evidence, intimidation of potential witnesses, or otherwise seriously jeopardizing an investigation or unduly delaying a trial. This last catchall category could apply in virtually any criminal case. In addition, while some courts had required the service of the warrant within a specified period of time, the Patriot Act simply required that the warrant specify that it would be served within a ``reasonable'' period of time after the search.

This provision of the Patriot Act was not limited to terrorism cases. In fact, before the Patriot Act passed, the FBI already had the authority to conduct secret searches of foreign terrorists and spies with no notice at all under the Foreign Intelligence Surveillance Act. Furthermore, the Patriot Act ``sneak and peek'' authority was not made subject to any sunset provision. So Section 213 was obviously a provision that the Department of Justice wanted regardless of the terrorism threat after 9/11.

Perhaps that is why this provision has caused such controversy. In 2003, by a wide bipartisan margin, the House passed an amendment to the Commerce-Justice-State appropriations bill offered by then- Representative Butch Otter from Idaho, a Republican, to stop funding for delayed notice searches authorized under section 213.

I first raised concerns about the sneak and peek provision when it was included in the Patriot Act in 2001. I raised concerns during the reauthorization process in 2005 and 2006, when changes were made that were, unfortunately, entirely inadequate. The reauthorization legislation did not change the very broad standard for issuing a sneak and peak search warrant. It put in place a 30-day time limit for the delayed notice of these warrants and permitted 90-day extensions--time periods that are far too long.

So even after the reauthorization process, adequate safeguards are still not in place for these types of searches. I have never argued, however, and I am not arguing now, that there should be no delayed notice searches at all and that the provision should be repealed. I simply believe that this provision should be modified to protect against abuse. My bill will do three things to accomplish this.

First, my bill would narrow the circumstances in which a delayed notice warrant can be granted to the following: potential loss of life, flight from prosecution, destruction or tampering with evidence, or intimidation of potential witnesses. I do not include the ``catchall provision'' in section 213, allowing a secret search when serving the warrant would ``seriously jeopardize an investigation or unduly delay a trial,'' because it can too easily be turned into permission to do these searches whenever the government wants.

Second, I believe that any delayed notice warrant should provide for a specific and limited time period within which notice must be given: 7 days. This is consistent with some of the pre-Patriot Act court decisions and will help to bring this provision in closer accord with the Fourth Amendment to the Constitution. Under my bill, prosecutors will be permitted to seek 21-day extensions if circumstances continue to warrant that the subject not be made aware of the search. But the default should be 1 week, unless a court is convinced that more time should be permitted.

Finally, Section 213 should include a sunset provision so that it expires along with the other expanded surveillance provisions in Title II of the Patriot Act, at the end of 2009. This will allow Congress to reevaluate this authority and whether additional safeguards are needed.

These are reasonable and moderate changes to the law. They do not gut the provision. Rather, they recognize the legitimate concern across the political spectrum that this provision presents the potential for abuse. They also send a message that Fourth Amendment rights have meaning, and potential violations of those rights should be minimized if at all possible. I urge my colleagues to support this bill.

Mr. President, I ask unanimous consent that the text of the bill be printed in the Record.

Mr. President, I am pleased to introduce the Computer Trespass Clarification Act of 2007, which would amend and clarify section 217 of the USA PATRIOT Act. This bill is virtually identical to a bill I introduced in the 109th Congress.

Section 217 of the Patriot Act addresses the interception of computer trespass communications. This bill would modify existing law to more accurately reflect the intent of the provision, and also protect against invasions of privacy.

Section 217 was designed to permit law enforcement to assist computer owners who are subject to denial of service attacks or other episodes of hacking. The original Department of Justice draft of the bill that later became the Patriot Act included this provision. A section by section analysis provided by the Department on September 19, 2001, stated the following:

Current law may not allow victims of computer trespassing

to request law enforcement assistance in monitoring

unauthorized attacks as they occur. Because service providers

often lack the expertise, equipment, or financial resources

required to monitor attacks themselves as permitted under

current law, they often have no way to exercise their rights

to protect themselves from authorized attackers. Moreover,

such attackers can target critical infrastructures and engage

in cyberterrorism. To correct this problem, and help to

protect national security, the proposed amendments to the

wiretap statute would allow victims of computer attacks to

authorize persons ``acting under color of law'' to monitor

trespassers on their computer systems in a narrow class of

cases.

I strongly supported the goal of giving computer system owners the ability to call in law enforcement to help defend themselves against hacking. Including such a provision in the Patriot Act made a lot of sense. Unfortunately, the drafters of the provision made it much broader than necessary, and refused to amend it at the time we debated the bill in 2001. As a result, the law now gives the government the authority to intercept communications by people using computers owned by others as long as they have engaged in some unauthorized activity on the computer, and the owner gives permission for the computer to be monitored--all without judicial approval.

Only people who have a ``contractual relationship'' with the owner allowing the use of a computer are exempt from the definition of a computer trespasser under section 217 of the Patriot Act. Many people-- for example, college students, patrons of libraries, Internet cafes or airport business lounges, and guests at hotels--use computers owned by others with permission, but without a contractual relationship. They could end up being the subject of Government snooping if the owner of the computer gives permission to law enforcement.

My bill would clarify that a computer trespasser is not someone who has permission to use a computer by the owner or operator of that computer. It would bring the existing computer trespass provision in line with the purpose of section 217 as expressed in the Department of Justice's initial explanation of the provision. Section 217 was intended to target only a narrow class of people: unauthorized cyberhackers. It was not intended to give the government the opportunity to engage in widespread surveillance of computer users without a warrant.

Another problem is that unless criminal charges are brought against someone as a result of such surveillance, there would never be any notice at all that the surveillance has taken place. The computer owner authorizes the surveillance, and the FBI carries it out.

There is no warrant, no court proceeding, no opportunity even for the subject of the surveillance to challenge the assertion of the owner that some unauthorized use of the computer has occurred.

My bill would modify the computer trespass provision in the following additional ways to protect against abuse, while still maintaining its usefulness in cases of denial of service attacks and other forms of hacking.

First, it would require that the owner or operator of the protected computer authorizing the interception has been subject to ``an ongoing pattern of communications activity that threatens the integrity or operation of such computer.'' In other words, the owner has to be the target of some kind of hacking.

Second, the bill limits the length of warrantless surveillance to 96 hours. This is twice as long as is allowed for an emergency criminal wiretap. With four days of surveillance, it should not be difficult for the government to gather sufficient evidence of wrongdoing to obtain a warrant if continued surveillance is necessary.

Finally, the bill would require the Attorney General to report annually on the use of Section 217 to the Senate and House Judiciary Committees. Section 217 was originally subject to the sunset provision in the Patriot Act and therefore would have expired at the end of 2005. However, the USA PATRIOT Improvement and Reauthorization Act, which became law in March 2006, made this provision permanent. Congress needs to do more oversight of the use of this provision.

The computer trespass provision now in the law as a result of section 217 of the PATRIOT Act leaves open the potential for significant and unnecessary invasions of privacy. The reasonable and modest changes to the provision contained in this bill preserve the usefulness of the provision for investigations of cyberhacking, but reduce the possibility of government abuse. I urge my colleagues to support the Computer Trespass Clarification Act.

Mr. President, I ask unanimous consent that the text of the bill be printed in the Record.