The USA PATRIOT Act:
the response and responsibility of library management

 Writing >

In my Management class, we had to write an essay about an "issue" in library management. I chose the USA PATRIOT Act, since it was urgent, important and topical. I hope others find it both informative and helpful. I've done a lot of readings, and the bibliography should be a particularly good resource for further study on the subject.

If you find this paper useful, please let me know. I like to be helpful, and find it personally rewarding to hear when others appreciate my writing.

Added April 9, 2003: Last night I attended a panel discussion about the USA PATRIOT Act and libraries. For some more updated information on the status of the law, see this journal entry which summarizes the latest news and information.
Also, the American Library Association has recently updated their website, which has broken all the ala.org links in the bibliography. I will repair them shortly.


The USA PATRIOT Act:

the response and responsibility of library management

Elisabeth Riba
July 2002


In the wake of the terrorist attacks on September 11th, the Bush administration submitted anti-terrorism legislation to Congress. Titled the "Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001" (with the catchy moniker "USA PATRIOT Act") it became Public Law 107-56 on October 26th.

The USA PATRIOT Act contains a mishmash of provisions to expedite law enforcement. Some of these changes eliminate loopholes or update existing laws to catch up with modern technology. Many grant the Justice Department powers that Congress had previously refused, but now passed due to the urgency of September 11th.

Several sections of the law modify the rules around libraries, particularly in terms of law enforcement access to library records, and the use of library systems for active surveillance and wiretapping. Library managers and staff need to be aware of the new requirements, and should prepare in advance what to do in case the police or FBI come calling.

The full USA PATRIOT Act is several hundred pages long. However, only a few sections are relevant to librarianship. The most important of these are Sections 214 through 216.

Section 215, "Access to records and other items under the Foreign Intelligence Surveillance Act (FISA)" enables FBI agents to request "any tangible things (including books, records, papers, documents, and other items) for an investigation to protect against international terrorism or clandestine intelligence activities." That includes library records. To obtain such materials, the FBI only needs a search warrant from a judge, not a subpoena which comes from grand juries, and they can get such warrants on a much lower legal standard than probable cause. The warrant itself does not have to disclose the reasons it was requested, and people who receive such a search warrant are not allowed to reveal that the FBI "has sought or obtained tangible things under this section."

Section 216, "Modification of authorities relating to use of pen registers and trap and trace devices," extends telephone monitoring laws to include information related to Internet traffic, including e-mail addresses, IP addresses and URLs for web pages. This changes the definitions across the board, affecting all kinds of law enforcement activities (state or federal), beyond terrorism.

Section 214, "Pen register and trap and trace authority under FISA," enables FBI agents to request such records through court orders in much the same manner as described in Section 215.

Elsewhere in the law, Section 206 permits the use of "roving" surveillance which can follow a suspect, rather than requiring officials to specify every number they wish to wiretap. Sections 219 and 220 enables national search warrants for electronic evidence, rather than limiting court orders to specific jurisdictions. These could all be used to justify traps or tracing devices on library computers.

There is a sunset clause on this section of the law. Sections 206, 214, 215, and 220 expire on December 31, 2005. However, they will remain applicable to ongoing investigations begun before that deadline. In other words, after 2005, law enforcement officials will still be able to request library records of patrons if their cases were already open before 2005. Sections 216 and 220 do not expire.

The ALA's Office for Intellectual Freedom has been assisting librarians in understanding and addressing issues with the USA PATRIOT Act, including guidelines on how to respond. Library management should take proactive precautions in case law enforcement comes calling, rather than waiting and being caught unprepared.

If your library has access to legal counsel, on staff or through the affiliated municipality, university or corporation, consult with them. Library management needs someone who is familiar with these provisions of the USA PATRIOT Act and with any relevant state or local laws.

Review library policies regarding the creation and retention of records. Because law enforcement could conceivably request any records a library has about a patron, a careful review of policies and procedures is important. While the USA PATRIOT Act does not require libraries to change the way they conduct business, it might be worthwhile to reevaluate what kinds of data you are keeping on your patrons. The ALA suggests libraries avoid retaining any records "that are not needed for efficient operation of the library" and establish policies that codify these practices. Anne M. Turner, president of the California Library Association, noted "they can't find what we don't have." (Egelko)

Fortunately for our patrons' privacy, it appears that most circulation software only tracks materials currently checked out, "automatically eras[ing] a reader's borrowing record once a book is returned and all fines are paid." (Flanders) However, many libraries use much less secure methods of tracking patrons Internet activity, such as "Internet sign-up sheets, Web logs, caches on individual computers as well as servers, and so forth." (Schneider) Libraries might want to reevaluate such policies.

Train all staff, including volunteers, on the new procedures, and conduct audits if necessary to ensure they are being followed.

Imagine if law enforcement officials request the records of Internet terminal use. If library policy is such that sign-in sheets are kept indefinitely, law enforcement could theoretically obtain all of them. If policy mandates that sign-in sheets be destroyed at the end of the day, then law enforcement could at best get the current day's paperwork only. However, if policy states that the sheets are destroyed daily yet the staff hasn't been diligent about doing so, then the officers could obtain all available pages. To destroy them after they've been requested, even if they should have been destroyed already, would be obstruction of justice, the same crime for which Arthur Andersen has been accused.

Also, develop policies and procedures for handling law enforcement requests, and train your staff in that. Anyone on the staff could be approached by law enforcement, so everyone should know what to do if the situation occurs. It might be worthwhile to designate someone within the library to be responsible for handling such requests, probably the library director.

Finally, it might be a good idea to educate your patrons, trustees, and others in the community on the implications of the law. Keeping everyone informed can both forestall unnecessary worry and explain areas where caution may be advised. As far as Internet service is concerned, it's also important to look upstream, at the source. For example, if the public library gets its Internet feed from a public ISP or municipal servers, law enforcement could easily install tracking software upstream, and the library might never know that their patrons' usage was being monitored.

These are all designed to prepare the library community in the event law enforcement comes calling. Should law enforcement officials "knock at the door," whoever they contact should ask for identification and then follow the policies set up for handling such requests, generally by referring them to the library director or other designated parties.

Contact legal counsel upon receiving a request. Libraries that do not have access to legal counsel can contact the Office for Intellectual Freedom for assistance.

Search warrants, unlike subpoenas, can be executed immediately. Agents or officers serving search warrants can begin the search as soon as the warrant is served. The gag order that's part of the USA PATRIOT Act does not limit libraries' ability to seek legal advice, so counsel should definitely be contacted and present for any search. However, there is no opportunity or right to quash a search warrant, as there are with subpoenas.

Having sound policies, and following them, "can provide order and justification during what can be a chaotic time." (Bradley & Tennant) Finally, there is a provision in the law which reimburses certain costs of assisting law enforcement. Although the guidelines are still unclear, document all costs incurred.

After law enforcement officials have left the premises, continue consulting with legal counsel. The library's responsibilities may not be over, particularly if officers implement any ongoing surveillance, so staff will have to ensure it continues to comply with any remaining requirements.

If its permissible to inform others about the law enforcement visit (which may not be the case) the ALA has asked to be notified so they can track such incidents. If the library is entitled to any reimbursements, those should be pursued.

Finally, this might be another time to review and possibly modify library policies in light of the experience.

Every state except Kentucky and Hawaii has laws making library records confidential, and the Attorneys General of those states have ruled that library records are confidential and may not be disclosed under the laws governing open records. The news articles and guidelines are contradictory. Many report that federal laws (such as the USA PATRIOT Act) override state confidentiality laws, but others express confusion over the conflict. James Dempsey, deputy director of the Center for Democracy and Technology, believes that "since the section of the Patriot Act dealing with libraries and books does not say it overrules state laws, the state rules should apply." (Olds) In the mean time, some librarians are saying they will comply, albeit reluctantly, many are taking a wait-and-see approach, and others say they would resist government records requests.

Because of the gag order inherent in the law, we don't have any specific information on the extent of inquiries libraries have faced. There is, however, some anecdotal evidence.

In December 2001, Professor Leigh Estabrook of the University of Illinois at Urbana-Champaign GSLIS conducted an anonymous mail-based survey to public libraries in the United States serving populations over 5,000. Of the 1028 libraries that responded (68% response rate, equaling 20% of such public libraries) 85 libraries (8.3% of respondents) reported that authorities have requested information about their patrons pursuant to the events of September 11th. And this was only in the first three or four months of the law.

Newspaper and magazine articles looking for local slants have occasionally reported whether local libraries received USA PATRIOT requests. The list of such libraries includes Queens, NY, Paterson, NJ, Bridgeview, IL, and St. Petersburg, Fort Lauderdale and Coral Springs, FL.

However, due to the built-in gag order, librarians have revealed nothing more than that; no information is available about how they responded or whether anything was found. Broward County (FL) library director Sam Morrison said "We've heard from them, and that's all I can tell you." ("FBI checks library records as part of terror probe")

Besides the changing legal environment of the USA PATRIOT Act, there are other ways that September 11th has affected libraries.

Dr. Estabrook's studies document other areas of impact, including security measures, changes in attitude toward patrons and influences on collection development.

  • Over 10% of libraries became more restrictive regarding patron use of the Internet due to the events of September 11th. Of those, over half began to request identification of patrons and 65% now monitor what patrons are doing either visually or by reviewing the cache and/or history files.
  • 23 libraries said they had reported patron records and/or behavior to outside authorities, but only 115 answered that particular question, making a response rate of 20%.
  • About one-fifth of the libraries report that staff have changed their attitude toward or treatment of users in some way. Over half who reported a change said they were more likely to notice the kinds of materials people are checking out.
  • Almost two-thirds of the respondents at the time of the survey reported hearing about the USA PATRIOT Act, but of those, fewer than half correctly identified the truth or falsehood of any provisions in the Act when asked.

At Edison Community College in Florida, "library staff recently contacted campus security about three Middle Eastern-looking men who were whispering while using library computers to look up Islamic newspapers. That call in turn prompted a call to the Collier County Sheriff's Office, which dispatched deputies to seize the library's computer hard drives for further investigation." ("A chill in the library")

The USA PATRIOT Act is still too new for anyone to truly understand what its impact will be.

Officials at Louisiana State University's GSLIS program have already included details of the USA PATRIOT Act to their lesson plans. According to assistant professor Robert Ward, "We had to jump on it and move it into the curriculum quickly because our students will be leaving for jobs this spring." When those students become librarians, they need to be able to deal with agents asking them for information and know whether record requests are legal, he said.

Meanwhile legal experts are still poring over the law trying to interpret it and develop better guidelines. Since there haven't yet been any court challenges, analysis has been difficult. There seem to be some questions over how this law interacts with state laws that protect patron records.

Some observers wonder whether the "lack of hearings or any other kind of public record will subject the law to legal challenges because of lack of a legislative history." (Bradley)

And meanwhile, further legislative action could change the playing field again, in either direction. Later laws could eliminate the sunset provision and extend these regulations beyond 2005. On the other hand, several senators referenced library issues during the floor debate before passage, and even now the House Judiciary Committee has questioned Attorney General John Ashcroft about several aspects of the USA PATRIOT Act, including its effect upon libraries (Sensenbrenner and Conyers) . So, repeal or rescission is also possible.

Benjamin Franklin once wrote "They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety." Personally, I find many aspects of the USA PATRIOT Act abhorrent and opportunistic. We are losing numerous essential liberties without any guarantee that these changes will improve public safety.

As Mike Pearson wrote in the Rocky Mountain News, "The First Amendment forbids government from removing items it deems subversive from store shelves, but the law lets it investigate you for doing so."

And any records that law enforcement can see may be misleading. It's a "classic sitcom plot line. An observer misconstrues a sequence of unrelated details, and then has a skewed perception of the protagonist." (Gelsey) But an incomplete picture here has more harmful results. Circulation records don't necessarily paint an accurate picture of what patrons are reading. Karyle Butcher, Oregon State University librarian, noted "If someone comes in and goes to the stacks, finds a book, and they are sitting and reading, we have no clue." (Bella)

The ALA Code of Ethics states that librarians "protect each library user's right to privacy and confidentiality with respect to information sought or received and resources consulted, borrowed, acquired or transmitted." That should remain a strong part of the profession.

The USA PATRIOT Act consists of much more than I've described in this essay. Since they don't directly impact library management, I haven't even touched on the secret FISA judges who issue the court orders, or the expansions of reasons why such orders may be granted.

Because passage of the USA PATRIOT Act was so rushed, it lacks the usual complement of government reports. And because the law is so recent, there aren't any books as yet on the subject. Most of the available information is limited to newspaper or magazine articles and online web-based resources.

Fortunately several organizations, including the Office for Intellectual Freedom of the American Libraries Association and the Electronic Frontier Foundation, have posted detailed analysis and guidelines explaining the law, to which I have referred.

Bibliography (in chronological order):

Added April 9, 2003: Last night I attended a panel discussion about the USA PATRIOT Act and libraries. For some more updated information on the status of the law, see this journal entry which summarizes the latest news and information.
Also, the American Library Association has recently updated their website, which has broken all the ala.org links in the bibliography. I will repair them shortly.



Valid HTML 4.01!

Copyright © 2002 - 2003 Elisabeth Riba,
All Rights Reserved