US used Patriot Act to gather logs of website visitors

The government has interpreted a high-profile provision of the Patriot Act as empowering FBI national-security investigators to collect logs showing who has visited particular web pages, documents show.

But the government stops short of using that law to collect the keywords that people submit to search engines because it considers such terms to be content that requires a warrant to gather, according to letters produced by the Office of the Director of National Intelligence.

The disclosures come at a time when Congress is struggling with new proposals to limit the law, known as Section 215 of the Patriot Act. The debate ran aground in the spring amid erratic messages from President Donald Trump but is expected to resume after President-elect Joe Biden takes the oath of office in January.

Enacted after the Sept. 11, 2001, terrorist attacks, Section 215 of the Patriot Act permits the FBI to obtain a secret court order to collect any business records deemed relevant to a national-security inquiry — a very easy standard for investigators to meet. The legal authority for it and two other surveillance-related investigative tools lapsed for new inquiries earlier this year, although the FBI can still use them for preexisting cases.

Section 215 has been at the center of repeated fights over the balance between empowering national-security investigators to detect potential threats and preserving Americans’ privacy and freedom to read what they want or call other people without fear of government observation. In the Bush years, civil rights advocates raised alarms over the possibility that the FBI might use it to monitor people’s library records. In 2013, an uproar erupted over the disclosure that the National Security Agency had been secretly using it to collect bulk logs of all Americans’ phone calls.

Demands to ban using Section 215 for library records gradually faded — it appeared that in practice, the FBI was not using it to monitor what books people had checked out — and Congress ended the use of Section 215 for bulk collection of calling data in 2015. But new tensions have emerged over the extent to which the FBI could use that law to gather logs of people’s web browsing activities, as opposed to using warrants — a tool that requires investigators to first be able to produce evidence that a person probably engaged in wrongdoing.

In May, 59 senators voted to bar the use of Section 215 to collect internet search terms or web browsing activity, but negotiations broke down in the House. During that period, Sen. Ron Wyden, D-Ore., one of the sponsors of the proposal ban, wrote to the director of national intelligence seeking clarity about any such use.

Six months later, the Trump administration finally replied — initially, it turned out, in a misleading way.

In a Nov. 6 letter to Wyden, John Ratcliffe, the intelligence director, wrote that Section 215 was not used to gather internet search terms and that none of the 61 orders issued last year under that law by the Foreign Intelligence Surveillance Court involved collection of “web browsing” records.

Wyden’s office provided that letter to The New York Times, arguing that it meant that Wyden’s proposal in May — which he co-sponsored with Sen. Steve Daines, R-Mont. — could be enacted into law without any operational costs.

But The Times pressed Ratcliffe’s office and the FBI to clarify whether it was defining “web browsing” activity to encompass logging all visitors to a particular website, in addition to a particular person’s browsing among different sites. The next day, the Justice Department sent a clarification to Ratcliffe’s office, according to a follow-up letter he sent to Wyden on Nov. 25.

In fact, “one of those 61 orders resulted in the production of information that could be characterized as information regarding browsing,” Ratcliffe wrote in the second letter. Specifically, one order had approved collection of logs revealing which computers “in a specified foreign country” had visited “a single, identified U.S. web page.”

Ratcliffe expressed regret that “that this additional information was not included in my earlier letter” to the senator and suggested that his staff might take further “corrective action.”

In a statement, Wyden said the letters raise “all kinds of new questions, including whether, in this particular case, the government has taken steps to avoid collecting Americans’ web browsing information."

“More generally,” Wyden continued, “the DNI has provided no guarantee that the government wouldn’t use the Patriot Act to intentionally collect Americans’ web browsing information in the future, which is why Congress must pass the warrant requirement that has already received support from a bipartisan majority in the Senate.”

Neither Ratcliffe’s office nor the FBI answered The Times’ follow-up questions, such as whether the bureau had used the law to gather website visitor logs or other types of web browsing data before 2019 or in 2020 — and if so, whether such information was collected without attempting to filter out Americans’ data.

The disclosure that the government has used Section 215 to gather logs of visitors to a web page may shed additional light on a fight in May between two factions of House Democrats over the law, before the legislative process collapsed.

The Wyden-Daines amendment had fallen one vote short of the supermajority it needed to be attached to the bill in the Senate. But similarly minded lawmakers in the House then sought to vote on attaching the same language to the bill in their chamber.

The House Speaker, Nancy Pelosi, instructed two Democrats from California — the chairman of the House Intelligence Committee, Rep. Adam Schiff, and a proponent of greater privacy limits on surveillance, Rep. Zoe Lofgren — to negotiate over a narrowed version of the proposal.

Schiff and Lofgren tentatively agreed on language that would bar the use of Section 215 to collect Americans’ web browsing data and search terms. But while privacy advocates initially supported the compromise, they withdrew their backing after Schiff put forward an interpretation suggesting that it would leave the government, while investigating foreign threats, empowered to gather Americans’ data as long as that was not its specific intention.

Debates in Congress over the wording of laws that govern classified surveillance-related techniques and capabilities are often opaque, and the lawmakers participating in the May debate were not explicit about the crux of their disagreement.

But it appeared to fit a dispute over where to draw the line in preventing the government from ever collecting Americans’ web browsing data using Section 215 and preserving its ability to develop investigative leads about foreigners by logging visitors to suspicious websites even if sometimes domestic users’ data may get swept up too. The government cannot know ahead of time whom it will catch in such a net, and there is no foolproof way to screen out U.S. users, computer experts say.

Asked whether Schiff had been trying to preserve that ability for national-security investigators, as Ratcliffe’s letter revealed they have done at least once, a Democratic official on the House Intelligence Committee said his efforts were based on “balancing legitimate privacy interests and the need to maintain capabilities that are critical to national security.”

Even as Schiff’s and Lofgren’s compromise was breaking down, Trump further disrupted the negotiations by abruptly urging Republicans to vote against the bill until the Justice Department’s Russia inquiry was more fully investigated. (The bill also contained changes to national-security wiretapping laws in response to findings that the FBI had botched applications to wiretap a former Trump campaign adviser as part of the inquiry.)

With support bleeding away from both the left and right flanks, Pelosi sent the legislation to a House-Senate conference committee for further negotiations. But without any coherent signal from Trump about what he would avoid his veto, the Republican Senate majority leader, Mitch McConnell of Kentucky, appointed no members to the panel — permitting Section 215 to remain lapsed until negotiations resumed under a new president.