Issue 2/The Patriot Act at 25
Understanding Whole Systems
On 26 October 2001, 45 days after the September 11 attacks, President George W. Bush signed the USA PATRIOT Act into law after it was rushed through Congress. The whole argument behind it rested on a single trade: privacy and freedom given up in exchange for security, a logic that has framed the debate over surveillance ever since.
Predictably, the Patriot Act has been at the root of many of the most serious abuses of government surveillance power. Before it passed, the FBI needed specific and articulable facts giving reason to believe a person was a foreign power or an agent of one before it could demand their phone, internet, or bank records with a national security letter. Afterwards, vague relevance to an investigation, without any actual suspicion of a crime, was enough, and no judge had to be involved. National security letter requests rose from about 8,500 in 2000 to about 56,000 in 2004, routinely sweeping up personal information about people with no connection to terrorism. The letters also came with gag orders that, for years, courts had no real power to review.
Other provisions allowed the government to obtain surveillance orders that identified neither the person nor the facility to be tapped, collect records of people’s web activity, conduct secret “sneak and peek” searches of their homes without telling them, label people terrorists for belonging to peaceful dissident groups, seize their property without prior notice or a hearing, and even detain non-US citizens indefinitely on the Attorney General’s say-so. Together with the laws that followed, it also laid the groundwork for global surveillance through secret court orders and dragnet collection of emails.
Even more jarring is that, before Edward Snowden’s leaks in 2013, the public had no official confirmation of the scale of mass surveillance, and the Director of National Intelligence, James Clapper, denied it under oath.
Perhaps the most insidious part of the whole setup is how the Patriot Act reached beyond America’s borders and citizens. It created what the art collective Metahaven called a “supra-jurisdiction”: authority over information held by any US-registered company, wherever its servers happen to be. This became part of what the theorist Benjamin Bratton called a “vast software/hardware formation, a proto-megastructure of both bits and atoms, literally circumscribing the planet, which [...] not only perforates and distorts Westphalian models of State territory, it also produces new spaces in its own image: clouds, networks, zones, social graphs, ecologies, megacities, formal and informal violences, weird theologies, each superimposed on the other.” Seen in this light, the state is no longer the only aggressor in surveillance. We have all become entangled in multiple overlapping jurisdictions and are, in Metahaven’s words, “captives of the cloud”.
Even though the internet was transformed, gradually and mostly in secret, into a massive surveillance machine that affected everyone in the world, the security benefits proved hard to find. Reviewing the bulk phone records programme built on the Act’s Section 215, the government’s own Privacy and Civil Liberties Oversight Board reported in 2014 that it had “not identified a single instance involving a threat to the United States in which the program made a concrete difference in the outcome of a counterterrorism investigation.” Section 215 was finally allowed to expire in 2020. In short, we gave up our privacy for a security that, in the case of the Act’s flagship programme, never materialised.