RIP Webby

The government has interpreted a high-profile provision of the Patriot Act as empowering F.B.I. national security investigators to collect logs showing who has visited particular web pages, documents show.

But the government stops short of using that law to collect the keywords people submit to internet search engines because it considers such terms to be content that requires a warrant to gather, according to letters produced by the Office of the Director of National Intelligence.
Read the Letters
Senator Wyden and the intelligence office’s correspondence on Section 215 and web browsing.

The disclosures come at a time when Congress is struggling with new proposals to limit the law, known as Section 215 of the Patriot Act. The debate ran aground in the spring amid erratic messages from President Trump, but is expected to resume after President-elect Joseph R. Biden Jr. takes the oath of office in January.

Enacted after the Sept. 11, 2001, attacks, Section 215 of the Patriot Act permits the F.B.I. to obtain a secret court order to collect any business records deemed relevant to a national security inquiry — a very easy standard for investigators to meet. The legal authority for it and two other surveillance-related investigative tools lapsed for new inquiries earlier this year, although the F.B.I. can still use them for pre-existing cases.

Section 215 has been at the center of repeated fights over the balance between empowering national security investigators to detect potential threats and preserving Americans’ privacy and freedom to read what they want or call other people without fear of government observation. In the Bush years, civil liberties advocates raised alarms over the possibility that the F.B.I. might use it to monitor people’s library records. In 2013, an uproar erupted over the disclosure that the National Security Agency had been secretly using it to collect bulk logs of all Americans’ phone calls.

Demands to ban using Section 215 for library records gradually faded — it appeared that in practice, the F.B.I. was not using it to monitor what books people had checked out — and Congress ended the use of Section 215 for bulk collection of calling data in 2015. But new tensions have emerged over the extent to which the F.B.I. could use that law to gather logs of people’s web browsing activities, as opposed to using warrants — a tool that requires investigators to first be able to produce evidence that a person probably engaged in wrongdoing.

In May, 59 senators voted to bar the use of Section 215 to collect internet search terms or web browsing activity, but negotiations broke down in the House. During that period, Senator Ron Wyden, Democrat of Oregon and one of the sponsors of the proposal ban, wrote to the director of national intelligence seeking clarity about any such use.

Six months later, the Trump administration finally replied — initially, it turned out, in a misleading way.

In a Nov. 6 letter to Mr. Wyden, John Ratcliffe, the intelligence director, wrote that Section 215 was not used to gather internet search terms, and that none of the 61 orders issued last year under that law by the Foreign Intelligence Surveillance Court involved collection of “web browsing” records.
On Tech with Shira Ovide: Your guide to how technology is transforming our lives — in the time of coronavirus and beyond.

Mr. Wyden’s office provided that letter to The New York Times, arguing that it meant Mr. Wyden’s proposal in May — which he sponsored with Senator Steve Daines, Republican of Montana — could be enacted into law without any operational costs.

But The Times pressed Mr. Ratcliffe’s office and the F.B.I. to clarify whether it was defining “web browsing” activity to encompass logging all visitors to a particular website, in addition to a particular person’s browsing among different sites. The next day, the Justice Department sent a clarification to Mr. Ratcliffe’s office, according to a follow-up letter he sent to Mr. Wyden on Nov. 25.

In fact, “one of those 61 orders resulted in the production of information that could be characterized as information regarding browsing,” Mr. Ratcliffe wrote in the second letter. Specifically, one order had approved collection of logs revealing which computers “in a specified foreign country” had visited “a single, identified U.S. web page.”

Mr. Ratcliffe expressed regret “that this additional information was not included in my earlier letter” to the senator, and suggested his staff might take further “corrective action.”

In a statement, Mr. Wyden said the letters raise “all kinds of new questions, including whether, in this particular case, the government has taken steps to avoid collecting Americans’ web browsing information.”

“More generally,” Mr. Wyden continued, “the D.N.I. has provided no guarantee that the government wouldn’t use the Patriot Act to intentionally collect Americans’ web browsing information in the future, which is why Congress must pass the warrant requirement that has already received support from a bipartisan majority in the Senate.”

Neither Mr. Ratcliffe’s office nor the F.B.I. answered The Times’s follow-up questions, such as whether the bureau had used the law to gather website visitor logs or other types of web browsing data before 2019 or in 2020 — and if so, whether such information was collected without trying to filter out Americans’ data.

The disclosure that the government has used Section 215 to gather logs of visitors to a web page may shed additional light on a fight in May between two factions of House Democrats over the law, before the legislative process collapsed.

The Wyden-Daines amendment had fallen one vote short of the supermajority it needed to be attached to the bill in the Senate. But similarly minded lawmakers in the House then sought to vote on attaching the same language to the bill in their chamber.

The House speaker, Nancy Pelosi, instructed two Democrats from California — the chairman of the House Intelligence Committee, Representative Adam B. Schiff, and a proponent of greater privacy limits on surveillance, Representative Zoe Lofgren — to negotiate over a narrowed version of the proposal.

Mr. Schiff and Ms. Lofgren tentatively agreed on language that would bar the use of Section 215 to collect Americans’ web browsing data and search terms. But while privacy advocates initially supported the compromise, they withdrew their backing after Mr. Schiff put forward an interpretation suggesting that it would leave the government, while investigating foreign threats, able to gather Americans’ data as long as that was not its specific intention.

Debates in Congress over the wording of laws that govern classified surveillance-related techniques and abilities are often opaque, and the lawmakers participating in the May debate were not explicit about the crux of their disagreement.

But it appeared to fit a dispute over where to draw the line in preventing the government from ever collecting Americans’ web browsing data using Section 215, and preserving its ability to develop investigative leads about foreigners by logging visitors to suspicious websites even if sometimes domestic users’ data may get swept up too. The government cannot know ahead of time whom it will catch in such a net, and there is no foolproof way to screen out American users, computer experts say.

Asked whether Mr. Schiff had been trying to preserve that ability for national security investigators, as Mr. Ratcliffe’s letter revealed they have done at least once, a Democratic official on the House Intelligence Committee said, “Schiff’s efforts were not based on preserving any specific program or use, but rather balancing legitimate privacy interests and the need to maintain capabilities that are critical to national security.”

Even as Mr. Schiff’s and Ms. Lofgren’s compromise was breaking down, Mr. Trump further disrupted the negotiations by abruptly urging Republicans to vote against the bill until the Justice Department’s Russia inquiry was more fully investigated. (The bill also contained changes to national security wiretapping laws in response to findings that the F.B.I. had botched applications to wiretap a former Trump campaign adviser as part of the inquiry.)

With support bleeding away from both the left and right flanks, Ms. Pelosi punted and sent the legislation to a House-Senate conference committee for further negotiations. But without any coherent signal from Mr. Trump about what would avoid his veto, the Republican Senate majority leader, Mitch McConnell of Kentucky, appointed no members to the panel — permitting Section 215 to remain lapsed until negotiations resumed under a new president.