This is the first in a series of posts that examine the principles governing the transfer of data across borders between the European Union and the United States, and the effect that the USA PATRIOT Act has on businesses, citizens and governments outside the United States. Although this is a U.S.-oriented site and I am a British citizen, the issues I surface here affect all readers, whether living and working inside or outside the United States.

The USA PATRIOT Act held prominence in American society shortly after the September 11 terrorist attacks, and played a crucial role in enhancing the search capabilities of law enforcement.
But as the scales of justice sway toward the law itself, an erosion of civil liberties became apparent — even to the U.S.’s closest neighbour, Canada.
Post-9/11 and the Patriot Act
The U.S. counter-terrorism strategy has been strengthened in light of the home grown and foreign terror threat to the mainland. However, the terrorist attacks against the U.S. on September 11, 2001, sparked a change in U.S. policy on gathering intelligence to prevent further attacks.
About a month after the attacks, the U.S. Congress passed a new counter-terrorism law, commonly abbreviated to the USA PATRIOT Act 2001.
The controversial USA PATRIOT Act, commonly known as the Patriot Act, revised and consolidated counter-terrorism laws post-9/11 to enhance domestic law enforcement investigatory authority, including sweeping surveillance and search powers; while some claim the elimination of judicial oversight to ensure these powers are not abused.
Most US citizens living in the U.S. are aware of the Patriot Act as the “counter-terrorism law”. But the act consolidates, refreshes and bolsters existing laws to improve federal resources to enable those fighting the war on terror to intercept communications and acquire intelligence to prevent what is considered modern day terrorism.
For a brief overview of the Patriot Act, such as the amended legislation and the new provisions accepted by Congress in light of the September 11 attacks, the College of Law at the University of Arizona and the School of Psychology at Juniata College have more.
The 2001 Act, for example, takes into account new technologies which enable acts of cyber-terrorism, prohibit the act of knowingly harbouring a terrorist; and provide law enforcement with the ability to delay the notification of a court-approved search warrant in order to prevent a suspect from destroying evidence or fleeing. In some cases, the Act simply refreshes certain areas to make it current with the times of today.
However, the Act has been criticised by academics as a “knee-jerk reaction” to the September 11th attacks, suggesting that it infringes the constitutional rights of ordinary citizens and foreign nationals by authorising surveillance without the necessary requirement of a court order.
However, many have argued that the rules of engagement have changed entirely and that citizens should allow certain civil liberties to be “eroded”, in order to prevent another major terrorist attack.
As a U.S. law, the Patriot Act applies to everyone living and visiting the country, including any foreign national who spends time on U.S. soil as part of a visa arrangement. The Act also applies to companies based in the U.S., whether they are headquartered there — such as Apple, Google or Microsoft — or are a subsidiary of a larger non-US company.
For example, although the BBC has its headquarters in London, it also has studios and offices in the U.S., making these U.S.-based offices vulnerable to the Act.
Many users of popular web services or cloud services are unclear of the laws in effect or even the jurisdiction under which users and service providers fall.

Yet, many services, products and websites, including those made available by the cloud, are provided by U.S.-based organisations. Cloud services are often sourced from localised companies (like Google UK or Microsoft UK) for citizens in the United Kingdom, instead of dealing directly with the U.S.-based corporations.
Because the Patriot Act legislation covers U.S. companies, data that is housed or passes through the United States is vulnerable to interception by authorities.
Arguably, one of the more controversial elements to the Patriot Act is the provision made available to U.S. law enforcement officials and intelligence agencies to demand that an organization or entity hand over stored records or data without a court order.
Using this provision of the Patriot Act has been challenged in court. An FBI-issued National Security Letter (NSL) prevented Nicholas Merrill, then ISP and now founder of the Calyx Institute, from disclosing to anyone his court challenge.
A U.S. District Court Judge struck down the ‘gagging order’ — the National Security Letter — ruling that it was “unconstitutional” as it violated the right of free speech under the First Amendment and the right to be free from unreasonable searches under the Fourth Amendment.
More information on the use of NSL’s can be found in the ruling document, mirrored by the Electronic Frontier Foundation (EFF).




