USA PATRIOT Act (2001)
Passed six weeks after September 11, it amended almost every surveillance statute on this page at once. For a carrier, the parts that still matter are in FISA, the pen-register statute and the Stored Communications Act.
Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001 (USA PATRIOT Act)
After the September 11 attacks Congress passed the PATRIOT Act, which amended FISA among many other statutes: foreign intelligence need only be "a significant purpose" of FISA surveillance rather than the primary one, roving surveillance was authorized, and the business-records provision was broadened. (The so-called "lone wolf" amendment — surveillance of a non-U.S. person engaged in international terrorism without a showing of connection to a foreign power — came later, in the Intelligence Reform and Terrorism Prevention Act of 2004.)
It also amended the criminal surveillance statutes: pen-register and trap-and-trace orders were extended expressly to Internet routing and addressing information and made nationwide in effect; the Stored Communications Act's emergency-disclosure and subpoena provisions were broadened; and providers assisting with lawful surveillance were given clearer protection from liability for good-faith compliance.
The parts that matter to a provider.
FISA
Lowered the standard from "the purpose" to "a significant purpose" (§ 218), authorized roving surveillance (§ 206), and broadened orders for business records (§ 215).
Pen registers and trap-and-trace
Confirmed that dialing, routing, addressing and signaling information on the Internet is within the pen-register statute; orders may be served anywhere in the United States.
Stored Communications Act
Expanded what a subpoena reaches (means and source of payment, session times and durations, temporarily assigned network addresses) and permitted voluntary disclosure to government in emergencies involving danger of death or serious physical injury.
Provider protection
Good-faith reliance on a court order, warrant, subpoena or statutory authorization is a complete defense to civil or criminal action against a provider.
Does this apply to you?
Every communications and computing service provider that receives legal process — the Act reshaped the process itself, and several of its provisions are what a records-production desk applies every day.
USA PATRIOT Act, full text
Hosted in full by Subsentio. Opens in a new tab.
Other primary documents.
CALEA Act of 1994
What CALEA (1994) requires, section by section — definitions, capability, security, safe harbor, enforcement — with the full text to download.
CALEA Broadband Coverage Order (2005)
The 2005 FCC order that extended CALEA to facilities-based broadband and interconnected VoIP providers — what it decided, why, and what it left open.
CALEA Capability Order (2006)
The 2006 FCC order that set the May 14, 2007 deadline, permitted Trusted Third Parties, required SSI filings and monitoring reports, and settled who pays.
ECPA (1986)
What ECPA did: extended the Wiretap Act to electronic communications and created the Pen Register Act and the Stored Communications Act — the tiers of process.
The Wiretap Act (1968)
The 1968 statute behind every Title III order: a general prohibition on intercepting communications, with a court-supervised exception on probable cause.
FISA (1978)
What FISA authorizes — foreign-intelligence surveillance of foreign powers and their agents under the FISA court — and what a FISA order means for a carrier.