Statement of James X. Dempsey

Executive Director

Center for Democracy & Technology*


before the

Senate Select Committee on Intelligence


May 24, 2005



         Chairman Roberts, Vice Chairman Rockefeller, Members of the Committee, thank you for the opportunity to testify this morning.  I previously testified before the Committee on April 19, at which time I urged the Committee to preserve the PATRIOT Act powers but to adopt checks and balances to make them more effective and less subject to abuse.  In particular, I stressed the role of prior judicial review based upon a factual showing and particularized suspicion. The draft bill before the Committee takes some small steps in the right direction, but overall the draft shifts radically in exactly the wrong direction.


         In particular, I will focus on the proposal for administrative subpoenas in national security investigations.  This is a big deal.  The first, threshold question of need has not been addressed.  And contrary to what has been said by some, there is no precedent in existing law for the grant of administrative subpoena power to the FBI in national security cases.  Given the unique nature of intelligence investigations, which call for greater not lower standards, we urge the Committee to reconsider and reject this proposal.


At the outset, let me reemphasize some basic points on which I hope there is widespread agreement:


·       Terrorism poses a grave and imminent threat to our nation. There are people -- almost certainly some in the United States -- today planning additional terrorist attacks, perhaps involving biological, chemical or nuclear materials.

·       The government must have strong investigative authorities to collect information to prevent terrorism.  These authorities must include the ability to conduct electronic surveillance, carry out physical searches effectively, and obtain transactional records or business records pertaining to suspected terrorists.

·       These authorities, however, must be guided by the Fourth Amendment, and subject to meaningful judicial controls as well as executive and legislative oversight and a measure of public transparency.


Intelligence Investigations Are More Dangerous to Liberty than Criminal Investigations – They Are Broader, Can Encompass First Amendment Activities and Are More Secretive and Less Subject to After-the-Fact Scrutiny -- and Therefore Intelligence Powers Require Stronger Compensating Protections


Throughout the PATRIOT Act debate, and now in the context of administrative subpoenas, the government has argued that it should have the same powers subject to the same standards in intelligence investigations that it has in criminal investigations. As we will explain below, administrative subpoenas are not normally available in criminal investigations, but even if they were, there are strong reasons not to extend criminal justice norms (like “relevance”) to intelligence investigations.


Intelligence investigations are special, in ways that make them preferable to the government, but also in ways that make them more dangerous to liberty than criminal investigations.  First, intelligence investigations are broader. They are not limited by the criminal code.  They can investigate legal activity. In the case of foreign nationals in the United States, they can focus solely on First Amendment activities.  Even in the case of U.S. persons, they can collect information about First Amendment activities.  In this context, the concept of “relevance” has little meaning.  Look at section 215 and the proposed administrative subpoena authority.  They refer to “an investigation to protect against international terrorism.”  The standard does not say “an investigation into international terrorism activities” – that would at least mean that there was some specific terrorism activity being investigated.  Instead, it says “an investigation to protect against international terrorism.” Think about an investigation to “protect against” tax fraud.  Or an investigation to “protect against” bank robbery.  How broad would that be?[1] 


Secondly, intelligence investigations are conducted in much greater secret than criminal cases, even perpetual secret. When a person receives a grand jury subpoena or an administrative subpoena in an administrative proceeding, normally he can publicly complain about it.  In a criminal case, even the target is often notified while the investigation is underway.  Most searches in criminal cases are carried out with simultaneous notice to the target.  Even though wiretaps are conducted in secret, the target is notified afterwards. Notice is an important element of Fourth Amendment norms, but most searches and wiretaps in intelligence investigations are secret forever.  Under the proposed administrative subpoena authority, the FBI can compel the recipient to perpetual secrecy.


Third, the big show in a criminal investigation is the trial.  A prosecutor knows that, at the end of the process, his actions will all come out in public.  If he is overreaching, if he went on a fishing expedition, that will all be aired, and he will face public scrutiny and even ridicule.  That’s a powerful constraint.  Similarly, an administrative agency like the SEC or the FTC must ultimately account in public for its actions, its successes and its failures.  But most intelligence investigations never result in a trial or other public proceeding.  The evidence is used clandestinely.  Sometimes the desired result is the mere sense that the government is watching


Since intelligence investigations are broader, more secret and there is no after the fact scrutiny, protections must be built in at the beginning.  That is where the PATRIOT Act fell short and where the proposal for administrative subpoenas falls short.


The Digital Revolution Is Placing More and More Information in the Hands of Third Parties


Section 215 of the PATRIOT Act and to an even greater degree the administrative subpoena authority are of especially grave concern because they exploit trends in technology that threaten to almost eliminate privacy. More and more information about our lives is collected in daily transactions by those with whom we transact business. Grocery stores, other merchants, hotels, travel agents, insurance companies, and banks all collect computerized information about our actions.  Credit cards, EZ passes, cell phones, and the Internet generate digital fingerprints giving a broad picture of our interests and associations.  Congress has tried to keep pace, with laws on financial privacy and medical privacy, but the administrative subpoena provisions of the draft bill would wipe those protections away.


Moreover, a storage revolution is sweeping the field of information and communications technology.  ISPs, websites and other online service providers are offering very large quantities of online storage, for email, calendars, photographs and even voicemail. Increasingly, ordinary citizens are storing information not in their homes or even on portable devices but on networks, under the control of service providers who can be served with compulsory process and never have to tell the subscribers that their privacy has been invaded.


         The Threshold Question – There Has Been No Showing of Need


         The 9/11 Commission concluded that the burden of proof for retaining – and equally so for adding – a particular governmental power should be on the executive to explain that the power actually materially enhances security.  To show that a power is needed, the government must show that current powers are inadequate.  With respect to administrative subpoenas, the government has not met that burden.


         As the Justice Department itself has noted, the rationale behind administrative subpoenas is that “Without sufficient investigatory powers, including some authority to issue administrative subpoena requests, federal governmental entities would be unable to fulfill their statutorily imposed responsibility to implement regulatory or fiscal policies.”  U.S. Department of Justice, Office of Legal Policy, “Report to Congress on the Use of Administrative Subpoena Authorities by Executive Branch Agencies and Entities, pursuant to Public Law 06-544” (2002) at p. 6.  As the DOJ goes on to note, limiting this authority “would leave administrative entities unable to execute their respective statutory authorities.”  Id at 7.


         Under current law, the FBI already has far-reaching and sufficient compulsory powers to obtain any relevant information when it is investigating terrorism, under both its criminal and intelligence authorities:


   Search Warrants. In any criminal investigation of international terrorism, the FBI can obtain a search warrant for documents or other materials if there is a judicial finding of probable cause that a crime is being planned. Search warrants can be issued not only to search a suspect's home, but also to obtain documents from any other third party if they constitute evidence of a crime.


   Grand Jury Subpoenas. The FBI also can use grand jury subpoenas in any criminal investigation of international terrorism to obtain any documents or other materials.


    FISA Orders and NSLs. In international terrorism cases, the FBI has sweeping authority to obtain business records and any other tangible things under the Foreign Intelligence Surveillance Act, as amended by the PATRIOT Act. This authority exists not only in Section 215, but also in the five National Security Letter authorities for those categories of records considered especially pertinent to intelligence investigations.


The government has made no showing that these powers are insufficient.  To the contrary, it has repeatedly praised the PATRIOT Act as providing the necessary tools to prevent terrorism and to prosecute a host of terrorism-related cases.  Given these broad existing powers, and given the widespread public and Congressional concern that some of the existing PATRIOT Act powers are not subject to sufficient checks and balances, there is no justification for going even further down the path of unchecked authority.


There is No Precedent for Giving the FBI Administrative Subpoena Power -- What We Do with “Crooked Doctors” Has No Bearing on National Security Investigations


         Contrary to what has been said by some, there is no precedent for giving the FBI administrative subpoena power.  The FBI has long sought, and Congress has long rejected granting it, the authority to issue its own orders compelling disclosure of records.  This is an issue that goes back to the momentous debates around the “FBI Charter” in the late 1970s and early 1980s, when administrative demand authority was one of the most contentious issues.  More recently, in July 1996, after the Oklahoma City bombing, the Administration sought administrative subpoena authority and Congress rejected it.  In 2001, in the original PATRIOT Act proposal, the Administration again sought administrative subpoena power and again Congress rejected it.


         Congress has repeatedly denied the FBI the power to write its own compulsory orders for good reason.  An administrative subpoena is an extraordinary device.  In this case, it is essentially a piece of paper signed by an FBI official that requires any recipient to disclose any documents or any other materials.  (We note that the proposed administrative subpoena in the Committee draft would not convey the power to compel a person to give testimony to the FBI.  This, at least, is an important line to draw.)


         In a 2002 study, the Department of Justice identified approximately 335 administrative subpoena authorities existing in the law.[2] Of those, 330 are for administrative agencies and not really relevant here, since, to say the least, the FBI’s intelligence division is not an administrative agency.  The 330 are in the context of administrative, regulatory programs – such as OSHA and the SEC. They are subject to various checks and balances. They often issue directly to the subjects of investigations. They are generally not subject to secrecy rules.  Only 5 are for use primarily in criminal investigations and even those have histories and limitations that make them unsuitable as analogies for what the FBI is seeking:


·      21 USC 876 – Controlled Substances Act. When the FBI in 1982 was given joint jurisdiction with the DEA over drug enforcement, it got for drug cases the administrative subpoena authority that went with the enforcement of the regulatory system for controlled substances. The subpoenas are served, for example, on pharmacies and doctors suspected of engaging in the diversion of controlled substances to the black market. According to CRS, “The earliest of the three federal statutes used extensively for criminal investigative purposes appeared with little fanfare as part of the 1970 Controlled Substances Act. … [T]he legislative history of section 876 emphasizes the value of the subpoena power for administrative purposes – its utility in assigning and reassigning substances to the acct’s various schedules and in regulating the activities of physicians, pharmacists and the pharmaceutical industry … .”


·      5 U.S.C. App. (III)  -- Inspectors General Act.  The Inspector General system is unique, because it is largely focused inward, towards the conduct of federal agencies and programs.  The Inspectors General seek to achieve systemic reform, and their powers are quasi-regulatory.  They oversee the administration of federal procurements, the use of federal resources and the administration of federal procurements.



·      18 U.S.C. 3486(a)(1)(A)(i)(I) - In a little-noticed provision in the Health Insurance Portability and Accountability Act (HIPAA), the massive medical insurance law of 1996, the Department of Justice was given administrative subpoena authority for investigation of Medicare and Medicaid fraud. Notably, the Attorney General has not delegated his administrative subpoena power to the FBI in health care fraud investigations.  The medical care sector is highly regulated. Medicare and Medicaid involve federal tax dollars. Generally, in these cases, the government serves the subpoena on the entity it is investigating, not some third party.  Thus, when the Justice Department demands records from a hospital or insurance company as part of a health care fraud investigation, it is investigating that hospital or insurance company - not the customers of those entities. That creates some built-in checks on the administrative subpoena process. Indeed, the HIPAA rules for administrative subpoenas require that individuals' health information contained in those records can be depersonalized whenever possible.


·      18 U.S.C. 3486(a)(1)(A)(i)(II) – The administrative subpoena provision for child abuse cases was also adopted without much debate and is used mainly to obtain subscriber account information from Internet Service Providers. See 18 U.S.C. 3486(a)(1)(C).


·      18 U.S.C. 3486(a)(1)(A)(ii) -  The Secret Service has authority to issue administrative subpoenas, but only in cases involving an “imminent” threat to one of its protectees.  According to the Department of Justice, “Where a finding of “imminence” is not appropriate, the Secret Service does not seek an administrative subpoena but proceeds, instead, through the process of procuring a grand jury subpoena through a local United States Attorney’s office.”  DOJ report, p. 39.  The provision was adopted in 2000, but the authority was not delegated to the Secret Service until November 2001, and in calendar 2001, the neither the Secretary of the Treasury nor the Secret Service issued a single administrative subpoena


It is apparent from the foregoing that the FBI's administrative subpoena authority is limited to only two situations, drug matters and child abuse cases.  The former is largely related to the administration of a regulatory scheme and is often subject to the accountability that comes from serving the subpoena on the target (a drug company or pharmacy), rather than secretly on a third party. By contrast, the administrative subpoena proposal in the Committee draft is designed to allow the FBI to obtain information, in secret, from entities that are not under investigation themselves but have customers whose records the FBI is seeking. The person under investigation never knows that the FBI has sought or obtained those records. With no other external check like a court or grand jury, the FBI would have almost limitless power to collect sensitive personal information.


Judicial Challenge is a Limited Protection, Insufficient to Overcome Concerns with the Authority


The Committee bill would allow the recipient of an administrative subpoena to challenge it, and consideration is being given to providing some form of judicial challenge for Section 215 orders.  While judicial challenge is appropriate, it does not resolve our concerns, for two reasons:


         First, few recipients of 215 orders or administrative subpoenas would be likely to challenge them.  These disclosure orders are not served on individuals.  They are served on businesses – airlines, hotels chains, and other third parties.  These businesses are provided immunity for complying.  They never have to tell their customers that there records have been sought and the customers never receive notice. So why would such a business go to the expense of challenging a 215 order or administrative subpoena?  A business has little incentive to spend its money challenging a subpoena for records that pertain to someone else. And since the business is prohibited from notifying its customer of the existence of the subpoena, the customer his no right to challenge the subpoena.


Second, the rules for administrative subpoenas require the courts to be extremely deferential to executive branch agencies.  Courts must defer to an agency’s determination of relevancy “so long as it is not ‘obviously wrong.’”  United States v. Hunton & Williams, 952 F. 2d. 843, 845 (3rd Cir. 1995).  The Third Circuit noted that the “reasonableness” inquiry in such cases is even more deferential than the Administrative Procedure Act’s “arbitrary and capricious” standard for review of agency action.  Id.  As the Justice Department admits, “the burden of proof imposed on a challenger to an administrative subpoena is steep.”  DOJ Report. For example, a challenge based on bad faith will be successful only upon a showing of “institutionalized bad faith, not mere bad faith on the part of the official issuing the subpoena.”  United States v. LaSalle Nat’l Bank, 437 U.S. 298, 316 (1978).


Intelligence Investigations Pose Unique Risks and Require Special Protections


The argument is made, if over 300 agencies have administrative subpoena power, why shouldn’t the FBI in intelligence investigations.  The answer is that no doctor will be detained and deported in a secret proceeding following use of the HIPAA administrative subpoena power, no pharmacist will be held in a military prison as an illegal enemy combatant based on informed provided under the Controlled Substances Act, no subject of an administrative subpoena will be sent to Egypt via “rendition” in a child abuse investigation.  The government has claimed an extraordinarily broad range of powers in intelligence investigations, especially against foreign nationals but also against citizens.  Given the secrecy with which these investigations are conducted, their breadth, and the lack of after-the-fact checks and balances, protections of liberty must come up front, in the form of meaningful judicial review based on a factual premise and particularized suspicion.


Mail covers


We will say only a few words on the provisions related to mail covers.  First, we know of no justification for this provision.  We suspect that it the problems the FBI has encountered with the Postal Service are minor and could be resolved by negotiation, perhaps mediated by this Committee. 


Second, though, we fear that the proposal is not merely a codification of existing practice but rather than shift of power from the Postal Service to the FBI.  We note that the Postal Services regulations start with an affirmation of the policy that the “U.S. Postal Service maintains rigid control and supervision with respect to the use of mail covers.”  39 CFR 233.3.  We are concerned that the FBI may not be as careful


Finally, we note a fundamental question: Is the concept of a mail cover, whether administered by the Postal Service or the FBI, outdated?  Congress has moved to bring a variety of intelligence processes under the supervision of the FISA court.  Section 215 applies to business records, and FISA also requires court approval for use of pen registers and trap and trace devices. The mail cover is a little like a transactional record, although it requires effort to create it.  The mail cover is also comparable to a pen register or trap and trace device:  A mail cover collects to and from information on surface mail, a pen register collects to and from information on a telephone call or email.  The records provision of FISA and the pen/trap are both subject to judicial approval.  If the Committee really found a need to codify mail cover authorities, then it should consider making all transactional record  provisions subject to the same standard: judicial approval, based on a factual showing and particularity.




Twenty-five public interest organizations from across the political spectrum have written to oppose the administrative subpoena provision.  Their letter states:


At the very time when there seems to be an emerging consensus around adding meaningful checks and balances to PATRIOT Act powers to protect against government abuse, “administrative subpoenas” would represent a new, unchecked power.  At the very time when the Attorney General is supporting amendments to strengthen judicial oversight of orders under Section 215 of the PATRIOT Act, authorization of “administrative subpoenas” would move radically in the opposite direction.


Indeed, Attorney General Gonzales has repeatedly emphasized that the prior judicial approval required for Section 215 orders is a safeguard against abuse.  The Attorney General’s assurances would be meaningless, however, if the FBI could issue disclosure orders with no judicial approval.


            The Center for Democracy and Technology looks forward to working with you to strike the right balance, to ensure that the government has the tools it needs to prevent terrorism, and that those tools are subject to appropriate checks and balances.

* The Center for Democracy and Technology is a non-profit, public interest organization dedicated to promoting civil liberties and democratic values for the new digital communications media.  Among our priorities is preserving the balance between security and freedom after 9/11. CDT coordinates the Digital Privacy and Security Working Group (DPSWG), a forum for computer, communications, and public interest organizations, companies and associations interested in information privacy and security issues.

[1]   This point was articulated by Suzanne Spaulding in her May 10, 2005 testimony before the Senate Judiciary Committee.

[2] U.S. Department of Justice, Office of Legal Policy, “Report to Congress on the Use of Administrative Subpoena Authorities by Executive Branch Agencies and Entities, pursuant to Public Law 06-544” (2002).  See also Charles Doyle, Congressional Research Service, “Administrative Subpoenas and National Security Letters in Criminal And Foreign Intelligence Investigations: Background and proposed Adjustments” (April 15, 2005).