The Impact Of The Patriot Act On Employers

As a result of September 11, 2001, Congress enacted sweeping legislation to expand the government's authority to conduct clandestine surveillance of suspected terrorist activity. This legislation is titled the "Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001," commonly referred to as the Patriot Act. The Patriot Act provides for increased surveillance powers for both domestic law enforcement and international intelligence agencies, strengthens criminal laws against terrorism, enhances intelligence, and combats money laundering.

While the Patriot Act is intended to target and prevent terrorism, its enforcement presents unique issues for employers. For example, Title II of the Patriot Act enhances the government's ability to conduct surveillance in the workplace, and Title III targets money laundering by financial institutions.

Title II of the Patriot Act coordinates intelligence gathering and the collection of evidence for criminal proceedings, and expands the government's ability to utilize wiretaps and computer surveillance. It also grants the government greater access to medical, financial, business, and educational records and authorizes secret searches of homes and offices.

To comply with these new requirements, many employers must implement new procedures while simultaneously balancing the privacy interests of their employees and customers with the government's requests for information. An employer that is classified as a financial institution must report suspicious financial transactions. The employer must keep records of foreign national employees in strict compliance with federal immigration statutes and regulations, but of equal importance, must ensure that its workplace remains free from unlawful discrimination based upon race, religion, or national origin.

The Electronic Communications Privacy Act (ECPA) has been substantially amended by the Patriot Act regarding the surveillance tools available to the government, making it easier to compel disclosure of electronic communications that were formerly protected by federal privacy laws. For instance, the government can now obtain the content of stored voice-mail messages merely upon the issuance of a search warrant without having to obtain a Title III wiretap order. Now, telecommunications providers can be compelled to disclose their customers' credit card or bank account numbers. This poses privacy concerns for the employer's customers and employees.

The enhanced surveillance capability now allows the government to monitor anyone who surfs the Web by merely asserting that this information is "relevant" to an ongoing criminal investigation. The government can utilize pen registers and trap-and-trace devices to obtain the non-content portion of an individual's communication, such as the source and addressee information, telephone conversations, Internet communications, and other computer networks, so long as the government's counsel certifies to the court that the information sought is "likely to be relevant to an ongoing criminal investigation." Although this amendment makes the ability to obtain a pen/trap authority "technology neutral," it still ensures that only the noncontent portion of the communication may be retrieved. Once the government obtains this pen/trap ex parte order, it may be executed anywhere in the U.S. If an employer is served with this order and is not a party, the employer may request certification from the government attorney stating that the order applies to its business.

The Patriot Act allows owners or operators of information (Internet) service provider systems to authorize federal law enforcement to investigate computer trespass, since a trespasser has no reasonable expectation of privacy in any communication transmitted to, through, or from the protected computer. The "computer trespasser" definition does not apply to legitimate subscribers of Internet services.

The Patriot Act authorizes the use of search warrants to obtain the contents of unopened electronic mail that has been in storage for 180 days or less. Similarly, the Act allows the government to access the contents of wireless communications that are stored in remote computing services for more than 180 days, without giving notice to the subscriber or customer. Again, this type of search warrant is valid anywhere in the U.S.

Armed with a search warrant, the government can seize stored voice-mail messages that were transmitted via computer. Consequently, this provision overrules U.S. v. Smith, 155 F.3d 1051 (9th Cir. 1998), cert. denied, 119 S. Ct. 804 (1999), which held that the government must apply for a Title III warrant before gaining access to unopened voice-mail messages, but not e-mail messages, held by a service provider.

Finally, the "emergency situation exception," a telecommunications service provider can voluntarily reveal the content of stored e-mail if it has a reasonable belief that an emergency situation exists that poses immediate danger of "death or serious physical injury to any person." This section also enables telecommunications service providers to disclose the non-content portion of a customer's records, including the user's login records, in order to safeguard its computer systems. The telecommunications service provider is not liable for disclosing this information if it is based on a reasonable belief that an emergency exists.

The amendments to the Foreign International Surveillance Act (FISA) expand the surveillance capabilities of the government for the purposes of foreign intelligence and international terrorism investigations. Investigations under FISA are not constrained by the Fourth Amendment because they are governed by a lesser standard. Under a FISA surveillance or physical search warrant, the government may conduct real-time interception of noncontent information merely by certifying that the gathering of foreign intelligence represents "a significant purpose" for the request. A FISA court can authorize a "roving" wiretap to intercept all of a suspect's wire or electronic communications so long as the information is relevant to an ongoing criminal investigation, regardless of the location where the suspect has initiated the communication. For instance, if an employer has an employee who is suspected of terrorist activity, the government may monitor all of the employee's communications at the employer's offices without disclosing the surveillance to the employer. The roving wiretap applies to both voice and electronic mail communications. Furthermore, the roving wiretap reduces the traditional common-law "particularity" requirements of the Warrant Clause of the Fourth Amendment by enabling the government to obtain warrants with a less stringent evidentiary showing.

The Patriot Act grants the same authority to utilize pen register and trap-and-trace authority under FISA as it does for the ECPA's surveillance requirements by requiring that the government certify that the information it is seeking is relevant to an ongoing terrorist investigation. A FISA court order, however, does not permit the collection of foreign intelligence for an investigation involving a U.S. national or surveillance where the individual has been targeted for investigation "solely upon the basis of" First Amendment activities.

The Patriot Act's amendments to FISA also significantly expand the government's ability to gain access to certain business records and other items for the purposes of foreign intelligence and international terrorism investigations. Prior to the enactment of the Patriot Act, only certain businesses were required to produce business records upon the government's request. The Patriot Act removes this limitation and covers instead "any person." Thus, Internet service providers and banks are now required to disclose records to the FBI. The FBI can apply for a court order to gain access to "any tangible things," including books, records, papers, documents, and other items, for an investigation related to international terrorism or clandestine intelligence activities. The target of the investigation may be a citizen of the United States, but such investigation may not be conducted solely upon the basis of activities protected by the First Amendment. The phrase "any tangible things" includes not only business records but also the computer servers on which the information is stored. The FBI can access the records it seeks pursuant to an ex parte order under FISA. In its petition for the order, the FBI must state that the records sought relate to an investigation aimed at preventing international terrorism or clandestine intelligence activities by a foreign power. An employer qualifies for immunity if the disclosure was made in good faith. Its application could be very broad and is subject to limitation only from the specific court from which the FBI sought its FISA order. However, employers cannot reveal to the targeted employee the fact that the FBI is seeking the information.

The Patriot Act does not impose any additional requirements on employers of foreign nationals. However, both the employees and their employer should take adequate steps to ensure compliance with applicable immigration statutes and regulations. Employers of foreign nationals should have an accurate system in place that monitors the terms of the employment visas for the employees. In particular, all documentation in the employee's file (including the H-1B status) must comply with Department of Labor regulations. Employers should ensure that the application processes for extensions or petitions are filed six months prior to the expiration date of the employee's status because they face possible delays in obtaining proper INS processing and FBI background clearances.

As a result of the current economy, many employers have been forced to reduce their workforce. If foreign nationals are part of an employer's reduction in force, the employer should seek assistance from an immigration attorney to protect not only the employer but also the national's work status.

Finally, employers should ensure that their employees who are foreign nationals carry proper identification and evidence of a valid non-immigrant status (e.g., I-94 Arrival/Departure Record and work authorization document) at all times and should also maintain copies of all their immigration documents to prove that they may legally work in the United States.

The Patriot Act condemns discrimination against Arab and Muslim Americans and Americans from South Asia on the basis of religious, ethnic, or racial background. However, the Patriot Act does not provide additional statutory protections against discrimination. Employers should review their anti-discrimination policies to ensure that they have effective procedures to address potential discrimination aimed at members of their diverse workforce. Patriotism is not a defense against a claim of discrimination.

In complying with a governmental request for information, employers must be mindful not to reveal confidential employee information to any non-governmental third parties because any such disclosure could result in potential civil liability.

When approached by the government with a request for production of certain information, employers may either (1) voluntarily cooperate with law enforcement by providing, upon request (as part of an ongoing investigation), confidential employee information, (2) choose not to cooperate and ask instead for permission to seek employee authorization to release the requested information, or (3) request to receive a subpoena, search warrant, or FISA order from the federal agency before disclosing an employee's confidential information.

Employers may also want to consider including a disclaimer in their personnel policies stating that the Patriot Act may require the disclosure of confidential employee information to federal agencies that are authorized to obtain said information.

Potentially substantial new obligations are imposed upon employers as a result of the Patriot Act. Counsel should familiarize itself with the new law.