U.S. used Patriot Act to gather website visitor logs

WASHINGTON — The government has interpreted a high-profile provision of the Patriot Act as empowering FBI national-security investigators to collect logs showing who has visited particular webpages, documents show.

But the government stops short of using that law to collect the keywords that people submit to search engines because it considers such terms to be content that requires a warrant to gather, according to letters produced by the Office of the Director of National Intelligence.

The disclosures come at a time when Congress is struggling with new proposals to limit the law, known as Section 215 of the Patriot Act. The debate is expected to resume after President-elect Joe Biden takes the oath of office in January.

Enacted after the Sept. 11, 2001, terrorist attacks, Section 215 of the Patriot Act permits the FBI to obtain a secret court order to collect any business records deemed relevant to a national security inquiry. The legal authority for it and two other surveillance-related investigative tools lapsed for new inquiries earlier this year, although the FBI can still use them for preexisting cases.

In May, 59 senators voted to bar the use of Section 215 to collect internet search terms or web-browsing activity, but negotiations broke down in the House. During that period, Sen. Ron Wyden, D-Ore., one of the sponsors of the proposal ban, wrote to the director of national intelligence seeking clarity about such use.

Six months later, the Trump administration replied.

In a Nov. 6 letter to Wyden, John Ratcliffe, the intelligence director, wrote that Section 215 was not used to gather internet search terms and that none of the 61 orders issued last year under that law by the Foreign Intelligence Surveillance Court involved collection of “web browsing” records.

But the Times pressed Ratcliffe’s office and the FBI to clarify whether it was defining “web browsing” activity to encompass logging all visitors to a particular website, in addition to a particular person’s browsing among different sites. The next day, the Justice Department sent a clarification to Ratcliffe’s office, according to a letter he sent to Wyden on Nov. 25.

In fact, “one of those 61 orders resulted in the production of information that could be characterized as information regarding browsing,” Ratcliffe wrote in the second letter. One order had approved collection of logs revealing which computers “in a specified foreign country” had visited “a single, identified U.S. web page.”