What Was the Patriot Act? Surveillance Powers and Legacy

The Patriot Act was a sweeping federal law, signed by President George W. Bush on October 26, 2001, that expanded the U.S. government’s surveillance, financial monitoring, intelligence-sharing, and immigration enforcement powers in response to the September 11 attacks. Congress passed it just six weeks after the attacks on the World Trade Center and the Pentagon. Several of its most aggressive surveillance tools have since expired, but its anti-money laundering rules, national security letter authority, and intelligence-sharing framework remain in force today.

How the Law Changed Surveillance

Most of the public debate over the Patriot Act has focused on Title II, which rewrote the rules for how federal investigators can watch people, search property, and demand records.

Roving Wiretaps

Before 2001, a surveillance warrant typically attached to a specific phone line or computer. If a target switched devices, investigators had to return to court. The Patriot Act authorized roving wiretaps for national security cases, letting the warrant follow the person instead of the device. Criminal investigators had used the same technique for drug and racketeering cases since 1986. Under the new authority, a roving wiretap could only be issued after the Foreign Intelligence Surveillance Court found that the target’s behavior, such as frequently swapping phones, was likely to defeat device-specific surveillance. This power expired on March 15, 2020, and Congress has not reauthorized it.

Delayed-Notice (“Sneak and Peek”) Search Warrants

The act also created a statutory basis for search warrants that let officers enter and search a property without immediately telling the owner. Under 18 U.S.C. § 3103a, a court can authorize delayed notice if immediate notification could lead to evidence destruction, flight of a suspect, witness intimidation, or serious jeopardy to an investigation. The 2001 version required notice within a “reasonable period” but set no hard deadline. The 2005 reauthorization tightened that window to 30 days after the search, with extensions of up to 90 days for good cause.¹ These warrants were never subject to a sunset provision and remain available.

Section 215 Business Records

Section 215, codified at 50 U.S.C. § 1861, was probably the most contested piece of the law. It allowed the FBI to apply to the FISA court for an order compelling any business to hand over “tangible things,” including books, records, papers, and documents, on a showing that the material was relevant to an authorized foreign intelligence or international terrorism investigation.² That standard was a sharp departure from traditional probable cause. The government did not need to suspect the records’ owner of any wrongdoing. Libraries, internet service providers, medical facilities, and phone companies all fell within reach. Recipients of a Section 215 order were barred, indefinitely under the original statute, from telling anyone about it.

National Security Letters

National Security Letters cover similar ground but require no court approval at all. Under 18 U.S.C. § 2709, the FBI Director or a senior designee can issue an NSL directly to a phone or internet service provider, compelling it to turn over subscriber information, billing records, and electronic communication transaction records.³ The only prerequisite is a written certification that the information is relevant to an authorized investigation protecting against international terrorism or clandestine intelligence activities.

NSLs carry a gag order if the FBI certifies that disclosure could endanger national security, interfere with an investigation, harm diplomatic relations, or threaten someone’s safety. Recipients can challenge the letter and the gag in federal court under 18 U.S.C. § 3511. If a recipient seeks review of the nondisclosure requirement, the government must apply within 30 days for an order maintaining the gag, and the court can sustain it only on a finding of good reason to believe disclosure would cause one of the specified harms.³ NSL authority was never subject to a sunset and remains active.

The Bulk Metadata Program and Its Rollback

In June 2013, former NSA contractor Edward Snowden leaked classified documents showing that the government had used Section 215 to justify collecting phone call metadata on virtually every American. Phone companies handed over records of who called whom, when, and for how long, though not the content of the calls. The scale prompted lawsuits arguing that “relevant to an investigation” could not stretch to billions of records from people with no link to terrorism.

Congress answered in 2015 with the USA FREEDOM Act, which banned bulk collection under Section 215 and replaced it with a more targeted process. Phone records stayed with the carriers, and the government had to obtain individual FISA court orders to query them. Each query required “reasonable, articulable suspicion” that the search term was tied to an approved international terrorist organization, and results were limited to two degrees of separation from that term instead of three.⁴

Even the reformed version did not last. Section 215 expired on March 15, 2020, and Congress has not renewed it. The FBI has confirmed that it has not used the authority for any investigation opened after that date.⁵

Anti-Money Laundering and Bank Reporting Rules

Title III of the act, formally the International Money Laundering Abatement and Financial Anti-Terrorism Act of 2001, rewrote the compliance rules for banks and other financial institutions. None of it was subject to a sunset. These provisions now form the backbone of modern anti-money laundering compliance.

Section 326 directed the Treasury Department to require every bank to maintain a Customer Identification Program. Banks must collect at minimum a customer’s name, date of birth, address, and an identification number such as a Social Security number or passport number before opening any account.⁶ The goal was to shut down anonymous movement of money through the U.S. banking system.

Banks must also file Suspicious Activity Reports when they spot transactions that lack an apparent lawful purpose. The reporting threshold applies to transactions of $5,000 or more where the bank knows or suspects the activity involves money laundering, Bank Secrecy Act violations, or transactions with no reasonable business explanation.⁷

Financial institutions that willfully violate Bank Secrecy Act reporting or recordkeeping rules face civil penalties of up to the greater of $25,000 or the amount involved in the transaction, capped at $100,000 per violation. A separate violation accrues for each day the noncompliance continues and at each branch where it occurs, so total exposure for a large bank can grow quickly.⁸

Breaking Down the Wall Between Agencies

Before 2001, a legal wall separated criminal investigations from foreign intelligence work. An FBI agent working a criminal case could not simply hand evidence to a CIA analyst on a national security matter, and the reverse was also blocked. The Patriot Act removed that barrier. Federal agents could share information collected through grand jury proceedings and wiretaps with intelligence officers without first getting a court’s permission.⁹

The law also amended the Foreign Intelligence Surveillance Act so that intelligence-gathering techniques could be used even when foreign intelligence was not the sole purpose of the investigation. Previously, FISA tools were off-limits if the primary goal was criminal prosecution. After the act, information gathered through FISA-authorized surveillance could be passed to prosecutors for use in court. This change reflected one of the central lessons of the September 11 investigations: agencies had pieces of a larger picture and no legal mechanism to assemble them.

Immigration Detention Powers

Title IV expanded the government’s ability to detain and deport noncitizens. Under 8 U.S.C. § 1226a, the Attorney General can certify a noncitizen for mandatory detention on reasonable grounds to believe the person is involved in terrorism or activity that endangers national security. Once certified, the person must be placed in removal proceedings or charged with a criminal offense within seven days, or the government must release them.¹⁰

If the person cannot actually be deported within a reasonable time, detention can continue in additional six-month increments, but only if the Attorney General finds that release would threaten national security or community safety. The certification must be reviewed every six months, and the detained person can submit written requests for reconsideration with supporting evidence.¹⁰ The authority is still on the books, though the government has rarely invoked it.

What Expired and What Still Applies

Congress built sunset dates into several of the most aggressive surveillance tools, forcing future lawmakers to affirmatively renew them. Three provisions expired on March 15, 2020, and have not been renewed:

Section 215 business records authority, so the FBI can no longer compel production of tangible things from businesses under this power for new investigations.⁵
Section 206 roving wiretaps under FISA, ending the authority to follow a surveillance target across devices.
The “lone wolf” provision, which allowed FISA surveillance of non-U.S. persons engaged in international terrorism without a connection to a specific foreign power or terrorist group.

Several major components remain fully in effect because they were never subject to sunset clauses:

Delayed-notice search warrants under 18 U.S.C. § 3103a, with the 30-day notification deadline and 90-day extensions added in 2005.¹
Title III anti-money laundering rules, including Customer Identification Programs and Suspicious Activity Report requirements, which continue to govern every financial institution in the country.
National Security Letters under 18 U.S.C. § 2709.³
The intelligence-sharing provisions that removed the wall between the FBI and CIA.
Immigration detention authority under 8 U.S.C. § 1226a.

Two decades on, the Patriot Act is best understood as a mixed inheritance. The most visible surveillance tools have lapsed, but the financial reporting architecture it built now runs quietly through every bank account opened in the United States, and the intelligence-sharing changes it made are permanent features of how federal law enforcement operates.

1
Office of the Law Revision Counsel. 18 U.S.C. 3103a – Additional Grounds for Issuing Warrant
2
Office of the Law Revision Counsel. 50 U.S.C. 1861 – Access to Certain Business Records for Foreign Intelligence Purposes
3
Office of the Law Revision Counsel. 18 U.S. Code 2709 – Counterintelligence Access to Telephone Toll and Transactional Records
4
Department of Justice. Joint Statement on the Declassification of Collection Under Section 215 as Amended by the USA Freedom Act
5
Department of Justice. Congressional Response on Section 215 Sunset
6
eCFR. 31 CFR 1020.220 – Customer Identification Program Requirements for Banks
7
FFIEC BSA/AML Examination Manual. 12 CFR 353 – Suspicious Activity Reports
8
Office of the Law Revision Counsel. 31 U.S. Code 5321 – Civil Penalties
9
Congress.gov. USA PATRIOT Act of 2001
10
Office of the Law Revision Counsel. 8 U.S.C. 1226a – Mandatory Detention of Suspected Terrorists