Banks up customer surveillance

Stuart Laidlaw has a very interesting article on customer surveillance at Canadian banks and the impact of the USA Patriot Act on their vigilance: TheStar.com - Banks up customer surveillance.

Federal Government secrets may be vulnerable to Patriot Act

Today's Vancouver Sun has a lengthy article that reports officials in the federal government are concerned about the security and privacy of information that is handled by American contractors or subsidiaries of US companies. The article is interested, but does not suggest what the federal government is considering doing in reponse:

U.S. law 'threatens Canada's secrets'

OTTAWA -- Highly sensitive personal, military and national security information held by the Canadian government is accessible to U.S. authorities under the Patriot Act, according to a document obtained Friday.

A team of Canadian government lawyers studied the vulnerability of top-secret data after a controversy broke out in B.C. earlier this year over whether British Columbians' personal medical records were being put at risk due to the provincial government's plan to contract out services to a U.S.-owned firm.

The federal lawyers agreed with B.C. privacy commissioner David Loukidelis that the Patriot Act, enacted after the 2001 terrorist attacks in New York, gives the U.S. government enormous ability to probe into the databases of American companies that do business with Canadian governments.

"Their preliminary findings indicate that the Federal Bureau of Investigation could require an American corporation under the U.S. Patriot Act to disclose information under its control, including information held by its Canadian subsidiaries," wrote Mark Seely, an official with Public Works and Government Services Canada, in a July 22, 2004 e-mail to more than two dozen Public Works officials....

Alberta Commissioner to conduct his own "PATRIOT ACT" outsourcing inquiry

The Alberta Information and Privacy Commissioner, Frank Work, announced that his office will be working jointly with the Government of Alberta to examine the implications of public sector outsourcing for the personal information of Albertans. The news release can be found here.

Outsourcing of Canadian student loans process to US results in complaint to the Privacy Commissioner

This is the first week that I've thought it would be easier to blog about who isn't complaining to the Office of the Privacy Commissioner ...

A Vancouver man is taking his complaint about foreign outsourcing of studen loans to the Privacy Commissioner, according to the Georgia Straight:

Straight.com: Student-Debt Activist Seeks Privacy Probe:

"A Vancouver man has asked the federal privacy commissioner to investigate the outsourcing of Canada student loans to a U.S.-owned company. Mark O'Meara, founder of the www.canadastudentdebt.ca/ Web site, claimed that as a result of a recent corporate takeover, Nebraska-based Nelnet has access to all federal student debtors' personal information and financial data.

On December 6, Nelnet announced that its wholly owned Canadian subsidiary had completed its purchase of a CIBC subsidiary, Edulinx Canada Corp., which administers the Canada Student Loans Program on behalf of the federal government. According to Human Resources and Skills Development Canada, more than 1.8 million students have borrowed approximately $15.6 billion through the Canada Student Loans Program since 1993.

In an e-mail to the Straight, O'Meara stated that the federal privacy commissioner should examine whether student-loan data is now subject to the USA PATRIOT Act (Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism). Under Section 215 of the act, the FBI is permitted to obtain secret court orders to obtain "any tangible things".

On October 29, provincial Information and Privacy Commissioner David Loukidelis released a report concluding that there is a "reasonable possibility" of unauthorized disclosure of personal information under the USA PATRIOT Act. He issued numerous recommendations to mitigate this risk.

O'Meara claimed that the federal privacy commissioner's office never responded to his e-mail asking for an investigation. Federal Privacy Commissioner Jennifer Stoddart also did not respond to the Straight's request for an interview by deadline.

Nelnet's Nebraska-based spokesperson, Ben Kiser, told the Straight that nothing will change for students and borrowers as a result of the change in ownership. "Edulinx will remain a Canadian firm with operations in Canada," he said. "That means all processing, call-centre, data-storage, records-storage, and other student-loan functions will continue to take place exclusively in Canada."

Last August, however, the American Civil Liberties Union filed a submission to Loukidelis claiming that the FBI could obtain personal records stored by a subsidiary of a U.S. corporation operating in another country. In one instance, a U.S. grand jury subpoenaed a foreign-bank employee while he was on U.S. soil. In a separate submission filed by the B.C. Government and Service Employees' Union, ACLU lawyer Jameel Jaffer claimed that the USA PATRIOT Act could enable the FBI to obtain entire databases of personal records without notifying anyone."

Canadian draft guidelines to shield personal information from the USA Patriot Act

The Canadian Press just released a story about new draft guidelines for Canadian federal government departments designed to (at least try to) shield information about Canadians from the reach of the USA Patriot Act. The guidelines remain in draft form as the election has intervened to prevent them from being tabled in Parliament this fall and more internal consultations are taking place.

Canada drafts proposals to shield personal data from U.S. anti-terror law - Yahoo! News

... The draft guidance document suggests, in the interest of upholding Canadian privacy laws, that federal databases of sensitive personal information created by contractors be located in Canada and be accessible only within the country.

However, it recognizes international trade obligations may make this impossible. In such cases, the government suggests contractors must agree to respect Canadian privacy laws as a condition of contract.

The guidelines say that if the privacy risk is considered high, a federal department might go so far as to cut off the flow of personal information to a foreign firm should it be "presented with an order" - such as an FBI notice - compelling release of data about Canadians.

In general, the guidelines encourage departments to assess each potential contract case-by-case to gauge the possibility of privacy invasion, the expectations of Canadians, and likelihood of injury to a person's "career, reputation, financial position, safety, health or well-being."

Treasury Board spokesman Robert Makichuk said the draft guidelines were undergoing revision following internal federal consultations....

UWO pension and the USA Patriot Act

According to an item on the Western News, the University of Western Ontario is entering into an arrangement to have a US-based company administer the faculty pension. That has made at least one person unhappy that Canadian faculty info will be within the reach of the USA Patriot Act.

Communications and Public Affairs

Senator member Mike Carroll wants written assurance faculty pension information will never be turned over to secret U.S.intelligence courts. But he isn't holding his breath.

So why be concerned if you're not a terrorist?

...

The statement seems to be saying that they might well transmit our pension data across international boundaries - and this of course would in itself bring such data within reach of the Patriot Act

Ok, but so what? No terrorists here, right? Why worry? Actually, for several reasons. U.S. FIS courts operate in secrecy with little or no oversight (it's a crime to reveal an action of this court and a felony not to comply with an order to turn over records). As any number of academic bodies in the U.S. (including a number of academic Senates just a tad more activist than ours) have suggested, the wide-ranging authority granted under the Patriot Act poses a threat to civil liberties and creates a climate of fear that undermines academic freedom. In addition, the combination of such wide ranging-power with strict secrecy means that mistakes affecting ordinary (and innocent) people are easy to make and hard to correct (think Ted Kennedy and the "no fly" list).

U.S. academics have no choice at the moment. They are subject to the Patriot Act. But it seems to me entirely inappropriate that the Western Administration should so casually enter into an institutional arrangement that likely puts our personal data within reach of U.S. courts acting under the authority of that Act. At Senate tomorrow, I will be asking the Administration to seek explicit written assurances from Buck Consultants Canada that they will not be shipping our data across international boundaries and would not comply with a FIS court order to turn over data.

Simple. questions that should have straightforward answers. Anyone want to bet we'll ever see those answers? I personally think it unlikely, unless of course someone in SLB decides it might improve our grade on the Globe and Mail scorecard.

Round two of labour-sponsored privacy campaign against BC government to begin

Labour groups are once again attacking the government of British Columbia for outsourcing public services that involve personal information. This second campaign comes after its high-profile attempt to derail the outsourcing of the province's medicare administration (See BCGEU's privacy campaign). While that campaign did not dissuade the Campbell government from its plans (BC announces medical privatization plan), it did lead to a significant inquiry by the province's Information and Privacy Commissioner. Now under attack is the province's plan to outsource bill collection:

B.C. opens private bank and credit data to U.S. scrutiny: "B.C. opens private bank and credit data to U.S. scrutiny

New privatization deal means U.S. authorities will have access to bank account and credit card numbers, property records, income and driver's licence information on B.C. residents

Vancouver - The B.C. Government and Services Employees' Union (BCGEU/NUPGE) plans to launch a new campaign this week warning residents that the Liberal government of B.C. Premier Gordon Campbell is making highly personal data vulnerable to American scrutiny through outsourcing and privatization.

The latest information to be placed in the hands of private American companies involves a wide range of information on most B.C. residents, including bank account and credit card numbers, property records, income and driver's licence information.

The province announced a $572-million ($483-million US) deal Friday with Electronic Data Systems (EDS) of Plano, Texas, to take over much of its bill collection activity. The 10-year deal comes with barely six months remaining in the Liberals' current mandate.

The province argues that privacy provisions contained in the contract will safeguard personal information but the union says the government is misleading citizens because it is already known that the contract will not withstand the overriding and intrusive powers available to American authorities under the U.S. Patriot Act.

The Patriot Act was passed by Congress and signed into law by President George Bush following the Sept. 11, 2001 terrorist attacks on New York and Washington.

The deal is even worse than a recent 10-year, $324-million contract signed with U.S.-based Maximus Inc. to privatize the processing of the medical claims of B.C. residents.

Privacy commissioner ignored

Once again, the province has ignored concerns raised by its own information and privacy commissioner, putting private sector ideological interests ahead of those of its own people, the BCGEU says.

Essentially, the latest contract means that intensely personal information on most British Columbians will be exposed to potential scrutiny by the FBI and other U.S. government agencies, the union warns.

"It’s another example of the Liberals bullying ahead without heeding the warnings of privacy commissioner David Loukidelis issues raised by the privatizing of records management, says BCGEU president George Heyman.

Loukidelis said the U.S. Patriot Act creates a real risk that personal information, once placed in the hands of private companies with U.S. links, will be open to scrutiny by the FBI and other American agencies. He recommended a series of measures to protect the privacy of British Columbians.

Heyman says Premier Campbell has failed to take the necessary range of measures recommended by the commissioner.

Patriot Act applies

"The fact is that the Patriot Act applies. EDS is an American company, and all the records in its possession are exposed," Heyman says.

"The Campbell government is clearly misleading the public and betraying the promise they made to British Columbians that real protections would be in place before any contracts were signed."

A long list of personal data at risk, Heyman warns..

"It includes everything from credit card and bank account numbers, personal property and asset details, individual and family income, and drivers license, vehicle and insurance information. It’s pretty serious stuff that British Columbians wouldn’t want to share with the Bush government," he says.

Meanwhile, the BCGEU leader said full details on his union's latest campaign to warn residents will be announced this week. The union is also continuing efforts to mount a legal challenge to the government.

The union says privacy guarantees written into the contract by EDS and the province will be overridden by the all-intrusive federal powers of the U.S. Privacy Act.

NUPGE

NYTimes editorial on Google and privacy

Google has been the target of a number of privacy critics, most likely because of the huge amount of information it is privy to and the lack of transparency about how much of it is kept in a personally identifiable state and for how long. An editorial in today's New York Times calls for a "privacy upgrade" at Google.

Here's a snippet:

What Google Should Roll Out Next: A Privacy Upgrade - New York Times:

The biggest area where Google's principles are likely to conflict is privacy. Google has been aggressive about collecting information about its users' activities online. It stores their search data, possibly forever, and puts "cookies" on their computers that make it possible to track those searches in a personally identifiable way - cookies that do not expire until 2038. Its e-mail system, Gmail, scans the content of e-mail messages so relevant ads can be posted. Google's written privacy policy reserves the right to pool what it learns about users from their searches with what it learns from their e-mail messages, though Google says it won't do so. It also warns that users' personal information may be processed on computers located in other countries.

The government can gain access to Google's data storehouse simply by presenting a valid warrant or subpoena. Under the Patriot Act, Google may not be able to tell users when it hands over their searches or e-mail messages. If the federal government announced plans to directly collect the sort of data Google does, there would be an uproar - in fact there was in 2003, when the Pentagon announced its Total Information Awareness program, which was quickly shut down.

In the early days of the Internet, privacy advocates argued that data should be collected on individuals only if they affirmatively agreed. But businesses like Google have largely succeeded in reversing the presumption. There is a privacy policy on the site, but many people don't read privacy policies. It is hard to believe most Google users know they have a cookie that expires in 2038, or have thought much about the government's ability to read their search history and stored e-mail messages without them knowing it.

Google says it needs the data it keeps to improve its technology, but it is doubtful it needs so much personally identifiable information. Of course, this sort of data is enormously valuable for marketing. The whole idea of "Don't be evil," though, is resisting lucrative business opportunities when they are wrong. Google should develop an overarching privacy theory that is as bold as its mission to make the world's information accessible - one that can become a model for the online world. Google is not necessarily worse than other Internet companies when it comes to privacy. But it should be doing better.

BC outsourcing fight not over yet

The BC union that kicked off the Canadian debate over privacy, outsourcing and the USA Patriot Act has taken their arguments to court, according to ITBusiness. The article doesn't really say what the legal basis of their attempt to derail the government's ousourcing plans are, particularly after the government amended the public sector privacy law:

ITBusiness.ca:

"The British Columbia Government and Service Employees' Union on Wednesday ended the third and final day of a Supreme Court case to block the outsourcing of its Medical Services Plan database management to a U.S. firm.

Union lawyers told the court that privatization of the Medical Services Plan (MSP) would violate the Canada Health Act and potentially jeopardize the privacy of patient data. The province has already signed a $324-million with Reston, Virginia-based Maximus Inc., which will deliver its services through two new Canadian subsidiaries, Maximus BC Health Inc. and Maximus BC Health Benefit Operations Inc. The BCGEU has asked for an injunction that would prevent the partnership from moving ahead until the broader issues in the case can be resolved. The Supreme Court had not made a decision at press time...."

Commissioner to investigate Alberta personal information leak

The Information and Privacy Commissioner of Alberta, Frank Work, will investigate the incident in which sensitive personal information of senior civil servants was found at a crime scene in Edmonton. (See: PIPEDA and Canadian Privacy Law: Incident: Massive leak of personal information in Edmonton, Alberta.)

The Calgary Sun: Province to probe credit leak:

"EDMONTON -- Alberta's privacy commissioner plans today to launch a top-to-bottom investigation into the leak of private staff credit files to a possible identity fraud ring. Frank Work said he'll try to find out if civil servants whose files were compromised will face grilling by U.S. security officials if they try to cross the border.

'Anything's possible,' Work said yesterday.

... The files were collected by Trans Union, a U.S.-based multinational credit-check firm.

...

In a letter to the Sun, senior government staffers voiced the fear that Trans Union might be compelled under the Patriot Act to report the stolen SIN numbers to the U.S. Department of Homeland Security, which could make it difficult for them to travel in the U.S.... "

The Privacy Lawyer: Privacy Policies And The Patriot Act

Parry Aftab's November 8, 2004 column in Information Week is an interesting week. She dicusses the challenges now faced by organizations if they are served with a Patriot Act "National Security Letter" to hand over customer information. Because the validity of these instruments are in question, an organization can be stuck between a rock and a hard place if they are legally restricted from handing over the info or if they have promised not to in their privacy policies, subject to a lawful request.

The Privacy Lawyer: Privacy Policies And The Patriot Act
"...In the meantime, businesses are well advised to review all governmental requests and their reaction to such requests. Once again, if your privacy policy (especially those of telecommunications or Internet-related providers) provides that you will not share personal information about subscribers except through valid legal process (for which they will receive notice, except to the extent prohibited by law) or otherwise in accordance with your privacy policy, the law prohibiting your informing them of any inquiry is key. If the decision is not overturned, you may not be able to rely on the Patriot Act to protect you if you don't inform your subscribers of a governmental inquiry. Make sure your counsel understands the laws and your policies and can guide you when government or anyone else comes knocking."

All organizations that are presented with an official looking document need to consult counsel because the document may be flawed or it may be based on unconstitutional legislation. Simply believing it is valid might not cut it.

Libraries should read the related posting in the LibraryLawBlog.

National Security Letters under the microscope

The Washtington Post has a very long and equally interesting article on "national security letters", a new tool given to the FBI under the USA Patriot Act. Their use is growing quickly and, as importantly, the FBI is putting all information gleaned by this mechanism into large databases. Thanks to Daniel Solove at Concurring Opinions for pointing to this article:

The FBI's Secret Scrutiny

The FBI now issues more than 30,000 national security letters a year, according to government sources, a hundredfold increase over historic norms. The letters -- one of which can be used to sweep up the records of many people -- are extending the bureau's reach as never before into the telephone calls, correspondence and financial lives of ordinary Americans.

Issued by FBI field supervisors, national security letters do not need the imprimatur of a prosecutor, grand jury or judge. They receive no review after the fact by the Justice Department or Congress. The executive branch maintains only statistics, which are incomplete and confined to classified reports. The Bush administration defeated legislation and a lawsuit to require a public accounting, and has offered no example in which the use of a national security letter helped disrupt a terrorist plot.

The burgeoning use of national security letters coincides with an unannounced decision to deposit all the information they yield into government data banks -- and to share those private records widely, in the federal government and beyond. In late 2003, the Bush administration reversed a long-standing policy requiring agents to destroy their files on innocent American citizens, companies and residents when investigations closed. Late last month, President Bush signed Executive Order 13388, expanding access to those files for "state, local and tribal" governments and for "appropriate private sector entities," which are not defined.

National security letters offer a case study of the impact of the Patriot Act outside the spotlight of political debate. Drafted in haste after the Sept. 11, 2001, attacks, the law's 132 pages wrought scores of changes in the landscape of intelligence and law enforcement. Many received far more attention than the amendments to a seemingly pedestrian power to review "transactional records." But few if any other provisions touch as many ordinary Americans without their knowledge.

Senior FBI officials acknowledged in interviews that the proliferation of national security letters results primarily from the bureau's new authority to collect intimate facts about people who are not suspected of any wrongdoing. Criticized for failure to detect the Sept. 11 plot, the bureau now casts a much wider net, using national security letters to generate leads as well as to pursue them. Casual or unwitting contact with a suspect -- a single telephone call, for example -- may attract the attention of investigators and subject a person to scrutiny about which he never learns.

BC announces medical privatization plan

Over the protests of public sector unions and privacy advocates, the government of British Columbia has formally announced that it is outsourcing the processing of medicare claims to a US-based company, Maximus. The prospect of this happening led to complaints by the BC Government and Service Employees Union to file a complaint to the province's Information and Privacy Commissioner, prompting the Commissioner's investigation into the impact of outsourcing and the USA Patiot Act on the privacy of British Columbians (see BC Privacy Watchdog Seeks US Government, FBI Input in Patriot Act). For more info on the recent outsourcing announcement, see:

CNEWS - Politics: B.C. announces medical privatization plan:

"...Maximus, Inc., a U.S.-based firm, has been given a 10-year contract worth $324 million, the government announced Thursday. The company also has a five-year renewal option...."

BC Privacy Commissioner's report leads to questions in Australia

The recent report by the BC Privacy Commissioner on privacy and outsourcing to US-controlled companies has led to questions in Australia:

Australian IT - US law raises privacy worries :

"THE South Australian Government has promised to review the access of US outsourcer Electronic Data Systems to information on citizens in the wake of a Canadian government report finding a 'reasonable possibility' of unathorised disclosure by US outsourcers to US government agencies.

A spokesman for Administrative Services Minister Michael Wright, who oversees the EDS whole-of-government outsourcing contract, said the the Government was 'taking the issue seriously'.... "

As alluded to above, much Australian government data processing is done by EDS. A related story, from Yahoo News, includes a statement from EDS that there has been no disclosure of Austrialian personal information to US authorities under the USA PATRIOT Act:

EDS denies breaching Privacy Act

"... The company's managing director Chris Mitchell says EDS is a corporate citizen and it complies with the Privacy Act of Australia.

"The US Government would have to talk to the Australian Government about superseding the laws of the land, that's all I can say," he said.

Mr Mitchell says the data for the Federal Government's accounts are dealt with in Australia and some other clients' data is processed offshore, but only with their agreement...."

Release: President of the Treasury Board responds to BC cross-border privacy report

The following was released by the President of the Treasury Board, Reg Alcock, on Friday, October 29, 2004:

Statement by Reg Alcock, President of the Treasury Board, in response to the report issued by the Information and Privacy Commissioner for British Columbia:

"For immediate release
October 29, 2004

Ottawa - Reg Alcock, President of the Treasury Board issued the following statement today in response to the report issued by the Information and Privacy Commissioner for British Columbia on Privacy and the USA Patriot Act:

"The Government of Canada is currently reviewing the report released today by the Information and Privacy Commissioner for British Columbia on Privacy and the USA Patriot Act. We are committed to doing everything we can to protect the privacy of Canadians with respect to key federal personal and sensitive information holdings. The Government will continue to work closely with the federal Privacy Commissioner, provincial governments and the private sector to protect the security and privacy of Canadians and the interests of Canadian businesses.

We are also calling on Canadian businesses to continue to respect the privacy rights of Canadians with regards to information the private sector possesses on individual Canadians, as legislated under the Personal Information Protection and Electronic Documents Act.

The actions taken by the Government in response to potential privacy and contracting risks posed by the USA Patriot Act include: a review by Government departments of their outsourcing arrangements to determine if action is needed; continuing the review of federal privacy laws and policies; and cooperating with the OPC on the planned audit in 2004-2005 of the transfer of personal information between Canada and the United States".

BC Information and Privacy Commissioner releases his report: Patriot Act contravenes BC privacy laws

The Information and Privacy Commissioner of BC has released his report into the impact of the USA PATRIOT Act on the privacy of British Columbians. His report is available here and a summary is available here.

See below for media coverage:

U.S. Patriot Act can eyeball private Canadian records, says B.C. report

Canadian Press via Yahoo! News Fri, 29 Oct 2004 11:10 AM PDT

VICTORIA (CP) - The USA Patriot Act has the power to eyeball private information about Canadians despite attempts by governments in Canada to thwart probes by American authorities, says a report released Friday by British Columbia's privacy commissioner.

Patriot Act contravenes B.C. privacy laws: report

CBC British Columbia Fri, 29 Oct 2004 11:06 AM PDT

VICTORIA - B.C Privacy Commissioner David Loukidelis says the U.S. Patriot Act violates provincial privacy laws – and he wants the province to temporarily ban the transfer of personal information to the U.S.

Canada Study Sees Risk in U.S. Anti-Terrorism Law

Reuters via Yahoo! News Fri, 29 Oct 2004 11:31 AM PDT

A key U.S. anti-terrorism law threatens the privacy of Canadians and rigorous steps are needed to protect private medical and financial information, a government study said on Friday.

BC Privacy Commissioner to release report on USA PATRIOT Act and outsourcing of personal information management

According to a press-release on the BCGEU website, the Information and Privacy Commissioner of British Columbia will be releasing his long-awaited -- and delayed -- report on the impact of the USA PATRIOT Act on the privacy of British Columbians' personal information. The report will be released at 10:00 am (PST), to be followed by the reaction of the BCGEU. (See BCGEU: News conference to respond to privacy ......)

New IT.Can Blog

The Canadian Information Technology Law Association has just launched a new blog to foster discussion of issues of interest to practitioners and others who are interested in Canadian technology law issues. It also has an RSS/XML feed.

One of the initial postings is related to the recent decision by the Privacy Commissioner on outsourcing and the USA Patriot Act. I blogged about it here (The Canadian Privacy Law Blog: Privacy Commissioner considers USA Patriot Act / Outsourcing complaints against Canadian bank), but the IT.Can blog provides a good oppotunity for discussion. Check out the post here: Bank’s notification to customers triggers PATRIOT Act concerns.

Right-to-Privacy Campaign presents 50,000-name petition opposing the privatization of government jobs

The British Columbia Government Employees Union, which started the USA PATRIOT ACT and outsourcing firestorm in BC a while ago, has presented a fifty-thousand name petition against privatizing government jobs by outsourcing:

BCGEU: Right-to-Privacy Campaign presents 50,000-name petition opposing the privatization of government jobs:

"The BC Government and Service Employees� Union congratulated Right-to-Privacy-Campaign representatives who turned over petitions totaling 51,203 names to the Opposition caucus in Victoria today, opposing the contracting out of Medicare and Pharmacare jobs to private companies.

...

While support for stopping the privatization of Medicare and Pharmacare jobs is welcome, President Heyman cautioned that all personal information in government data banks is at risk.

"The Campbell Liberals are proceeding with plans to contract out help desk, disaster recovery and many other services to the private sector," Heyman said. "If these contracts proceed, virtually every piece of confidential information handled by the government could be accessed by private multi-national corporations.""

FBI Papers Indicate Intelligence Violations

Even when the FBI can go to a secret court for authorization for intrusive surveillance or, in some cases, do it according to internal oversight, the Washinton Post is reporting that some FBI agents have circumvented all oversight to conduct surveillance on US residents:

FBI Papers Indicate Intelligence Violations

In other cases, agents obtained e-mails after a warrant expired, seized bank records without proper authority and conducted an improper "unconsented physical search," according to the documents.

Although heavily censored, the documents provide a rare glimpse into the world of domestic spying, which is governed by a secret court and overseen by a presidential board that does not publicize its deliberations. The records are also emerging as the House and Senate battle over whether to put new restrictions on the controversial USA Patriot Act, which made it easier for the government to conduct secret searches and surveillance but has come under attack from civil liberties groups.

The records were provided to The Washington Post by the Electronic Privacy Information Center, an advocacy group that has sued the Justice Department for records relating to the Patriot Act.

David Sobel, EPIC's general counsel, said the new documents raise questions about the extent of possible misconduct in counterintelligence investigations and underscore the need for greater congressional oversight of clandestine surveillance within the United States.

"We're seeing what might be the tip of the iceberg at the FBI and across the intelligence community," Sobel said. "It indicates that the existing mechanisms do not appear adequate to prevent abuses or to ensure the public that abuses that are identified are treated seriously and remedied."