FBI sets guidelines for data collection

WASHINGTON —  The FBI is warning its agents to carefully review all personal data collected from Americans in terrorism investigations before it is uploaded into FBI databases to protect the subjects’ privacy rights and to make sure only requested information is used.

The warning came in draft FBI guidelines made public Wednesday to be issued to correct abuses of so-called national security letters that were revealed in a Justice Department audit three months ago. The letters allow investigators to subpoena records, without court approval, in terrorism and spy cases.

Under the 24-page guidelines, which are effective immediately, investigators must request specific information -- and justify its need -- before the demand for data is sent.

Moreover, the strictly worded rules require all evidence received from the subpoena to be reviewed before it is uploaded into FBI databases to make sure that only the information specifically requested is used. Any irrelevant or extra material received will be locked away from investigators and, potentially, ultimately returned or destroyed.

“Receiving information beyond the scope of an NSL is a potential violation, regardless of whether the overproduction occurred as a result of an error by the FBI or the NSL recipient,” the guidelines state.

Agents must lay out reasons the request must remain secret, as outlined in the USA Patriot Act, which governs the use of national security letters, when it was reauthorized in 2005.

“Nondisclosure is not required in all NSLs,” the guidelines state. They note, however, that “the statutory standard for nondisclosure will be met in most cases” -- including when there is concern that revealing an investigation would tip off its targeted suspect.

FBI Director Robert S. Mueller III had asked the American Civil Liberties Union and other civil liberties and privacy groups to assist in crafting the guidelines.

Under the Patriot Act, the national security letters give the FBI authority to demand that telephone companies, Internet service providers, banks, credit bureaus and other businesses produce personal records about their customers or subscribers.