Twenty-five years after the Patriot Act, Washington’s surveillance capabilities are growing faster than the safeguards meant to restrain them
On October 26,2001, US President George W. Bush signed the USA PATRIOT Act into law, less than seven weeks after the September 11 attacks killed nearly 3,000 people in New York. The speed of its passage reflected the extraordinary political and social atmosphere in the United States. The tragedy had shattered the country’s sense of security, and fears of further terrorist activity continued to haunt the country in the months that followed.
In the weeks after 9/11, grief and anger were accompanied by an unprecedented surge of patriotism and national solidarity. President Bush’s approval rating reached 86 percent by late September, and public trust in the federal government rose to levels unseen in decades. A majority of Americans also expressed a willingness to sacrifice at least some civil liberties if doing so would help combat terrorism. Under intense pressure to prevent another catastrophe, Congress moved rapidly to expand federal investigative and surveillance powers.
The Patriot Act facilitated information sharing between intelligence and law enforcement agencies, broadened certain authorities to obtain records, and expanded investigative tools available in terrorism cases. Supporters argued that these measures were necessary to confront a transnational threat with legal instruments suited to a new security environment.
Yet national unity did not eliminate concerns about civil rights. Arab and Muslim Americans, as well as people perceived to belong to these communities, faced increased discrimination and violence. As the immediate shock of 9/11 receded, questions grew over how far the governments’ new powers should extend and what safeguards were needed to prevent abuse.
These tensions would shape the law’s legacy for decades. The debate intensified after Edward Snowden’s 2013 disclosures exposed the scale of certain US surveillance programs, helping spur the USA FREEDOM Act of 2015, which curtailed the government’s bulk collection of domestic telephone records. The controversy revealed that the challenge was not simply how to protect Americans from terrorism, but how to preserve privacy and civil liberties while doing so.
The surveillance debate that follows 9/11 has evolved alongside technology. Today, governments can analyze enormous volumes of digital information, from communications metadata to online activity, making it increasingly difficult to distinguish targeted intelligence gathering from the broader collection of personal data.
However, not all modern US surveillance powers originate in the Patriot Act. One important distinction is between Section 215 of the Patriot Act, which became associated with the NSA’s bulk collection of domestic telephone records, and Section 702 of the Foreign Intelligence Surveillance Act (FISA), enacted in 2008.
Section 702 allows US intelligence agencies to target non-US persons reasonably believed to be outside the country for foreign intelligence purposes. Yet communications involving Americans may also be collected when they interact with foreign targets. A separate framework. Executive Order 12333 governs much of the intelligence community’s overseas surveillance activity.
These authorities raise questions that extend beyond the original post-9/11 debate. Artificial intelligence is adding a new dimension to the problem. Machine-learning systems can process vast quantities of communications, financial records, location data and other digital information, identifying patterns that human investigators might overlook. Such capabilities could help intelligence agencies detect terrorist networks and anticipate emerging threats. Yet they also raise the possibility of increasingly comprehensive surveillance, in which individuals can be assessed through their digital associations, behavior and inferred characteristics rather than through evidence of specific wrongdoings.
The risks are not limited to the amount of information collected. AI systems can produce false positives, reproduce biases present in their training data and generate conclusions that are difficult to explain or independently verify. If such assessments inform investigations or security decisions, errors may have serious consequences for individuals. The challenge for governments is therefore not simply to regulate access to data, but also to establish accountability for how algorithms analyze it, how their conclusions are used and whether affected individuals have meaningful avenues for redress.
Twenty-five years later: Has America found the balance?
Twenty-five years after the Patriot Act became law, the United States has neither abandoned its expanded national security apparatus nor settled the debate over its proper limits. The government’s ability to collect and analyze information remains an important instrument in counterterrorism and foreign intelligence. At the same time, experience has shown that powers introduced in response to an emergency can endure long after the circumstances that justified them have changed.
The law’s defenders argue that intelligence agencies need effective tools to identify threats before they result in violence. Critics counter that broad surveillance authorities, secret legal interpretations and insufficient oversight can undermine privacy and weaken public trust. Both concerns are fundamental to a democratic society: security is essential to protecting freedom, but security measures can also threaten it when they operate without adequate safeguards.
The central lesson of the Patriot Act is therefore not that national security and civil liberties are necessarily incompatible. It is that the balance between them cannot be established once and left untouched. It requires clear legal limits, meaningful judicial and congressional oversight, transparency wherever possible, and public debate about how surveillance powers are used.
Artificial intelligence makes this balance even harder to maintain. Surveillance systems are increasingly capable of drawing connections across datasets and generating assessments at a speed and scale that traditional oversight mechanisms were not designed to handle. Decisions may depend partly on algorithmic outputs that are difficult for the public, and sometimes even for officials, to scrutinize. Democratic oversight must therefore evolve alongside technology, requiring clear rules on the use of AI, independent testing, safeguards against discriminatory outcomes and human accountability for consequential decisions.
The digital age makes this task more urgent. As governments acquire increasingly sophisticated tools to monitor communications and analyze personal information, lawmakers must ensure that technological capabilities do not automatically translate into unlimited authority.
The question raised in October 2001 remains relevant today: how can a democracy protect its citizens without compromising the freedoms that give its political system legitimacy? Twenty-five years later, the United States continues to grapple with the answer.
