Nearly three years after its enactment, the USA Patriot Act remains not just a political but also a technological issue on many college campuses.

Unprepared or ill-prepared schools can find themselves facing network problems, service disruptions, and in the worse case FBI agents driving onto the campus with subpoenas to haul off PCs, servers, and computer log data.

IT groups can minimize the potential disruptions of Patriot Act investigations by taking the lead on campus to pull together legal counsel, administration, and faculty to craft a clear process for handling investigations that will become more common, says Peter Siegel, CIO at University of Illinois at Urbana Champaign.

Siegel spoke this week at the annual conference of the Association for Communications Technology Professionals in Higher Education (ACUTA) meeting in Chicago.

"The status of dealing with the Patriot Act in higher education is very mixed," Siegel said. "Some people say, ‘What does this have to do with IT?’ Others say, ‘We have [network] security professionals who work closely with law enforcement agencies.’ There's not much in between, where you find people just ramping up [to deal with the Act]. For one thing, it's very hard to get people to share information about this."

Siegel pointed out to his audience that while the Patriot Act is new, it doesn't actually introduce new legal instruments or actions.

"Every component of the Patriot Act was present in previous law," he said. "But just not often used. Now, it's more likely that a Patriot Act incident will start or end or, especially, go through your campus."

Siegel said the act does, however, lower the bar on judicial oversight on searches and seizures. But oversight is still required: seizing records or doing electronic surveillance requires a subpoena issued by a judge.

"It allows [electronic] searches without requiring the person [under investigation] being notified, for an undefined 'reasonable time,'" he said.

Schools may find themselves drawn into a Patriot Act investigation even if those being investigated are not actually students or employees of the school. The school's network and computers may be hijacked by someone halfway around the world to attack a third location. "You need a solid policy," Siegel told his audience. "If it's 2 a.m. and your network is being used to attack another university or a private company, who gets called?"