When Congress passed the Patriot Act in the aftermath of the 9/11 attacks, law-enforcement agencies hailed it as a powerful tool to help track down the confederates of Osama bin Laden. No one expected it would end up helping to snag the likes of Eliot Spitzer. In the fine print were provisions that gave the Treasury Department authority to demand more information from banks about their customers' financial transactions. But Treasury went further. It issued stringent new regulations that required banks themselves to look for unusual transactions (such as odd patterns of cash withdrawals or wire transfers) and submit SARs-Suspicious Activity Reports-to the government. Facing potentially stiff penalties if they didn't comply, banks and other financial institutions installed sophisticated software to detect anomalies among millions of daily transactions. They began ranking the risk levels of their customers ... based on complex formulas that included ... whether an account holder was a politically exposed person" [PEP]. At first focused on potentially crooked foreign officials, the PEP lists expanded to include many U.S. politicians and public officials who were conceivably vulnerable to corruption. Federal prosecutors around the country routinely scour the SARs for potential leads. One of those leads led to Spitzer. Last summer New York's North Fork Bank, where Spitzer had an account, filed a SAR about unusual money transfers he had made. The governor called attention to himself by asking the bank to transfer money in someone else's name. The SAR was not itself evidence that Spitzer had committed a crime. But it made the Feds curious enough to follow the money.