Photo: Gini/Flickr
Last year, when a telecommunications company received an ultra-secret demand letter from the FBI seeking information about a customer or customers, the telecom took an extraordinary step — it challenged the underlying authority of the FBI’s National Security Letter, as well as the legitimacy of the gag order that came with it.
Both challenges are allowed under a federal law that governs NSLs, a power greatly expanded under the Patriot Act that allows the government to get detailed information on Americans’ finances and communications without oversight from a judge. The FBI has issued hundreds of thousands of NSLs and been reprimanded for abusing them — though almost none of the requests have been challenged by the recipients.
After the telecom challenged its NSL last year, the Justice Department took its own extraordinary measure: It sued the company, arguing in court documents that the company was violating the law by challenging its authority.
That’s a pretty intense charge, according to Matt Zimmerman, an attorney for the Electronic Frontier Foundation, which is representing the anonymous telecom.
“It’s a huge deal to say you are in violation of federal law having to do with a national security investigation,” says Zimmerman. “That is extraordinarily aggressive from my standpoint. They’re saying you are violating the law by challenging our authority here.”
The government’s “Jabberwocky” argument – accusing the company of violating the law when it was actually complying with the law – appears in redacted court documents that were released on Wednesday by EFF with the government’s approval. Prior to their release, the organization provided them to the Wall Street Journal, which first reported on the case Tuesday night. The case is a significant challenge to the government and its efforts to obtain documents in a manner that the EFF says violates the First Amendment rights of free speech and association.
It’s only the second time that such a serious and fundamental challenge to NSLs has arisen. The first occurred in 2004 in the case of a small ISP owner named Nicholas Merrill, who challenged an NSL seeking info on an organization that was using his network. He asserted that customer records were constitutionally protected information.
But that issue never got a chance to play out in court before the government dropped its demand for documents.
With this new case, civil libertarians are getting a second opportunity to fight NSLs head-on in court.
NSLs are written demands from the FBI that compel internet service providers, credit companies, financial institutions and others to hand over confidential records about their customers, such as subscriber information, phone numbers and e-mail addresses, websites visited and more.
NSLs are a powerful tool because they do not require court approval, and they come with a built-in gag order, preventing recipients from disclosing to anyone that they have even received an NSL. An FBI agent looking into a possible anti-terrorism case can self-issue an NSL to a credit bureau, ISP or phone company with only the sign-off of the Special Agent in Charge of their office. The FBI has to merely assert that the information is “relevant” to an investigation into international terrorism or clandestine intelligence activities.
The lack of court oversight raises the possibility for extensive abuse of NSLs under the cover of secrecy, which the gag order only exacerbates. In 2007 a Justice Department Inspector General audit found that the FBI had indeed abused its authority and misused NSLs on many occasions. After 9/11, for example, the FBI paid multimillion-dollar contracts to AT&T and Verizon requiring the companies to station employees inside the FBI and to give these employees access to the telecom databases so they could immediately service FBI requests for telephone records. The IG found that the employees let FBI agents illegally look at customer records without paperwork and even wrote NSLs for the FBI.
Before Merrill filed his challenge to NSLs in 2004, ISPs and other companies that wanted to challenge NSLs had to file suit in secret in court – a burden that many were unwilling or unable to assume. But after he challenged the one he received, a court found that the never-ending, hard-to-challenge gag orders were unconstitutional, leading Congress to amend the law to allow recipients to challenge NSLs more easily as well as gag orders.
Now companies can simply notify the FBI in writing that they oppose the gag order, leaving the burden on the FBI to prove in court that disclosure of an NSL would harm a national security case. The case also led to changes in Justice Department procedures. Since Feb. 2009, NSLs must include express notification to recipients that they have a right to challenge the built-in gag order that prevents them from disclosing to anyone that the government is seeking customer records.
Few recipients, however, have ever used this right to challenge the letters or gag orders.
The FBI has sent out nearly 300,000 NSLs since 2000, about 50,000 of which have been sent out since the new policy for challenging NSL gag orders went into effect. Last year alone, the FBI sent out 16,511 NSLs requesting information pertaining to 7,201 U.S. persons, a technical term that includes citizens and legal aliens.
But in a 2010 letter (.pdf) from Attorney General Eric Holder to Senator Patrick Leahy (D-Vermont), Holder said that there had “been only four challenges,” and those involved challenges to the gag order, not to the fundamental legality of NSLs. At least one other challenge was filed earlier this year in a secret case revealed by Wired. But the party in that case challenged only the gag order, not the underlying authority of the NSL.
When recipients have challenged NSLs, the proceedings have occurred mostly in secret, with court documents either sealed or redacted heavily to cover the name of the recipient and other identifying details about the case.
The latest case is remarkable then for a number of reasons, among them the fact that a telecom challenged the NSL in the first place, and that EFF got the government to agree to release some of the documents to the public. The organization provided them to the Wall Street Journal, before releasing them on its web site, with the name of the telecom and other details redacted. The Journal, however, using details left in the court records, narrowed the likely plaintiffs down to one, a small San-Francisco-based telecom named Credo. The company’s CEO, Michael Kieschnick, didn’t confirm or deny that his company is the unidentified recipient of the NSL.
The case began sometime in 2011, when Credo or another telecom received an NSL from the FBI.
EFF filed a challenge on behalf of the telecom (.pdf) in May that year on First Amendment grounds, asserting first that the gag order amounted to unconstitutional prior restraint and, second, that the NSL statute itself “violates the anonymous speech and associational rights of Americans” by forcing companies to hand over data about their customers.
Instead of responding directly to that challenge and filing a motion to compel compliance in the way the Justice Department has responded to past challenges, government attorneys instead filed a lawsuit against the telecom, arguing that by refusing to comply with the NSL and hand over the information it was requesting, the telecom was violating the law, since it was “interfer[ing] with the United States’ vindication of its sovereign interests in law enforcement, counterintelligence, and protecting national security.”
They did this, even though courts have allowed recipients who challenge an NSL to withhold government-requested data until the court compels them to hand it over. The Justice Department argued in its lawsuit that recipients cannot use their legal right to challenge an individual NSL to contest the fundamental NSL law itself.
“It was eye-opening to us that they followed that approach,” Zimmerman says.
After heated negotiations with EFF, the Justice Department agreed to stay the civil suit and let the telecom’s challenge play out in court. The Justice Department subsequently filed a motion to compel in the challenge case, but has never dropped the civil suit.
“So there’s still this live complaint that they have refused to drop saying that our client was in violation of the law,” Zimmerman says, “presumably in the event that they lose, or something goes bad with the [challenge case].”
Justice Department spokesman Wyn Hornbuckle declined to comment on the case.
The redacted documents don’t indicate the exact information the government was seeking from the telecom, and EFF won’t disclose the details. But by way of general explanation, Zimmerman said that the NSL statute allows the government to compel an ISP or web site to hand over information about someone who posted anonymously to a message board or to compel a phone company to hand over “calling circle” information, that is, information about who has communicated with someone by phone.
An FBI agent could give a telecom a name or a phone number, for example, and ask for the numbers and identities of anyone who has communicated with that person. “They’re asking for association information – who do you hang out with, who do you communicate with, [in order] to get information about previously unknown people.
“That’s the fatal flaw with this [law],” Zimmerman says. “Once the FBI is able to do this snooping, to find out who Americans are communicating with and associating with, there’s no remedy that makes them whole after the fact. So there needs to be some process in place so the court has the ability ahead of time to step in [on behalf of Americans].”
It remains to be seen, however, whether that issue will finally get its day in court.