eWEEK content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.
National Security Letters have been around as long as the Internet, but only after the terrorist attacks of Sept. 11, 2001, have they been used with great frequency.
An NSL is a type of a subpoena issued by the Federal Bureau of Investigation that demands information from a customer’s bank, telephone company, Internet service provider or email account. They are issued by an FBI agent and they don’t require a court order.
What bothers most people about NSLs beyond the lack of a court order is that most come with a perpetual gag order that forbids the recipient from disclosing the existence of the letter. Recently, the gag orders and the letters themselves have been challenged in court on constitutional grounds. A number of cases that might have overturned the NSL practice were making their way through the federal courts when Congress passed the USA Freedom Act on June 2, 2015.
The act required that the FBI abandon the gag orders on NSLs three years after an investigation is resolved or when disclosure of an NSL’s contents would not cause any harm to the investigation. At that point, the FBI is required to notify the recipient of an NSL that they can reveal both the existence and the contents.
Now Yahoo has become the first Internet services company to release an NSL’s contents. Chris Madsen, head of global law enforcement, security and safety for Yahoo, revealed the contents of three NSLs in a blog posting on June 1, a year after the passage of the USA Freedom Act. Yahoo also notified two users that they were the subjects of an NSL inquiry the same time. The person connected to the third letter was not a Yahoo customer.
NSLs have been a source of irritation for the IT industry for years. Many companies felt that the letters were being misused, that the gag orders were unwarranted restrictions on their freedom and that there was insufficient oversight. While it was possible to challenge the NSL and its accompanying gag order in court, this happened only rarely.
The passage of the USA Freedom Act required the Department of Justice and the U.S. attorney general to develop procedures for dropping the gag orders and it also stiffened the requirements for issuing an NSL in the first place. Whether that resulted in a reduction in the number of NSLs issued by the FBI is unclear because, for the most part, the NSLs are still secret.
The three NSLs revealed by Yahoo are just the tip of the iceberg, coming as they are on the year after the passage of the act.
Yahoo Is First to Legally Disclose National Security Letter Contents
You can expect that more NSLs will be revealed by a growing number of email and Internet providers, phone companies and financial institutions as the process moves forward.
While the USA Freedom Act made issuing a National Security Letter more complicated, it didn’t end the practice; so the FBI can still issue them, they still include the gag orders, and providers are still required to honor them. There’s still no requirement for a court order. Although judicial review is possible, it’s still extremely difficult.
In addition, where they’ve been challenged in court, the orders themselves have been found unconstitutional on First and Fourth Amendment grounds by a series of federal courts, but appeals by the Justice Department have kept the practice alive.
Part of the reason that the NSLs have been allowed to exist at all is that they don’t demand the actual contents of communications or other content information. Instead, like the metadata you’ve heard about in other surveillance activities, the information that the government is seeking are things like account numbers, activity, transactions, IP addresses and the like.
While transaction data demanded by the FBI doesn’t reveal the contents of a message, it can still reveal a great deal of information that most would consider private. That information can include with whom the subject of an investigation communicated, when it happened, how long it took and how many times the communication happened.
This information is then used to develop a picture of ongoing relationships—which, in turn, can be used as the basis for a request for a warrant to reveal the contents of the communications.
If it looks like the FBI is skirting the borders of constitutional limits, you’d be right. That’s why Congress overwhelmingly passed the USA Freedom Act, which is intended to put some limits and some accountability into the surveillance activities of the government as it applies to U.S. citizens.
Of course, like most things in government, the fact that the law exists isn’t the same thing as changing the practices covered by the law, which is why a full year has passed since the Freedom Act went into effect and we’re only now seeing the first results.
Still, the announcement by Yahoo is a first critical—if very small—step. For once, the existence and content of an NSL has been revealed by the recipient without a court fight, and that’s very important.
A few dozen more changes like that and perhaps the U.S. IT industry can move past the suspicions of Web users and companies around the world that currently must assume that everything they do online is being watched in detail by U.S. government agencies.