The scope of user information the FBI obtains with National Security Letter (NSL) was revealed on Monday, following a court victory by an ISP challenging the gag order which accompanies the secretive orders.
The victory allowed Calyx Internet Access founder Nicholas Merrill to release documents showing the FBI uses National Security Letters to demand complete web browsing history, the IP addresses of all people corresponding with the customer named in the letter, and records of that person’s online purchases, among other information.
Hosted service provider Calyx received a National Security Letter in 2004, which founder Nicholas Merrill has fought in court on several grounds. His latest victory reveals that the FBI has previously obtained cell-site location information, tracking individuals through their cellular phones. The bureau said in court filings that its policy changed to discontinue gathering location data, but that it remains free to resume the practice in the future.
“For more than a decade, the FBI has been demanding extremely sensitive personal information about private citizens just by issuing letters to online companies like mine,” Merrill said in a statement. “The FBI has interpreted its NSL authority to encompass the websites we read, the web searches we conduct, the people we contact, and the places we go. This kind of data reveals the most intimate details of our lives, including our political activities, religious affiliations, private relationships, and even our private thoughts and beliefs.”
Judge Victor Marrero of the federal district court of Manhattan ruled that the gag order on NSLs is “extreme and overly broad,” saying “(c)ourts cannot, consistent with the First Amendment, simply accept the Government’s assertions that disclosure would implicate and create a risk.”
An attachment which accompanied the National Security Letter Merrill received details the kinds of information demanded by the FBI (PDF), and Merrill has released the attachment through the Information Society Project of the Yale Law School.
“At this moment, when the public is once again debating whether to expand the scope of the government’s surveillance authorities, we should pause to ensure that we know how existing authorities have been construed in secret,” Amanda Lynch, a member of the Yale Law School clinic representing Merrill said. “The fact that Mr. Merrill is now able to reveal how the FBI has construed its NSL authority will enhance the quality of the public debate about surveillance and will give the public the opportunity to hold the FBI accountable.”
The use of NSLs was greatly expanded by the Patriot Act, but the non-disclosure laws relating to them have blocked almost all information about them. Telecoms are now permitted to disclose how many thousands of NSLs they have received, following changes made by the Obama administration in 2014.