Revealed: What info the FBI can collect with a National Security Letter

After winning an eleven-year legal battle, Nicholas Merrill can finally tell the public how the FBI has secretly construed its authority to issue National Security Letters (NSLs) to permit collection of vast amounts of private information on US citizens without a search warrant or any showing of probable cause.

The PATRIOT Act vastly expanded the domestic reach of the NSL program, which allows the FBI to compel disclosure of information from online companies and forbid recipients from disclosing they have received an NSL. The FBI has refused to detail publicly the kinds of private data it believes it can obtain with an NSL.

Merrill has been privy to this information since 2004, when the FBI served him with an NSL demanding that he turn over records about a customer of the Internet company he then owned, Calyx Internet Access. Until yesterday, Merrill was subject to a gag order forbidding him from sharing this information with the public.

Merrill is now able to reveal that the FBI believes it can force online companies to turn over the following information simply by sending an NSL demanding it: an individual’s complete web browsing history; the IP addresses of everyone a person has corresponded with; and records of all online purchases.

The FBI also claims authority to obtain cell-site location information with an NSL, which effectively turns a cell phone into a location tracking device. In court filings, the FBI said that at some point it stopped gathering location data as a matter of policy, but that it could secretly choose to resume the practice under existing authority.

“For more than a decade, the FBI has been demanding extremely sensitive personal information about private citizens just by issuing letters to online companies like mine,” said Mr. Merrill. “The FBI has interpreted its NSL authority to encompass the websites we read, the web searches we conduct, the people we contact, and the places we go. This kind of data reveals the most intimate details of our lives, including our political activities, religious affiliations, private relationships, and even our private thoughts and beliefs,” he explained.

The law authorizing NSLs allows the FBI to demand “electronic communications transactional records” from online companies, but the FBI has long refused to clarify just how broadly it construes this vaguely worded and undefined phrase.

The NSL that Mr. Merrill received in 2004 included an attachment listing the specific categories of highly sensitive personal information that the FBI was demanding he disclose under this authority. Mr. Merrill has repeatedly challenged the gag order that forbade him from disclosing this information. The Media Freedom & Information Access Clinic at Yale Law School represented Mr. Merrill in his current, successful First Amendment challenge.

Three months ago, in a partially redacted opinion, Judge Victor Marrero of the federal district court in Manhattan found that the gag order was no longer justified. Judge Marrero’s decision described the FBI’s position as “extreme and overly broad,” affirming that “Courts cannot, consistent with the First Amendment, simply accept the Government’s assertions that disclosure would implicate and create a risk.” He also found that the FBI’s overbroad gag order on Mr. Merrill “implicates serious issues, both with respect to the First Amendment and accountability of the government to the people.” Judge Marrero’s ruling goes into effect today and has just been published in full, without redaction, after the government declined to appeal.

More than ten thousand NSLs are issued to online companies by FBI officers every year, and almost all of those NSLs are accompanied by a complete gag order barring any public disclosure of what the FBI has requested and from whom. Merrill is the first person who has succeeded in completely lifting an NSL gag.

“The broad scope of the FBI’s claimed NSL authority is deeply problematic because the government can issue NSLs without any judicial oversight,” stated Lulu Pantin, a law student intern who represented Mr. Merrill in his successful lawsuit. Other investigatory tools that the government can use to obtain these same types of information require advance judicial approval. “The fact that the FBI can obtain such sensitive information without prior judicial review raises serious Fourth and First Amendment questions,” explained Ms. Pantin. “Mr. Merrill’s experience demonstrates the FBI indefinitely silences Internet Service Providers while forcing them to de-anonymize their users and divulge a broad range of information about law-abiding citizens’ online activity, simply by issuing a letter,” Pantin added.

For more than 10 years, while Congress debated and adopted reforms to the laws authorizing NSLs and other surveillance authorities, the gag order prevented Mr. Merrill from alerting the public about how the NSL statute was actually being interpreted in practice. A formal Justice Department legal opinion states that NSLs only reach “those categories of information parallel to subscriber information and toll billing records for ordinary telephone service,” but Mr. Merrill can now clarify that NSLs are being used much more broadly than the opinion suggests.

“At this moment, when the public is once again debating whether to expand the scope of the government’s surveillance authorities, we should pause to ensure that we know how existing authorities have been construed in secret,” observed Amanda Lynch, another member of the Yale Law School clinic representing Mr. Merrill. “The fact that Mr. Merrill is now able to reveal how the FBI has construed its NSL authority will enhance the quality of the public debate about surveillance and will give the public the opportunity to hold the FBI accountable,” Ms. Lynch added.