Recipient Of FBI National Security Letter Can Finally Reveal Details, 11 Years Later

from the and-it's-just-as-messed-up-as-expected dept

Back in October, we followed up on a much older story concerning Nicholas Merrill, the owner of Calyx Internet Access, who back in 2004 had received one of the FBI’s infamous National Security Letters (NSLs) complete with a total gag order on it. NSLs have long been widely abused by the FBI to (unconstitutionally) get around the 4th Amendment, demanding all sorts of information from private parties and then putting a perpetual gag order on the request, which also would seem to violate the 1st Amendment. Merrill fought back against the NSL — at first anonymously because he wasn’t even allowed to admit to anyone that he’d received one. In 2010, Merrill was finally granted the right to admit that he had received an NSL and that he was fighting it. But he still couldn’t reveal much more than that.

The October ruling said that the entire gag order needed to be lifted, and that Merrill should be able to finally reveal the actual NSL — and that has now happened. You can see the ridiculously broad list of information that was demanded from Merrill.

Merrill is now able to reveal that the FBI believes it can force online companies to turn over the following information simply by sending an NSL demanding it: an individual?s complete web browsing history; the IP addresses of everyone a person has corresponded with; and records of all online purchases. The FBI also claims authority to obtain cell-site location information with an NSL, which effectively turns a cell phone into a location tracking device. In court filings, the FBI said that at some point it stopped gathering location data as a matter of policy, but that it could secretly choose to resume the practice under existing authority.

?For more than a decade, the FBI has been demanding extremely sensitive personal information about private citizens just by issuing letters to online companies like mine,? said Mr. Merrill.   ?The FBI has interpreted its NSL authority to encompass the websites we read, the web searches we conduct, the people we contact, and the places we go. This kind of data reveals the most intimate details of our lives, including our political activities, religious affiliations, private relationships, and even our private thoughts and beliefs,? he explained.

As Marcy Wheeler notes, the depth of information that the NSL was getting willy nilly with no oversight at all through NSLs is rather astounding.

This is what the government means when it does ?connection? chaining: gluing together every fragment of your online life together to see it all.

The ACLU has also helpfully created a graphic showing the gradual revealing of this NSL, with each part of the legal fight unmasking a bit more over the course of this decade-plus battle:

Along with the NSL details, Merrill was also able to release an unredacted version of October’s ruling — and we’ll deal with that in a separate post, so stay tuned.

Filed Under: , , , , , , , ,
Companies: calyx

Rate this comment as insightful
Rate this comment as funny
You have rated this comment as insightful
You have rated this comment as funny
Flag this comment as abusive/trolling/spam
You have flagged this comment
The first word has already been claimed
The last word has already been claimed
Insightful Lightbulb icon Funny Laughing icon Abusive/trolling/spam Flag icon Insightful badge Lightbulb icon Funny badge Laughing icon Comments icon

Comments on “Recipient Of FBI National Security Letter Can Finally Reveal Details, 11 Years Later”

Subscribe: RSS Leave a comment
Whatever (profile) says:

Reading the request, it seems much more straightforward and not at all as sinister as it’s made out to be.

The requests all seem to be related to what the ISP / Hosting company was providing as services. The request for purchases, as an example, seems to be in relation to services offered by the company, and not ALL online purchases made.

There is also (from the list you posted) no indication that they expect a list of URLs visited, rather a request for any URLs related to the subscriber account (domains hosted).

There is nothing that says “the IP addresses of everyone a person has corresponded with” rather a request for screen names / IDs and email addresses associated with the subscriber’s account (most ISPs allow for multiple Emails, and may also require a screen name to log in).

It would seem that (at least based on the unredacted list) that Merrill may have been either over reacting or taking certain requests in an odd manner. It seems everything on that list pertains to transactions and setups between the ISP and their customer, and not anything else.

Anonymous Coward says:

Re: Re:

I’m glad that your rose colored glasses give the government so much credit. Here I thought we had to rely on action rights and law for things like this to be revealed. We have warrants for a reason and anything that gets the same information without the same legal requirements is not in the interest of the people.

Whatever (profile) says:

Re: Re: Re:

I am really not debating NSL versus warrants here – rather that what Merrill claims and what is on the unredacted list just don’t seem to match. Everything on the list seems to pertain to the relationship between the ISP and the client, with no mention of surfing history or a list of all people they have sent email to…

Whatever (profile) says:

Re: Re: Re:2 Re:

I didn’t overlook it. Rather, I considered that an ISP generally won’t have a “transaction record” that includes all of the email contacts, the websites you visit, etc., unless they specifically have set it up to do so.

Perhaps Mr Merill’s bigger issue is that, as an ISP, he may have been collecting this information without any legal requirement or need. ISPs don’t generally track user activity beyond sheer volume (to charge for bandwidth). Perhaps the problem here is in how Merrill operated? I doubt we will ever know.

Anonymous Coward says:

Re: Re:

Reading the request, it seems much more straightforward and not at all as sinister as it’s made out to be.

All the more reason to ask yourself why such a straightforward request would need to be shrouded in secrecy, no?

If it’s just SOP, and there’s nothing to see, then surely court oversight shouldn’t be an issue.

Anonymous Coward says:

Though I usually disagree with Whatever, I have to say [he|she|it] seems to be correct on this. The information requested appears to be limited to details about the account – with the notable exception of the last point (“Any other information…”). However, that does not in any way take away from the unconstitutional nature of an NSL.

Anonymous Coward says:

Re: Re: Re:

…electronic communication transactional record…


That could mean any connection, whether or not one did anything with said connection. Including unwanted pop-ups and redirects.


That could mean only those connections that resulted in money (or other consideration(s), like Bitcoin) to change hands. Think about it: you don’t need the word transactional in that phrase to get connection/email/etc. records.

Problem is one has to go to court to find out what the court considers this to be.

Add Your Comment

Your email address will not be published. Required fields are marked *

Have a Techdirt Account? Sign in now. Want one? Register here

Comment Options:

Make this the or (get credits or sign in to see balance) what's this?

What's this?

Techdirt community members with Techdirt Credits can spotlight a comment as either the "First Word" or "Last Word" on a particular comment thread. Credits can be purchased at the Techdirt Insider Shop »

Follow Techdirt

Techdirt Daily Newsletter

Techdirt Deals
Techdirt Insider Discord
The latest chatter on the Techdirt Insider Discord channel...