Dec. 1, 2015 8:24am Liz Klimas

Over a decade ago, the founder of an Internet company received a letter from the federal government, ordering him to not only provide information about one of his clients but also banning him from telling anyone about it.

That man, Nicholas Merrill who owned the now-defunct company Calyx Internet Access, can speak publicly and in full for the first time about the national security letter he received from the FBI in 2004.

“I was completely in shock,” Merrill told the Washington Post, recalling the day when he was served the letter. “When I first looked at the letter, I got stuck at the paragraph where it said I couldn’t tell anyone.”

According to a U.S. District Court judge’s order and decision document, an NSL can be issued by the FBI to an electronic service provider for “subscriber information and toll billing records information, or electronic communication transactional records” under the then USA Patriot Act and now the USA Freedom Act. These administrative subpoenas do not require a judge’s prior approval.

Merrill, identified in legal proceedings as John Doe, took the issue to court. According to the Washington Post, his first legal victory came when a judge ruled that those presented with NSLs had the right to challenge the request in such letters and the nondisclosure provisions.

Merrill was later allowed to reveal his name under a partial gag order. Then in September 2015, U.S. District Judge Victor Marrero ruled that the government had “not shown a good reason for continued non-disclosure” of the request made of Merrill and his company. Marrero’s decision though came with a 90-day delay on its enforcement to give the government the opportunity to appeal.

“Judge Marrero’s decision vindicates the public’s right to know how the FBI uses warrantless surveillance to peer into our digital lives,” Merrill, now executive director of the Calyx Institute, said in a statement at the time. “I hope today’s victory will finally allow Americans to engage in an informed debate about proper the scope of the government’s warrantless surveillance powers.”

An appeal by the government was not made and on Monday the full gag order was lifted.

On Twitter Merrill wrote that his experience “illuminates flaws in the reciprocal notice that #USAFreedomAct codified. It places the burden to litigate on the NSL recipient.”

“The @FBI should not be able to silence innocent critics like myself – or hide abuses – simply by saying the magic words ‘National Security,’” he went on to write in a tweet.

After the gag order was fully lifted, the Yale Law School Information Society Project released the documents, which it said reveals the “previously undisclosed scope of [the] FBI warrantless surveillance tool.” Here’s from the law school’s news release:

Merrill is now able to reveal that the FBI believes it can force online companies to turn over the following information simply by sending an NSL demanding it: an individual’s complete web browsing history; the IP addresses of everyone a person has corresponded with; and records of all online purchases. The FBI also claims authority to obtain cell-site location information with an NSL, which effectively turns a cell phone into a location tracking device. In court filings, the FBI said that at some point it stopped gathering location data as a matter of policy, but that it could secretly choose to resume the practice under existing authority.

The Intercept, an online publication with founding editors that include Glenn Greenwald and Laura Poitras — two journalists who broke the NSA leak with Edward Snowden — reported on the “most striking revelations” from the disclosure of this document:

One of the most striking revelations, Merrill said during a press teleconference, was that the FBI was requesting detailed cell site location information — cellphone tracking records — under the heading of “radius log” information. Traditionally, radius log refers to a user’s attempts to connect to a server or a DSL line — a sort of anachronism given the progress of technology.

“The notion that the government can collect cellphone location information — to turn your cellphone into a tracking device, just by signing a letter — is extremely troubling,” Merrill said.

The court ruling noted that the FBI is no longer requesting this type of information using NSLs, but wants to maintain the possibility of doing so in the future.

A review by the Office of the Inspector General of the use of these letters between 2003 and 2006 found “repeated instances of the FBI’s misuse of NSL authorities.” A later review following the IG’s recommendations though, found significantly fewer were issued because of “increased scrutiny.”

Still, with more than 10,000 NSLs issued by the FBI to companies every year, according to Yale’s Law School, Merrill’s is the first case to get a gag order completely lifted.

“The broad scope of the FBI’s claimed NSL authority is deeply problematic because the government can issue NSLs without any judicial oversight,” Lulu Pantin, a law student intern who represented Merrill, said in a statement. “The fact that the FBI can obtain such sensitive information without prior judicial review raises serious Fourth and First Amendment questions.

“Mr. Merrill’s experience demonstrates the FBI indefinitely silences Internet Service Providers while forcing them to de-anonymize their users and divulge a broad range of information about law-abiding citizens’ online activity, simply by issuing a letter,” Pantin said.

—

Front page image via Shutterstock.