For years, the Federal Bureau of Investigation (FBI) has been demanding sensitive data on individuals’ telecommunications and Internet usage and refusing to allow businesses receiving those requests to divulge anything about them — even their existence — all without obtaining a search warrant. But now, after 11 years of court battles, one man has revealed the extensive information the FBI tried to get out of him with one of its National Security Letters (NSLs).
“For more than a decade, the FBI has been demanding extremely sensitive personal information about private citizens just by issuing letters to online companies like mine,” Nicholas Merrill, 43, said in a November 30 press release. “The FBI has interpreted its NSL authority to encompass the websites we read, the web searches we conduct, the people we contact, and the places we go. This kind of data reveals the most intimate details of our lives, including our political activities, religious affiliations, private relationships, and even our private thoughts and beliefs.”
In 2004, Merrill was the owner of a small Internet service provider in New York City. In February of that year, an FBI agent presented him with an NSL requesting “electronic communication transactional record[s]” on one of his clients. The letter also informed him that he was forbidden to tell anyone, including his client, about it.
“Based on the context of the demand … I suspected that the FBI was abusing its power and that the letter sought information to which the FBI was not entitled,” Merrill wrote in an anonymous 2007 op-ed in the Washington Post.
Merrill claimed he “never released the information the FBI sought.” Instead, he took the government to court. U.S. District Judge Victor Marrero in Manhattan soon ruled that the NSL law, which had existed since the 1970s but whose scope had been vastly expanded by the 2001 USA PATRIOT Act, was unconstitutional. Congress reinstated it, amending it to address some of Marrero’s concerns, including allowing an NSL recipient to challenge both the NSL itself and the gag order. In 2008, an appeals court ruled that the amended NSL statute was still partially unconstitutional. By then the FBI had ceased demanding the information from Merrill, but the gag order remained in place.
The FBI partially lifted the order two years later, allowing Merrill to announce that he was the plaintiff in the case and discuss some of the details of the NSL. He was not, however, permitted to release the NSL attachment listing the types of records the bureau had sought. Still, it must have been a welcome relief to Merrill, who in his op-ed stated, “I resent being conscripted as a secret informer for the government and being made to mislead those who are close to me,” including lying about his whereabouts when meeting with attorneys, denying that he was the plaintiff in the case, and hiding related papers where they wouldn’t be found.
Last year, a group of Yale University law students took up Merrill’s case, and he sued again to get the gag order completely lifted. In August, Marrero again ruled in Merrill’s favor, calling the FBI’s position “extreme and overly broad” and explaining that “courts cannot, consistent with the First Amendment, simply accept the Government’s assertions that disclosure would implicate and create a risk.” That was especially true in this case, he said, given that the NSL was over 11 years old and “many, if not all” of the techniques the FBI was trying to keep secret had been revealed by other agencies in the interim. Marrero stayed his decision for 90 days to give the government an opportunity to appeal.
As soon as the 90 days had passed with no appeal, Merrill released the NSL attachment to the public, though he did not release the name of the NSL’s target in order to protect his former client. The attachment requests that Merrill provide the client’s records of various types, including account information and number, “radius log,” screen names, online orders, billing history, email addresses, IP addresses, all account website information, and “any other information which you consider to be an electronic communication transactional record.”
Merrill highlighted the parts of the attachment he found most troubling in a press teleconference Monday.
First, reported the Intercept:
One of the most striking revelations, Merrill said…, was that the FBI was requesting detailed cell site location information — cellphone tracking records — under the heading of “radius log” information. Traditionally, radius log refers to a user’s attempts to connect to a server or a DSL line — a sort of anachronism given the progress of technology.
“The notion that the government can collect cellphone location information — to turn your cellphone into a tracking device, just by signing a letter — is extremely troubling,” Merrill said.
The FBI claims it no longer uses NSLs for cellphone tracking, but its court filings indicate it wants to keep open the possibility of doing so.
Second, Merrill’s press release argued that “the FBI believes it can force online companies to turn over the following information simply by sending an NSL demanding it: an individual’s complete web browsing history; the IP addresses of everyone a person has corresponded with; and records of all online purchases.” Merrill’s NSL doesn’t explicitly request all those things, but since “the FBI has long refused to clarify just how broadly it construes” the phrase “electronic communication transactional records,” the statement explained, it could conceivably demand such data. Merrill told a reporter that owing to the vagueness of many of the NSL terms, refusing to turn over such records, if demanded, “would make him fearful of consequences,” according to U.S. News & World Report.
The danger of letting the government conduct such warrantless searches, Merrill said, is that it would allow the FBI to “unmask anonymous online speakers and expose an individual’s networks of personal contacts and associations, raising important privacy and free speech concerns,” penned the Washington Post.
Merrill’s NSL release doesn’t shed much new light on the contents of NSLs, and it’s possible the letters currently in use are significantly different. Nevertheless, it’s worth having for a couple of reasons. First, the FBI is still issuing thousands of NSLs, each accompanied by a gag order, every year. Second, having a publicly available NSL and a victorious, known plaintiff will aid in the debate over government surveillance, which until now has been dominated by the feds’ side of the story. In his op-ed, Merrill expressed his frustration that the gag order had prevented him from participating in the debate over various PATRIOT Act reauthorizations, during which time he “would have contacted members of Congress to discuss [his] experiences and to advocate changes in the law.”
“At this moment, when the public is once again debating whether to expand the scope of the government’s surveillance authorities, we should pause to ensure that we know how existing authorities have been construed in secret,” Amanda Lynch, one of the Yale students representing Merrill, said in a statement. “The fact that Mr. Merrill is now able to reveal how the FBI has construed its NSL authority will enhance the quality of the public debate about surveillance and will give the public the opportunity to hold the FBI accountable.”
