Cloudflare Finally Able To Reveal FBI Gag Order That Congress Told Cloudflare Couldn't Possibly Exist

from the letter-that-dare-not-speak-its-[REDACTED-IN-FULL] dept

Another one of the FBI's thousands of National Security Letters has been made public -- along with its recipient. Cloudflare's latest transparency report (its seventh to date) contains a bonus: a 2013 NSL [PDF] the FBI felt no longer needed to kept secret.

This NSL was received in 2013, and was challenged by Cloudflare and the EFF. It's only now being made public, and that's largely due to litigation and the USA Freedom Act's changes to NSL review policies. Rather than review them every three years-to-never, the FBI must now review them more frequently. Better still, recipients are now allowed to challenge NSL gag orders within one year of receiving them. This places the burden back on the government to prove ongoing secrecy is needed.

Shortly before the new year, Cloudflare received a letter from the FBI rescinding the NSL's gag order.

The letter withdrew the nondisclosure provisions (the “gag order”) contained in NSL-12-358696, which had constrained Cloudflare since the NSL was served in February 2013. At that time, Cloudflare objected to the NSL. The Electronic Frontier Foundation agreed to take our case, and with their assistance, we brought a lawsuit under seal to protect its customers' rights.

In this particular case, the NSL itself was pulled by the FBI as a result of the lawsuit.

Early in the litigation, the FBI rescinded the NSL in July 2013 and withdrew the request for information. So no customer information was ever disclosed by Cloudflare pursuant to this NSL.

So much secrecy surrounds NSLs -- by default -- that Ken Carter of Cloudflare wasn't even able to correct a Senate staffer who told him things that were completely untrue.

In early 2014, I met with a key Capitol Hill staffer who worked on issues related to counter-terrorism, homeland security, and the judiciary. I had a conversation where I explained how Cloudflare values transparency, due process of law, and expressed concerns that NSLs are unconstitutional tools of convenience rather than necessity. The staffer dismissed my concerns and expressed that Cloudflare’s position on NSLs was a product of needless worrying, speculation, and misinformation. The staffer noted it would be impossible for an NSL to issue against Cloudflare, since the services our company provides expressly did not fall within the jurisdiction of the NSL statute. The staffer went so far as to open a copy of the U.S. Code and read from the statutory language to make her point.

That's what a gag order does: allows misinformation to go uncorrected. The staffer's interpretation of US Code may have been more to the letter of the law, but Cloudflare's Carter knew -- from personal experience -- that the FBI's interpretation was different.

Because of the gag order, I had to sit in silence, implicitly confirming the point in the mind of the staffer. At the time, I knew for a certainty that the FBI’s interpretation of the statute diverged from hers (and presumably that of her boss).

Not only does the default secrecy allow the FBI to continue to pursue questionable requests with NSLs, but it also allows it to deploy them in apparent violation of US law, right under the nose of its Congressional oversight.

Congratulations to both the EFF and Cloudflare, which worked together to protect a user's privacy against the FBI's self-issued NSL. Apparently the demand for information couldn't hold up when scrutinized by a judge for the first time. The fact that the USA Freedom Act only recently went into effect likely explains the three year-plus gap between the NSL's withdrawal and the lifting of the gag order.

While the USA Freedom Act's NSL-handling changes are an improvement, they're far from perfect. The burden of proof has been shifted to the government, but there's very little compelling it to respond to gag order challenges quickly, as the EFF points out.

Under the USA FREEDOM Act of 2015, the FBI is required to periodically review outstanding NSLs and lift gag orders on its own accord if circumstances no longer support a need for secrecy. As we’ve seen, this periodic review process has recently resulted in some very selective transparency by the FBI, which has nearly complete control over the handful of NSL gags it retracts, not to mention the hundreds of thousands it leaves in place. Make no mistake: this process is irredeemably flawed. It fails to place on the FBI the burden of justifying NSL gag orders in a timely fashion to a neutral third party, namely a federal court.

The EFF's legal battle against NSLs continues. We've seen incremental lifting of secrecy as a result of its multiple NSL challenges, but the EFF is hoping to see a court find the whole NSL scheme -- warrantless demands for user data and identifying information the FBI often uses to route around judicial rejection -- to be unconstitutional.

Filed Under: congress, fbi, gag order, nsl
Companies: cloudflare, eff

Internet Archive Calls Out FBI For Using Outdated NSL Boilerplate; Scores Removal Of Gag Order

from the shame:-the-universal-motivator dept

One of the reforms included in the USA Freedom Act is the actual ability to challenge National Security Letter gag orders. Prior to the passage of this bill, recipients were limited to challenging gag orders once per year -- challenges that rarely succeeded. The process is no longer restricted to annual challenges, but many recipients won't be aware of this fact because the FBI hasn't been interested in telling them.

The Internet Archive -- with the assistance of the EFF -- has managed to lift a gag order on an NSL it received. This NSL [PDF], like the thousands of NSLs the FBI issues each year, came with outdated information regarding recipients' options for challenging gag orders.

The NSL we received includes incorrect and outdated information regarding the options available to a recipient of an NSL to challenge its gag. Specifically, the NSL states that such a challenge can only be issued once a year. But in 2015, Congress did away with that annual limitation and made it easier to challenge gag orders. The FBI has confirmed that the error was part of a standard NSL template and other providers received NSLs with the same significant error. We don’t know how many, but it is possibly in the thousands (according to the FBI, they sent out around 13,000 NSLs last year). How many recipients might have delayed or even been deterred from issuing challenges due to this error?

Having been caught using outdated boilerplate, the FBI will now be sending out thousands of correction letters [PDF]. It's not as though the FBI wasn't aware of the changes in the laws governing NSLs. It likely found it more conducive to its secrecy aims to allow the old boilerplate to remain until recipients caught on.

Not only will the FBI be updating its NSL boilerplate, but it has apparently been shamed into transparency… at least in this particular case. The gag order on this NSL has been dropped and the Internet Archive is allowed to publish the redacted request.

The request asks for all personal information related to the targeted accounts from "inception to present." But there's another problem with the request which goes beyond outdated boilerplate. As the EFF's letter to the FBI [PDF] points out, the Internet Archive isn't the sort of entity the FBI can actually serve an NSL to.

18 U.S.C. 2709 is inapplicable to the Archive in this matter because the Archive is a library. Under 2709(g), the FBI cannot issue an NSL demanding records -- or imposing a nondisclosure requirement -- to libraries unless they are providers of wire or electronic communications services. The NSL does not specify which of the Archive's services it seeks records from and thus does not identify any context in which the Archive is a provider of a wire or electronic communication service.

The letter also points out that the FBI's gag order is unconstitutional prior restraint, something that runs contrary to the First Amendment. Of course, it's one thing for an NSL recipient to make this allegation. It's quite another to have it confirmed by a federal court. The EFF's constitutional challenge of NSL gag orders is currently awaiting review by the Ninth Circuit Court of Appeals. Whatever conclusion the court arrives at, there's little doubt that it will ultimately make its way to the US Supreme Court. Whether or not the Supreme Court decides to address it is likely still at least a year or two away.

But the voluntary lifting of a gag order by the FBI is a positive development -- one that suggests the more these orders are challenged, the more often the government will discover its demands for indefinite secrecy are rarely supported by the facts of the case.

Filed Under: fbi, gag order, national security letter, nsl, usa freedom act
Companies: eff, internet archive

More National Security Letters Made Public After Government Drops Its Attempt To Keep Its Gag Orders In Place

from the most-transparent-administration-still-all-about-forced-transparency dept

Thanks to the EFF's efforts, another set of National Security Letters have been published and their recipient freed to discuss them. CREDO Mobile received two NSLs in 2013 -- both accompanied with the usual indefinite gag order. The NSLs [PDF 1] [PDF 2] requested a wealth of data on three of CREDO's customers -- including all call records, financial information (credit cards used, etc.), and personal information (name, address, etc.) -- dating back to April 2008.

CREDO challenged the constitutionality of the indefinite gag orders as well as the constitutionality of the NSLs themselves.

“A founding principle of CREDO is to fight for progressive causes we believe in, and we believe that NSLs are unconstitutional. These letters, and the gag orders that came with them, infringed our free speech rights, blocking us from talking to our members about them or discussing our experience while lawmakers debated NSL reform,” said Ray Morris, CREDO CEO. “We were proud to fight these NSLs all these years, and now we are proud to publish the letters and take full part in the ensuing debate.”

CREDO's challenge to the gag order was upheld [PDF] by a federal judge in March, who struck it down when the FBI failed to show a need for the continued secrecy. This decision was held pending the FBI's appeal, but the government apparently decided this wasn't a battle it wanted to fight and dropped its appeal of the court's order.

The government's decision to drop the appeal highlights one of the (many) problems with NSLs. These are self-issued administrative orders subject to very little, if any, oversight. The FBI can issue as many of these as it wants without ever having to get a judge involved. Every one of these arrives with an indefinite gag order attached, forcing recipients to lawyer up if they want to challenge the government's demands for secrecy.

The government clearly felt it couldn't demonstrate why this gag order should still be in place. But the government doesn't have to justify its demands for secrecy at the point the NSL is issued. It only needs to do this if challenged in court. While some judges have expressed an interest in periodic reviews of NSLs to determine the need for ongoing secrecy, these conclusions are the exception rather than the rule.

That judges are the ones making this determination is another part of the problem. In response to the USA Freedom Act, the DOJ instituted a policy requiring a "periodic" review of issued NSLs. Unfortunately, that's all it does. There's no definition attached to "periodic," which means the review could happen every few years… or never.

The constitutionality of the orders themselves should still be actively challenged. While much of what is sought with these falls under the very generous definition of "third party records," the lack of any oversight or judicial review makes these the go-to tool for the FBI -- which has been known to issue NSLs when its warrant requests are turned down by federal courts. Throw an indefinite gag order on it, and the FBI can pretty much ensure complete compliance from recipients, whose only option is to fight an often-futile legal battle against the government.

Filed Under: doj, fbi, first amendment, gag order, nsl
Companies: credo mobile, eff

Yahoo Asks James Clapper To Please Let It Talk About The Email Scanning It Did For The Government

from the 'it-already-sucks-enough-to-be-us' dept

After spending several days basking in the fiery glow of negative press (and seeing potential investors walk away from buying the company), Yahoo is asking the government to please please let it talk about the spying it apparently performed for the NSA or FBI.

Yahoo sent a letter to National Intelligence director James Clapper on Wednesday urging the U.S. government to provide clearer information to citizens on national security demands for user data.

Yahoo’s letter called for intelligence groups to confirm if future reported demands for data are real, and if they are, declassify them with context for the public.

Pots, kettles, and other analogous materials are rendered incomprehensible in its statement, which involves a media company implicitly criticizing other media companies.

In a letter today to James Clapper, Director of National Intelligence (DNI), Yahoo is formally urging that the U.S. government provide its citizens with clarification around national security orders they issue to internet companies to obtain user data.

While the letter makes specific reference to recent allegations against Yahoo, it is intended to set a stronger precedent of transparency for our users and all citizens who could be affected by government requests for user data. As we’ve said before, recent press reports have been misleading; the mail scanning described in the article does not exist on our systems.

"Does not exist" is not nearly the same thing as "did not exist." This means Yahoo is no longer scanning emails in this fashion, not that it never performed this scanning.

The letter does make a good point about transparency. Currently, Yahoo is unable to defend itself against any allegations because it is likely under a gag order. Yahoo would like Clapper's office to share in the public pain, especially since it had a problem sharing in the communications gathered on its behalf by the email provider.

Public embarrassment or not, Clapper's office is probably not rushing through a declassification review of this Section 702 FISA order. It could still be months or years before the government produces this document and/or allows Yahoo to speak openly about its email scanning program.

Perhaps recognizing that a displeased letter to the ODNI doesn't create much leverage, the company appears to be making this a global issue, rather than simply a domestic one. Marcy Wheeler points out that the letter mentions Yahoo's global reach and users several times and namechecks the EU's Privacy Shield agreement. This may be the key that loosens the Intelligence Community's Glomarred lips.

But there’s another reason why Clapper’s office — or rather ODNI General Counsel Bob Litt — may be so quiet.

Litt is the one who made many of the representations about US spying to authorities here [Wheeler is in Europe at the moment]. Someone — Litt, if he’s still around for a hearing that may take place under President Hillary — may also need to go testify under oath in an Irish court in conjunction with a lawsuit there. Whoever testifies will be asked about the kinds of surveillance implicating European users the government makes US companies do.

In other words, Bob Litt is the one who made certain representations to the European authorities. And now some of those same people are asking questions about how this scan complies with the terms Litt laid out.

Which makes his silence all the more instructive.

Someone's going to have to start talking about Yahoo's email scanning program soon. Yahoo obviously can't, which means the ODNI is going to have to address this on someone else's timetable. We already have US legislators demanding answers. European politicians are already unhappy about the apparent breach of the Privacy Shield Agreement. If the ODNI continues to avoid the issue, all it will be doing is letting a private company take the fall for its possible overreach.

Filed Under: email, gag order, james clapper, mass surveillance, nsa, scanning, surveillance
Companies: yahoo

FBI Lifts Gag Order On NSL Issued To Google... Which Doesn't Have Much To Say About It

from the THIS-JUST-IN:-mumblemumble...gag-order...mumble dept

The government's embrace of transparency -- an uncomfortable hug forced on it like a drunken uncle at a wedding reception by the passage of the USA Freedom Act -- has paid off for a local computer concern. Google is now able to speak in non-specifics about one (1) National Security Letter it has received.

The national security letter issued to Google was mentioned without fanfare in Google’s latest bi-annual transparency report, which includes information on government requests for data the company received from around the world in the first half of 2016.

Google received the secret subpoena in first half of 2015, according to the report.

Here's the original wording from the report, which follows actual specifics about new countries Google can add to the list of entities demanding user info from it (Algeria, Belarus, Cayman Islands, El Salvador, Fiji, and Saudi Arabia):

[P]ursuant to the USA Freedom Act, the FBI lifted a gag restriction on an NSL issued in the second half of 2015.

The law requires the FBI to "periodically" review its NSL-related gag orders to see whether the restriction still needs to be in effect. Theoretically, the gag order should be lifted three years after the NSL is issued or the investigation concludes, whichever comes first. Theoretically. I guess we'll see if the gag order floodgates begin opening in 2019.

In addition to finally being able to barely talk about it, Google was also able to move the transparency dial forward exactly one click.

To reflect this, we have updated the range of NSLs received in that period — July to December 2015 — from 0-499 to 1-499.

What Google hasn't done is publish the request itself, something both Yahoo and Signal did once given the green light by the feds. It cited no reasons for withholding the contents. However, it may be unable to fully publish the letter, despite the lifting of the gag order, as The Intercept's Jenna McLaughlin points out.

It’s… unclear why Google wouldn’t immediately publish the document — unless the gag is only partially lifted, or the company is involved in ongoing litigation to challenge the order, neither of which were cited as reasons for holding it back.

In other news, Google saw an increase in FISA-ordered requests for user info, bumping it up by about 5,000 total accounts as compared to the previous reporting period.

Hopefully, Google's ungagged-but-still-secret NSL won't stay secret for much longer. It would be troubling if this were to become Google's standard policy -- the announcement of gag order removals but with no further details forthcoming. Not much "transparency" in the Transparency Report, unfortunately… not if that's how it's going to be handled.

True, much of the opacity is still the government's fault: the not-at-all-useful "banding" that makes NSL numbers impossible to parse (1-499 could mean one NSL… or almost 500 in one reporting period), the gag orders that remain in place forever, etc. But private companies shouldn't take their cues from naturally-secretive government agencies. They're pretty much all we have to provide us with an outside, somewhat unrestricted measure of the government's surveillance efforts.

Filed Under: fbi, gag order, nsl, secrecy, transparency
Companies: google

EFF's Challenge Of NSL Gag Orders Reaches The Ninth Circuit Court Of Appeals

from the FBI-still-not-a-fan-of-the-Constitutional dept

In a rather quick turnaround, the EFF has had its brief [PDF] it filed under seal in September unsealed by the Ninth Circuit Court of Appeals. The brief challenges the FBI's use of gag orders with its National Security Letters -- the administrative subpoenas the FBI issues to recipients without having to run them by a judge.

Unfortunately, the brief has been heavily redacted and both the appellee and appellant remain undisclosed. The filing challenges NSL gag orders, claiming them to be unconstitutional infringements on the First Amendment. The EFF is arguing on behalf of its redacted clients, both "electronic communications providers."

Beyond preventing the providers from informing the FBI's targets that their communications/data are being turned over to the government, the EFF points out that the gag orders have been stopping them from discussing these limitations with Congress -- even to the point of correcting bad information given to legislators by the FBI itself.

An NSL gag prevented [redacted] Appellant from correcting [lengthy, two-line redaction] and that [another lengthy redaction] ER 129. Similarly, an NSL gag prevented [redacted] Ithrough its [redacted] from telling Congress and the public about [redacted] experiences as an NSL recipient and explaining why those experiences informed its belief that the FBI-supported amendments to the NSL statute proposed in 2014 (and later enacted) would be insufficient to remedy problems with the FBI's use of NSLs.

This is spelled out a little more explicitly later in the filing.

But as discussed above, the gag orders had the direct effect of preventing [redacted] from informing a legislative official [redacted] that [redacted] seriously misapprehended the scope of that statute.

During the period when this legislation was being argued, recipients of these letters were forbidden to discuss them, providing the FBI with a handy, one-sided platform to deploy its arguments in favor of the changes it wanted.

As the law stands now, the FBI can issue as many NSLs as it wants (and it does, at a rate of well over 10,000 per year) without judicial oversight and demand recipients never discuss them. The only judicial review these NSLs receive is after the fact and that's only if the court feels NSL recipients are actually in a position to demand periodic review of indefinite gag orders.

The FBI can also review gag orders itself to see if they're still justified, but it's wholly internal and the process allows the agency to decide in its favor every time. It places the FBI under no obligation to turn over its internal findings to Congressional oversight or even inform recipients when investigations are closed and a gag order could theoretically be lifted.

But for all the arguments about means, methods, terrorism, ongoing investigations or whatever, it is the FBI is using to justify issuing tens of thousands of gag orders every year, it's still nothing more than indefinite prior restraint.

The gag order provision of the NSL statute violates the First Amendment for two independent reasons.

First, the statute lacks the substantive and procedural requirements necessary to uphold a prior restraint because it allows the government to unilaterally impose indefinite gags on recipients and, in the rare instance that a court reviews the gag, requires the court to approve it upon a showing of the mere possibility of harm. The district court justified upholding the NSL statute only by inventing a new category of prior restraints involving “non-customary” speakers as a basis for reducing the First Amendment protections against prior restraints.

Second, the statute is a content-based restriction that fails strict scrutiny because it allows the FBI to impose indefinite, overinclusive gags that bar recipients from discussing government conduct without any consideration of less restrictive means of protecting national security.

This Court should reject the district court’s improper departure from established First Amendment law and hold that the NSL statute is unconstitutional.

The FBI's NSL closed-loop needs to be cracked open. It's writing itself permission slips for data and other records from service providers at a rate of more than 30 times a day and demanding secrecy forever in almost every case. It's not just screwing with companies, their customers, and a few Constitutional amendments (1st, 4th, 5th), it's actually preventing lawmakers and oversight committee members from hearing the other side of the argument when crafting legislation.

Filed Under: 9th circuit, free speech, gag order, nsl, surveillance
Companies: eff

Feds Gagged Encrypted Communications Firm Open Whisper Systems Over Massively Overbroad Subpoena

from the and-then-backed-down dept

This morning the ACLU announced that it had convinced the government to remove a ridiculous gag order on a subpoena that had been sent to Open Whisper Systems, the makers of the popular Signal encrypted messaging app, and whose encrypted communication protocol is used by many others, including WhatsApp, Facebook and Google for their encrypted messaging offerings. It's not that surprising that a grand jury would issue a subpoena to Open Whisper Systems demanding "subscriber name, address, telephone numbers, email addresses, method of payment, IP registration, IP history logs and addresses, account history, toll records, upstream and downstream providers, any associated accounts acquired through cookie data, and any other contact information from inception to the present" for certain accounts being investigated. But, of course, Open Whisper Systems has basically none of that data. It "complied" with the subpoena to the extent that it could, which is basically that the only information it has is when the account was created and the last time it was accessed: As Marcy Wheeler rightly points out, the request itself is way too broad, covering information that the government is not allowed to ask for under ECPA (Electronic Communications Privacy Act). But, it's not like the government feels it needs to follow its own laws anyway...

The really concerning part about this, however, is that the subpoena came with an unnecessary and likely unconstitutional gag order. The gag order was, at least, bounded. After years of the DOJ issuing gag orders with no end date, at least this one was limited to one year. However, as the ACLU pointed out, a gag order needs to meet a pretty high bar to get over the fairly large First Amendment hurdle. And this one did not do that:

A magistrate judge signed the gag order, citing “reason to believe that notification of the existence of the . . . subpoena will seriously jeopardize the investigation [under prosecution by the grand jury], including by giving targets an opportunity to flee or continue flight from prosecution, destroy or tamper with evidence, change patterns of behavior, or notify confederates.”

Of course, those risks could be real, and the government’s need for secrecy in law enforcement investigations cannot be dismissed outright. But that general interest applies in virtually every criminal investigation, including those involving the public execution of search warrants. To meet the stringent First Amendment standard, any gag must be justified by something much greater. The First Amendment requires that to close courtrooms or seal evidence—and especially to prohibit a party from speaking publicly on a matter of public concern—the government demonstrate a compelling interest in secrecy, and it must apply that secrecy in the narrowest possible way. But instead, the government appears to seek blanket gag orders by default, without considering precisely what information can be disclosed without harm to its interests.

Open Whisper Systems went to the ACLU. The ACLU reached out to the government with a friendlier version of "WTF?" -- and the government basically backed down immediately, more or less admitting that the gag order was bogus:

To its credit, the government quickly agreed with us that most of the information under seal could be publicly disclosed. But the fact that the government didn't put up too much of a fight suggests that secrecy—and not transparency—has become a governmental default when it comes to demands for our electronic information, and critically, not everyone has the resources or the ability to work with the ACLU to challenge it.

OWS immediately recognized that even though the government required some secrecy over the subpoena, it did not need, nor could it justify, total secrecy. So OWS came to us, and we went to the government, which agreed to reverse its original demand for secrecy—and now OWS’s customers and the broader public can see for themselves just how wildly overbroad the government’s gag order was from the jump. And while this—the only one ever received by OWS—is now public, there are many more like it, hiding in the filing cabinets in the U.S. attorney’s offices across the country.

Of course, this leaves the big open question implied by the ACLU's statement above: how many other companies have also received unconstitutional gag orders, and simply complied? The larger tech companies have gotten much better (in the post-Snowden era) of pushing back against such gag orders, but for smaller companies it's likely that many are just complying, because they don't have either the resources or knowledge that this kind of thing is not actually allowed.

Filed Under: 1st amendment, encrypted communications, encryption, gag order, signal, subpoena
Companies: aclu, open whisper systems

ACLU Challenges Gag Orders Issued To Tech Companies By The DOJ

from the hey,-we-notified-SOMEBODY...-that-counts-for-something dept

The ACLU is hoping to intervene in Microsoft's legal battle against the government, challenging gag orders attached to warrants and subpoenas issued under the Electronic Communications Privacy Act (ECPA). Microsoft sued the DOJ back in April, arguing for the right to notify customers that their communications and data have been handed over to the government.

Microsoft didn't have a problem with the government's gag orders in every case. It's just that the demand for secrecy accompanied more than half of the ~300 orders per month Microsoft receives. And nearly 70% of those gag orders arrived with no fixed end date.

The ACLU petitioned the court to intervene in the case on its own behalf, citing its position as a Microsoft customer. The DOJ filed a motion to dismiss Microsoft's lawsuit, hoping the court will find Microsoft has no standing to challenge gag orders on its customers' behalf. The ACLU is trying to prevent this from happening until the DOJ addresses the issues raised by the ACLU's (attempted) intervention. In its opposition [PDF] to the DOJ's motion, the ACLU points out that the government's "no standing" argument pretty much nullifies any sort of due process for Microsoft customers (including the ACLU) who've been targeted by the DOJ's super-secret warrants, relegating them to a Kafka-esque legal purgatory.

The government attempts to insulate its refusal to provide notice from judicial review, arguing that neither Microsoft nor the ACLU has standing to raise these important constitutional questions. By the government’s logic, Microsoft does not ever have standing to defend its customers’ right to notice, and Microsoft’s customers, including the ACLU, may not defend their own right to notice until after they receive the primary relief they would seek—that is, notice. In the government’s view, the only plaintiffs who have standing to sue for notice are those who have already gotten it, and those deprived of notice forever have no ability to seek a remedy at all. That is not the law.

The hope here is to not only find the open-ended gag orders unconstitutional, but also the law granting this secrecy -- the ECPA -- unconstitutional as well. The shift from physical "papers" to digital files was addressed by legislators in the worst way possible. The ECPA did away with the notification requirement attached to searches of physical places. When a home or business is searched, the owner or resident is served with a warrant. For electronic communications, a third party is approached. Legislators apparently felt as long as someone was notified, that was good enough -- even if that someone isn't the target of the search warrant.

That's basically the government's argument: notice is served to the site of intrusion. If the affected parties don't actually reside there (but their "papers" do), too bad.

The government’s argument conflates a historical anachronism with a constitutional principle. The government is correct that officers traditionally provided Fourth Amendment notice at the physical site of the intrusion. But that is so because, for the first 175 years of the Fourth Amendment’s application, it was understood to cover primarily physical trespasses. See Katz, 389 U.S. at 353. As a result, notice provided at the site of the intrusion was notice to the individual whose Fourth Amendment rights were at stake. It is no surprise, therefore, that Federal Rule of Criminal Procedure 41 reflects that historical context. Under Rule 41(f), an officer executing a warrant must “give a copy of the warrant and a receipt for the property taken to the person from whom, or from whose premises, the property was taken or leave a copy of the warrant and receipt at the place where the officer took the property.”

The ECPA is the DOJ's argument committed to paper. Notice only needs to be provided to the third party where communications and documents are held. To ensure the party whose documents/communications are being taken is kept out of the loop, the DOJ takes the wording of the law to heart and ignores the intent behind the Fourth Amendment protections granted to citizens.

The ECPA does not require the government to provide notice when it relies on a warrant, and so the government now routinely searches and seizes individuals’ electronic communications without providing any notice—delayed or otherwise—to those whose private information it has obtained. According to Microsoft’s Complaint, nearly half of the federal demands it has received under ECPA in the last eighteen months were accompanied by gag orders, the majority of which contained no time limit. Accordingly, a substantial portion of the individuals whose electronic communications the government demands from Microsoft receive no notice whatsoever, from either the government or Microsoft.

The law undercuts the Fourth Amendment by preventing those affected from challenging the lawfulness of the search or seeking redress through the judicial system for violations. Gag orders that run indefinitely allow the government to avoid being held accountable for any wrongdoing. In addition, the service of warrants to third parties is done without any meaningful oversight, putting the DOJ in the position of policing itself -- something it does with no particular enthusiasm or effectiveness.

Filed Under: doj, ecpa, gag order, standing, subpoena, surveillance, warrants
Companies: aclu, microsoft

Post Gag Order, Lavabit Founder Reveals Non-Secret That Feds Were After Ed Snowden's Emails

from the the-least-surprising-news-ever dept

Want some unsurprising news? Apparently a three year gag order has just lapsed, allowing Ladar Levison, the founder and former operator of Lavabit, the secure email service Ed Snowden famously used, to finally say that yes, the feds asked him to turn over his encryption key in order to access Ed Snowden's emails.

Lavabit founder Ladar Levison can finally confirm that Edward Snowden was the target of the 2013 investigation, which led to the shutdown of the Lavabit email service. The original case concerned law enforcement’s authority to compel the disclosure of an SSL/TLS private key, which belonged to Lavabit, and was used to protect the communications of all 410,000 customers, when only one of those customers was the subject of a criminal investigation. After three years, and five separate attempts, the federal judge overseeing the case has granted Mr. Levison permission to speak freely about investigation. The recently delivered court decision unseals the vast majority of the court filings, and releases Mr. Levison from the gag order, which has limited his ability to discuss the proceedings until now.

Mr. Levison has consistently relied on the First Amendment in his court filings, which sought to remove the gag orders entered against him. He argued that such orders are an unconstitutional restraint against speech, and an afront to the democratic process. He plans to use his newfound freedom to discuss the case during a planned presentation on Compelled Decryption at DEF CON 24 in Las Vegas, NV.

Of course, the fact that the feds were after Snowden isn't exactly news. First off, it's what everyone assumed the second the site shut itself down. But, more importantly, earlier this year, a redaction failure revealed it directly: Still, it's good that the gag order has finally been lifted, and it's great that Levison is now going to talk about these issues more widely. He also notes plans to create a legal defense foundation to help with similar cases:

In order to continue the fight, Mr. Levison is forming the Lavabit Legal Defense Foundation (or “LavaLegal”), a non-profit organization founded to, among other things, protect service providers from becoming complicit in unconstitutional activities, and fight secret attempts aimed circumventing digital privacy or impinging upon the right of those involved to speak of the experience. The foundation will be funded by donations from people and organizations all over the world that want to help protect digital privacy and bolster our collective defense against government overreach.

Filed Under: doj, ed snowden, encryption, first amendment, gag order, keys, ladar levison, service providers
Companies: lavabit

Judge Calls Out Prosecutors For Bogus Subpoena Gag Orders

from the it's-a-request,-not-a-demand dept

At long last, it appears some prosecutors will no longer be putting BS gag orders on their subpoenas. Eastern District of New York judge Raymond J. Dearie has expressed his displeasure with the language found on nearly all subpoenas issued by the Brooklyn, New York US Attorney's Office.

With the exception of National Security Letters, recipients of subpoenas are free to inform the targets of the documents as well as discuss them publicly. (The exception is financial institutions served in grand jury investigations related to fraud or drug trafficking.) But that doesn't stop prosecutors and investigators from adding misleading statements to their subpoenas. They can only ask recipients not to disclose anything. They can't demand it. That's called "prior restraint" -- something the government should be taking great care to avoid. But some still make it appear as though the recipient has no choice but to comply and shut up.

As was covered here earlier, Reason's website received a subpoena for information on its commenters. Included with the subpoena was a request that Reason not talk about it. Reason's attorneys understood it was only a request and went ahead and informed the commenters targeted by it. Most recipients won't do this because prosecutors either utilize deliberately vague wording (making it seem more like a demand than a request) or verbally suggest any disclosure could result in criminal charges for the recipient.

The latter tacic was deployed in the Reason case. When it informed the US Attorney's office that it would be making the subpoena public, AUSA Niketh Velamoor suggested the site was "coming close" to "interfering with a grand jury investigation."

Judge Dearie has gone after the US Attorney's Office in Brooklyn for basically doing the same thing. A subpoena related to a cocaine smuggling investigation issued to a law office contained the following words:

You are hereby directed not to disclose the existence of this subpoena, as it may impede an ongoing investigation.

No subtlety there. This is an order -- and an illegal one at that. The battle over that phrase resulted in the discovery of widespread abuse by the prosecutor's office.

The Gigliotti case suggests that this was not the first time that prosecutors in the Eastern District of New York made such a demand. “Policy was violated multiple times here,” Judge Raymond J. Dearie wrote last week in a ruling, “and it is apparent that such violations are not isolated to this case.”

The lawyers challenging the wording called it "blatantly improper." The judge called it a "violation." The office issuing the bogus wording called it something else: "inadvertent." (It agreed it was "improper," but refused to take responsibility for crafting the words it crafted.)

Prosecutors said they will fix this going forward, although they were vague enough on details that Dearie had more harsh words for them.

In a decision last week, Judge Dearie called the government’s response “disappointing” and “glib,” saying prosecutors did not outline the scope of the problem or how they would address it.

'“Now that the government is unambiguously on notice of this problem and the need to correct it, continued violations could well warrant severe remedies,” Judge Dearie wrote.

“The government proceeds at its peril.”

Most likely, the prosecutors will continue to issue verbiage that strongly suggests recipients keep their mouths shut. They're apparently going to put this wording on a separate piece of paper (rather than on the subpoena itself) from now on, as if that somehow changes the implicit severity of the misleading language.

While it is good to see the office called out for its bogus demands, little will change if it can regularly rely on the ignorance of subpoena recipients to maintain the secrecy it can't actually demand. The more foreboding the wording sounds, the more likely it is that these "requests" will be complied with. The most honest solution would be to remove the wording entirely, unless nondisclosure is stipulated by statute.

Filed Under: brooklyn attorney's office, gag order, raymond dearie, subpoena