There May Be A New Boss At The DOJ, But The Government Still Loves Its Indefinite Gag Orders

from the inalienable-right-to-STFU dept

Despite the DOJ recently drawing heat for its targeting of journalists during internal leak investigations, a lot still hasn't changed about the way demands for data are handled by the feds. Over the past couple of decades, the DOJ and its components have been asking for and obtaining data from service providers, utilizing subpoenas and National Security Letters that come with indefinite gag orders attached.

These orders swear recipients like Microsoft and Google to secrecy, forbidding them from notifying targeted customers and users. (Even Techdirt has been hit with one.) Unlike regular search warrants, where the target is made aware of the rummaging by the physical presence of law enforcement officers, warrants, subpoenas, and NSLs allow the government to go about its rummaging unnoticed.

Reforms to surveillance powers by the USA Freedom Act have at least forced the government to perform periodic reviews of ongoing gag orders. It has also given companies a way to challenge gag orders and demands for data, but that's only useful if the companies have some idea who is being targeted. As this report on the ongoing abuse of gag orders by Jay Greene and Drew Harwell for the Washington Post points out, it's not always clear who the government is seeking information about. (Alternative link here.)

[T]ech company officials said it is often difficult to tell which orders are worth fighting. The orders are often vague — sometimes just email addresses — and the owner of the account isn’t always obvious.

Microsoft provided two secrecy orders to The Post with the names of the customers redacted. Each is only about four paragraphs long and declares that notifying the customer about the existence of the data request could lead to evidence tampering or flight from prosecution.

Neither order offers any support for those claims, or any details to indicate why secrecy is necessary. Microsoft complied with both orders and notified customers of the seizure only after the orders expired.

Even with those limitations, some companies are doing what they can to push back on these unreasonable restrictions.

Microsoft said it generally complies with secrecy orders because it is legally required to do so. At Google, director of law enforcement and information security Richard Salgado said the company will challenge nondisclosure orders if there are “external signals” that the orders lack merit.

But those are the exceptions, not the rule. Nearly 70% of the 62,000 government requests Facebook received during the last six months of 2020 came with gag orders attached. Microsoft receives far fewer requests, but still sees 7-10 requests with gag orders per day. Add in Google and Apple and the number of requests easily tops 100,000 per year. If Facebook is an outlier, it's still probably safe to assume nearly half of those come with gag orders. That's a lot of secrecy and it's absolutely certain all of it isn't justified.

The government claims the courts keep it honest, but given the dearth of challenges, it's a claim the feds can make only because the pushback is so limited. And it's deliberately limited. If a judge clears it, recipients have to assume the secrecy is warranted.

But agencies like the FBI issue their own paperwork and gag orders that don't require any judicial oversight. NSLs begin and end inside agencies, reliant only on whatever internal oversight there is to ensure these aren't abused. And history shows they are abused -- something the FBI turns to when its demands for information or data are rejected by the judicial oversight the DOJ claims keeps its vast power in check.

Even when targets are finally notified, they aren't given all the information. The Washington Post article details a former Defense Department contractor (Ryan Lackey) who was informed the government demanded data from Facebook, a platform he has used regularly for the last 15 years. Even though he was told the government sought his data, he was unable to find out what the government sought and for what time period. And that notification arrived nearly two years after Facebook had handed over his data.

The government won't answer any questions about it. Neither will Facebook, which suggested he get a lawyer.

After receiving the March email, Lackey asked Facebook what information it had handed over and what time frame the request covered. In an emailed response reviewed by The Post, the tech giant wrote that it couldn’t give him “legal advice” and suggested that he “consult with an attorney.”

Lackey said he has been left with “low-level anxiety” and lots of unanswered questions.

“I’m not opposed to helping law enforcement with a legitimate investigation,” he said. “But if it’s a civil liberties violation or a fishing expedition, I don’t want to help them in that.”

Legislative efforts continue to rein in these powers and limit demands for indefinite secrecy. But the feds are fond of these 9/11-enabled powers and in no hurry to see them restricted. Claims about public safety and national security tend to be all that's needed to convince certain legislators that the government's business should continue as usual. Those pushing back have limited information to work with, thanks to years of deference in service to the never-ending War on Terror.

This shouldn't be considered business as usual in a free country where citizens have inalienable rights that are supposed to protect them against unchecked snooping by the government, as well as grant them the ability to challenge unjustified demands for their possessions and papers. But a handful of wars engaged in by the government against its citizens (Terror, Drugs) have reduced these rights to privileges only very occasionally recognized by the agencies engaging in unwarranted seizures and only slightly more occasionally recognized by the courts, which have largely shrugged off their obligations to keep the government in check.

Filed Under: 1st amendment, doj, fbi, gag orders, journalism, national security letters, nsls
Companies: google, microsoft

Cloud Communications Service Twilio Releases Two NSLs Sprung From Their Gag Order Cages

from the all-purpose-paperwork dept

Another communications platform has published National Security Letters it has received from the FBI. Twilio -- a San Francisco-based cloud communications platform -- has published two NSLs freed from the confines of their accompanying gag orders.

When Twilio receives requests that are issued without the review of a court, such as National Security Letters, Twilio will ask the agent to instead produce a court order or withdraw the nondisclosure component of the request.

Twilio requested judicial review of the nondisclosure requirement, and as a result, received permission from the U.S. Department of Justice to publish two National Security Letters, in addition to the letters authorizing Twilio to do so.

Twilio was also permitted to count the two National Security Letters in our semi-annual transparency report for the second half of 2017. Therefore, Twilio indicates receiving between 2 and 999 National Security Letters in the time range of July 1, 2017 through December 31, 2017.

Twilio says it will continue to challenge the gag orders attached by default to FBI NSLs, which should result in more published NSLs in the future. The two posted by Twilio are fairly recent. Both were received in May of last year. Both also contain the FBI's response letter letting Twilio know the gag orders had been lifted.

The first [PDF] of the two published lets Twilio know the FBI has agreed to lift the gag order. It also states the FBI is withdrawing its request for subscriber info. The second [PDF] is a little more interesting. The FBI agreed to lift the gag order, but requested Twilio give it a ring before notifying the affected customer.

Please be advised that the FBI has reviewed the nondisclosure requirement imposed in connection with the NSL at issue and determined that the facts and circumstances supporting nondislosure under 18 USC 2709(c) no longer continue to exist. Consequently, the government is lifting the nondisclosure requirement imposed in connection with the NSL at issue… [T]he FBI also asks that Twilio notify Special Agent [redacted] of the FBI Cincinnati Field Office, in the event Twilio chooses to inform the subscriber of the account at issue regarding the NSL request or any of the information set forth in that request…

This sounds like "assessment" stuff -- where the FBI rounds up everything it can obtain without a warrant to start building towards a preliminary investigation and possibly even the probable cause needed to continue pursuing a suspect. But the FBI office is seemingly willing to spook a subject in exchange for whatever minimal account info Twilio has on hand. That's a little strange, considering the gag order was lifted within a few months of the NSL being sent. The two published by Twilio are unlike the NSLs published elsewhere, some of which are closer to a decade old at this point.

Whatever the case, it's more transparency from another service provider, adding to the body of public knowledge on the FBI's use of NSLs.

Filed Under: gag orders, nsls, surveillance, transparency reports
Companies: twilio

The Case Of Glassdoor And The Grand Jury Subpoena, And How Courts Are Messing With Online Speech In Secret

from the it-ain't-so-grand dept

In my last post, I discussed why it is so important for platforms to be able to speak about the discovery demands they receive, seeking to unmask their anonymous users. That candor is crucially important in ensuring that unmasking demands can't damage the key constitutional right to speak anonymously, without some sort of check against their abuse.

The earlier post rolled together several different types of discovery instruments (subpoenas, warrants, NSLs, etc.) because to a certain extent it doesn't matter which one is used to unmask an anonymous user. The issue raised by all of them is that if their power to unmask an anonymous user is too unfettered, then it will chill all sorts of legitimate speech. And, as noted in the last post, the ability for a platform receiving an unmasking demand to tell others it has received it is a critical check against unworthy demands seeking to unmask the speakers behind lawful speech.

The details of each type of unmasking instrument do matter, though, because each one has different interests to balance and, accordingly, different rules governing how to balance them. Unfortunately, the rules that have evolved for any particular one are not always adequately protective of the important speech interests any unmasking demand necessarily affects. As is the case for the type of unmasking demand at issue in this post: a federal grand jury subpoena.

Grand jury subpoenas are very powerful discovery instruments, and with good reason: the government needs a powerful weapon to be able to investigate serious crimes. There are also important constitutional reasons for why we equip grand juries with strong investigatory power, because if charges are to be brought against people, it's important for due process reasons that they have been brought by the grand jury, as opposed to a more arbitrary exercise of government power. Grand juries are, however, largely at the disposal of government prosecutors, and thus a grand jury subpoena essentially functions as a government unmasking demand. The ability to compel information via a grand jury subpoena is therefore not a power we can allow to exist unchecked.

Which brings us to the story of the grand jury subpoena served on Glassdoor, which Paul Levy and Ars Technica wrote about earlier this year. It's a story that raises three interrelated issues: (1) a poor balancing of the relevant interests, (2) a poor structural model that prevented a better balancing, and (3) a gag that has made it extraordinarily difficult to create a better rule governing how grand jury subpoenas should be balanced against important online speech rights.

Glassdoor is a platform focused on hosting user-provided information about employers. Much of the speech it hosts is necessarily contributed anonymously so that the speakers can avoid any fallout from their candor. This is the sort of fallout that, if they had to incur it, would discourage them from contributing information others might find valuable. The seriousness of these sorts of consequences is why the district court decision denying Glassdoor's attempts to resist the grand jury subpoena seeking to unmask their users reflects such a poor balancing of the relevant interests. Perhaps if the subpoena had been intended to unmask people the government believed were themselves guilty of the crime being investigated, the balance might have tipped more in favor of enforcing it. But the people who the subpoena was seeking to unmask were simply suspected as possibly knowing something about the crime that others were apparently committing. It is not unreasonable for the government to want to be able to talk to witnesses, but that desire to talk to them is not the only interest present here. These are people who were simply availing themselves of their right to speak anonymously, and who, if this subpoena is enforced, are going to be shocked to suddenly find the government on their doorstep wanting to talk to them.

This sort of unmasking is chilling to them and anyone else who might want to speak anonymously because it means that there's no way they ever will be able to speak should their speech happen to ever somehow relate (however tangentially) to someone else's criminal behavior. It is also inconsistent with the purported goal of fighting crime because it will prevent criminal behavior from coming to light in the first place, for few will want to offer up information if it will only tempt trouble for them at some point in the future.

This mis-balancing of interests is almost a peripheral issue in this case, however. The more significant structural concern is why such a weak balancing test was used. As discussed previously, in order to protect the ability to speak anonymously online, it is important for a platform to be able to resist demands to unmask their users in cases where the reason for the unmasking does not substantially outweigh the need to protect people's right to speak anonymously online. But the district court denied Glassdoor's attempt to resist the subpoena when it chose to apply the test from Branzburg v. Hayes, a Supreme Court case focused on the ability to resist a grand jury subpoena. Branzburg, however, has nothing to do with the Internet or Internet platforms. It is a case from the 1970s that was solely focused on whether the First Amendment gave journalists the right to resist a grand jury subpoena. Ultimately it decided that they generally had no such right, at least so long as the government was not shown to be acting in bad faith, which, while not nothing, is not a standard that is particularly protective of anonymity. It also barely even addressed the interests of the confidential sources themselves, dismissing their interest in maintaining anonymity as a mere "preference," and one the Court presumed was being sought only to shield themselves from prosecution for their own criminal culpability.

The upshot of Branzburg is that the journalist, as an intermediary for a source's information, had no right to resist a grand jury subpoena. Unfortunately, Branzburg simply can't be extended to the online world where, for better or worse, essentially all speech must be intermediated by some sort of platform or service in order to happen. The need to let the platforms resist grand jury subpoenas therefore has less to do with whether an intermediary itself has a right to resist them and everything to do with the the right of their users to speak anonymously, which, far from being a preference, is an affirmative right the Supreme Court, after Branzburg, subsequently recognized.

A better test, and one that respects the need to maintain this critical speech right, is therefore needed, which is why Glassdoor appealed the district court's ruling. Unfortunately, its appeal has raised a third issue: while there is often a lot of secrecy surrounding a grand jury investigation, in part because it makes sense to keep the subject of an investigation in the dark, preserving that level of secrecy does not necessarily require keeping absolutely everything related to the subpoena under seal. Fortunately the district court (and the DOJ, who agreed to this) recognized that some information could safely be released, particularly related to Glassdoor's challenge of the subpoena's enforcement generally, and thanks to that limited unsealing we can tell that the case involved a misapplication of Branzburg to an Internet platform.

Unfortunately the Ninth Circuit didn't agree to this limited disclosure and sealed the entirety of Glassdoor's appeal, even the parts that were already made public. The effects of this sealing included that it became impossible for potential amici to weigh in in support of Glassdoor and to argue for a better rule that would allow platforms to better protect the speech rights of their users. While Glassdoor had been ably litigating the case, the point of amicus briefs is to help the court see the full implications of a particular ruling on interests beyond those immediately before it, which is a hard thing for the party directly litigating to do itself. The reality is that Glassdoor is not the first, and will not be the last, platform to get a grand jury subpoena, but unless the rules governing platforms' ability to resist are stronger than what's afforded by Branzburg, the privacy protection speakers have depended on will continue to evaporate should their speech ever happen to capture the interest of a federal prosecutor with access to grand jury.

For all we know, of course, the Ninth Circuit might have seen its point and quashed the subpoena. Or maybe it upheld it and maybe the FBI has now unpleasantly surprised those Glassdoor users. We may never know, just as we may never know if there are other occasions where courts have used specious reasoning to allow grand jury subpoenas to strip speakers of their anonymity. Even if the Ninth Circuit indeed fixed the problems with this questionable attempt at unmasking, by doing it in secret it's missed an important opportunity to provide guidance to lower courts to help ensure that they don't allow other questionable attempts to keep happening to speakers in the future.

Filed Under: anonymity, gag orders, sealed dockets, subpoenas, warrants
Companies: glassdoor

Some Thoughts On Gag Rules And Government Unmasking Demands

from the dissent-dies-in-the-dark dept

The news about the DOJ trying to subpoena Twitter calls to mind an another egregious example of the government trying to unmask an anonymous speaker earlier this year. Remember when the federal government tried to compel Twitter to divulge the identity of a user who had been critical of the Trump administration? This incident was troubling enough on its face: there’s no place in a free society for a government to come after a critic of it. But largely overlooked in the worthy outrage over the bald-faced attempt to punish a dissenting voice was the government’s simultaneous attempt to prevent Twitter from telling anyone that the government was demanding this information. Because Twitter refused to comply with that demand, the affected user was able to get counsel and the world was able to know how the government was abusing its authority. As the saying goes, sunlight is the best disinfectant, and by shining a light on the government's abusive behavior it was able to be stopped.

That storm may have blown over, but the general issues raised by the incident continue to affect Internet platforms – and by extension their users and their speech. A significant problem we keep having to contend with is not only what happens when the government demands information about users from platforms, but what happens when it then compels the same platforms to keep those demands a secret. These secrecy demands are often called different things and are born from separate statutory mechanisms, but they all boil down to being some form of gag over the platform’s ability to speak, with the same equally troubling implications. We've talked before about how important it is that platforms be able to protect their users' right to speak anonymously. That right is part and parcel of the First Amendment because there are many people who would not be able to speak if they were forced to reveal their identities in order to do so. Public discourse, and the benefit the public gets from it, would then suffer in the absence of their contributions. But it's one thing to say that people have the right to speak anonymously; it's another to make that right meaningful. If civil plaintiffs, or, worse, the government, can too easily force anonymous speakers to be unmasked then the right to speak anonymously will only be illusory. For it to be something speakers can depend on to enable them to speak freely there have to be effective barriers preventing that anonymity from too casually being stripped by unjust demands.

One key way to prevent illegitimate unmasking demands is to fight back against them. But no one can fight back against what they are unaware of. Platforms are thus increasingly pushing back against the gags preventing them from disclosing that they have received discovery demands as a way to protect their communities of users.

While each type of demand varies in its particulars (for instance a civil subpoena is different from a grand jury subpoena, which is different than an NSL, which is different from the 19 USC Section 1509 summons that was used against Twitter in the quest to discover the Trump critic), as well as the rationale for why the demanding party might have sought to preserve the secrecy around the demand with some sort of gag, all of these unmasking demands still ultimately challenge the durability of an online speaker's right to remain anonymous. Which is why rulings that preserve, or, worse, even strengthen, gag rules are so troubling because they make it all the more difficult, if not outright impossible, to protect legitimate speech from illegitimate unmasking demands.

And that matters. Returning to the example about the fishing expedition to unmask a critic, while it's great that in this particular case the government quickly dropped its demand on Twitter, questions remain. Was Twitter the only platform the government went after? Perhaps, but how would we know? How would we know if this was the only speech it had chosen to investigate, or the 1509 summons the only unmasking instrument it had used to try to identify the speaker? If the other platforms it demanded information from were, quite reasonably, cowed by an accompanying demand for secrecy (the sanctions for violating such an order can be serious), we might never know the answers to these questions. The government could be continuing its attacks on its apparently no-longer-anonymous critics unabated, and speakers who depended on anonymity would unknowingly be putting themselves at risk when they continued to speak.

This state of affairs is an affront to the First Amendment. The First Amendment was intended in large part to enable people to speak truth to power, but when we make it too hard for platforms to be partners in protecting that right it entrenches that power. There are a lot of ways that platforms should have the ability to be that partner, but one of them must be the basic ability to tell us when that right is under threat.

Filed Under: anonymity, free speech, gag orders, gag rules, governments, nsls, subpoenas, unmasking, warrants

New DOJ Policy Restricts Use Of Warrant/Subpoena Gag Orders

from the finally dept

It appears public pressure -- coming in the form of lawsuits and gag order challenges -- has finally had an effect on the DOJ. Ellen Nakashima is reporting the Justice Department will no longer attach indefinite gag orders to routine requests for data and communications.

The Justice Department has issued new guidelines aimed at providing more transparency around prosecutors’ secret demands for customer data stored on tech firms’ servers.

The binding guidance, approved last week by Deputy Attorney General Rod J. Rosenstein, ends the routine imposition of gag orders barring companies from telling customers that their email or other records have been turned over in response to legal demands.

It also bans — in most cases — indefinite gag orders that forbid a company from ever telling users that their data have been searched.

This new guidance has resulted in Microsoft dropping its lawsuit against the DOJ over its gag orders. This will likely be followed by similar dismissals. There are, of course, some exceptions to the guidelines that will still allow the DOJ to deploy gag orders. But the policy at least (mostly) forbids the FBI (and others) from gagging companies forever.

The new guidance requires prosecutors to tailor their applications for secrecy orders to ensure that they are necessary, and explain why. For instance, a prosecutor might fear that the target will destroy data if he or she learns of the probe. Or the target might try to flee. The assessment must be “individualized and meaningful.”

And now there is a time limit: “Barring exceptional circumstances,” a gag order may be sought for “one year or less.”

Now, for the bad news. Anything the DOJ can claim is national security-related will probably still come with a gag order attached. In addition, this guidance has zero effect on the FBI's favorite paperwork, National Security Letters. The upside is normal warrants and subpoenas won't be treated as requests so sensitive no one should be able to talk about them, much less inform targets their data/communications are being sought.

The new policy also contains a couple of advantages for the DOJ. First, the more lawsuit dismissals this leads to, the less chance there is of a court handing down a precedential ruling severely restricting the use of gag orders. Second, the voluntary nature allows the DOJ to resume its indiscriminate deployment of gag orders at any time. While this development is welcome, it should be noted this is an area where legislation would be far more effective than internal policy shifts if US tech companies would like to see the change become permanent.

Filed Under: doj, gag orders, subpoenas, warrants
Companies: facebook, google, microsoft, twitter

Automattic Releases Five Un-Gagged National Security Letters

from the ask-and-you-have-slightly-better-chance-of-receiving dept

Another batch of FBI National Security Letters has been released, thanks to the expedited review process instituted by the USA Freedom Act. Automattic, the company behind Wordpress, has released five NSLs dating back to 2010, as the result of successful nondisclosure challenges.

Each of the NSLs that we are publishing initially included an indefinite nondisclosure requirement that prohibited us from sharing any information about the letter or publicly acknowledging that we received an NSL.

We recently requested that these nondisclosure requirements be lifted, under the “reciprocal notice” procedures of the USA FREEDOM Act. More detail on the procedures that we followed is below.

In response to our requests, the FBI lifted the gag orders with respect to all information in each of the NSLs we are making available today. Before publishing the letters publicly, however, we decided to redact the following information from each letter: (1) the site URL about which the government requested information, (2) names of Automattic personnel to whom the request was addressed, and (3) name and contact information for the FBI personnel involved in making the information request.

We made these limited redactions in order to protect privacy interests. The NSLs are otherwise what we received when they were served onto us.

The five NSLs are identical. (PDF links included at the bottom of the Automattic post.) Automattic responded to four of those, but had none of the information requested for the fifth. After the gag orders were lifted by the FBI, Automattic informed the targeted users.

The boilerplate NSLs ask for far more info than the FBI's own legal guidance suggests it should be able to request. A 2008 DOJ legal memo says NSLs should be constrained to "phone billing records." The FBI has apparently decided to interpret this as any and all electronic transactional records when it comes to internet service providers. Here's what's requested in the Automattic NSLs:

• Subscriber name and related subscriber information
• Account number(s)
• Date the account opened or closed
• Physical and or postal addresses associated with the account
• Subscriber day/evening telephone numbers
• Screen names or other on-line names associated with the account
• All billing and method of payment related to the account including alternative billed numbers or calling cards
• All e-mail addresses associated with the account to include any and all of the above information for any secondary or additional e-mail addresses and/or user names identified by you as belonging to the targeted account in this letter
• Internet Protocol (IP) addresses assigned to this account and related e-mail accounts
• Uniform Resource Locator (URL) assigned to the account
• Plain old telephone(s) (POTS), ISDN circuit(s), Voice over internet protocol (VOIP), Cable modem service, Internet cable service, Digital Subscriber Line (DSL) asymmetrical/symmetrical relating to this account
• The names of any and all upstream and providers facilitating this account's communications

This is where the FBI starts digging, apparently. By demanding all this info from a single service provider, the FBI can issue NSLs and subpoenas to a large number of additional third parties, even though the DOJ's legal guidance suggests the FBI's NSL requests should be far more constrained.

The recently-instituted challenge options are better than what was in place previously, but Automattic points out there's still plenty of room for improvement.

We also continue to believe that NSLs pose serious constitutional concerns, particularly because they indefinitely prevent companies like us from speaking about them, and informing our users or the public about the NSLs that we receive. The procedures used to lift nondisclosure requirements are flawed because they put the burden of seeking an end to secrecy almost entirely on the companies, like Automattic, who receive NSLs.

The FBI has almost zero legal obligation to perform proactive reviews of issued NSL gag orders. Recipients must spend their time and money challenging them. Fortunately, the challenge process now requires much less of these scarce resources. Automattic has its own boilerplate form for challenging boilerplate NSL gag orders -- one it's willing to share with any NSL recipient --- so we should be seeing more of these released in the near future.

Filed Under: fbi, gag orders, national security letter, nsl, nsls, secrecy, transparency, wordpress

Appeals Court Agrees Government Can Tell NSL Recipients To STFU Indefinitely

from the cram-that-in-your-gag-hole,-transparency-activists dept

The Ninth Circuit Court of Appeals has just handed down a terrible decision in a fight against National Security Letter gag orders. The EFF has been working with plaintiffs Cloudflare and Credo Mobile to have these indefinite gag orders found unconstitutional.

Unfortunately, there's still nothing hopeful on the horizon in terms of government transparency. The Appeals Court has upheld the lower court's decision, finding this form of prior restraint somehow Constitutional. From the decision [PDF]:

The panel held that § 2709(c)’s nondisclosure requirement imposes a content-based restriction that is subject to, and withstands, strict scrutiny. The panel further held that, assuming the nondisclosure requirement was the type of prior restraint for which the procedural safeguards set forth in Freedman v. Maryland, 380 U.S. 51 (1965) were required, the National Security Letters law provided those safeguards. The panel concluded that the nondisclosure requirement does not run afoul of the First Amendment.

The panel notes the statutory framework for NSLs allows the government to ask for secrecy for an indefinite period of time to ensure investigations aren't interfered with or suspects prematurely notified of the government's interest in their activities. The statutes say the government "may" ask for secrecy. However, the FBI -- in the thousands of NSLs it issues every year -- reads this as "will." No one receives an NSL without a gag order attached.

Challenging gag orders is easier than it used to be, but it's still far from ideal. Rather than limited-time gag orders or stiffer requirements for the FBI to meet before deploying them, recipients have been given modestly-improved avenues of recourse. That may help going forward, but it's doing very little to address NSLs/gag orders sent out before the USA Freedom Act reforms in 2015. Old NSL gag orders are still mostly unassailable. At the center of this case are NSLs dating back to 2011 and 2012. For reasons only known to the government, these half-decade-old gag orders are still in place.

The court recognizes gag orders are content-based restrictions of speech. This means the government has to hit a higher bar to justify this control of citizens' speech. But the Appeals Court agrees with the lower court: to meet this high bar, the government just needs to deploy national security mantras.

As a threshold matter, we readily conclude that national security is a compelling government interest. Indeed, the Court has recognized that “[e]veryone agrees that the Government’s interest in combating terrorism is an urgent objective of the highest order.” “It is ‘obvious and unarguable’ that no governmental interest is more compelling than the security of the Nation.”

By the same token, keeping sensitive information confidential in order to protect national security is a compelling government interest. See Dep’t of the Navy v. Egan, 484 U.S. 518, 527 (1988) (recognizing “the Government’s compelling interest in withholding national security information from unauthorized persons in the course of executive business” (internal quotation marks omitted)); Snepp v. United States, 444 U.S. 507, 509 n.3 (1980) (“The Government has a compelling interest in protecting both the secrecy of information important to our national security and the appearance of confidentiality so essential to the effective operation of our foreign intelligence service.”).

The plaintiffs pointed out that while the USA Freedom Act gave them new tools to challenge NSL gag orders, it also lowered the standards governing the attaching of gag orders. Instead of nondisclosure demands being approved only by the FBI Director, any number of designees could perform approvals. The court responds by saying "Trust the FBI."

[T]he new 2015 provision allowing disclosures to “other persons as permitted by the [FBI] Director” or the Director’s designee, id. § 2709(c)(2)(A)(iii), merely provides the FBI with more flexibility to tailor the scope of the nondisclosure provision. We reject the recipients’ argument that this provision gives the government unfettered discretion and therefore creates a system of insufficiently cabined prior restraints. Even if the NSL law is determined to be the type of regulation for which procedural safeguards are required (see section V, infra), the law as a whole imposes narrow, objective, and definite standards on the government before it can issue a nondisclosure requirement…

The fact that the statute also gives the FBI Director or a designee discretion to make additional exceptions to the nondisclosure requirement does not lessen the adequacy of the clear standards imposed on these officials before issuing a nondisclosure requirement in the first place.

The court also says this isn't a case of prior restraint, even though each NSL arrives with some legal language preventing recipients from even acknowledging the NSL's existence. The panel declares NSL recipients have no "intent" to speak, so telling them not to talk somehow doesn't damage their First Amendment rights.

[N]SL law prohibits the disclosure of a single, specific piece of information that was generated by the government: the fact that the government has requested information to assist in an investigation addressing sensitive national security concerns, i.e., “to protect against international terrorism or clandestine intelligence activities.” 18 U.S.C. § 2709(b)(1). As the Second Circuit noted, “[u]nlike an exhibitor of movies,” the recipient of a nondisclosure requirement “did not intend to speak and was not subject to any administrative restraint on speaking prior to the Government’s issuance of an NSL.”

So, I guess it's not prior restraint because companies could talk vaguely and non-specifically about NSLs they might receive, but aren't allowed to talk about any NSLs they have received until the government says it's ok. Seems legit.

The next step for the EFF and a number of NSL recipients is the Supreme Court. Given the ongoing deference to anything national security-related, it would be a surprise if the nation's top court reversed two lower court decisions. It may decide it's not even worth reviewing if petitioned. As it stands now, the government can demand indefinite silence from service providers thousands of times a year… all supposedly without violating the Constitution.

Filed Under: 9th circuit, first amendment, free speech, gag orders, national security, national security letters, nsl, nsls
Companies: cloudflare, credo mobile, eff

Facebook Back In Court Challenging More Law Enforcement Gag Orders

from the omerta-without-the-fringe-benefits dept

Facebook is at it again, hoping to make law enforcement agencies second-guess their secrecy demands. It recently successfully challenged gag orders attached to 381 warrants served to it by Manhattan DA Cyrus Vance's office. It also forced Minnesota law enforcement to retract warrants seeking information from a police shooting victim's girlfriend's Facebook account by challenging the secrecy added to the demand for data.

Court documents obtained by Buzzfeed show the social media giant is taking on another gag order -- this one possibly related to arrests stemming from protests during Trump's inauguration.

According to the limited information unsealed so far, Facebook received search warrants from the government for three account records over a three-month period. The warrants were accompanied by a nondisclosure order from a District of Columbia Superior Court judge barring Facebook from notifying users about the warrants before Facebook complied — an order the tech company is now challenging.

Most details about the case remain under seal, although one recent filing suggests that the warrants relate to the mass arrests in Washington, DC, during President Trump’s inauguration. BuzzFeed News obtained court papers filed on Friday by tech companies, civil liberties groups, and consumer advocacy organizations in support of Facebook’s challenge to the gag order.

If the warrants (and their gag orders) are related to the inauguration protests, the amount of data demanded seems excessive. Facebook's notice to potential amici [PDF] has this to say about the warrants:

The Warrants seek all contents of communications, identifying information, and other records related to three Facebook accounts for a specified three-month period of time. The Warrants are accompanied by a non-disclosure order issued by the Superior Court pursuant to 18 U.S.C. § 2705 (the “NDO”) requiring that Facebook and its employees not disclose the existence of the Warrants to anyone before Facebook produces documents and information to the government in response to the Warrants.

Ninety days of Facebook use captures a whole lot of communications, much of which will have little to do with the felony charges no one's able to discuss. Facebook's notice hints this is related to a high-profile case, so there's little to be gained by demanding complete silence for an indefinite period of time.

Because Facebook believed that neither the government’s investigation nor its interest in Facebook user information was secret, Facebook moved to vacate the NDO so that it could provide its users with notice of the Warrants and an opportunity to object to them before Facebook produced responsive records to the government.

Facebook isn't challenging the warrants themselves. It has attempted to do this in the past but has yet to see its asserted third-party interest find any takers in the judiciary. Facebook says it's already preserved the records requested by law enforcement. If this is the case, the continued demand for secrecy makes very little sense.

The good news is several tech companies and civil liberties groups have already filed motions in support of Facebook's challenge:

Three briefs in support of Facebook were filed on Friday. One represented the views of eight tech companies – Microsoft, Google, Apple, Snap, Dropbox, Twitter, Yelp, and Avvo – along with the Reporters Committee for Freedom of the Press; another came from the American Civil Liberties Union and Public Citizen Litigation Group; and a third was filed on behalf of the Electronic Frontier Foundation, Access Now, Center for Democracy & Technology, and New America’s Open Technology Institute.

Zoe Tillman at Buzzfeed points out the EFF's brief contains further hints about the not-so-secret investigation the government would like to keep under cover. From the brief:

The timing of the government’s investigation and the underlying motions of this case in the Superior Court of the District of Columbia coincide with the proceedings in the cases involving the January 20, 2017 Presidential Inauguration protestors, who are currently facing prosecution in the same jurisdiction. These cases and the events surrounding them have been highly publicized.

The immediate upshot is the nondisclosure period has been shortened to 30 days after Facebook hands over the information to the government. But the data won't be handed over until the gag order issue is resolved, so the gag order is still in place for the time being. Facebook is obviously hoping to find the use of these gag orders unconstitutional and is trying to build a litigation portfolio of free speech wins to push the government out of its default secrecy mode.

Filed Under: first amendment, free speech, gag orders, surveillance
Companies: facebook

Court Says Microsoft Can Sue Government Over First Amendment-Violating Gag Orders

from the prior-restraint,-but-for-forever-wars dept

One of several service providers to sue the government over its gag orders, Microsoft received some good news from a federal judge in its lawsuit against the DOJ. Microsoft is challenging gag orders attached to demands for data and communications, which the DOJ orders is statutorily-supported by the Electronic Communications Privacy Act (ECPA) and, if not, by supposed national security concerns.

As Microsoft pointed out in its lawsuit, the government rarely justifies its secrecy demands and frequently issues gag orders with no endpoint. Microsoft received nearly 2,800 of these gag-ordered requests over an 18-month period, with over two-thirds of them demanding silence indefinitely.

The good news is a federal judge has (partially) waved away the DOJ's motion to dismiss and will allow Microsoft to proceed with its lawsuit, as Politico's Josh Gerstein reports.

U.S, District Court Judge James Robart issued a 47-page opinion [PDF] Thursday allowing Microsoft to proceed with a lawsuit claiming a First Amendment violation when the government restricts internet providers from notifying subscribers about requests for their data.

"The orders at issue here are more analogous to permanent injunctions preventing speech from taking place before it occurs," Robart wrote. "The court concludes that Microsoft has alleged sufficient facts that when taken as true state a claim that certain provisions of Section 2705(b) fail strict scrutiny review and violate the First Amendment."

Section 2705(b) refers to the Stored Communications Act, which allows the government demand notice be withheld under certain circumstances, unless otherwise forbidden to by another section of the same law (Section 2703). Microsoft is looking to have both sections declared unconstitutional, especially given the severe upheaval the communications landscape has undergone in the thirty years since the law was passed.

Microsoft contends that Section 2705(b) is unconstitutional facially and as applied because it violates the First Amendment right of a business to “talk to [the business’s] customers and to discuss how the government conducts its investigations.” Specifically, Microsoft contends that Section 2705(b) is overbroad, imposes impermissible prior restraints on speech, imposes impermissible content-based restrictions on speech, and improperly inhibits the public’s right to access search warrants. Microsoft also alleges that Sections 2705(b) and 2703 are unconstitutional facially and as applied because they violate the Fourth Amendment right of “people and businesses . . . to know if the government searches or seizes their property.”

Microsoft contends that the statutes are facially invalid because they allow the government to (1) forgo notifying individuals of searches and seizures, and (2) obtain secrecy orders that “prohibit providers from telling customers when the government has accessed their private information” without constitutionally sufficient proof and without sufficient tailoring.

The DOJ argued Microsoft didn't have standing to bring this complaint, as its Fourth Amendment rights aren't implicated. Only its customers' are. But the court points out that, if nothing else, the company does have standing to pursue its claims of First Amendment violations.

The court finds that Microsoft has sufficiently alleged an injury-in-fact and a likelihood of future injury. Microsoft alleges “an invasion of” its “legally protected interest” in speaking about government investigations due to indefinite nondisclosure orders issued pursuant to Section 2705(b)... The court concludes that Section 2705(b) orders that indefinitely prevent Microsoft from speaking about government investigations implicate Microsoft’s First Amendment rights.

The court goes on to point out that frequent use of indefinite gag orders certainly appears to be unconstitutional, given that they act as a "forever" application of prior restraint.

The court also concludes that Microsoft's assertions of further civil injuries aren't speculative, as the DOJ claimed. Judge Robart points to the government's own actions as evidence of continued harm to Microsoft's civil liberties.

Microsoft bolsters its prediction by alleging that over a 20-month period preceding this lawsuit, the Government sought and obtained 3,250 orders–at least 4504 of which accompanied search warrants—that contained indefinite nondisclosure provisions. In addition, Microsoft alleges that in this District alone, it has received at least 63 such orders since September 2014. Because these orders have been frequent and issued recently, the Government will likely continue to seek and obtain them. Accordingly, Microsoft’s “fears” of similar injuries in the future are not “merely speculative.”

Unfortunately, the court won't grant Microsoft the standing to represent its users for Fourth Amendment purposes. Judge Robart points to a whole bunch of precedential decisions declaring otherwise, but at least takes a bit of time to discuss how denying Microsoft this opportunity likely means denying several of its users any sort of redress.

The court acknowledges the difficult situation this doctrine creates for customers subject to government searches and seizures under Sections 2703 and 2705(b). As Microsoft alleges, the indefinite nondisclosure orders allowed under Section 2705(b) mean that some customers may never know that the government has obtained information in which those customers have a reasonable expectation of privacy... For this reason, some of Microsoft’s customers will be practically unable to vindicate their own Fourth Amendment rights.

Expect the government to make heavy use of its "national security" mantra as it defends itself in this case. Those magic words have allowed all sorts of civil liberties violations in the past and still tend to move courts to the government's side when deployed in DOJ motions. If the court does side with Microsoft when this is all said and done, it's likely the remedy won't be a restriction on gag orders, but more likely something analogous to the rules that now govern National Security Letters -- periodic review of gag orders by the government and better avenues for raising challenges for companies affected. Then again, the court could simply punt it back to legislators and push them to fix the 30-year-old law whose dubious constitutionality is the source of numerous lawsuits against the federal government.

Filed Under: doj, ecpa, first amendment, gag orders, sca, stored communications act, surveillance
Companies: microsoft