Internet Archive Successfully Fends Off Secret FBI Order

A decade ago, the FBI sent Brewster Kahle, founder of the Internet Archive, a now-infamous type of subpoena known as a National Security Letter, demanding the name, address and activity record of a registered Internet Archive user. The letter came with an everlasting gag order, barring Kahle from discussing the order with anyone but his attorney — not even his wife could know.

But Kahle did eventually talk about it, calling the order “horrendous,” after challenging its constitutionality in a joint legal effort with the Electronic Frontier Foundation and the American Civil Liberties Union. As a result of their fight, the FBI folded, rescinding the NSL and unsealing associated court records rather than risk a ruling that their surveillance orders were illegal. “This is an unqualified success that will help other recipients understand that you can push back on these,” Kahle told reporters once the gag order was lifted.

The bureau continued to issue tens of thousands of NSLs in subsequent years, but few recipients followed in Kahle’s footsteps. Those who did achieved limited but important transparency gains; as a result of one challenge, a California District Court ruled in 2013 that the everlasting gag orders accompanying NSLs are unconstitutional, and last year Congress passed a law forcing the FBI to commit to periodically reviewing such orders and rescinding them when a gag is no longer necessary to a case.

Now, Kahle and the archive are notching another victory, one that underlines the progress their original fight helped set in motion. The archive, a nonprofit online library, has disclosed that it received another NSL in August, its first since the one it received and fought in 2007. Once again it pushed back, but this time events unfolded differently: The archive was able to challenge the NSL and gag order directly in a letter to the FBI, rather than through a secretive lawsuit. In November, the bureau again backed down and, without a protracted battle, has now allowed the archive to publish the NSL in redacted form.

The speedy and decisive resolution was enabled in part by the series of legal battles in prior years that have chipped away at rules restricting how recipients of NSLs can challenge them. Previously, this could be done only though an anonymized lawsuit, in which the plaintiffs were identified as John or Jane Doe. Now recipients can simply challenge a gag order by sending a letter to the FBI indicating they won’t agree to it without judicial review, and the burden is on the FBI to then convince a judge that the gag should be upheld.

So after the FBI sent the Internet Archive the NSL in August, demanding the name, address, length of service and a list of all accounts used by one of the archive’s supposed subscribers, the archive and the EFF sent the bureau a letter challenging the legality and constitutionality of the NSL and gag order. They also disclosed in the letter that the archive didn’t possess any records that matched the FBI’s request. Archive subscribers can use their accounts to upload contributions of books, music and other digital material or to comment on material others have uploaded. But the archive had no records of a subscriber matching the FBI’s target.

Also in its response to the FBI, the archive asked permission to publish the NSL, with details about the target of the surveillance redacted, since the fact that the archive received the NSL posed no threat to national security.

“As part of its commitment to transparency, and as an effort to inform its patrons and the general public about government requests for information, the archive wishes to publish the NSL in redacted form,” EFF Staff Attorney Andrew Crocker wrote in his September letter to the bureau.

Internet Archive Win Is a “Tiny Peek” at NSL Process

Kahle told The Intercept that the incident should encourage others to challenge NSLs and gag orders in the interest of transparency.

“We would like to see more of these come to light so we understand more of the workings of the government,” he said. “All we get [now] is a tiny peek. We’re appreciative of at least having this much light on the process, but what we’d like to see is a lot more.”

In fact, this week as the Internet Archive was preparing to publish its NSL, Credo Mobile, a politically progressive mobile phone network, also made public an NSL that it had received in 2013. A court ruled earlier this year that the FBI had failed to demonstrate a need for the gag order in that case, and the FBI recently decided to drop its appeal of that decision. In going public with the NSL, Credo also revealed that it was one of the anonymous plaintiffs at the heart of the historic legal battle fought in 2013 that resulted in gag orders being ruled unconstitutional. It was long believed that Credo was involved in the case, but the company was barred until now from revealing that fact.

The number of known challenges to NSLs in the last decade can be counted on two hands. The challengers include Nicholas Merrill, the owner of a small ISP in New York who fought a six-year battle beginning in 2004 to lift his gag order; a group of Connecticut librarians who fought an NSL they received in 2005; North Carolina State University, which received an improperly issued NSL that same year; the Internet Archive, which received its first NSL in 2007; a still unidentified service provider in California, which received an NSL in 2012; Credo Mobile; and Google and Yahoo, who challenged a couple of recent NSLs, out of unknown numbers the two companies have received over the years.

Attorney General Eric Holder.

Former Attorney General Eric Holder noted the paucity of NSL challenges the FBI has faced in a 2010 letter he wrote to Senator Patrick Leahy (D-Vermont). The letter disclosed that between 2008 and 2010 the FBI had received only four challenges, even though more than 50,000 had been issued during that time.

Chris Butler, office manager for the archive, suggests that pushing back on gag orders is the least recipients should do.

“It’s almost always doable for the people issuing these [law enforcement] requests to get a court order for nondisclosure if they think that that’s important,” he says. “And that’s what we require in order to not inform or not send out notice to users when their information has been requested.”

Many NSL Problems Remain

National Security Letters are one of the most powerful and ubiquitous tools the FBI uses to obtain user information from internet service providers and other businesses, since they don’t require court approval and are therefore easily issued. There are three statutes that grant authority to use NSLs — the Electronic Communications Privacy Act, the Right to Financial Privacy Act, and the Fair Credit Reporting Act all have provisions allowing the use of NSLs for different kinds of records. These NSLs can compel internet service providers, financial institutions, and other businesses to hand over subscriber names and addresses, phone numbers, e-mail addresses, and transactional records showing account activity, while preventing the recipient from telling the subscriber about the request so that he or she can challenge the NSL.

Year	National Security Letters issued
1999	7,800
2000	8,500
2001	Not available
2002	Not available
2003	39,346
2004	56,507
2005	47,221
2006	49,425
2007	16,804
2008	24,744
2009	14,788
2010	24,287
2011	16,511
2012	15,229
2013	14,219
2014	12,452
2015	9,418
Source: Justice Department

The FBI has been issuing NSLs since the 1980s, but the FBI considered NSLs during that time to be of limited value for a number of reasons, according to a DoJ Inspector General’s report issued in 2007. But the Patriot Act, passed directly after the 9/11 attacks, lowered the legal standard for using an NSL and widened the kinds of records they could obtain, thereby helping to expand their use. In 2000, prior to the Patriot Act, the FBI issued just 8,500 NSLs to businesses. But in 2003, the next year for which statistics are available, the FBI issued nearly 40,000. With that expansion and the extensive secrecy around NSLs due to the gag orders, came abuse. The Inspector General found that the FBI misused NSLs on a number of occasions and underreported their use to Congress.

In 2013, thanks to the constitutional challenge EFF brought on behalf of Credo Mobile, a California district court issued the landmark ruling that gag orders preventing a recipient from disclosing that they had ever received an NSL were unconstitutional because they are overly broad and have the potential to unnecessarily restrict the speech of recipients. The ruling didn’t stick, however. The Ninth Circuit Court of Appeals vacated it and sent the case back to the district court for further evaluation. But before the district court could rule again, Congress passed the USA Freedom Act, which partially addressed the perpetual gag order issue. As a result, the District Court concluded that the gag order problem had been solved and that it no longer needed to address the constitutionality of NSLs; EFF is challenging this conclusion.

The USA Freedom Act, passed in May 2015, required the FBI to develop procedures for periodically reviewing NSL gag orders and lifting them when the FBI determines that doing so won’t harm an investigation or national security. But the FBI only has to review a gag order twice — either when the investigation associated with it has closed or on the third anniversary of the investigation opening, if the case is still active. At least one district court has ruled that the frequency of the reviews is inadequate.

“[The court] noted that there’s a lot of loopholes in that policy,” says Crocker, “because what if that investigation never closes?” A review only at the three-year mark of such an investigation would allow gag orders to live on, even after the need for them ends.

There’s also little reason to have faith in the FBI’s ability to oversee its administration of NSLs and gag orders. The NSL the Internet Archive received in August had a legal error the bureau never caught. It stated that by law the archive could only challenge the NSL’s gag order once a year and that the initial challenge had to occur within 10 days of receiving the NSL. The USA Freedom Act, however, changed that restriction last year. Recipients can now challenge an NSLs gag order at any time and repeatedly within a year, which they might do if circumstances around the NSL changed.

“It is a matter of public interest that the FBI continues to issue NSLs that incorrectly inform recipients that their ability to challenge nondisclosure requirements is limited to a single petition per year,” Crocker wrote in his September letter to the FBI.

The FBI acknowledged the mistake in its response to him earlier this month. Evidently, it’s a mistake the FBI made repeatedly in the 18 months since the USA Freedom Act was passed; the FBI told Crocker that it would be correcting the text of the template that FBI agents use to create NSLs.

“That could be as many as 20,000 NSLs that were incorrect,” Crocker notes.

The FBI has been quietly sending revised NSL’s to recipients in recent weeks correcting the error in previous NSLs the bureau sent out, without explaining what prompted the revision.

Top photo:In this July 21, 2011 photo, Brewster Kahle, digital librarian for the Internet Archive, discusses how books are stored in converted shipping containers while being interviewed at the Internet Archive’s Physical Archive warehouse in Richmond, Calif.