Cloudflare and Credo Mobile today lost their fight to speak publicly about the National Security Letters they and other tech companies receive, which demand user data and frequently forbid companies from ever disclosing the demands to their users.
The two companies received NSLs from the FBI in 2011 and 2013, requiring them to secretly disclose account information.
The Electronic Frontier Foundation, representing web performance company Cloudflare and mobile network Credo, said the gag orders accompanying the NSLs violated the companies' rights to free speech. But the 9th Circuit Court of Appeals ruled today that this nondisclosure requirement "does not run afoul of the First Amendment".
The ruling is a major upset for Cloudflare and Credo, as well as for larger tech companies that have begun disclosing NSLs over the past year. Companies that receive NSLs are usually restricted from discussing them for years — sometimes forever — and, if they disclose them in transparency reports, they may only do so in ranges of 500.
The EFF argued that companies with millions of users should be allowed to disclose the specific number of NSLs they receive and to mention their experiences receiving NSLs when communicating with customers or lobbying the government. (While lobbying against NSLs in 2014, Cloudflare's in-house counsel was told by a dismissive Capitol Hill staffer that it was impossible for Cloudflare to receive an NSL, and because of the gag order, he was unable to point out that Cloudflare had already received several of the letters.)
"I'd be lying if I didn't say this is a real setback," EFF staff attorney Andrew Crocker told Gizmodo. "But the trend is going the other way. I've seen a lot of courts questioning these blanket indefinite gag orders."
Twitter, which is also challenging NSL gag orders in court, recently secured a promising ruling from a district court judge that suggests Twitter's reporting of NSLs in narrower ranges than 500 could be protected under the First Amendment.
The 9th Circuit, however, was more dismissive of the reporting bands: "We decline the recipients' invitation to quibble with the particular ranges selected by Congress," the court wrote.
"In 2017, it's really unsupportable to not give internet companies like my clients a full First Amendment set of rights that they would give to any other speaker," Crocker said, likening internet service providers like Cloudflare to traditional publishers like newspapers. "The implicit assumption in this ruling is that they don't have this set of rights."