The names of more than 120 companies secretly served FBI subpoenas for their customers’ personal data were revealed this week, including a slew of US banks, mobile phone providers and a leading antivirus software maker.
Known as national security letters (NSL), the subpoenas are a tool commonly used by FBI counterterrorism agents when seeking individuals’ communication and financial histories. No judge oversees their use. Senior-most agents at any of the FBI’s 56 nationwide field offices can issue the letters, which are typically accompanied by a gag order.
The letters allow the FBI to demand access to limited types of information, most of which may be described as “metadata” — the names of email senders and recipients and the dates and times that messages were sent, for example. The actual content of messages is legally out of bounds.
Financial information such as credit card transactions and travellers check purchases can also be obtained, in addition to the billing records and history of any given phone number.
Because NSL recipients are often forced to keep the fact secret for many years there’s been little transparency around who’s getting served.
But this week, The New York Times published four documents with details on 750 NSLs issued as far back as 2016.
The paper described the documents — obtained by digital-rights group the Electronic Frontier Foundation (EFF) in a Freedom of Information Act lawsuit — as a “small but telling fraction” of the more than 500,000 letters issued since 2001, when passage of the Patriot Act greatly expanded the number of FBI officials who could sign them.
Between 2000 and 2006, use of NSLs increased nearly six-fold, according to the US Justice Department inspector general.
While it’s widely known that tech companies such as Google and Facebook are routinely served NSLs, the documents — 751 letters informing companies that their gag orders had been lifted — offer new insight into the scope of the businesses receiving them: Not only banks (big and small), but universities, money-transfer services, domain registrars and voice-over-internet (VoIP) providers.
Even video game companies.
Valve, the video game developer, received an NSL in December 2016. A month earlier, Symantec, the antivirus software developer, received a letter. In addition to all the major phone carriers, phone companies such as TracFone and MetroPCS also received letters.
A number of cloud service providers, including Rackspace, are identified by the documents, as well as smaller social apps such as Tango and MeetMe.
After passage of the USA Freedom Act in 2015, the FBI adopted guidelines that require gag orders to be reviewed for necessity three years after issuance or after an investigation is closed. Yet, privacy advocates accuse the FBI of failing to follow its own rules.
“The documents released by the FBI show that a wide range of services and providers receive NSLs and that the majority of them never tell their customers or the broader public, even after the government releases them from NSL gag orders,” said Aaron Mackey, a staff attorney at the EFF.
“The records also show that the FBI is falling short of its obligations to release NSL recipients from gag orders that are no longer necessary.”
The FBI declined to comment.
The secrecy — not to mention the weak evidentiary standards — has kept NSLs squarely in cross hairs of civil liberties groups for years. But the FBI also carries a history of abuse, having in the past issued numerous letters “without proper authorization,” to quote the bureau’s own inspector general in 2009.
The same official would also describe to US Congress a bevy of violations including “improper requests” and “unauthorised collections” of data that can’t be legally obtained with an NSL. In some cases, the justifications used by agents to obtain letters were found to be “perfunctory and conclusory”, or convenient and inherently flawed.
“It’s unconstitutional for the FBI to impose indefinite gags on the companies that receive NSLs,” said Neema Singh Guliani, senior legislative counsel with the American Civil Liberties Union. “This is one of the reasons that Congress previously sought to put an end to this practice, but it is now clear that the FBI is not following the law as intended.”
“As part of its surveillance reform efforts this year, Congress must strengthen existing laws designed to bar these types of gag orders,” she added.
The NSL records obtained by the EFF can be viewed here.