Google has filed a rare petition to challenge an ultra-secret national security letter issued by the government to obtain private data about one or more of its users.

The extraordinary petition, which was filed under seal in the U.S. District Court of Northern California on March 29, comes just days after a U.S. District Judge in California ruled in a case brought by an unnamed company and the Electronic Frontier Foundation that so-called NSLs that come with a gag order on the recipient are an unconstitutional impingement on free speech.

On March 14, U.S. District Judge Susan Illston ordered the government to stop issuing NSLs and to cease enforcing the gag provision in cases where they have already been issued. Illston, however, stayed her order for 90 days to give the government a chance to appeal her ruling to the Ninth Circuit Court of Appeals.

The recent Google challenge has also been assigned to Judge Illston.

It's not known exactly when Google received the NSL or why it decided to fight back against this particular one, though the company was likely emboldened to act by the recent ruling. Bloomberg broke the story about Google's challenge.

In early March, Google signaled an interest in becoming more transparent about the NSLs it has received by releasing a report for the first time showing a “range” of times that it received NSL's from the FBI.

The search giant published the information only after negotiating an agreement with the federal government that it would only publish a vague range indicating the number of times it received NSLs. The report indicated only that Google had received somewhere in the range of 0 and 999 NSLs each year between 2009 and 2012. Though the numbers were too broad to be useful, they signaled an interest by the search giant to provide an accounting of NSLs that has been missing since the government began using the orders prolifically after 9/11.

In filing its recent court challenge, Google has joined a very small club of NSL recipients who have taken on the civil liberties interests of users by fighting back against orders that until now have been issued under the cloak of secrecy and generally without oversight.

NSLs, which have been in use for to decades but were greatly expanded under the Patriot Act, are written demands from the FBI that compel internet service providers, credit companies, financial institutions and others to hand over confidential records about their customers, such as subscriber information, phone numbers and e-mail addresses, websites visited and more.

NSLs are a powerful tool because they do not require court approval. Until now, most came with a built-in gag order, preventing recipients from disclosing to anyone that they had received an NSL. An FBI agent looking into a possible anti-terrorism case could self-issue an NSL to a credit bureau, ISP or phone company with only the sign-off of the Special Agent in Charge of their office. The FBI had to merely assert that the information was “relevant” to an investigation into international terrorism or clandestine intelligence activities.

The lack of court oversight raised the possibility for extensive abuse of NSLs under the cover of secrecy, which the gag order only exacerbated. In 2007 a Justice Department Inspector General audit found that the FBI had indeed abused its authority and misused NSLs on many occasions. After 9/11, for example, the FBI paid multimillion-dollar contracts to AT&T and Verizon requiring the companies tostation employees inside the FBI and to give these employees access to the telecom databases so they could immediately service FBI requests for telephone records. The IG found that the employees let FBI agents illegally look at customer records without paperwork and even wrote NSLs for the FBI.

The FBI has issued hundreds of thousands of NSLs over the years. Although recipients can file a petition with the court asking it to modify or set aside the nondisclosure order, this has proven to be a burdensome task for many small companies who don't have the resources or interest in mounting a fight. As a result, only a handful of requests have been challenged by recipients.

The ruling by Illston last month came after an unnamed telecom filed one of those challenges against the NSL it received. Despite the fact that the telecom was operating within its rights to challenge the document, the Justice Department sued the company, arguing in court documents that the company was violating the law by challenging the government's authority.

In her ruling, Judge Illston said that the NSL nondisclosure provisions violated the First Amendment rights of free speech and association and "significantly infringe on speech regarding controversial government powers."

She also said that the review process for challenging an order violated the separation of powers. Because the gag order provisions cannot be separated from the rest of the statute, Illston ruled that the entire statute was unconstitutional.

Illston found that although the government made a strong argument for prohibiting the recipients of NSLs from disclosing to the target of an investigation or the public the specific information being sought by an NSL, the government did not provide compelling argument that the mere fact of disclosing that an NSL was received harmed national security interests.

A blanket prohibition on disclosure, she found, was overly broad and "creates too large a danger that speech is being unnecessarily restricted." She noted that 97 percent of the more than 200,000 NSLs that have been issued by the government were issued with nondisclosure orders.

Number of NSLs Issued by FBI

The FBI has sent out nearly 300,000 NSLs since 2000, about 50,000 of which have been sent out since the new policy for challenging NSL gag orders went into effect.

The first challenge to an NSL involved one sent in 2005 to Library Connection, a consolidated back office system for several libraries in Connecticut. The gag order was challenged and found to be unconstitutional because it was a blanket order and was automatic. As a result of that case, the government revised the statute to allow recipients to challenge the gag order. In her recent ruling, IIllston found this unconstitutional as well, however, due to restrictions around how recipients could challenge the NSL.

In 2004, another case also challenged a separate aspect of the NSL. This one involved a small ISP owner named Nicholas Merrill, who challenged an NSL seeking info on an organization that was using his network. He asserted that customer records were constitutionally protected information.

But that issue never got a chance to play out in court before the government dropped its demand for documents.

Before Merrill filed his challenge to NSLs in 2004, ISPs and other companies that wanted to challenge NSLs had to file suit in secret in court – a burden that many were unwilling or unable to assume. But after he challenged the one he received, a court found that the never-ending, hard-to-challenge gag orders were unconstitutional, leading Congress to amend the law to allow recipients to challenge NSLs more easily as well as gag orders.

After that, companies could simply notify the FBI in writing that they opposed the gag order, leaving the burden on the FBI to prove in court that disclosure of an NSL would harm a national security case. The case also led to changes in Justice Department procedures. Since Feb. 2009, NSLs must include express notification to recipients that they have a right to challenge the built-in gag order that prevents them from disclosing to anyone that the government is seeking customer records.

But in a 2010 letter from Attorney General Eric Holder to Senator Patrick Leahy (D-Vermont), Holder said that there had "been only four challenges," and those involved challenges to the gag order, not to the fundamental legality of NSLs. At least one other challenge wasfiled earlier this year in a secret case revealed by Wired. But the party in that case challenged only the gag order, not the underlying authority of the NSL.

When recipients have challenged NSLs, the proceedings have occurred mostly in secret, with court documents either sealed or redacted heavily to cover the name of the recipient and other identifying details about the case.

Last year, an unknown company filed a challenge against an NSL it received.

According to documents filed in the U.S. District Court in Alexandria, Virginia, the FBI served the unknown company with an NSL sometime around the end of last January seeking information about a customer or customers.

The company, identified only as a corporation "with employees dispersed across the world" that offers electronic communication services to customers and account holders, was told to hand over "electronic communications transaction" records of an unidentified target or targets. The NSL specifically excluded the contents of the communications.

The NSL indicated that the company had 10 days to challenge the gag order if it intended to do so. The company did so via fax, and on March 9 the government filed a request for a court order enforcing the gag order.

All documents in that case were under seal so the outcome is unknown.

mystery-nsl_gov-request-for-gag.jpg

Originally published by Wired.