A document released by the courts over the FBI’s use of National Security Letters (NSLs) and gag orders show the agency used secret interpretations of the Patriot Act to demand extensive access to sensitive web history and location data – without a warrant.
“For more than a decade, the FBI has been demanding extremely sensitive personal information about private citizens just by issuing letters to online companies like mine,” Nicholas Merrill, former owner of Calyx Internet Access and a plaintiff in the case, said in a statement. The document released on Monday, in which the agency had demanded access to user data, was sent to Merrill by the FBI over a decade ago.
“The FBI has interpreted its NSL authority to encompass the websites we read, the web searches we conduct, the people we contact, and the places we go. This kind of data reveals the most intimate details of our lives, including our political activities, religious affiliations, private relationships, and even our thoughts and beliefs,” added Merrill.
The court-ordered release on Monday shows the FBI believed that under the Patriot Act it could force online companies to turn over data simply by sending a National Security Letter demanding it. The data included an individual’s complete web browsing history, the IP address of everyone a person has corresponded with, email addresses, and records of all online purchases.
The FBI also claimed the authority to obtain cell-site location information with an NSL, effectively using a cell phone as a location tracking device. The FBI said in court filings that at some point it had stopped gathering location data as a matter of policy, but that it could secretly choose to resume the practice under existing authority.
The revelations come amidst an 11-year legal battle waged by the American Civil Liberties Union against the Justice Department on behalf of Nicholas Merrill, a business man, who questioned the validity of the FBI’s use of a gag order with a First Amendment challenge.
Citing the Patriot Act, the FBI refused to publicly reveal what kinds of private data it believed it could obtain with an NSL. Merrill became privy to the request’s overreach when the FBI served him an NSL in 2004, demanding that he turn over the records of one of the customers of Calyx Internet Access, the internet company he owned.
In September, the court agreed that the government had violated Merrill’s constitutional rights, describing the FBI’s position as “extreme and overly broad.” It marked the first time that a gag order had been lifted since the FBI’s authority to conduct warrantless spying was vastly expanded by the Patriot Act the in 2001.
“Courts cannot, consistent with the First Amendment, simply accept the Government’s assertions that disclosure would implicate and create a [public] risk,” wrote Judge Victor Marrero of the federal district court of Manhattan in his ruling. He also found that the FBI’s overly broad gag order on Merrill “implicates serious issues, both with respect to the First Amendment and accountability of the government to the people.”
The government had 90 days to appeal the court’s ruling, but declined to do so.
More than 10,000 NSLs are issued to online companies by FBI officers every year, and almost all of those are accompanied by a complete gag order barring any public disclosure of what the FBI has requested or from whom. Merrill is the first person to have successfully and completely lifted an NSL gag.