Sharing National Security Letters with the Public(blog.google)
blog.google
Sharing National Security Letters with the Public
https://blog.google/topics/public-policy/sharing-national-security-letters-public/
138 comments
I am trying to imagine just how much the legal council alone for 300K NSLs a year costs the American Economy.
I would like to know what proportion of those 300K are tech companies.
I would like to know what proportion of those 300K are tech companies.
Correction, ~30k a year. Still doesn't change your question much. I really hope the vast majority have their gag order removed. Who knows how many were sent to now defunct companies.
Is it just me or is the DOJ/FBI being foolish about using an incrementing identifier for these? Base on Google's list, we now know there have been at least 418,313 letters/records, and can track roughly how many letters there were between specific dates.
I would also like to know the probability of indictment given an NSL.
Pretty high, I imagine. "We have proof but we can't tell you about it because of national security."
That would work on most citizens and/or secret FISA court personnel.
That would work on most citizens and/or secret FISA court personnel.
A tip:
* Council is a group of people, often in charge of something.
* Counsel is an attorney (whose job is in part to advise you, like any other counselor).
* Council is a group of people, often in charge of something.
* Counsel is an attorney (whose job is in part to advise you, like any other counselor).
It's more confusing than that. A "council" can be an advice-giving body (such as the US President's National Economic Council) and "counsel" can be the advice given, either by your counsel (attorney) or council (advisory panel.)
President Obama received sage counsel from his council but wanted to run it by his counsel first.
President Obama received sage counsel from his council but wanted to run it by his counsel first.
> President Obama received sage counsel from his council but wanted to run it by his counsel first.
...before expending some of his capital political capital at the Capitol in the capital.
...before expending some of his capital political capital at the Capitol in the capital.
Anyone would be forgiven for thinking the history of the language must include a period during which novel arrangements of phonemes were the subject of a heavy tariff.
Hm. Can we fit "consul" (roughly equivalent to "ambassador", but lower, I think?) in there?
President Obama received sage counsel from his council but wanted to consult with his counsel before consenting to collaborate with the visiting consul.
Hm. I'm not sure whether "consenting" and "collaborate" help or hurt the sentence, there.
President Obama received sage counsel from his council but wanted to consult with his counsel before consenting to collaborate with the visiting consul.
Hm. I'm not sure whether "consenting" and "collaborate" help or hurt the sentence, there.
[deleted]
ahahaha, it's an email template at this point.
[deleted]
> we have been freed of nondisclosure obligations.
> the Act restricts the use of indefinite gag restrictions that prevent providers from ever notifying customers
Did Google say anywhere in that blog post that they've notified the users the NSLs were targeted at?
EDIT: no, but from the TC article[1]
> A Google spokesperson said the usernames were redacted to protect user privacy and that the targeted individuals had been notified.
[1] https://techcrunch.com/2016/12/13/google-national-security-l...
> the Act restricts the use of indefinite gag restrictions that prevent providers from ever notifying customers
Did Google say anywhere in that blog post that they've notified the users the NSLs were targeted at?
EDIT: no, but from the TC article[1]
> A Google spokesperson said the usernames were redacted to protect user privacy and that the targeted individuals had been notified.
[1] https://techcrunch.com/2016/12/13/google-national-security-l...
The interesting aspect of NSLs to me has always been authentication. One gets a fax, and one faxes some crap back? Trivially hackable. One contacts the phone number listed on the NSL? Ditto. How difficult would it be for the Chinese or the Russians to slide in their own "NSL" in the 30K / year "legitimate" ones?
In fact the feds make it intentionally difficult to authenticate requests; for instance they prohibit taking copies of federal IDs, they often won't submit them for actual inspection, and they have no directory of employees to consult. If one wants to confirm that one is speaking to a bona fide FBI agent you're looking at minimum an hour in phone tag, and then there is the issue of if they are relating a bona fide request or going off the reservation.
In fact the feds make it intentionally difficult to authenticate requests; for instance they prohibit taking copies of federal IDs, they often won't submit them for actual inspection, and they have no directory of employees to consult. If one wants to confirm that one is speaking to a bona fide FBI agent you're looking at minimum an hour in phone tag, and then there is the issue of if they are relating a bona fide request or going off the reservation.
You can Google the phone number in the letter and also look up the number for the field office they are from, call the office and ask for the agent.
Yes, it may take time. But you don't get many NSLs, so you do it. You do it to protect yourself (liability of disclosing info without a legal order) and your customer/user who is the subject of the letter. Every time.
Yes, it may take time. But you don't get many NSLs, so you do it. You do it to protect yourself (liability of disclosing info without a legal order) and your customer/user who is the subject of the letter. Every time.
Tangential: it always annoys me how difficult it is to highlight text in a Google blog post and look it up. Drag doesn't work and right click clears the selection. My only working approach is highlight and hit menu key.
I was about to say that it worked fine for me but then I realized that it might be because I have uMatrix, so I allowed the site everything it wanted in order to test and indeed that interferes with right click due to a dumb black popup thing with a twitter and two other icons on it.
Disappointed. Would have expected more in terms of UX from Google.
Anyway you might enjoy uMatrix, it's pretty good although it can be a tad bit annoying to figure out what I need to allow each domain in order for their pages to load content when they host content-critical scripts and such on a separate CDN-domain that they own or through a third-party CDN.
I also don't know if it's possible to allow some domain to always be allowed to be iFramed by any other. For example I would like to always allow embeds from SoundCloud, YouTube and Vimeo on any site.
Disappointed. Would have expected more in terms of UX from Google.
Anyway you might enjoy uMatrix, it's pretty good although it can be a tad bit annoying to figure out what I need to allow each domain in order for their pages to load content when they host content-critical scripts and such on a separate CDN-domain that they own or through a third-party CDN.
I also don't know if it's possible to allow some domain to always be allowed to be iFramed by any other. For example I would like to always allow embeds from SoundCloud, YouTube and Vimeo on any site.
> I also don't know if it's possible to allow some domain to always be allowed to be iFramed by any other. For example I would like to always allow embeds from SoundCloud, YouTube and Vimeo on any site.
You can do this with uMatrix (and have added this functionality to my own browsers for the sites you used as an example) To do the same, add the following rules to your 'My Rules' tab:
For SoundCloud:
You can do this with uMatrix (and have added this functionality to my own browsers for the sites you used as an example) To do the same, add the following rules to your 'My Rules' tab:
For SoundCloud:
* sndcdn.com other allow
* sndcdn.com script allow
* sndcdn.com xhr allow
* soundcloud.com frame allow
* soundcloud.com image allow
* soundcloud.com other allow
* soundcloud.com script allow
* soundcloud.com xhr allow
* youtube-nocookie.com frame allow
* youtube-nocookie.com script allow
* youtube-nocookie.com xhr allow
* youtube.com frame allow
* youtube.com image allow
* youtube.com other allow
* youtube.com plugin allow
* youtube.com script allow
* youtube.com xhr allow
* ytimg.com image allow
* ytimg.com plugin allow
* ytimg.com script allow
* vimeo.com frame allow
* vimeo.com other allow
* vimeo.com script allow
* vimeo.com xhr allow
* vimeocdn.com frame allow
* vimeocdn.com other allow
* vimeocdn.com plugin allow
* vimeocdn.com script allow
* vimeocdn.com xhr allow
* soundcloud.com * allow
I found that in order for links to an offset into a video to work I also had to add:
* googlevideo.com xhr allow
* *.googlevideo.com xhr allowAh yep, I forgot about that one which is normally the stream source on a youtube video. This is the additional global rule I use:
* googlevideo.com * allowExcellent, thanks :)
I don't know why you'd expect better from UX, Google has had notoriously terrible UX for as long as I can remember. Off the top of my head - blogger/blogspot, youtube, hangouts android app, google voice android app, gmail settings, google maps (especially the android app), etc.
My favourite example of poor, almost outright user-hostile Google UX is adding a contact to the Android address book.
(For the uninitiated: there is no yep/confirm/save element in the add-contact dialog. You have to press the back arrow -- the biggest text on the screen is the heading Add new contact, but that doesn't react to touch!)
(For the uninitiated: there is no yep/confirm/save element in the add-contact dialog. You have to press the back arrow -- the biggest text on the screen is the heading Add new contact, but that doesn't react to touch!)
That reminds me - gmail hangouts vs inbox hangouts vs hangouts hangouts vs hangouts android - contact sharing is essentially useless. No way to search for a contact in your contact list from ANY of those except android. So if I want to text someone I haven't in a while, I need to first text them from my phone before having access to the conversation thread in web clients.
Looks like they fixed it, there's a save button for me.
http://i.imgur.com/S7Zfk0Sh.jpg
http://i.imgur.com/S7Zfk0Sh.jpg
The whole reason why Google was a success is the superior UX of google.com over Yahoo, Altavista, et.al. They can ignore that at their peril.
The iconic simplicity of the Google web search UI was simply because the earliest developers were terrible at web programming.
I'd be interested to hear more about your reasoning, since it seems very flimsy and opinion-based. Developers at the time were excellent with the technologies available then.
It loaded fast over 56k, too.
Its the other way around, its when the "web devs" came that its UX started to suffer.
They still are
Google Search, YouTube and GMail are things that I find have good UX for me.
You are right, however, that they have had many products with not so good or even bad UX.
I just failed to remember the bad ones at the moment when I wrote my comment.
You are right, however, that they have had many products with not so good or even bad UX.
I just failed to remember the bad ones at the moment when I wrote my comment.
I really like Google Maps Android's UI.
And then some fronted developers wonder how/why anyone would browse the Web with JavaScript blocked. This is why. (Plus malware. Plus privacy. Plus performance issues.) Thankfully the blog renders without JS.
Trust me: we know
Not enough of you know
Not all of us care. If you want me to take an application that does complex, possibly computationally expensive client-side work and extend it so that it also supports doing the same work server-side because you refuse to run the application code locally, I'm happy to do so at my regular hourly rate plus the amortized cost of whatever additional infrastructure is required. If you want all that extra work and ongoing cost for free, you're welcome to go on wanting.
On the other hand, I wouldn't build a blog with this kind of highlight popup nonsense in the first place, because it's stupid and annoying; I'd do it in the end if a client insisted, but I'd also try hard to build a case around user engagement (or lack of same) that the time and cost of doing it would be wasted. So we may not be talking to the same point here.
On the other hand, I wouldn't build a blog with this kind of highlight popup nonsense in the first place, because it's stupid and annoying; I'd do it in the end if a client insisted, but I'd also try hard to build a case around user engagement (or lack of same) that the time and cost of doing it would be wasted. So we may not be talking to the same point here.
Knowing isn't even half the battle.
When you paycheck depends on people that don't care about it at all and keep adding stuff that is counter to that goal... then good luck
When you paycheck depends on people that don't care about it at all and keep adding stuff that is counter to that goal... then good luck
Firefox 50.0.2 (just noticed there's an update) on Windows 10.
Drag to select, ctrl+c, ctrl+k, ctrl+v, enter.
Drag to select, ctrl+c, ctrl+t, ctrl+v, enter.
Drag to select, ctrl+c, ctrl+l, ctrl+v, enter.Also, right click on any term and hit "Search for <term> using <engine of choice>".
On macOS, you can three-finger-tap (not click, tap) to invoke the right-click “Look Up” menu item. That’s my preferred technique, though it’s obviously OS-dependant.
I remember that I had a Synaptics driver on my old XPS laptop that allowed to customize three-fingers actions, so probably should be doable in other environments!
Click-drag to highlight, and then Alt-click to "Search Google" works for me on Chromebook.
From the statute (and in the letters):
> the information sought is relevant to an authorized investigation to protect against international terrorism or clandestine intelligence activities, provided that such an investigation of a United States person is not conducted solely upon the basis of activities protected by the first amendment to the Constitution of the United States.
Of course they could still lie but you can't be investigated just for your protected speech. Not defending the whole thing, but didn't realize that requirement until now.
[edit: formatting]
> the information sought is relevant to an authorized investigation to protect against international terrorism or clandestine intelligence activities, provided that such an investigation of a United States person is not conducted solely upon the basis of activities protected by the first amendment to the Constitution of the United States.
Of course they could still lie but you can't be investigated just for your protected speech. Not defending the whole thing, but didn't realize that requirement until now.
[edit: formatting]
Interestingly, 'clandestine' doesn't seem to be defined in US law; Black's law dictionary defines it as 'secret or concealed, especially for illegal or unauthorized purposes.' The law does ban such activities conducted 'on behalf of a foreign power,' which latter definition is so wide in scope as to encompass all sorts of people who might never have considered themselves to be such.
https://www.law.cornell.edu/uscode/text/50/1801
Simply having too high a degree of curiosity about certain parties and gathering publicly available data could easily be made to qualify in the hands of a creative prosecutor (and I anticipate prosecutions getting a lot less rigorous and a lot more creative in many jurisdictions real soon now).
Of course they could still lie but you can't be investigated just for your protected speech.
I'm not sure that curating a lot of information - a private library, if you like - constitutes a speech act per se.
Suppose, for example, that I wished to dominate the market for some collectible item and assembled a large volume of information on the market and its participants, but chose not to publish or advertise its existence so as not to tip my hand to competitors in that collectors' market. I would, by definition, be engaged in a sort of clandestine intelligence activity - albeit a wholly harmless one. I'm really not sure if the collection of such information is protected by the 1A.
You'd think so, but I can think of many persuasive arguments to the contrary. There's no federal law explicitly protecting the privacy of journalistic sources, for example, so it's possible that the act of publication itself might be considered a prerequisite to a 1A defense. I hope I'm overthinking this but it does seem to be a bit of a legal hot potato.
https://en.wikipedia.org/wiki/Shield_laws_in_the_United_Stat...
https://www.law.cornell.edu/uscode/text/50/1801
Simply having too high a degree of curiosity about certain parties and gathering publicly available data could easily be made to qualify in the hands of a creative prosecutor (and I anticipate prosecutions getting a lot less rigorous and a lot more creative in many jurisdictions real soon now).
Of course they could still lie but you can't be investigated just for your protected speech.
I'm not sure that curating a lot of information - a private library, if you like - constitutes a speech act per se.
Suppose, for example, that I wished to dominate the market for some collectible item and assembled a large volume of information on the market and its participants, but chose not to publish or advertise its existence so as not to tip my hand to competitors in that collectors' market. I would, by definition, be engaged in a sort of clandestine intelligence activity - albeit a wholly harmless one. I'm really not sure if the collection of such information is protected by the 1A.
You'd think so, but I can think of many persuasive arguments to the contrary. There's no federal law explicitly protecting the privacy of journalistic sources, for example, so it's possible that the act of publication itself might be considered a prerequisite to a 1A defense. I hope I'm overthinking this but it does seem to be a bit of a legal hot potato.
https://en.wikipedia.org/wiki/Shield_laws_in_the_United_Stat...
>> ... but you can't be investigated just for your protected speech.
Yes you can. All law enforcement regularly investigate wholly innocent people. It's called following leads. The vast majority of people investigated are totally innocent and never hear a peep. Sometimes those investigations lead to bad people, sometimes the lead was false, and sometimes they discover there is no real crime. They look at the speech, determine it is perfectly legal, and that's the end of the situation. But that is still "investigating".
Yes you can. All law enforcement regularly investigate wholly innocent people. It's called following leads. The vast majority of people investigated are totally innocent and never hear a peep. Sometimes those investigations lead to bad people, sometimes the lead was false, and sometimes they discover there is no real crime. They look at the speech, determine it is perfectly legal, and that's the end of the situation. But that is still "investigating".
It's not as simple as that.
"The price of lawful public dissent must not be a dread of subjection to an unchecked surveillance power. Nor must the fear of unauthorized official eavesdropping deter vigorous citizen dissent and discussion of Government action in private conversation." From https://en.wikipedia.org/wiki/United_States_v._United_States...
And "These Guidelines do not authorize investigating or collecting or maintaining information on United States persons solely for the purpose of monitoring activities protected by the First Amendment or the lawful exercise of other rights secured by the Constitution or laws of the United States" from the Attorney General's guidelines for the FBI, which were originally created because of said case.
Much as how there's a legal distinction between firing someone for no reason and firing someone for an illegal reason, there is certainly reasonably interpretable legal precedent that investigating someone solely for their protected first amendment activities may violate their first and fourth amendment rights.
Of course, IANAL, but that doesn't seem to stop many people on the internet.
"The price of lawful public dissent must not be a dread of subjection to an unchecked surveillance power. Nor must the fear of unauthorized official eavesdropping deter vigorous citizen dissent and discussion of Government action in private conversation." From https://en.wikipedia.org/wiki/United_States_v._United_States...
And "These Guidelines do not authorize investigating or collecting or maintaining information on United States persons solely for the purpose of monitoring activities protected by the First Amendment or the lawful exercise of other rights secured by the Constitution or laws of the United States" from the Attorney General's guidelines for the FBI, which were originally created because of said case.
Much as how there's a legal distinction between firing someone for no reason and firing someone for an illegal reason, there is certainly reasonably interpretable legal precedent that investigating someone solely for their protected first amendment activities may violate their first and fourth amendment rights.
Of course, IANAL, but that doesn't seem to stop many people on the internet.
>> unauthorized official eavesdropping
It's authorized by law.
>> solely for the purpose of monitoring activities protected by the First Amendment
They don't look into such things randomly. They have some notion, say a report from someone, and examine the speech. A typical example might be some kid reporting "terrorist speech" in a public forum. So some officer somewhere takes a look, finds nothing illegal, and that's the end of things. That is an "investigation" of 1st-amendment speech because the officer is reading and investigating legal speech, but the purpose of the investigation was non-protected terror speech, or child porn, or threats, or any number of categories of illegal speech. It's not proper to turn around and call those investigations illlegal simply because they didn't find anything. That would only encourage officers to find things, to make mountains out of molehills, to justify their investigation.
It's authorized by law.
>> solely for the purpose of monitoring activities protected by the First Amendment
They don't look into such things randomly. They have some notion, say a report from someone, and examine the speech. A typical example might be some kid reporting "terrorist speech" in a public forum. So some officer somewhere takes a look, finds nothing illegal, and that's the end of things. That is an "investigation" of 1st-amendment speech because the officer is reading and investigating legal speech, but the purpose of the investigation was non-protected terror speech, or child porn, or threats, or any number of categories of illegal speech. It's not proper to turn around and call those investigations illlegal simply because they didn't find anything. That would only encourage officers to find things, to make mountains out of molehills, to justify their investigation.
You might want to skim the decision (try searching for the word "authorize") in the case: http://caselaw.findlaw.com/us-supreme-court/407/297.html
This is semantics, but they're important. The investigation you mentioned isn't someone being investigated just for their protected speech, it's someone being investigated on suspicion of a specific crime. I do believe there are frameworks in which such investigations can be legal (but whether the NSLs themselves are sufficient or warrants are necessary is another matter) but I do not believe it follows that you can be investigated solely for [any] protected speech, which is what I interpreted your comment to mean. Could the speech create the suspicion in many contexts? Sure, I don't see why not. But it must actually do so, and it's the suspicion that provides the framework for the potentially legal search, not the speech.
The real law enforcement activity I think this prohibits would be pure fishing expeditions against those engaged in lawful first amendment activities. If the head of the FBI decides he doesn't like a given newspaper because of what they've said, and he can't even name a crime he suspects they've committed, I do not believe he has the legal authority to authorize an investigation into the newspaper to see if he can find something that they're guilty of. I believe it violates first and fourth amendment protections under Keith. What precisely the bar is to prove or justify any such suspicion (or even if there's any oversight) is a separate question.
This is semantics, but they're important. The investigation you mentioned isn't someone being investigated just for their protected speech, it's someone being investigated on suspicion of a specific crime. I do believe there are frameworks in which such investigations can be legal (but whether the NSLs themselves are sufficient or warrants are necessary is another matter) but I do not believe it follows that you can be investigated solely for [any] protected speech, which is what I interpreted your comment to mean. Could the speech create the suspicion in many contexts? Sure, I don't see why not. But it must actually do so, and it's the suspicion that provides the framework for the potentially legal search, not the speech.
The real law enforcement activity I think this prohibits would be pure fishing expeditions against those engaged in lawful first amendment activities. If the head of the FBI decides he doesn't like a given newspaper because of what they've said, and he can't even name a crime he suspects they've committed, I do not believe he has the legal authority to authorize an investigation into the newspaper to see if he can find something that they're guilty of. I believe it violates first and fourth amendment protections under Keith. What precisely the bar is to prove or justify any such suspicion (or even if there's any oversight) is a separate question.
>>I do not believe it follows that you can be investigated solely for [any] protected speech, which is what I interpreted your comment to mean.
Then you did miss my point. Often cops/feds have to investigate whether something is or isn't protected speech. When those investigations find nothing (normal) they then appear to have been an investigation into protected speech, but that wasn't clear at the time. We cannot make such investigations illegal simply because they come to nothing.
Then you did miss my point. Often cops/feds have to investigate whether something is or isn't protected speech. When those investigations find nothing (normal) they then appear to have been an investigation into protected speech, but that wasn't clear at the time. We cannot make such investigations illegal simply because they come to nothing.
I didn't say the investigation is/should be illegal if they come to nothing. I said the are/should be illegal if they happen without suspicion that a specific crime has been committed.
The state should not be able to target someone for investigation solely because they disagree with their speech and "think they might be guilty of something." They need to state/establish what that something is. That's my read of Keith.
Material support of designated terrorist organizations is a crime under the law, and investigating someone for that is wholly different from investigating someone solely because they disagree with their protected first amendment activities. Consider again my newspaper example. With terrorism cases, they can point to the laws about supporting terrorism and say that's what the person is suspected of. They likewise need to have a law they can point to that they need to believe is broken before they target the newspaper for investigation because of their speech. How they have to do said pointing (warrants, NSLs, etc.) is a separate question, but in the absence of such suspicion I do believe the search is illegal.
The state should not be able to target someone for investigation solely because they disagree with their speech and "think they might be guilty of something." They need to state/establish what that something is. That's my read of Keith.
Material support of designated terrorist organizations is a crime under the law, and investigating someone for that is wholly different from investigating someone solely because they disagree with their protected first amendment activities. Consider again my newspaper example. With terrorism cases, they can point to the laws about supporting terrorism and say that's what the person is suspected of. They likewise need to have a law they can point to that they need to believe is broken before they target the newspaper for investigation because of their speech. How they have to do said pointing (warrants, NSLs, etc.) is a separate question, but in the absence of such suspicion I do believe the search is illegal.
I'm highly skeptical of your approach to this problem.
> It's not proper to turn around and call those investigations improper simply because they didn't find anything.
And why not? "Some kid reporting" should not be enough to trigger even the most cursory look - especially when, as you conveniently leave out of your scenario, that cursory look involves issuing an NSL or otherwise obtaining non-public information by exerting the government's considerable power and influence. I see no reason why that should be allowed, nor that it is properly allowed under our legal framework. "Some kid reporting" is not probable cause.
And why not? "Some kid reporting" should not be enough to trigger even the most cursory look - especially when, as you conveniently leave out of your scenario, that cursory look involves issuing an NSL or otherwise obtaining non-public information by exerting the government's considerable power and influence. I see no reason why that should be allowed, nor that it is properly allowed under our legal framework. "Some kid reporting" is not probable cause.
It's interesting that most of these are only for:
>>...name, address, length of service, and electronic communications transactional records for all services, as well as accounts...
Makes me think they would submit two requests: one for metadata and one for content. This would allow them to let google publish more "innocuous" letters while continue to gag order letters where they request more intrusive information.
Would love to hear the opinion, however, of someone who unlike myself knows what they are talking about.
>>...name, address, length of service, and electronic communications transactional records for all services, as well as accounts...
Makes me think they would submit two requests: one for metadata and one for content. This would allow them to let google publish more "innocuous" letters while continue to gag order letters where they request more intrusive information.
Would love to hear the opinion, however, of someone who unlike myself knows what they are talking about.
> Makes me think they would submit two requests: one for metadata and one for content
NSLs can't (legally) be used for content, only metadata.
(putting aside, of course, that metadata is itself content)
NSLs can't (legally) be used for content, only metadata.
(putting aside, of course, that metadata is itself content)
Ah see, this is what I meant. This makes sense. Thanks for the clarification.
Multiple requests would also likley mean that if one were challenged in court, the other could still be fulfilled.
Interesting. As a service provider (hosting) we have received many "court orders" that are very similar to these NSLs... but they were not NSLs. Now that I see these NSLs, I am not that freaked out by them. I'm not sure of all the hub bub, at least for these particular NSLs. The scope of these is basically limited to identifying the user. These specifically say to not provide content of the account to the FBI. The not-NSL court orders we have received have included verbage to not disclose the request to the subject of the request.
I thought NSLs were supposedly non-contestible, broad and were for communication detail. These don't seem to be any if that.
The requests we have received have been from a variety of organizations (but signed by a magistrate) ranging from local law enforcement to three letter acronyms and one entity that is neither. While the requests don't say why the order is being issued, we usually receive a call from the agent/detective beforehand and dialog ensues in which they explain what's going on.
While many companies will just give the info, we scrutinize the request and ask the agent/detective politely and apologetically that we can help, but only if they acquire a court order. We have caught not-legitimate requests before, so we verify the request is legit before responding. We have never been asked for content of communications. If Google is not doing the same thing... oof. Just as a matter of process I assume they do. I recall in the past some networks having right in their WHOIS info, how/where Law Enforcement can send FAX requests.
I thought NSLs were supposedly non-contestible, broad and were for communication detail. These don't seem to be any if that.
The requests we have received have been from a variety of organizations (but signed by a magistrate) ranging from local law enforcement to three letter acronyms and one entity that is neither. While the requests don't say why the order is being issued, we usually receive a call from the agent/detective beforehand and dialog ensues in which they explain what's going on.
While many companies will just give the info, we scrutinize the request and ask the agent/detective politely and apologetically that we can help, but only if they acquire a court order. We have caught not-legitimate requests before, so we verify the request is legit before responding. We have never been asked for content of communications. If Google is not doing the same thing... oof. Just as a matter of process I assume they do. I recall in the past some networks having right in their WHOIS info, how/where Law Enforcement can send FAX requests.
They redacted the NSL letter number on the top left of the second pages, but kept the file reference number "In reply, please refer to NSL 10-272979" both in the address box on first page and the name of the PDF file.
Are you sure that's the NSL number being redacted at the top-left?
The NSL numbers are also listed in the Google blog entry, and are in the URLs of each PDF, so the numbers definitely aren't something that Google intended to censor.
The NSL numbers are also listed in the Google blog entry, and are in the URLs of each PDF, so the numbers definitely aren't something that Google intended to censor.
I only looked at one of them, but it seems that these are able to be released as they have the same illegal language as the Internet Archive release. Their language makes it sound like they were released due to the government being forced to review if they should be upheld.
Has anyone on HN ever been notified by Google/Yahoo/other that they were the subject of an NSL? I wonder if the people most likely to care about that are unlikely to ever be targeted?
NSLs prohibit informing the target.
Right. I meant one of the published NSLs where "the targeted individuals have been notified", not the unpublished ones.
The fact that the NSL numbers are sequential gives an interesting look into the scale of issuance.
I checked the article again after reading your comment and you were not kidding. Damn! I thought maybe they had learned something from the "German tank problem" (https://en.wikipedia.org/wiki/German_tank_problem), but maybe they just don't care how all this looks to us, regular people.
> In 2015, Congress passed the USA Freedom Act
Really?! That is a terrible name for a piece of legislation - it says nothing - even before you consider that it was messing with gag orders about executive overreach.
Really?! That is a terrible name for a piece of legislation - it says nothing - even before you consider that it was messing with gag orders about executive overreach.
Certain names are timeless favorites with bureaucrats (and worse):
"Freedom Act", "Freiheitsgesetz":
https://en.wikipedia.org/wiki/German_referendum,_1929
"Extraordinary rendition", "Sonderbehandlung":
https://en.wikipedia.org/wiki/Sonderbehandlung
"Freedom Act", "Freiheitsgesetz":
https://en.wikipedia.org/wiki/German_referendum,_1929
"Extraordinary rendition", "Sonderbehandlung":
https://en.wikipedia.org/wiki/Sonderbehandlung
I wonder how this writing of a NSL letter would affect an organisation's warrant canary (if they have one).
The US courts haven't decided on whether warrant canaries are constitutionally protected speech. At best, they help ward off an NSL as it would lead to a challenge that the EFF would love to take to the Supreme Court. The powers-that-be would much prefer to have some money laundering operation challenge a warrant canary.
I'm not a lawyer, but every time I've talked to one about this type of subject, they've informed me that these "clever" loopholes like warrant canaries are not viewed favorably by prosecutors or judges. They'll happily slap you with conspiracy/accessory/obstruction/contempt/whatever charges if they think you're being cute and trying to short-circuit a legal order with loopholes. Apparently the law, at least in most areas, has anticipated the existence of smartasses and provided mechanisms to deal with them.
I can't imagine that warrant canaries would be much different in practice. The judge would probably say that removing the canary is tantamount to revealing the existence of the letter, is thus a violation of the gag order, and that doing it will land you in contempt.
Again, pure speculation, and not a lawyer.
I can't imagine that warrant canaries would be much different in practice. The judge would probably say that removing the canary is tantamount to revealing the existence of the letter, is thus a violation of the gag order, and that doing it will land you in contempt.
Again, pure speculation, and not a lawyer.
There's always blackmail, too. Plenty of ways to force a warrant canary to continue as normal
But how does that work with a distributed canary? An NSL may affect someone in the USA who is part of a canary but what if it has to be signed by someone in the UK, then Hong Kong, then Kenya, then Venezuela etc? Those people can't be compelled to sign it....
What canaries for sure operate this way? That definitely makes things a little harder for the boys in black.
That's what an NSL is ... if you don't comply they throw you in jail. If you challenge a charge, the prosecutor will often add new ones.
Who do they jail? You can't jail a corporation, so do they jail the CEO? The lawyer who sends the letter saying they won't comply?
Either way, isn't that just begging for that information to be made public? Suddenly, Sundar Pichai is missing, and someone finds out he's in jail. That's going to be a story that gets reported (and probably leaked widely).
Either way, isn't that just begging for that information to be made public? Suddenly, Sundar Pichai is missing, and someone finds out he's in jail. That's going to be a story that gets reported (and probably leaked widely).
I know of an instance of corporate executives being walked out the door in handcuffs by the US Marshalls. That was for flagrantly disobeying the FDA. I'm pretty sure there wouldn't be a lesser response for flagrantly disobeying a National Security Letter.
My point is that the NSL is supposed to be secret, not just for its contents, but the existence of the letter. So, dragging a CEO off publicly would almost certainly expose the existence of the NSL.
It might expose the existence of an NSL, but not of that NSL.
That is: I'm Joe Terrorist. I use, say, GMail. Google gets a thousand NSLs. On at least one of them, they tell the NSA/FBI/CIA/whoever to get lost. Five Google execs get arrested. I, Joe Terrorist, may guess that the arrest is over NSLs. I have no idea whether I am named on one of the NSLs in question, or whether I was on one of the NSLs that Google complied with, or whether I'm still completely under the radar.
It might serve to remind me "oh, yeah, that's right, any of those companies can get an NSL and report everything they know about me", but if I'm at all a competent terrorist, that's something I already knew and should be continually remembering.
That is: I'm Joe Terrorist. I use, say, GMail. Google gets a thousand NSLs. On at least one of them, they tell the NSA/FBI/CIA/whoever to get lost. Five Google execs get arrested. I, Joe Terrorist, may guess that the arrest is over NSLs. I have no idea whether I am named on one of the NSLs in question, or whether I was on one of the NSLs that Google complied with, or whether I'm still completely under the radar.
It might serve to remind me "oh, yeah, that's right, any of those companies can get an NSL and report everything they know about me", but if I'm at all a competent terrorist, that's something I already knew and should be continually remembering.
The IRS suddenly starts audits of company officials. Srsly.
I was under the impression the FBI and CIA are separate agencies from the IRS, i.e., they can't just secretly tell the IRS to audit someone.
Trying to dredge up the articles; I believe that the CEO of a high-tech company was heavily investigated by the IRS after he threatened to make an NSL public.
In the past, the IRS has definitely been used as a tool to apply pressure. It's not supposed to happen, but it does.
In the past, the IRS has definitely been used as a tool to apply pressure. It's not supposed to happen, but it does.
> Trying to dredge up the articles; I believe that the CEO of a high-tech company was heavily investigated by the IRS after he threatened to make an NSL public.
Joseph Nacchio[1], CEO of Quest?
His case[2] is a clear warning shot that if you don't play ball with the spooks, the government has no problem throwing the hammer at you.
[1] https://en.wikipedia.org/wiki/Joseph_Nacchio#Career
[2] http://www.businessinsider.com/the-story-of-joseph-nacchio-a...
Joseph Nacchio[1], CEO of Quest?
His case[2] is a clear warning shot that if you don't play ball with the spooks, the government has no problem throwing the hammer at you.
[1] https://en.wikipedia.org/wiki/Joseph_Nacchio#Career
[2] http://www.businessinsider.com/the-story-of-joseph-nacchio-a...
Yup, that's the guy.
They will use whatever powers they have to coerce companies (or individuals) into cooperating, including with holding contracts or causing regulatory headaches.
I wish the FBI would be required to produce the original digital document instead of poor quality scans...
Imagine the possibilities of this, combined with McCarthy's wet dream palantir.
You mean Trumps wet dream, Palantir? What a perfect vessel for public/private cooperative actions! I'm sure his buddy Pete would give him a huge referral.
I've had at least half-a-dozen non-techie friends signup for Signal since Trump's election.
But not under Obama or (potentially Hillary)? What about Trump makes them so fearful now where they weren't under the current state of affairs.
I'm not saying that a Trump presidency isn't a great way to convince people to get a Signal account, but it strikes me that NSA spying and everything else that's gone on over the past decade should have been enough.
I'm not saying that a Trump presidency isn't a great way to convince people to get a Signal account, but it strikes me that NSA spying and everything else that's gone on over the past decade should have been enough.
The increased fear is not based on the capabilities, which as you said have existed for awhile, but on what Trump will do with them. They feel he has fascist tendencies or intentions and does not respect for American traditions or law.
(I'm not trying to make partisan points; I'm only saying that there is a large cohort that feels that way. Obviously, many in the U.S. voted for Trump.)
(I'm not trying to make partisan points; I'm only saying that there is a large cohort that feels that way. Obviously, many in the U.S. voted for Trump.)
> They feel he has fascist tendencies or intentions and does not respect for American traditions or law.
These illegal capabilities have been spreading regardless of party or political promises.
These illegal capabilities have been spreading regardless of party or political promises.
Absolutely. And I don't doubt that Hillary wouldn't have expanded them further; if anything she's more hawkish than Trump.
That said, only one of these two people is asking for names of every government employee who has attended a climate science meeting in the past 5 years. The implications are truly chilling.
That said, only one of these two people is asking for names of every government employee who has attended a climate science meeting in the past 5 years. The implications are truly chilling.
"Chilling" seems a bit histrionic. It's an interesting challenge to the customary, but as far as I know extraconstitutional, idea that cabinet departments operate independently of the sitting president rather than, like the rest of the executive branch, serving at his pleasure. If law exists to mandate this arrangement, I'd be obliged to anyone who wil make me aware of it; absent that, it seems like something that's purely de facto, albeit at this point quite longstanding, and open to challenge by any president who so chooses.
I'm not surprised to see Trump mount such a challenge, because he is likely ill accustomed to tolerating independent fiefdoms within an organization he nominally heads. But he's far from the first president to try it on, and I very much doubt he'll find more success than his predecessors - indeed the latest on this particular story seems to be that DOE has told him to go to hell, and if that sounds like hyperbole then it's no more so than a lot of the headlines I've just seen.
I'm not surprised to see Trump mount such a challenge, because he is likely ill accustomed to tolerating independent fiefdoms within an organization he nominally heads. But he's far from the first president to try it on, and I very much doubt he'll find more success than his predecessors - indeed the latest on this particular story seems to be that DOE has told him to go to hell, and if that sounds like hyperbole then it's no more so than a lot of the headlines I've just seen.
There are a number of things presidents technically /could/ do but do not because they are horrifying. The fact that he's technically legally allowed to do something bad does not mean it's okay that he is doing it -- the president can (and has) executed and indefinitely jailed citizens without trial or attorney, locked everyone in America of a certain race in camps and taken their belongings, sold arms to and trained terrorist groups, ordered torture, leaked the identity of a CIA operative in order to enact personal petty revenge on her husband, toppled and assassinated democratically elected world leaders, given out pardons in exchange for personal favors or money, criminalized drugs with the explicit stated purpose of going after cultural subgroups who chose to dissent but were doing so legally and could not be jailed, sent law enforcement to spy on and shut down peaceful legal protest groups including trying to convince MLK Jr. to commit suicide, to name a few.
Presidents have done and can legally do all these things. Trump could do each one of these things. The only hope we have is that he chooses not to out of a sense of not wanting to destroy the country, or out of some sense of morality and sense of what is right and wrong. Each one is a disgusting, horrifying abuse of power. So is demanding a list of federal employees who meet some political criteria with the explicit intention of an ideological purge (even worse, he's purging all people who believe in or are curious about science from a science agency). Next will he ask for a list of federal employees who have had an abortion? A list of those who have voted Democrat? A list of those who have posted an Internet comment critical of him? The next time he asks for a list, will we hear about it?
Presidents have done and can legally do all these things. Trump could do each one of these things. The only hope we have is that he chooses not to out of a sense of not wanting to destroy the country, or out of some sense of morality and sense of what is right and wrong. Each one is a disgusting, horrifying abuse of power. So is demanding a list of federal employees who meet some political criteria with the explicit intention of an ideological purge (even worse, he's purging all people who believe in or are curious about science from a science agency). Next will he ask for a list of federal employees who have had an abortion? A list of those who have voted Democrat? A list of those who have posted an Internet comment critical of him? The next time he asks for a list, will we hear about it?
You have just equated a new president-elect inquiring into the staffing of one of his subordinate departments, and the mass internment in concentration camps of American citizens with Japanese ancestry.
In response to that, I cannot imagine what I might possibly be able to contribute.
In response to that, I cannot imagine what I might possibly be able to contribute.
I have done nothing of the sort, of course, which you know, but it's a common dishonest rhetorical tactic to suggest that mentioning two concepts in the same post is automatically drawing an equivalence between them. I've made an argument that because something a president does is /allowed/ or /legal/ does not mean that it's morally acceptable. If you think everything that is legal but immoral is equivalent, that's on you, not me.
The fact that he's doing horribly immoral things and the defense is -30 days into his presidency already "it's legal therefore it's okay" is a very, very bad sign for the future of his administration, because as I've shown abiding by actions which are 'legal' means almost nothing when it comes to federal executive power. That moral sense which we are depending on which prevents a president from abusing their power is, by the evidence we've seen, not present in him.
The fact that he's doing horribly immoral things and the defense is -30 days into his presidency already "it's legal therefore it's okay" is a very, very bad sign for the future of his administration, because as I've shown abiding by actions which are 'legal' means almost nothing when it comes to federal executive power. That moral sense which we are depending on which prevents a president from abusing their power is, by the evidence we've seen, not present in him.
> Each one is a disgusting, horrifying abuse of power. So is [...]
How do you mean this to be taken if not to say that what he's done is as bad as all the other things you named? - that is, as a claim of moral equivalence.
How do you mean this to be taken if not to say that what he's done is as bad as all the other things you named? - that is, as a claim of moral equivalence.
It is definitely true that many people believe Trump has fascist tendencies, but it is worth noting that many people believe HRC has similar tendencies, and would also greatly expand the surveillance state. Some of these two groups (who distrust each candidate) overlap, while many distrust one much more than the other.
> it is worth noting that many people believe HRC has similar tendencies
I disagree. Trump is the President-elect; she has no position in government. Also, depending on the definition of "many", I don't think it was true that 'many' thought that way. People widely called her corrupt and other things, but generally she didn't propose fascist policies, I don't recall seeing her called fascist, and I followed the election closely. If 'many' = 'some', we can find 'many people' who think anything.
I guess I just dislike relativistic statements, painting all sides as equal.
I disagree. Trump is the President-elect; she has no position in government. Also, depending on the definition of "many", I don't think it was true that 'many' thought that way. People widely called her corrupt and other things, but generally she didn't propose fascist policies, I don't recall seeing her called fascist, and I followed the election closely. If 'many' = 'some', we can find 'many people' who think anything.
I guess I just dislike relativistic statements, painting all sides as equal.
Not agreeing with people's apprehensions about Trump is one thing, but ignorance of why people are apprehensive isn't credible. I do not believe that you are cognizant of privacy issues but unable to see any qualitative difference between him and Obama (or HRC).
> Not agreeing with people's apprehensions about Trump is one thing, but ignorance of why people are apprehensive isn't credible. I do not believe that you are cognizant of privacy issues but unable to see any qualitative difference between him and Obama (or HRC).
The specter of Trump has been there the entire time. The danger of mass data collection isn't merely the current President, it's that we have an election every four years.
Go start encrypting everything now. Better late than never. But all the things you sent unencrypted during Obama's presidency, that you didn't stop them from keeping, now Trump will have all of it.
The specter of Trump has been there the entire time. The danger of mass data collection isn't merely the current President, it's that we have an election every four years.
Go start encrypting everything now. Better late than never. But all the things you sent unencrypted during Obama's presidency, that you didn't stop them from keeping, now Trump will have all of it.
Obama put the left to sleep. Ironically Trump will probably be the best possible outcome for civil liberties as people will actually fight him.
> Obama put the left to sleep
I agree with this 100%. Suddenly people care about mass deportation, for example, but where were they when Obama was deporting a record 2.5 million people? They are terrified of Trump's "deportation force", not realizing apparently that many such deportation forces (e.g. ICE) already exist.
Some things that the left should have cared about under Obama:
* initiating new undeclared wars
* expanding the surveillance state
* eliminating habeas corpus with the 2012 NDAA
* killing two American citizens extra-judicially
* fracking
* selling arms to radicals and brutal foreign regimes
* the Honduran coup
* CIA black sites / torture (forced rectal 'feeding' to the point of rectal prolapse, for example)
* prosecuting whistleblowers
* raiding legal dispensaries / grow ops and wholesale continuing the ludicrous war on drugs
* pro-corporate policies like the TPP, ACA, and the bailouts
* running up the national debt another 10 trillion or so
* contracting out development of astroturfing software from HBGary / Operation Earnest Voice
I could go on. The real left barely exists anymore in America.
I agree with this 100%. Suddenly people care about mass deportation, for example, but where were they when Obama was deporting a record 2.5 million people? They are terrified of Trump's "deportation force", not realizing apparently that many such deportation forces (e.g. ICE) already exist.
Some things that the left should have cared about under Obama:
* initiating new undeclared wars
* expanding the surveillance state
* eliminating habeas corpus with the 2012 NDAA
* killing two American citizens extra-judicially
* fracking
* selling arms to radicals and brutal foreign regimes
* the Honduran coup
* CIA black sites / torture (forced rectal 'feeding' to the point of rectal prolapse, for example)
* prosecuting whistleblowers
* raiding legal dispensaries / grow ops and wholesale continuing the ludicrous war on drugs
* pro-corporate policies like the TPP, ACA, and the bailouts
* running up the national debt another 10 trillion or so
* contracting out development of astroturfing software from HBGary / Operation Earnest Voice
I could go on. The real left barely exists anymore in America.
Is that the same NDAA that gives the military law enforcement powers?
I hope you're right. I fear that they will continue to sleep.
I'm not sure what to think about Signal. It's got some great supporters like the EFF, but on Android, it requires about a dozen permissions, most unnecessary. It also requires your phone number to register, and uses a Twilio API at registration. WTF? What are peoples' thoughts on Silent Phone? It's written by the creator of PGP, only requests permissions when it needs them (at least on Android 6 and up), and stores encryption keys locally.
Signal is awesome! However, it does very little to help the very case we'd have to deal with around NSLs. Signal doesn't aim to conceal metadata about who is communicating, just what they are communicating about.
Signal explicitly states they do not try or can protect you from state actors.
Sure, that's easy to miss in the entire "supported by snowden" marketing, but we've had actually a debate about that on HN before.
Sure, that's easy to miss in the entire "supported by snowden" marketing, but we've had actually a debate about that on HN before.
Of all the messaging apps, Signal is probably the most secure.
They're just being realistical about it. If a nation-state is targeting you, relying on a particular app, no matter how secure, isn't enough and they don't want to make false promises.
They're just being realistical about it. If a nation-state is targeting you, relying on a particular app, no matter how secure, isn't enough and they don't want to make false promises.
Is it? People at risk of state surveillance would usually switch to GPG or OTR with FLOSS apps before, and usually throw proprietary stuff from their devices.
Now, they use Signal.
I'm not sure if that's more secure. In fact, I'd argue Signal is less secure.
Moxie himself has argued before that the intention of Signal is not to be more secure than these options, but to be a solution that everyone can use that's more secure than Telegram/The old WhatsApp protocol without Axolotl/etc.
Now, they use Signal.
I'm not sure if that's more secure. In fact, I'd argue Signal is less secure.
Moxie himself has argued before that the intention of Signal is not to be more secure than these options, but to be a solution that everyone can use that's more secure than Telegram/The old WhatsApp protocol without Axolotl/etc.
> Signal explicitly states they do not try or can protect you from state actors.
Where do they state that?
Where do they state that?
In every single debate I had on HN where I complained that Signal reduces the privacy of people at risk of state surveillance, such as journalists, political activists, etc, because they bothered to use GPG before, and now switch - due to the marketing - to Signal, it was always said (even from OWS members themselves) that Signal is not designed to protect against that, instead, it is designed to improve the safety of the average citizen.
Could you provide a link to the comments? I'm currently discussing Signal with some friends and this would be helpful.
>...combined with McCarthy's wet dream...
His dreams really can come true:
http://mediamatters.org/video/2016/06/13/fox-s-gingrich-call...
His dreams really can come true:
http://mediamatters.org/video/2016/06/13/fox-s-gingrich-call...
This is probably a better link: https://blog.google/topics/public-policy/sharing-national-se...
I really think HN should block/downvote all TC links, which are most of the time worse than the original source.
The relationship between YC/HN and TC goes back pretty far as part of a collusory pipeline for media attention around startup launch and funding announcements. Not sure how that's changed since TC's decline over recent years (which is why I imagine YC invested in ProductHunt), but there are possibly still some artifacts of a relationship there that might prevent this.
I think instead they could possibly add a report button for links explicitly for providing the original source. To help limit people just bashing it for the hell of it, the report could be set up to only submit with a valid URL. Then the mods could quickly correct it.
You can just email them.
No, that's a bad idea.
TC articles ARE many times vapid, uniformative and click-baity, but...
They will remain tech-oriented, timely and do serve the purpose of initiating conversation, by drawing attention to information sources that might not have gained visibility on their own. In short, you risk harming the network effect by applying a censor or restriction against such behavior.
This is one of those nuances that requires to blood and sweat of moderation. Unless there's a reasonable way to maybe crawl the submission and search its contents reliably, preventing such links carries risk.
TC articles ARE many times vapid, uniformative and click-baity, but...
They will remain tech-oriented, timely and do serve the purpose of initiating conversation, by drawing attention to information sources that might not have gained visibility on their own. In short, you risk harming the network effect by applying a censor or restriction against such behavior.
This is one of those nuances that requires to blood and sweat of moderation. Unless there's a reasonable way to maybe crawl the submission and search its contents reliably, preventing such links carries risk.
The site guidelines actually ask you to prefer the original source, when available. It's not complicated at all in this case.
[deleted]
Ok, we changed to that from https://techcrunch.com/2016/12/13/google-national-security-l....
[https://www.eff.org/issues/national-security-letters/faq#5]
* - formatting