Authorized by the revised USA Patriot Act, the national security letter program allows the FBI, on its own authority, to demand information on individuals from a variety of "electronic communication providers," including Internet companies, banks, credit card companies, libraries and other entities in the name of national security.
The recipients of such letters, such as Microsoft, are by law not allowed to make the requests public.
What's surprising about the program is how many national security letters demanding information are sent out by the FBI each year -- tens of thousands, by court count, and 97 percent are under gag orders preventing them from being made public.
The American Civil Liberties Union said the NSLs have reached 40,000 to 50,000 in some years.
In addition, the law allowing the executive branch intrusion makes sure any judicial supervision of the program is loose-reined.
In a suit filed by San Francisco's Electronic Frontier Foundation -- the nation's premier advocate of electronic communications freedom -- in May 2011, U.S. District Judge Susan Illston declared the NSL program unconstitutional. Illston, a Clinton appointee to the bench, said last month the prior restraint gag order violated the First Amendment, and the law's attempts to keep the courts at arm's length violated the First Amendment and the constitutional separation of powers.
She ordered the FBI to stop issuing the letters, but stayed her order for 90 days to allow the Obama administration to appeal. No word yet on whether there will be one, but an appeal is almost certain.
In response to an earlier challenge to the NSL program, the FBI said in 2008, "National security letters remain indispensable tools for national security investigations and permit the FBI to gather the basic building blocks for our counter-terrorism and counter-intelligence investigations."
Working against the administration and the FBI in a continuation of the case: Any appeal would go to the 9th U.S. Circuit Court of Appeals, the country's most liberal federal appeals court.
Working for the administration and the FBI: The narrow conservative majority in the U.S. Supreme Court frequently relishes reversing the Ninth Circuit -- but in a First Amendment case, all bets may be off.
Also last month, Microsoft and Google said in separate announcements their customers had been the targets of NSLs, but did not name the customers or even the specific number of letters received.
In a 2012 Law Enforcement Requests Report, Microsoft said, "This data covers law enforcement requests and/or court orders Microsoft received in calendar year 2012 related to our online and cloud services -- including, for example, Hotmail/Outlook.com, SkyDrive, Xbox LIVE, Microsoft Account, Messenger and Office 365. Skype data is included, but reported separately, since prior to being acquired by Microsoft in late 2011, Skype collected data in a different format and because Skype continues to operate under Luxembourg law. Skype reporting policies and practices have now been brought in line with Microsoft reporting policies and going forward all data will be provided in a consistent format."
The report said in 2012 "Microsoft and Skype received 75,378 law enforcement requests. Those requests potentially impacted 137,424 accounts. While it is not possible to directly compare the number of requests to the number of users affected, it is likely that less than 0.02 percent of active users were affected. The data show that, after a careful review of each request by our compliance teams, 18 percent of law enforcement requests to Microsoft resulted in the disclosure of no customer data. Approximately 79.8 percent of requests to Microsoft resulted in the disclosure of only non-content information, and only a small number of law enforcement requests [2.2 percent] resulted in the disclosure of customer content."
Only a small percentage of the law enforcement requests were NSLs.
Google, on its transparency report page, revealed only a range of requests: up to 999 national security letters each year from 2009 to 2012, affecting 1,000 to 1,999 user accounts in 2009; affecting 2,000-2,999 users or accounts in 2010; and 1,000-1,900 each in 2011 and 2012.
Microsoft reported similar numbers for 2012.
Earlier this month, Google asked a federal court to block its latest NSL, though neither the court nor the company released details.
Judge Illston's order last month in San Francisco was festooned with Supreme Court cites, but focused on parallel action in a separate earlier challenge to NSLs before the U.S. Court of Appeals for the Second Circuit in New York.
Illston said two provisions of the U.S. Code "provide that a wire or electronic communication provider shall comply with a request for specified categories of subscriber information if the director of the FBI or his designee certifies that the records sought are relevant to an authorized investigation to protect against international terrorism or clandestine intelligence activities, provided that such an investigation of a United States person is not conducted solely on the basis of activities protected by the First Amendment to the Constitution of the United States.
"[One section] provides that if the director of the FBI or his designee certifies that 'there may result in a danger to the national security of the United States, interference with a criminal, counter-terrorism or counter-intelligence investigation, interference with diplomatic relations or danger to the life or physical safety of any person,' the recipient of the NSL shall not disclose to anyone [other than to an attorney to obtain legal advice or legal assistance with respect to the request] that the FBI has sought or obtained access to information or records of the NSL."
A federal judge could set aside the non-disclosure requirement or the NSL itself, but only if the certification "was made in bad faith."
In the separate New York challenge, a federal judge ruled the law restricted judicial review.
But the Second Circuit appellate court, in John Doe vs. Mukasey, accepted concessions from the government to save the law. As summed up by Illston, the appeals court "accepted the government's position -- offered in litigation -- that the [law's] non-disclosure requirement applies only if the FBI certifies that an enumerated harm related to an authorized investigation to protect against international terrorism or clandestine activity may occur. Second, the [appeals] court accepted the government's litigation position that [the law's] requirement that a court may alter or modify the non-disclosure agreement only if there is 'some reasonable likelihood' that the enumerated harm will occur." And third and finally, the appeals court "accepted the government's agreement that it would bear the burden of proof to persuade a district court -- through evidence submitted in camera as necessary -- that there is a good reason to believe that disclosure may risk one of the enumerated harms; and the the district court must find that such good reason exists."
But Illston was not completely buying the concessions.
"In the pleadings in the present [San Francisco] case, the government did not state whether it was complying with the narrowing constructions and the procedural requirements imposed on the NSL non-disclosure by the Second Circuit. However, at the hearing before this court, the government asserted it was following the mandates imposed by the Second Circuit in the John Doe vs. Mukasey decision for all NSLs being issued, since it would be impracticable to attempt to comply with that decision only in the Second Circuit."
But, Illston said, "Even if the FBI is in fact complying with both the procedural and substantive requirements imposed by the Second Circuit for all NSLs issued, the fact that the statute is facially deficient ... presents too great a risk of potential infringement of First Amendment rights to allow the FBI to sidestep constitutional review by relying on its voluntary, nationwide compliance with the Second Circuit's limitations," citing the U.S. Supreme Court in 2000's Friends of the Earth vs. Laidlaw.
"Another significant factor weighs in favor of this court resolving the facial challenge: Despite evidence demonstrating that tens of thousands of NSLs are issued each year -- and by the government's own estimate, 97 percent of them may come with a non-disclosure order -- only a handful of challenges to the NSL provisions have been brought," the judge said.
Illston concluded the NSL provisions "suffer from significant constitutional infirmities" which can't be severed to save part of the law.
"The court concludes that the non-disclosure provision of [one part of the section] violates the First Amendment and [the second part] violates the First Amendment and the separation of powers principles," Illston said in her order. "The government is therefore enjoined from issuing NSLs under section 2709 or from enforcing the non-disclosure provision in this or any other case. However, given the significant constitutional and national security issues at stake, enforcement of the court's judgment will be stayed pending appeal, or if no appeal is filed, for 90 days."
The Electronic Frontier Foundation filed its suit on behalf of an unnamed telecommunications company. After Illston's ruling, the EFF claimed victory.
"The First Amendment prevents the government from silencing people and stopping them from criticizing its use of executive surveillance power," EFF Legal Director Cindy Cohn said in a statement posted online. "The NSL statute has long been a concern of many Americans, and this small step should help restore balance between liberty and security."
But the legal battle is probably far from over. The seriousness of the dispute, both in terms of national security and constitutional issues, makes it likely that it will end up in the U.S. Supreme Court.