Privacy & Information Security Law Blog

On March 14, 2013, the United States District Court for the Northern District of California granted a motion to prohibit the government from issuing National Security Letters (“NSLs”) to electronic communication service providers (“ECSPs”) requesting “subscriber information” and enforcing nondisclosure clauses contained in such letters. The nondisclosure clauses are intended to prevent ECSPs from disclosing that they received an NSL. The court also held that the sections of two federal statutes relating to the nondisclosure provisions of NSLs, 18 U.S.C. §2709(c) and 18 U.S.C. §3511(b), (collectively, the “NSL Nondisclosure Statutes”) were unconstitutional because they violated the First Amendment as well as separation of powers principles. In light of the significant constitutional and national security implications, the court stayed enforcement of its judgment pending appeal to the Ninth Circuit, or for 90 days if no appeal is filed.

In this case, In re National Security Letter, the FBI requested information (i.e., name, address, length of service and toll billing records) via an NSL from an unspecified ECSP. The NSL contained a nondisclosure clause prohibiting the ECSP from disclosing that it had received the request or the contents of the request. According to documents reviewed by the court, the FBI issues tens of thousands of NSLs each year and approximately 97% of them contain a nondisclosure mandate. The ECSP informed the FBI that it intended to contest the request, including the nondisclosure provision, and the government initiated an enforcement action in federal court.

Under the current NSL Nondisclosure Statutes, the FBI may prohibit the recipient of an NSL from disclosing that it has received the request, and the contents of the request, if a high-ranking official at the FBI “certifies” that disclosure by the recipient would (1) endanger national security; (2) interfere with diplomatic relations; (3) interfere with a criminal, counterterrorism or counterintelligence investigation; or (4) endanger the life or physical safety of an individual. If a recipient challenges the nondisclosure mandate, and the Attorney General (or another specified high-ranking government official) also certifies to one of the four scenarios above, the court must treat that certification as “conclusive,” unless it was made in bad faith. Without a certification from the Attorney General (or other high-ranking government official), the court may “modify or set aside” the nondisclosure provision if it determines that “there is no reason to believe” that disclosure would result in one of the four scenarios above.

The court noted that while national security is a compelling governmental interest, the NSL Nondisclosure Statutes are not narrowly tailored, and thus are unconstitutional, because they make no distinction “between a prohibition on disclosing mere receipt of an NSL and disclosing the underlying contents.” Additionally, the court found that the NSL Nondisclosure Statutes are impermissibly overbroad because they do not require or even allow the nondisclosure mandate to expire if the situation no longer requires secrecy.

The procedures for challenging an NSL were deemed unconstitutional as well. The court found that the curtailment of judicial review violated the separation of powers principles, because “[t]reating the government’s certification as ‘conclusive’ diminishes the exacting scrutiny courts must apply to speech restraints down to ‘no scrutiny’ at all.” Moreover, the court asserted that the NSL Nondisclosure Statutes inappropriately place the burden on NSL recipients to initiate court proceedings for challenging nondisclosure provisions, instead of on the censor (i.e., the government).

While enforcement of the court’s order is on hold pending review by the Ninth Circuit, the decision may impact other processes, beyond NSL requests for subscriber information from ECSPs. The process for judicial review that the court held unconstitutional under the NSL Nondisclosure Statutes is the same process applied to recipients’ challenges to certain governmental requests for consumer information pursuant to the Fair Credit Reporting Act, Right to Financial Privacy Act and the National Security Act.