Your browser history, IP addresses, online purchases etc all up for grabs without a warrant

What the FBI can do with an NSL and a gagging order

Following a decade-long legal battle, the details of a US national security letter (NSL) sent to ISP owner Nicholas Merrill can finally be revealed.

The broad details have been known for some time, and a recent court decision all but listed the personal information that Merrill was told to hand over on all of his ISPs' customers.

However, the decision by the FBI to not continue appealing the federal court's judgment means people are now able to formally see the personal information that the US government believes it has a right to be granted access to without a warrant.

Merrill celebrated his legal victory on Twitter, noting: "Today my National Security Letter gag order is gone after over 11 years of litigation. I hope others who get NSLs find ways to challenge them", adding: "I risked my freedom to speak out about my National Security Letter because I feel strongly about the need to protect privacy and free speech."

At the same time the gag order built into the NSL was officially lifted, an unredacted version [PDF] of a court decision from Judge Victor Marrero was published listing in full all the details that the FBI requested be handed over by Calyx Internet Access back in 2004.

It is the first time that a National Security Letter gag order has been lifted. There are approximately 10,000 NSLs sent each year but the FBI refuses to provide hard statistics.

All in the details

Judge Marrero's decision was carefully worded to effectively reveal the sort of details the FBI had requested but the unredacted version makes them explicit: an individual's complete web browsing history; the IP addresses of everyone a person has corresponded with; and records of all online purchases.

The FBI also claims it has the authority to ask for mobile phone location data. According to the Feds, they have stopped asking for that data when sending out NSLs, although that doesn't mean the agency doesn't feel it continues to have the authority to do so under its reading of the law (originally the Patriot Act).

Merrill refused to hand over the information, and sued both the FBI and the US Department of Justice to lift the gagging order and let him say what they had demanded – claiming the ban restricted his First Amendment rights.

That was the start of an 11-year court battle in which Merrill himself was not allowed to be named, since he was under a gagging order, and the case name changed three times to reflect different attorneys general.

"For more than a decade, the FBI has been demanding extremely sensitive personal information about private citizens just by issuing letters to online companies like mine," said Merrill.

"The FBI has interpreted its NSL authority to encompass the websites we read, the web searches we conduct, the people we contact, and the places we go. This kind of data reveals the most intimate details of our lives, including our political activities, religious affiliations, private relationships, and even our private thoughts and beliefs," he added. ®