[00:03.860 --> 00:09.140] Thank you very much, everybody who is here tonight. [00:10.220 --> 00:16.040] And thank you to the organizers of HOPE for inviting me to talk about this. [00:19.540 --> 00:24.900] The struggle that I went through with national security letters has been going on for quite a long time. [00:25.040 --> 00:26.260] It started in 2004. [00:26.880 --> 00:34.660] And one of my real fears was similar to something that Edward Snowden said, that basically nobody would pay attention. [00:34.980 --> 00:38.150] And it would just sort of be a news story for a day and then it would go away. [00:39.490 --> 00:45.740] The amazing thing is that this story seems to endure and continue. [00:47.810 --> 00:56.920] And as time has gone on, more and more organizations have sort of jumped on board and started to push back against the government. [00:57.930 --> 01:02.790] But before I get too deeply into that, let me give sort of an overview. [01:03.830 --> 01:06.140] The talk is about national security letters. [01:07.460 --> 01:14.880] And the sort of subtext is how they're supposed to be a system of checks and balances, but they're not really strong enough. [01:15.320 --> 01:21.540] And in many cases, including my experiences, they were essentially non-existent. [01:24.120 --> 01:29.380] In 2004, I ran an Internet service provider here in New York City. [01:30.060 --> 01:41.740] I'm a native of New York and I got into the Internet business really early on, around 1994, when there was only a couple of ISPs here in New York. [01:42.280 --> 01:46.780] But about 10 years into it, I was more of a hosting provider and doing security consulting. [01:46.780 --> 01:54.980] And I got a visit one day from an FBI agent who came knocking on my door with that heavy kind of police knock like that. [01:56.760 --> 02:02.100] The agent came to my office and physically handed me a letter, which I opened and I read. [02:02.340 --> 02:10.420] And the letter directed me that I had to provide a whole ton of information on one of my company's clients. [02:10.420 --> 02:20.320] And at the end of it included this catch-all called electronic communications transactional records. [02:21.100 --> 02:24.890] The reason that's important will become apparent sort of later on in the talk. [02:27.700 --> 02:37.880] You know, I've been sort of litigating this legal issue for a little... around 12 years. [02:38.350 --> 02:41.700] And it's been a super long process. [02:41.700 --> 02:51.360] And it's sort of taken me the entire almost 12 years to be able to like stand here and tell the story... [02:51.360 --> 02:57.440] without fear of getting in trouble for saying something that the government doesn't want me to say. [02:59.100 --> 03:06.800] The really nice thing is that as of a few months ago, I'm able to really speak completely fully about this issue... [03:06.800 --> 03:13.490] without any kind of fear, other than the normal paranoia that we all might have. [03:15.340 --> 03:20.880] What really happened was that there was a person who was a client of my Internet provider... [03:21.360 --> 03:26.580] who actually had nothing but a shell account on a Unix server. [03:28.580 --> 03:33.020] And that person was politically active. [03:33.020 --> 03:43.860] And they were involved in trying to reform the government and trying to reform in particular the correctional system. [03:45.680 --> 03:50.770] And often the people that my company worked with were doing political stuff. [03:50.960 --> 03:52.640] And I sought out people like that. [03:52.800 --> 03:59.920] And I took pride and I took pleasure in helping out people who were doing work that seemed important to me. [04:02.140 --> 04:06.180] I was only able to sort of piece together this whole story over the course of several years. [04:06.400 --> 04:12.960] But what I began to understand was that the FBI approached this person who is my company's client... [04:12.960 --> 04:19.060] and they tried to enlist them to become an informant within their activist community... [04:19.060 --> 04:20.720] and within their social community. [04:20.720 --> 04:30.060] And this person being not the type of person who is easily pushed around... [04:30.060 --> 04:33.740] refused to get involved in that type of activity... [04:34.300 --> 04:37.100] and declined to become an informant. [04:37.460 --> 04:41.980] But that apparently made the FBI very upset... [04:41.980 --> 04:55.040] and they began to try to use a sort of increasing level of hostile techniques to try to elicit cooperation... [04:55.040 --> 04:57.120] from this individual. [04:57.540 --> 05:00.980] And it ranged from... [05:02.540 --> 05:09.100] you know, things like putting national security letters on them to gather records on everyone that they were communicating with... [05:09.100 --> 05:15.280] to visiting all their prospective places of employment... [05:15.820 --> 05:21.860] like sending out a couple of agents to talk to them and say, hey, you know, do you really know about this person? [05:22.680 --> 05:25.980] And making like kind of vague... asking vague questions like that... that would freak out potential employers... and sort of... causing... his... [05:32.800 --> 05:34.400] Professional life to be... more or less undermined.. to... [05:39.120 --> 05:42.380] things like putting him on the no-fly list... [05:42.380 --> 05:45.060] and preventing him from... from traveling. [05:47.400 --> 05:48.680] You know, I... [05:49.640 --> 05:52.560] I ended up finding out a lot about this... [05:52.560 --> 05:55.400] in part from... from court papers that I saw over the years... [05:56.440 --> 05:58.540] where the FBI talked about... [06:00.320 --> 06:01.820] you know, things that they had done... [06:01.820 --> 06:04.600] and also just from talking to the person who... [06:04.600 --> 06:06.460] it was... it was awkward and uncomfortable... [06:06.460 --> 06:07.880] but I... I maintained... [06:07.880 --> 06:09.040] like a... [06:09.040 --> 06:14.200] a relationship communicating over instant messaging with this person throughout the entire 12 years... [06:14.200 --> 06:15.900] but without ever telling them... [06:15.900 --> 06:17.160] what was going on... [06:17.160 --> 06:18.560] because I... I wasn't able to... [06:19.600 --> 06:20.080] but... [06:20.080 --> 06:21.620] sometimes he would tell me... [06:21.620 --> 06:23.000] you know, stuff that was going on... [06:23.000 --> 06:24.580] and so I was able to, like, piece together... [06:24.580 --> 06:25.760] what was happening. [06:27.400 --> 06:27.760] Um... [06:27.760 --> 06:29.620] I really strongly felt when... [06:29.620 --> 06:31.040] when I received this letter that... [06:31.040 --> 06:32.000] that there was no... [06:33.100 --> 06:34.780] that this was not a bad person... [06:34.780 --> 06:37.440] and that if the government really thought that they were up to something bad... [06:37.440 --> 06:40.060] that they could get a real warrant from a judge... [06:40.820 --> 06:41.920] but the government... [06:41.920 --> 06:43.280] always refused to do that... [06:43.280 --> 06:44.140] and I... [06:45.000 --> 06:45.360] I... [06:46.540 --> 06:46.980] uh... [06:46.980 --> 06:49.160] on some level I'm happy that they didn't because... [06:50.260 --> 06:50.700] uh... [06:50.700 --> 06:50.980] it... [06:50.980 --> 06:53.400] it let this issue come to the forefront... [06:53.400 --> 06:53.940] uh... [06:53.940 --> 06:55.200] on the other hand... [06:55.200 --> 06:55.600] uh... [06:55.600 --> 06:57.900] my life would have been a lot easier if they had just kind of... [06:57.900 --> 06:59.540] followed the... [07:00.540 --> 07:00.980] uh... [07:00.980 --> 07:02.740] the Constitution... [07:03.980 --> 07:04.420] um... [07:04.420 --> 07:05.360] speaking about the Constitution... [07:06.060 --> 07:06.620] you know... [07:06.620 --> 07:07.820] for me, really, the... [07:07.820 --> 07:09.500] the central issue about... [07:09.500 --> 07:11.460] national security letters is... [07:11.460 --> 07:12.520] the fact that... [07:12.520 --> 07:14.740] using them, the government is able to... [07:16.020 --> 07:16.520] uh... [07:16.520 --> 07:17.480] search people's effects... [07:17.480 --> 07:19.840] and search people's personal papers... [07:19.840 --> 07:20.340] uh... [07:20.340 --> 07:21.540] without following... [07:21.540 --> 07:25.860] the guidelines that are set forth in the Fourth Amendment of the Constitution and... [07:25.860 --> 07:27.500] the Fourth Amendment is... [07:27.500 --> 07:28.920] is a historical thing... [07:28.920 --> 07:31.380] and you kind of have to understand the background and the... [07:32.160 --> 07:32.660] um... [07:32.660 --> 07:34.820] the framing of it to understand why it was... [07:34.820 --> 07:35.800] why it was... [07:35.800 --> 07:37.960] added to the Bill of Rights and why... [07:38.280 --> 07:40.120] it was written the way it was... [07:41.040 --> 07:41.540] um... [07:41.540 --> 07:41.960] you know... [07:41.960 --> 07:43.880] the purpose of it was to protect us from... [07:43.880 --> 07:56.660] Government overreach and the government rifling through all our stuff without having a very particularized idea of what they were going for and what was the suspicion. [07:58.960 --> 08:23.620] The Fourth Amendment came about because during colonial times in America in the 17th century, the British colonial authorities who were trying to squash independence movements in this place were using something that were called writs of assistance or general warrants. [08:23.900 --> 08:37.720] And essentially, it's like a catch-all type of a warrant which says, this document enables you police to get whatever stuff you need from anywhere for any reason. [08:37.920 --> 08:43.640] Something super open-ended like that, that would essentially match any potential situation out there. [08:44.480 --> 08:57.500] And these types of things were used against all the independence-minded people who wanted to break away here from the British crown. [08:59.000 --> 09:19.540] The sort of reaction against of that background was that when America declared its independence and wrote its constitution, they deliberately added this clause about what are the legitimate circumstances under which the government can search through people's personal papers and effects. [09:19.820 --> 09:38.500] And the basic solution was to require specificity to have the government say exactly what it's looking for or who it's intending to search. [09:40.520 --> 09:55.980] More specifically, the Fourth Amendment says that law enforcement authorities must prove probable cause, which is like sort of a level of proof. [09:56.480 --> 09:58.320] And they must do that under oath. [09:58.840 --> 10:04.180] And they must describe exactly what it is that they're looking for. [10:04.360 --> 10:06.640] And they must describe exactly where it is that they're going. [10:08.120 --> 10:18.580] The reason that I mention this is that when the Patriot Act was passed in 2001, it sort of evaded all of those different parameters. [10:19.000 --> 10:30.820] And it allowed FBI agents to sort of write their own warrants, but without going to a judge, without proving probable cause, without describing what they were looking for or where they were going. [10:30.900 --> 10:37.260] So in a way, the reason that I was telling that whole historical story was to say that we have this bad situation. [10:37.280 --> 10:40.400] They wrote this framework to try to stop that. [10:40.400 --> 11:01.960] And then, you know, 200 years later, the Patriot Act essentially brought us back to the beginning to where they could have these very generalized warrants that didn't describe what they were looking for and evaded the whole idea that that the courts would exert oversight over the law enforcement people. [11:03.720 --> 11:14.340] So NSLs, rather than having to go to court, FBI guys can just, you know, kind of hit print on their computer and print one out themselves. [11:14.600 --> 11:16.280] They don't have to go to court and prove anything. [11:16.660 --> 11:19.640] They just need to assert themselves. [11:19.960 --> 11:24.860] They need to self-certify and assert relevance to some authorized investigation. [11:26.720 --> 11:33.180] However, the Department of Justice did an audit of the FBI's use of NSLs. [11:33.880 --> 11:56.860] And so the Department of Justice's own Inspector General showed that the FBI, even though they had almost total freedom to sort of print out whatever warrants they wanted, they even circumvented that super low bar by falsifying circumstances and claiming that there were emergencies that didn't really exist. [11:57.420 --> 12:02.140] And furthermore, gathering information that really wasn't relevant to any authorized investigation. [12:04.820 --> 12:13.220] The NSL that I got in about the third of the fourth paragraph said that I could never tell any person that I had gotten it. [12:13.860 --> 12:18.120] And I wasn't the only person that this happened to. [12:19.280 --> 12:26.320] You know, something like a half a million national security letters have gone out since the Patriot Act was passed in 2002. [12:27.000 --> 12:34.840] And every person that has ever gotten one has been told that they can't tell any person that they ever received one. [12:34.980 --> 12:44.980] So depending on how you look at it, it's like a massive infringement on the freedom of speech of quite a number of people. [12:45.240 --> 12:46.900] Although it's really hard to say how many. [12:50.030 --> 13:00.800] this type of an order telling the recipients of these letters that they can't talk about it has a number of really far-reaching ramifications. [13:04.340 --> 13:13.840] One of which is that, you know, I was part of this company and I wasn't able to talk to my colleagues at the company about it. [13:14.180 --> 13:25.840] Not only that, but I was part of a community of Internet service providers and content providers and Internet-based services. [13:26.220 --> 13:33.200] And, you know, they were essentially putting out about 50,000 of these letters a year after a couple of years. [13:34.520 --> 13:53.860] And the fact that we were not able to sort of all get together at, let's say, meetings like this and just sort of compare notes and talk about what was going on means that we weren't really able to and we still aren't able to fully piece together what's actually happening with these orders. [13:56.160 --> 14:06.080] Because I was told that I wasn't able to talk to anyone, my first question to the FBI agent that came to my office was, what about my lawyer and what about my business partners? [14:06.400 --> 14:08.760] And the FBI agent refused to answer that question. [14:09.700 --> 14:21.920] And I have to assume that that's how it went down with other people, although I've never, like, knowingly spoken to another person that got an NSL, although I may have, but we never have discussed it openly like that. [14:22.920 --> 14:29.560] But if you can't tell anyone about having received it, that means, you know, you can't talk to a lawyer. [14:29.720 --> 14:32.860] And if you can't tell anyone, that means you also can't talk to a court. [14:33.040 --> 14:35.180] So you can't go and file a court case over it. [14:35.240 --> 14:38.220] And you can't challenge the legitimacy of these types of orders. [14:39.040 --> 14:58.740] And it also means that by preventing people from talking about it, it sort of undercuts the ability of Congress to exert oversight over the Department of Justice and the FBI and law enforcement in general, by keeping everything under wraps. [15:04.160 --> 15:15.240] I had to take a long time and think about this letter that I got because I took pretty seriously the implied threat in the letter when it said that I could never tell anyone. [15:16.280 --> 15:32.080] But at the same time, I really, in a way that I never before or since saw, I could just viscerally see and experience the slippery slope right in front of my face happening. [15:32.940 --> 15:40.780] And it felt that... I felt that... that there really wasn't much of a choice in the matter. [15:41.180 --> 15:54.380] And I felt also very confident in my sort of upbringing and maybe from the one or two classes of undergraduate law I'd taken in college that I knew I could talk to a lawyer about it, despite what the FBI had said. [15:55.880 --> 16:01.760] And to sort of cut through a whole series of agonizing decisions and discussions, [16:04.980 --> 16:14.340] what happened was I went to the American Civil Liberties Union, the ACLU, who, as luck would have it, was a client of my company. [16:14.800 --> 16:18.720] And I hosted the website for the New York Civil Liberties Union. [16:20.800 --> 16:22.020] And it was just luck. [16:22.620 --> 16:24.180] But that's what happened. [16:24.580 --> 16:31.260] And they... when I went to talk to them, I told them, I think this is an illegal order. [16:31.320 --> 16:32.700] I don't think this is legitimate. [16:32.700 --> 16:34.040] And they agreed with me. [16:34.840 --> 16:42.960] And they agreed to represent me and to help me challenge the constitutionality of the Patriot Act itself. [16:42.960 --> 16:51.760] So we went to court and the national security letter provision was ruled unconstitutional a number of times. [16:52.800 --> 17:05.680] And eventually, the Congress decided to amend the law and to try to address some of the constitutional problems that the judge in the case had pointed out. [17:07.790 --> 17:11.300] And the changes that they added were relatively minor. [17:11.460 --> 17:21.640] But in some ways, they were pretty significant because they sort of retroactively legalized everything that I had done that I thought was a violation of the order not to talk. [17:21.800 --> 17:24.400] They specifically said that you can talk to a lawyer. [17:24.600 --> 17:26.040] You can go to court. [17:27.920 --> 17:29.940] And you can challenge the gag orders. [17:29.970 --> 17:32.340] And you can challenge the legitimacy of the actual searches. [17:34.020 --> 17:42.300] So the actual story of the seven years of litigation with ACLU could take like a day or something. [17:42.440 --> 17:43.440] It's a really long story. [17:44.160 --> 17:54.640] And suffice it to say, I kind of thought that the path would be like sort of a straight line starting here and ending in the upper right corner. [17:54.900 --> 17:57.440] And instead, it looked like a piece of spaghetti. [17:57.440 --> 17:58.800] And it went all over the place. [17:58.900 --> 18:00.600] And it was really confusing and crazy. [18:00.900 --> 18:05.380] And the government essentially did everything it could to sort of undercut my case. [18:05.580 --> 18:14.210] And eventually, what it did was withdraw the letter itself, which sort of prevented me from making continued arguments about the search. [18:14.320 --> 18:17.880] Because once they withdrew the letter, they were no longer asking to search anything. [18:19.440 --> 18:29.600] But in their infinite wisdom, they left this gag order in place and insisted that I shouldn't ever talk about it still, which allowed me to sort of continue the case for a number of years after that. [18:30.140 --> 18:40.060] Because for me, it was really important to be able to tell the whole story, to have it be an open and public discussion about what powers the government has. [18:43.060 --> 18:56.040] And in, I think, 2013 or so, I started to work with a law clinic at Yale Law School called the Media Freedom and Information Access Clinic. [18:56.460 --> 18:59.140] And they also agreed to help me for free. [19:00.260 --> 19:16.400] And they specialized very much on free speech matters and helped me challenge this gag order that even though the FBI had admitted that there was no investigation, that they insisted that I not be able to tell the story of what had happened. [19:16.780 --> 19:33.240] And that began another several years of litigation, which wonderfully was successful and concluded this past winter, which is why I'm able to actually even tell this part of the story. [19:35.500 --> 19:43.470] The unfortunate thing is that even though I won in court over and over again, NSLs are still, you know, being issued today. [19:44.100 --> 19:49.580] And they're still being issued at around the same types of numbers that they were for the past 15 years. [19:49.800 --> 19:57.420] So, you know, the absolutist part of me is like, okay, on some level, this is a complete failure. [19:58.240 --> 20:10.320] But on the other hand, a lot of attention has been given and a lot of column space in newspapers has been given to it and a lot of awareness has been raised and the law was changed. [20:14.660 --> 20:26.280] This illustration here was made by people at ACLU this past winter after I was released from this gag order. [20:26.520 --> 20:29.440] And it sort of, yeah, it makes me really happy. [20:29.580 --> 20:31.400] It's like a really, it's a really amazing graphic. [20:31.400 --> 20:48.880] Um, I think that, I think that this one lawyer that I worked with at ACLU named Jamil Jaffer was the one who suggested this, but this illustrates the, the appearance of the, the third page of the national security letter at various stages throughout the litigation. [20:49.740 --> 20:55.700] And as you can see in the leftmost picture, that's how it looked in the beginning in 2004. [20:56.020 --> 21:00.200] Uh, the redactions were just complete and you didn't read anything. [21:00.740 --> 21:04.100] All you could tell is that there were paragraphs or something. [21:05.040 --> 21:16.240] Uh, in the second stage, uh, and just so you understand, this page is about the actual types of information that the FBI was demanding from me. [21:16.780 --> 21:28.960] In the second stage, the, all the categories of information are still redacted, except for a couple of words here and there, which were things that were like super obvious, like name and address or something like that. [21:29.120 --> 21:31.640] Like really obvious stuff that anyone could guess. [21:32.340 --> 21:35.100] Uh, and sort of like the pros at the beginning and the end are open. [21:35.940 --> 21:41.820] One interesting thing that they did though, that they, that they didn't do in terms of redaction was they left all the bullet points there. [21:42.180 --> 21:46.900] And so a lot of people were able to took a lot from it that, oh, there's 16 categories of information. [21:47.020 --> 21:49.340] And so they understood more about it. [21:49.520 --> 22:01.640] Uh, in the third stage, more of the information became unredacted and in the final stage, which is where we arrived this past winter, uh, after this litigation with Yale, uh, the whole thing became opened up. [22:01.900 --> 22:06.240] And it's funny because some of the information in there is so outdated. [22:06.420 --> 22:19.800] Like if I'm sure there are other kind of sys-admin tech people in there, but it, it was asking for radius logs and like just really ancient stuff that um, it didn't even exist then, you know, or like I didn't have it then, but, uh, but, but what's kind of, [22:19.800 --> 22:30.560] uh, interesting about it is that the last category that they ask for there is this line where they ask for electronic communications transactional records. [22:30.820 --> 22:37.660] And this is where it sort of becomes relevant to stuff that's going on like right now in 2016 in Congress. [22:38.580 --> 22:46.820] Um, essentially for years, the FBI was demanding and collecting types of information that they weren't even allowed to, uh, under the law. [22:47.560 --> 22:58.040] And one of those things, the way they phrased it in the letter that I got was, um, any other communication you consider to be an electronic communications transactional record. [22:59.040 --> 23:11.380] Uh, which is sort of interesting if you go back and remember, uh, in an earlier slide, the sort of specifications that the Fourth Amendment lays out in terms of a search. [23:11.680 --> 23:15.320] You know, the government has to know exactly what it's looking for and where it is and everything about it. [23:15.500 --> 23:29.100] Uh, yet the way these MSLs are phrased, it just kind of says like anything you think, you know, you, you decide what's, what's information and you decide what's relevant and just give us anything and everything. [23:29.740 --> 23:52.060] Um, what's been happening recently this year in Congress is, uh, that there was a proposal to amend the national security letter provision and add permission for the FBI to obtain electronic communication transactional records, uh, which is this sort of implicit admission that they were not allowed to do this the whole time. [23:52.880 --> 24:06.220] Uh, and somewhere in the court papers in the most recent litigation, uh, they explained that they interpret this to also include things like geolocation information from cell phone towers. [24:06.380 --> 24:16.360] So they could track, you know, your comings and goings and, uh, it really, the, their interpretation of it is, is sometimes like really interesting and, and super broad. [24:17.540 --> 24:33.220] Um, part of the, one of the really central issues of, of this talk that I want to get across is, is that the secrecy involved in, in these types of techniques, uh, leads to unaccountability. [24:33.700 --> 24:43.020] Um, you know, the fourth amendment says that the, uh, the court system has to have oversight over law enforcement. [24:43.360 --> 24:48.960] Uh, but NSLs allow law enforcement to do a complete end run around that whole concept. [24:49.820 --> 25:12.500] Um, gag orders that they put on the recipients of these letters, uh, mean that, uh, even now, even 15 years almost since, uh, the Patriot Act was passed, we still don't really have a clear picture of exactly what the FBI has been doing with NSLs and how broadly they've been used and, [25:12.740 --> 25:20.260] uh, and like what type of information has been gathered and where that information has gone on and who has access to it. [25:20.960 --> 25:35.060] Um, we only are able to sort of figure out little tiny pieces of information from when the FBI has, or the Department of Justice and their Inspector General has decided to make parts of it public. [25:36.000 --> 25:55.820] Um, but, uh, you know, after, after Congress amended the, uh, the Patriot Act in around 2005, 2006, uh, the Congress ordered the Department of Justice Inspector General to perform a full audit of FBI's use of these letters. [25:56.040 --> 26:05.540] And the Inspector General really, uh, I would say to his credit, uh, didn't really go so soft on the FBI. [26:05.540 --> 26:23.700] And he, um, he really, uh, uncovered a lot of abuse, uh, in terms of not keeping track of how many NSLs were issued, uh, coming up with hundreds of examples where the FBI had invented fake emergencies to try to get information, uh, without even writing, [26:23.980 --> 26:25.500] or without even printing out an NSL. [26:26.260 --> 26:36.440] Uh, information in which they had demanded, like, super broad degrees of information on essentially hundreds of thousands of people. [26:36.720 --> 26:50.540] Um, the, the one example that they highlighted was about in New Year's Eve in Las Vegas in around 2004, I think, uh, the FBI got a list of every single person that, that visited Las Vegas over New Year's Eve. [26:50.620 --> 26:52.940] And it was like into the, well into the hundreds of thousands of people. [26:53.040 --> 27:02.200] And so they got lists of everyone with just one letter, just printing it out with, without ever going to court, without, uh, without worrying about the rights of those people. [27:03.140 --> 27:15.000] Uh, and the, the, the really upsetting thing, you know, is that this information goes into some huge database and then we don't know, uh, where it goes after that. [27:15.220 --> 27:20.840] Like, we, we understand that it is, uh, it's indefinitely retained. [27:21.400 --> 27:31.440] Uh, you know, regardless of whether a person is, is cleared and found innocent or found to be not even a suspect or not interesting, this information stays there forever. [27:32.000 --> 27:40.880] Uh, and whether there are rules and regulations about how to deal with that information or when to purge it or if to purge it ever is just completely unknown. [27:41.780 --> 27:41.840] Uh, [27:44.860 --> 27:58.120] other things that the FBI, uh, did that was uncovered by the inspector general included that, uh, within, within just a short timeframe, he only looked at two years or three years. [27:58.380 --> 28:02.740] Uh, from 2003 to 2005, they issued 143,000 NSLs. [28:03.580 --> 28:09.600] Uh, and in theory, these are only to be used for counter-terrorism and counter-espionage. [28:10.540 --> 28:18.860] Uh, in issuing all these NSLs, only one conviction, even related to terrorism, came from it. [28:19.000 --> 28:21.520] And it wasn't even for an actual terrorist plot. [28:21.680 --> 28:41.960] It was this thing called material support, which is a super vague, open-ended kind of law, which is so broad that lawyers have complained that if, uh, if a human rights organization went and consulted with a terrorist organization on, on conflict resolution and how to peacefully solve conflicts, [28:42.060 --> 28:45.060] that would be considered material support to a terrorist group. [28:45.260 --> 28:56.500] It's, it's like any type of service or help that you might provide to a terrorist group, even if it's super inane, like, I don't know anything, bringing, selling them water, I don't know anything. [28:57.360 --> 29:02.000] It's, it's a super open-ended kind of a catch-all. [29:02.560 --> 29:11.440] Uh, so I, I guess with this, with this, uh, uh, what this gets to for me is sort of the, the efficacy of the law itself. [29:11.640 --> 29:23.680] Like when, when you violate the rights of, you know, unknown numbers of people, because 143,000 NSLs, you might assume that it means 143,000 people's rights have been violated. [29:23.720 --> 29:33.820] But when you understand that one letter gets four or 500,000 people who went to Vegas in one night, uh, you start to understand that it's, it could be much more than 143,000 people. [29:33.920 --> 29:35.160] It could be well into the millions. [29:35.160 --> 29:39.160] Uh, but again, due to secrecy, we, we don't really know. [29:39.320 --> 29:41.540] We have to, uh, guesstimate. [29:42.600 --> 29:50.360] Um, out of those 143,000 NSLs, there were 43 criminal referrals made, but they were not related to terrorism. [29:50.500 --> 29:58.620] They're related to low-level things like immigration offenses, uh, or, or fraud, uh, or money laundering. [29:58.740 --> 30:02.700] But like little, penny-ante small crimes. [30:02.880 --> 30:07.180] Not, not, uh, existential threats. [30:07.400 --> 30:14.840] Not, not the type of stuff that we were told justified these types of violations of, of basic rights and, and the Constitution. [30:15.820 --> 30:16.120] Um, [30:20.840 --> 30:33.560] a question I get asked all the time, and it's, and it's confusing, and it's, it's hard to really explain to people properly, is if the government lost in court over and over again, why are NSLs still being issued at a rate of 50,000 per year? [30:34.400 --> 30:53.840] Um, there's a number of explanations for that, and one of which is that in many of the cases that we know of where an organization decided to sort of fight back and challenge, uh, national security letters in a specific case or, or conceptually and, and constitutionally, [30:54.000 --> 30:55.420] the, the law itself. [30:55.720 --> 30:58.400] Uh, the FBI ended up withdrawing the letter. [30:59.100 --> 31:00.900] Um, that happened to me. [31:01.240 --> 31:11.000] That happened to the, the famous Connecticut librarians who got a national security letter which was seeking patron records, library patron records. [31:11.240 --> 31:12.780] Uh, they withdrew the letter there. [31:12.940 --> 31:21.540] That happened also to the Internet archive, archive.org, uh, who also sued over national security letters with the electronic frontier foundation. [31:22.640 --> 31:40.240] Uh, and when organizations, when smaller organizations would challenge these things, the FBI would essentially decide that it was better for them to just withdraw the letter and not risk, uh, the case being heard by the Supreme Court or not risk, uh, the law itself, [31:40.240 --> 31:45.220] uh, you know, being judged whether it's constitutional or not. [31:45.480 --> 31:56.880] Um, which always gave me the impression that, that the government didn't really have a great deal of confidence that the law would withstand scrutiny in the court system and at the highest court level. [31:57.320 --> 32:05.900] Um, you know, the, the lower court and the, uh, circuit courts have repeatedly ruled, uh, national security letters themselves to be unconstitutional. [32:05.900 --> 32:14.520] And so I think the government did everything in its power to avoid the Supreme Court ever hearing a case about them or, or, you know, ruling on them. [32:15.320 --> 32:15.680] Um, [32:19.440 --> 32:23.660] on to more, like, positive stuff, uh, because there's so much negativity in this in some ways. [32:24.000 --> 32:27.360] You know, like, who's doing something about this and what, what can be done? [32:28.200 --> 32:53.920] Um, you know, I, I'm really proud of the work of organizations like the ACLU and EFF, uh, who've really spent, uh, probably tens of thousands of man hours and many, many years, uh, litigating, uh, and, and, you know, just plowing through the court system endlessly, [32:54.240 --> 33:03.380] trying to, uh, trying to get some change made in terms of, uh, recognition of the, of the unconstitutionality of this. [33:03.700 --> 33:05.500] And it's sort of a thankless task. [33:05.680 --> 33:08.200] It's really, it's really hard work. [33:08.340 --> 33:12.300] People spend, you know, a quarter of their life working on this. [33:12.460 --> 33:29.820] And, and it's, uh, it's like you, you don't, you don't ever get like this complete victory that you fantasize about, but it's, uh, but it's, it's really endearing to me and, and inspiring that, that so many people are willing to spend so much of their time, [33:30.060 --> 33:31.560] uh, trying to do this. [33:32.240 --> 33:36.960] Um, and the cool thing about it too, the sort of side benefit is that it raises awareness. [33:37.120 --> 33:43.960] And so people, until I started the lawsuit in 2004, nobody really knew what a national security letter was. [33:44.060 --> 33:46.400] It was never in the newspapers. [33:46.620 --> 33:54.520] Nobody, it wasn't really one of the things that, that people made a huge example of when the Patriot Act passed, they talked about some of the other aspects more. [33:54.840 --> 34:16.060] Um, but it has become a huge thing where advocacy organizations that raise awareness and get people to write, uh, to their Congress people and to their senators, uh, and to oppose, you know, uh, the renewal of the Patriot Act and, uh, propose, and to oppose, [34:16.060 --> 34:30.460] uh, bills that have been proposed to expand Patriot Act powers, uh, have ended up being, uh, struck down by, by, you know, the, the force of, uh, of the general public. [34:31.280 --> 34:35.980] Um, and to me, that's also really encouraging. [34:37.400 --> 34:56.360] Um, but I'm, I'm a technical person and on some level, the two approaches of litigation and legislation sometimes leave me a bit frustrated because, uh, they seem a bit murky. [34:56.860 --> 35:16.740] Um, one of the things that I came to realize a certain, a certain way into this process was that, uh, technical people, uh, like us, uh, should be designing their products so that they, they don't have this metadata in the first place. [35:17.340 --> 35:28.080] Um, and they really should be, uh, uh, you know, integrating cryptography in such a way that it's transparent to the end user so that it's not too much work for them. [35:28.200 --> 35:36.560] Because one thing that I've learned is that if, if people have to click one time on, on a button to add more security, they're just not going to do it. [35:36.560 --> 35:48.020] Um, it's hard to, uh, to understand how, how little it takes to dissuade, uh, people from doing work to make their communications more secure. [35:48.580 --> 35:57.040] Um, the other group of, of people that, that are really doing something is, is some of the big tech companies. [35:57.220 --> 36:01.120] You know, like in the news in the past year, there was this whole thing about Apple. [36:01.360 --> 36:07.440] Now they weren't, as far as I know, given a national security letter, they were asked to put this back door in their operating system. [36:08.060 --> 36:24.820] Uh, but there has been other stuff going around that maybe Yahoo, maybe Google, maybe a number of other organizations, maybe some phone company in California, have all been, uh, litigating against national security letters in the federal court system out on the west coast. [36:25.180 --> 36:37.280] And there's been, uh, some really positive movement in a way that wasn't going on in 2004 when I began this whole thing and, and I felt like I was all alone. [36:37.420 --> 36:48.240] Now it seems like that the, the general consensus in the tech industry is that the government has kind of gone too far and that it's okay, uh, to sort of push back. [36:49.940 --> 37:01.840] Um, the roles of litigation legislation and, and, and technical approaches are, uh, things that are complimentary. [37:02.220 --> 37:16.100] Uh, and despite that, I personally have a stronger affinity for the technical, rather than the litigative or legislative, I'm not really willing to give up on any of them thus far. [37:16.220 --> 37:29.800] And I feel like if we're going to make progress against, uh, this type of government overreach, and, and I do believe that we are, and that, that we are, uh, that I think we have to use all the tools at our disposal. [37:30.160 --> 37:31.780] So all three of those categories. [37:32.400 --> 37:43.380] Um, and all in all, you know, I, I did feel really lonely at the beginning of this thing and really isolated because I couldn't talk to anyone about it. [37:44.040 --> 37:49.580] Uh, and, uh, now I don't feel alone. [37:49.580 --> 38:02.080] Um, I really do feel like, uh, that this has become part of the consensus and that at the beginning, what I did seemed extremist and now seems like common sense. [38:02.240 --> 38:05.560] And so that in and of itself is a huge deal. [38:05.560 --> 38:10.620] And I think I should thank Edward Snowden for that to a large degree. [38:11.880 --> 38:11.900] Um, [38:19.740 --> 38:30.680] um, the, there was a man who I read about, uh, years later, who was the founder of the American Civil Liberties Union. [38:31.720 --> 38:34.060] And his name was Roger Baldwin. [38:34.920 --> 38:41.420] And he said something really wise one time, which is that, no fight for civil liberties ever stays won. [38:42.140 --> 38:46.120] Um, and it, it's true, I think. [38:46.460 --> 38:51.460] Um, you see sometimes things repeating themselves over and over again. [38:52.260 --> 39:05.060] You know, we, people of my generation, we grew up understanding about the civil rights era and the battles for, uh, for people to all be treated the same, to be treated equally under the law. [39:05.900 --> 39:18.440] And then after the Civil Rights Act was passed on some level, whether reality reflected it or not, the law did theoretically say that everyone had to be treated equally. [39:18.620 --> 39:27.880] And then decades later, certain parts of society in America decided to sort of, like, refight these same battles, but pick a different minority group. [39:28.380 --> 39:32.500] Uh, rather than racial minorities, they picked gay people. [39:32.660 --> 39:43.600] And they tried to say, well, you know, let's allow restaurants and cake bakers or whatever crazy case they picked to discriminate against people based on their sexual orientation. [39:44.360 --> 39:53.180] And in a lot of ways, it's people that maybe couldn't accept the outcome of the first civil rights battle. [39:53.720 --> 39:55.460] Trying to refight the battle again. [39:55.900 --> 39:59.560] And using a category of people that isn't protected under the Civil Rights Act. [40:00.200 --> 40:07.920] And so seeing that happen really made me understand in some ways that this quote from Roger Baldwin is really true. [40:08.040 --> 40:12.760] And I think it, uh, it's a really good closing thought to, to wrap up this talk. [40:13.720 --> 40:16.780] Um, so that's, that's the end. [40:30.900 --> 40:38.200] Uh, if anybody wants to ask questions, I would ask you please go to the microphone, uh, so that it gets recorded. [40:39.580 --> 40:41.680] Two quick, uh, just clarifying questions. [40:42.220 --> 40:46.080] Um, FISA court, uh, we hear that a lot. [40:46.300 --> 40:52.760] Uh, do, does the FISA court have to, uh, rubber stamp the, uh, the NSLs? [40:53.480 --> 40:57.440] And separate question, uh, parts of the Patriot Act were set to expire. [40:57.880 --> 41:01.240] Uh, does the NSL part have any expiration on it? [41:02.380 --> 41:17.420] So the FISA court and it being sort of a rubber stamp, uh, you know, it's a, it's a troubling thing because what I've read is that FISA court rarely, if ever, turns down any request for a warrant. [41:17.920 --> 41:24.020] On the other hand, in theory, this is the system of checks and balances. [41:24.280 --> 41:33.420] Even if, even if it's a facade, even if it's bogus and they don't actually say no ever, at least it follows the framework that, that we're taught is the way it's supposed to work. [41:33.780 --> 41:44.240] Um, I can't say I have any personal experience with it, but I would feel like at least a rubber stamp court that doesn't allow an adversarial discussion. [41:44.480 --> 41:48.560] Like there, there is no person representing the, the person who's being searched in that court. [41:48.780 --> 41:50.700] At least there wasn't until recently. [41:50.820 --> 41:56.980] I think they're proposing to add a sort of a, an advocate for the, for the person whose rights is to be, are to be violated. [41:57.720 --> 42:05.040] Um, it's, it's like an improvement over the national security letter scenario where there's no court involvement at all. [42:06.040 --> 42:12.780] Um, Um, the second part of your question, uh, tell me that again. [42:13.160 --> 42:14.920] Parts of the Patriot Act expiring. [42:15.080 --> 42:15.520] Right, right. [42:15.640 --> 42:21.680] Any, any, any, the, the national security letter provision doesn't sunset, uh, like some of the other parts, unfortunately. [42:21.680 --> 42:33.300] So as, as I'm not a lawyer, I'm a systems administrator, but my understanding is that, uh, for the national security letter provision to ever be taken down. [42:33.460 --> 42:39.060] It either has to be, uh, voted on to be repealed or struck down by the Supreme Court. [42:40.020 --> 42:41.000] Uh, yeah. [42:41.200 --> 42:41.540] Thank you. [42:41.780 --> 42:42.080] Sure. [42:42.400 --> 42:43.220] Thanks for the question. [42:44.320 --> 42:44.800] Hi. [42:45.020 --> 42:48.700] First of all, congratulations for standing your ground on behalf of all of us. [42:48.880 --> 42:49.620] Thank you so much. [42:49.720 --> 42:50.000] Thank you. [42:51.340 --> 42:53.180] It's really nice to hear that. [42:53.680 --> 42:57.500] And secondly, what can we do to help you? [42:59.080 --> 43:06.180] And thirdly, if something that they obtained through an NSA actually went to court, is it even admissible? [43:06.580 --> 43:09.760] Because it sounds like a fishing expedition to me. [43:10.000 --> 43:12.460] They could go after everything and just sift through it. [43:14.220 --> 43:15.240] That's a good question. [43:15.680 --> 43:28.020] Um, and I wish I had a lawyer here on the panel with me to address it because on some level, it seems to me that what they would get evidence that they would obtain with an NSL should be inadmissible or challengeable in court. [43:28.500 --> 43:35.180] But, uh, it seems like court cases are being brought with information that they obtain with NSLs. [43:36.100 --> 43:37.640] And I don't... yeah? [43:38.080 --> 43:43.080] You can... I'm not a lawyer, but my understanding is that what they do is what's called parallel construction. [43:44.100 --> 43:46.100] That is one... that is one way they do it. [43:46.140 --> 43:46.220] Yeah. [43:46.280 --> 43:46.940] Have you heard about that? [43:47.080 --> 43:48.960] I mean, that's essentially parallel construction is like... [43:50.140 --> 43:53.280] I've heard about that mainly in the context of NSA stuff. [43:53.560 --> 43:55.680] Where, like, the NSA overhears all the conversations. [43:56.160 --> 44:00.740] They hear so-and-so is going to meet so-and-so and they get some evidence like that. [44:00.860 --> 44:07.220] And then they essentially go and tell DEA, okay, say that some guy you met told you this story. [44:07.800 --> 44:12.440] And so they come up with, like, a story that they can tell in court that actually passes muster. [44:13.000 --> 44:16.420] I don't... I don't... you know, that's... it gets into the realm of speculation. [44:16.420 --> 44:17.660] I really don't know. [44:17.660 --> 44:17.660] Yeah. [44:17.980 --> 44:20.660] And the first one there was, what can we do to help you? [44:21.020 --> 44:23.700] That is a great question. [44:23.940 --> 44:29.280] So I... at this point, I run a non-profit organization called the Calix Institute. [44:30.740 --> 44:34.200] It's calix.com or calixinstitute.org. [44:34.200 --> 44:48.420] And what we do is we try to build software and help non-governmental organizations, human rights organizations, free press type organizations on their communication security. [44:48.640 --> 44:50.580] And we provide a bunch of free network services. [44:51.360 --> 44:59.660] And I actually have a vendor table down on the second floor where we're trying to solicit people to sign up for memberships. [44:59.880 --> 45:01.940] So that's one way you can help. [45:02.660 --> 45:10.780] Another way you can help is to contribute to organizations like ACLU and EFF who are doing this amazing litigation. [45:13.700 --> 45:32.280] And, you know, actually, my organization is a very tiny and barely funded organization that really needs people to help us get the message out and to formulate the message in much more easily understandable ways. [45:33.180 --> 45:38.960] The parts of it that I really enjoy are like the technical part and not so much the communications part. [45:39.160 --> 45:44.600] So if anyone knows about that kind of stuff, come talk to me downstairs tomorrow or the next day. [45:44.600 --> 45:45.240] Okay. [45:45.780 --> 45:46.840] That would be awesome. [45:47.080 --> 45:47.700] Thank you. [45:47.880 --> 45:48.140] Thanks. [45:50.440 --> 45:50.940] Okay. [45:52.300 --> 45:52.800] Okay. [45:53.180 --> 45:55.120] So five more minutes, I'm being told. [45:55.300 --> 45:56.560] I'll try to keep mine short. [45:56.860 --> 45:57.000] Sure. [45:57.140 --> 46:04.860] Um, I was really glad to hear that you've won the opportunity to talk about, you beat the gag order. [46:05.020 --> 46:07.280] You can talk about the national security letter that you received. [46:07.840 --> 46:18.740] Do you know that if, you know, by virtue of you beating the gag order, does this enable other people who've got NSLs to talk about them or to beat the gag order? [46:20.360 --> 46:20.840] No. [46:21.640 --> 46:22.620] The short answer is no. [46:24.340 --> 46:43.500] One of the things that was really sort of disappointing to me in the, in the sort of progression of this court case was that at the beginning, the potential payoff was so huge and broad that what was being discussed was, could the national security letter provision even be separated from the Patriot Act or, [46:43.640 --> 46:48.040] or if it was unconstitutional, would the whole Patriot Act have to go away? [46:49.020 --> 46:51.480] And it was so broad, it would affect everyone in the country. [46:51.600 --> 46:54.520] And then by the end, it became just about me and my free speech rights. [46:54.580 --> 46:59.980] So the decision at the end just related to me and doesn't actually let anyone else speak. [47:00.060 --> 47:04.520] They would have to do the same, uh, court process that I did if they wanted to speak. [47:05.640 --> 47:07.600] Um, and someone did, who did just now? [47:07.840 --> 47:09.560] Was it Yahoo or something? [47:09.800 --> 47:10.240] I don't remember. [47:10.380 --> 47:10.960] Or Microsoft? [47:11.260 --> 47:11.540] I don't know. [47:11.680 --> 47:21.180] One of those companies, uh, just got the right to talk about and released the actual contents of NSLs, but without having the FBI just let them do it without going through 10 or 12 years of court. [47:21.520 --> 47:29.200] Did they ever make specific the nature of the threat that you were facing if you did, uh, ignore the gag order? [47:29.320 --> 47:36.080] And had you, are there any people who didn't abide by the gag order who they made a demonstration of and put them away for 20 years? [47:36.160 --> 47:37.720] Or what was the nature of the threat they were making? [47:37.840 --> 47:40.040] I think that the penalty is five years. [47:41.200 --> 47:44.300] My, my understanding, and I'm not even 100% clear on this. [47:44.420 --> 47:51.100] I think that the penalty is five years if you do it inadvertently and 10 years if you do it with the intent to screw up one of their investigations. [47:51.920 --> 47:57.620] Uh, but the weird thing was at the beginning when I first started this whole thing, the law was so incomplete. [47:57.620 --> 48:00.820] It was almost like a rough draft that it didn't say what the penalty was. [48:00.960 --> 48:06.740] So it just left you in the dark just wondering like, well, I'm sure it's gonna be something bad, but it doesn't say what it is. [48:07.280 --> 48:18.020] Um, it's sort of, my question is sort of related to that, but since these aren't supposed to be able to go to court because you can't talk to a court about them, how do they enforce them at all? [48:18.160 --> 48:26.120] Like, if you go to a judge and say, these guys in suits handed me this document, uh, this seems wrong. [48:26.680 --> 48:29.280] And they say, wait, wait, you can't talk about this. [48:29.460 --> 48:29.600] Right. [48:30.420 --> 48:31.500] You're now in a court of law. [48:31.760 --> 48:31.940] Right. [48:32.120 --> 48:32.220] Right. [48:32.960 --> 48:37.000] Um, yeah, it is, it is a bizarre kind of Kafka-esque catch 22. [48:37.420 --> 48:42.520] And, uh, I think the bottom line is that the courts didn't agree with the FBI. [48:43.200 --> 48:46.420] The FBI in the letter that I got just said I could tell no person. [48:46.560 --> 48:59.120] It didn't specifically say you can't go to court, but I took that, I took that to mean what it said, you know, I, I, I, I took that to mean no person, like not, not any single person in the world, which would include all lawyers and judges and everyone. [48:59.440 --> 49:02.520] Uh, but the court apparently really didn't agree with that. [49:02.620 --> 49:09.240] And actually the judge that we had in New York's was really harsh, uh, in his ruling was just like, he smacked that down really hard. [49:12.500 --> 49:23.680] Well, uh, again, uh, thank you for, for your work and I'm glad that, uh, I'm an ACLU card-carrying member and I'm glad that the money I give them gets put to things I do care about. [49:24.020 --> 49:25.920] Uh, I mean, I care about a lot of things. [49:26.120 --> 49:31.800] Uh, the, the question is that, uh, you're familiar with the term policy laundering. [49:31.980 --> 49:32.300] Hmm. [49:32.980 --> 49:34.400] It's, uh, the U.S. [49:34.480 --> 49:57.060] government, for example, and to pick on our favorite topic here, can't get something passed or done or established in the U.S., so they get some friendly government, like a puppet, some puppet state like the United Kingdom, uh, pass, uh, pass certain laws that establish the practice of doing things that ostensibly we wouldn't like. [49:57.160 --> 50:01.320] And once they're, they're practiced there, they say, see if the United Kingdom is doing it, let's do it also. [50:01.580 --> 50:01.840] Right. [50:02.220 --> 50:08.380] Um, um, the European Union, so take away the, the, the, the United Kingdom for a while. [50:08.600 --> 50:28.660] The European Union, on the other hand, uh, the Continental European Union, uh, has a, uh, a practice of being very, very pro, uh, um, um, personal rights and, and, um, and have any of these companies that, um, that are multinational companies try to prosecute, [50:28.780 --> 50:29.460] do the opposite. [50:29.620 --> 50:34.460] So, do the policy laundering in Europe and, and bring that to attention that way? [50:35.340 --> 50:37.480] Uh, if they are, I'm not aware of it. [50:37.680 --> 50:55.800] Um, and my impression, and this is only my impression, is that the European, uh, regulators seem very much more focused on the privacy of individuals from companies than they are from the government. [50:56.340 --> 51:07.040] So, they seem much more up in arms about Google, Facebook, DoubleClick, all the, the data mining companies getting your information more than the government. [51:07.260 --> 51:20.980] Whereas here, it's been the opposite and, and like almost no concern about companies gathering the data, which is sort of also like an end run around the Fourth Amendment because, you know, companies aren't regulated by the Fourth Amendment. [51:21.120 --> 51:21.940] Only the government is. [51:22.080 --> 51:24.860] So, the government can always say, well, we didn't collect your information. [51:25.080 --> 51:25.560] Google did. [51:26.100 --> 51:35.640] Uh, and, you know, in, in a way, when the government comes and makes you or your company take part in this, it's sort of like you're unofficially deputized. [51:35.780 --> 51:37.860] You're like an agent of the government, or that's what they want. [51:38.240 --> 51:44.800] So, you, you, you mentioned also that due to end on a jocular note, you mentioned that you don't know what happened to all this information that gets collected. [51:45.020 --> 51:52.740] I'm not worried about it because the tools to mine it, um, are probably beyond their, uh, their business. [51:52.940 --> 51:56.540] And also in, in like 10 years, some data center will get the commission. [51:56.720 --> 51:58.240] Somebody will forget to back it up. [51:58.620 --> 52:00.820] So, yeah, don't worry about that much. [52:02.540 --> 52:03.140] All right. [52:03.240 --> 52:06.200] Well, thank you for all the questions and thank you for everyone that came. [52:06.620 --> 52:09.520] Uh, I'm really thankful.