National Security Letters in Foreign Intelligence Investigations: Legal Background
Released: 2015-07-30T00:00:00

Introduction

Five statutory provisions vest government agencies responsible for certain foreign intelligence investigations (principally the Federal Bureau of Investigation (FBI)) with authority to issue written commands comparable to administrative subpoenas. A National Security Letter (NSL) seeks customer and consumer transaction information in national security investigations from communications providers, financial institutions, and credit agencies. Over the years, Congress has struggled with efforts to ensure the effectiveness of the NSL authority, while guarding against its abuse.

Background

NSL authority began with dissatisfaction with the exception to the privacy provisions of the Right to Financial Privacy Act (RFPA). Congress initially acted, without a great deal of analysis on the record, to be sure the exception was not too broadly construed. But the exception was just that, an exception. It was neither an affirmative grant of authority to request information nor a command to financial institutions to provided information when asked. It removed the restrictions on the release of customer information imposed on financial institutions by the Right to Financial Privacy Act, but it left them free to decline to comply when asked to do so.

[I]n certain significant instances, financial institutions [had] declined to grant the FBI access to financial records in response to requests under [S]ection 1114(a). The FBI informed the Committee that the problem occurs particularly in States which have State constitutional privacy protection provisions or State banking privacy laws. In those States, financial institutions decline to grant the FBI access because State law prohibits them from granting such access and the RFPA, since it permits but does not mandate such access, does not override State law. In such a situation, the concerned financial institutions which might otherwise desire to grant the FBI access to a customer's record will not do so, because State law does not allow such cooperation, and cooperation might expose them to liability to the customer whose records the FBI sought access.

Congress responded with passage of the first NSL statute as an amendment to the Right to Financial Privacy Act, affirmatively giving the FBI access to financial institution records in certain foreign intelligence cases. At the same time in the Electronic Communications Privacy Act, it afforded the FBI comparable access to the telephone company and other communications service provider customer information. Together the two NSL provisions afforded the FBI access to communications and financial business records under limited circumstances—customer and customer transaction information held by telephone carriers and banks pertaining to a foreign power or its agents relevant to a foreign counter-intelligence investigation.

Both the communications provider section and the Right to Financial Privacy Act section contained nondisclosure provisions and limitations on further dissemination except pursuant of guidelines promulgated by the Attorney General. Neither had an express enforcement mechanism nor identified penalties for failure to comply with either the NSL or the nondisclosure instruction.

In the mid-1990s, Congress added two more NSL provisions—one permits NSL use in connection with the investigation of government employee leaks of classified information under the National Security Act; and the other grants the FBI access to credit agency records pursuant to the Fair Credit Reporting Act, under much the same conditions as apply to the records of financial institutions. The FBI asked for the Fair Credit Reporting Act amendment as a threshold mechanism to enable it to make more effective use of its bank record access authority:

FBI's right of access under the Right of Financial Privacy Act cannot be effectively used, however, until the FBI discovers which financial institutions are being utilized by the subject of a counterintelligence investigation. Consumer reports maintained by credit bureaus are a ready source of such information, but, although such report[s] are readily available to the private sector, they are not available to FBI counterintelligence investigators....

FBI has made a specific showing ... that the effort to identify financial institutions in order to make use of FBI authority under the Right to Financial Privacy Act can not only be time-consuming and resource-intensive, but can also require the use of investigative techniques—such as physical and electronic surveillance, review of mail covers, and canvassing of all banks in an area—that would appear to be more intrusive than the review of credit reports. H.Rept. 104-427 , at 36 (1996).

The National Security Act NSL provision authorized access to credit and financial institution records of federal employees with security clearances who were required to give their consent as a condition for clearance. Passed in the wake of the Ames espionage case, it is limited to investigations of classified information leaks. As noted at the time, "The Committee believes section 801 will serve as a deterrent to espionage for financial gain without burdening investigative agencies with unproductive recordkeeping or subjecting employees to new reporting requirements.... The Committee recognizes that consumer credit records have been notoriously inaccurate, and expects that information obtained pursuant to this [S]ection alone will not be the basis of an action or decision adverse to the interest of the employee involved."

Both the Fair Credit Reporting Act section and the National Security Act section contain dissemination restrictions; as well as safe harbor (immunity), and nondisclosure provisions. Neither has an explicit penalty for improper disclosure of the request, but the Fair Credit Reporting Act section expressly authorizes judicial enforcement.

USA PATRIOT Act

The USA PATRIOT Act amended three of the four existing NSL statutes and added a fifth. In each of the three NSL statutes available exclusively to the FBI—the Electronic Communications Privacy Act section (18 U.S.C. 2709), the Right to Financial Privacy Act section (12 U.S.C. 3414(a)(5)), and the Fair Credit Reporting Act section (15 U.S.C. 1681u) (§505 of the USA PATRIOT Act)

expanded FBI issuing authority beyond FBI headquarter officials to include the heads of the FBI field offices (i.e., Special Agents in Charge (SAC)); eliminated the requirement that the record information sought pertain to a foreign power or the agent of a foreign power; required instead that the NSL request be relevant to an investigation to protect against international terrorism or foreign spying; added the caveat that no such investigation of an American can be predicated exclusively of First Amendment protected activities.

The amendments allowed NSL authority to be employed more quickly (without the delays associated with prior approval from FBI headquarters) and more widely (without requiring that the information pertain to a foreign power or its agents).

Subsection 358(g) of the USA PATRIOT Act amended the Fair Credit Reporting Act to add a fifth and final NSL section; the provision had one particularly noteworthy feature, it was available not merely to the FBI but to any government agency investigating or analyzing international terrorism:

Notwithstanding [S]ection 1681b of this title or any other provision of this subchapter, a consumer reporting agency shall furnish a consumer report of a consumer and all other information in a consumer's file to a government agency authorized to conduct investigations of, or intelligence or counterintelligence activities or analysis related to, international terrorism when presented with a written certification by such government agency that such information is necessary for the agency's conduct or such investigation, activity or analysis.

Although the subsection's legislative history treats it as a matter of first impression, Congress's obvious intent was to provide other agencies with the national security letter authority comparable to that enjoyed by the FBI under the Fair Credit Reporting Act. The new section had a nondisclosure and a safe harbor subsection, but no express means of judicial enforcement or penalties for improper disclosure of a request under the section.

Early Judicial Reaction

Two court decisions colored the debate over NSL authority, which culminated in enactment of the 2006 USA PATRIOT Act reauthorization statutes. Doe v. Gonzales suggested that the NSL statutes could not withstand constitutional scrutiny under the First Amendment unless more explicit accommodations were made for judicial review and permissible disclosure by recipients. Doe v. Ashcroft had earlier reached much the same conclusion on the First Amendment and raised Fourth Amendment issues as well. In essence, Doe v. Ashcroft found that the language of communications NSL statute and the practices surrounding its use offended (1) the Fourth Amendment because "in all but the exceptional case it [had] the effect of authorizing coercive searches effectively immune from any judicial process," and (2) the First Amendment because its sweeping, permanent secrecy order feature applied "in every case, to every person, in perpetuity, with no vehicle for the ban to ever be lifted from the recipient or other persons affected under any circumstances, either by the FBI itself, or pursuant to judicial process."

NSL Amendments in the 109th Congress

Both USA PATRIOT Act reauthorization statutes amended the NSL statutes. Their amendments:

created a judicial enforcement mechanism and a judicial review procedure for both the requests and accompanying nondisclosure requirements; established specific penalties for failure to comply or to observe the nondisclosure requirements; made it clear that the nondisclosure requirements did not preclude a recipient from consulting an attorney; provided a process to ease the nondisclosure requirement; expanded congressional oversight; called for an Inspector General's audit of use of the authority.

Inspector General's Reports

The First IG Report

The statutorily directed Department of Justice Inspector General audit reports, one released in March of 2007, the second in March of 2008, and the third in January of 2010, were less than totally favorable. The first report noted that FBI use of NSLs had increased dramatically, expanding from 8,500 requests in 2000 to 47,000 in 2005, IG Report I at 120. During the three years under review, the percentage of NSLs used to investigate Americans ("U.S. persons") increased from 39% in 2003 to 53% in 2005. A substantial majority of the requests involved records relating to telephone or e-mail communications, id.

The report and the subsequent report a year later provided a glimpse at how the individual NSL statutes were used and why they were considered available. In case of the 18 U.S.C. 2709, the Electronic Communications Privacy Act (ECPA) NSL statute, the reports explained that

Through national security letters, an FBI field office obtained telephone toll billing records and subscriber information about an investigative subject in a counterterrorism case. The information obtained identified the various telephone numbers with which the subject had frequent contact. Analysis of the telephone records enabled the FBI to identify a group of individuals residing in the same vicinity as the subject. The FBI initiated investigations on these individuals to determine if there was a terrorist cell operating in the city.

Headquarters and field personnel told us that the principal objective of the most frequently used type of NSL—ECPA NSLs seeking telephone toll billing records, electronic communication transactional records, or subscriber information (telephone and e-mail)—is to develop evidence to support applications for FISA orders.

The Right to Financial Privacy Act (RFPA) NSL statute, 12 U.S.C. 3414(a)(5), also affords authorities access a wide range of information (bank transaction records v. telephone transaction records) as demonstrated by the instances where it proved useful:

The FBI conducted a multi-jurisdictional counterterrorism investigation of convenience store owners in the United States who allegedly sent funds to known Hawaladars (persons who use the Hawala money transfer system in lieu of or parallel to traditional banks) in the Middle East. The funds were transferred to suspected Al Qaeda affiliates. The possible violations committed by the subjects of these cases included money laundering, sale of untaxed cigarettes, check cashing fraud, illegal sale of pseudoephedrine (the precursor ingredient used to manufacture methamphetamine), unemployment insurance fraud, welfare fraud, immigration fraud, income tax violations, and sale of counterfeit merchandise.

The FBI issued national security letters for the convenience store owners' bank account records. The records showed that two persons received millions of dollars from the subjects and that another subject had forwarded large sums of money to one of these individuals. The bank analysis identified sources and recipients of the money transfers and assisted in the collection of information on targets of the investigation overseas.

The Fair Credit Reporting Act NSL statutes, 15 U.S.C. 1681u (FCRAu) and 1681v (FCRAv) can be even more illuminating, "The supervisor of a counterterrorism squad told us that the FCRA NSLs enable the FBI to see 'how their investigative subjects conduct their day-to-day activities, how they get their money, and whether they are engaged in white collar crime that could be relevant to their investigations.'"

Overall, the report notes that the FBI used the information gleaned from NSLs for a variety of purposes, "to determine if further investigation is warranted; to generate leads for other field offices, Joint Terrorism Task Forces, or other federal agencies; and to corroborate information developed from other investigative techniques." Moreover, information supplied in response to NSLs provides the grist of FBI analytical intelligence reports and various FBI databases.

The report was somewhat critical, however, of the FBI's initial performance:

[W]e found that the FBI used NSLs in violation of applicable NSL statutes, Attorney General Guidelines, and internal FBI policies. In addition, we found that the FBI circumvented the requirements of the ECPA NSL statute when it issued at least 739 "exigent letters" to obtain telephone toll billing records and subscriber information from three telephone companies without first issuing NSLs. Moreover, in a few other instances, the FBI sought or obtained telephone toll billing records in the absence of a national security investigation, when it sought and obtained consumer full credit reports in a counterintelligence investigation, and when it sought and obtained financial records and telephone toll billing records without first issuing NSLs. Id . at 124.

More specifically, the report found that

a "significant number of NSL-related possible violations were not being identified or reported" as required; the only FBI data collection system produced "inaccurate" results; the FBI issued over 700 exigent letters acquiring information in a manner that "circumvented the ECPA NSL statute and violated the Attorney General's Guidelines ... and internal FBI policy;" the FBI's Counterterrorism Division initiated over 300 NSLs in a manner that precluded effective review prior to approval; 60% of the individual files examined showed violations of FBI internal control policies; the FBI did not retain signed copies of the NSLs it issued; the FBI had not provided clear guidance on the application of the Attorney General's least-intrusive-feasible-investigative-technique standard in the case of NSLs; the precise interpretation of toll billing information as it appears in the ECPA NSL statute is unclear; SAC supervision of the attorneys responsible for review of the legal adequacy of proposed NSLs made some of the attorneys reluctant to question the adequacy of the underlying investigation previously approved by the SAC; there was no indication that the FBI's misuse of NSL authority constituted criminal conduct; personnel both at FBI headquarters and in the field considered NSL use indispensable; and information generated by NSLs was fed into a number of FBI systems. IG Report I at 121-24.

Exigent Letters

Prior to enactment of the Electronic Communications Privacy Act (ECPA), the Supreme Court held that customers had no Fourth Amendment protected privacy rights in the records the telephone company maintained relating to their telephone use. Where a recognized expectation of privacy exists for Fourth Amendment purposes, the Amendment's usual demands such as those of probable cause, particularity, and a warrant may be eased in the face of exigent circumstances. For example, the Fourth Amendment requirement that officers must knock and announce their purpose before forcibly entering a building to execute a warrant can be eased in the presence of certain exigent circumstances such as the threat of the destruction of evidence or danger to the officers. Satisfying Fourth Amendment requirements, however, does not necessarily satisfy statutory prohibitions.

The ECPA prohibits communications service providers from supplying information concerning customer records unless one of the statutory exceptions applies. There are specific exceptions for disclosure upon receipt of a grand jury subpoena or an NSL. A service provider who knowingly or intentionally violates the prohibition is subject to civil liability, but there are no criminal penalties for the breach.

The Inspector General found that contrary to assertions that "the FBI would obtain telephone records only after it served NSLs or grand jury subpoenas, the FBI obtained telephone bill records and subscriber information prior to serving NSLs or grand jury subpoenas" by using "exigent letters." The FBI responded that it had barred the use of exigent letters, but emphasized that the term "exigent letter" does not include emergency disclosures under the exception now found in 18 U.S.C. 2702(c)(4). Thus, the FBI might request that a service provider invoke that exception to the record disclosure bar "if the provider reasonably believes that an emergency involving immediate danger of death or serious physical injury to any person justifies disclosure of the information," 18 U.S.C. 2702(c)(4). Moreover, the Justice Department's Office of Legal Counsel subsequently advised the FBI in a classified memorandum that "under certain circumstances the ECPA does not prohibit electronic communications service providers from disclosing certain call detail records to the FBI on a voluntary basis without legal process or a qualifying emergency under [S]ection 2702."

The Second IG Report

The second IG Report reviewed the FBI's use of national security letter authority during calendar year 2006 and the corrective measures taken following the issuance of the IG's first report. The second Report concluded that

"the FBI's use of national security letters in 2006 continued the upward trend ... identified ... for the period covering 2003 through 2005; "the percentage of NSL requests generated from investigations of U.S. persons continued to increase significantly, from approximately 39% of all NSL requests issued in 2003 to approximately 57% of all NSL requests issued in 2006;" the FBI and DOJ are committed to correcting the problems identified in IG Report I and "have made significant progress in addressing the need to improve compliance in the FBI's use of NSLs;" [and] "it [was] too early to definitively state whether the new systems and controls developed by the FBI and the Department will eliminate fully the problems with NSLs that we identified," IG Report II at 8-9.

The Third IG Report

The third IG Report examined the FBI's use of exigent letters and other informal means of acquiring communication service provider's customer records in lieu of relying on NSL authority during the period from 2003 to 2007. The IG's Office discovered that "the FBI's use exigent letters became so casual, routine, and unsupervised that employees of all three communications service providers sometimes generated exigent letters for FBI personnel to sign and return to them."

Some of the informality was apparently the product of proximity. In order to facilitate cooperation, communications providers had assigned employees to FBI offices. In addition to a relaxed exigent letter process, the on-site feature gave rise to a practice of sneak peeks, that is, of providing the FBI with "a preview of the available information for a targeted phone number, without documentation of any justification for the request." "In fact, at times the service providers' employees simply invited FBI personnel to view the telephone records on their computer screens. One senior FBI counterterrorism official described the culture of casual requests for telephone records by observing, "It [was] like having the ATM in your living room."

Not surprisingly, the IG's review " ... found widespread use by the FBI of exigent letters and other informal requests for telephone records. These other requests were made ... without first providing legal process or even exigent letters. The FBI also obtained telephone records through improper 'sneak peeks,' community of interest █████, and hot-number ████ Many of these practices violated FBI guidelines, Department policy, and the ECPA statute. In addition, we found that the FBI also made inaccurate statements to the FISA [(Foreign Intelligence Surveillance Act)] Court related to its use of exigent letters."

Although critical of the FBI's initial response and recommending further steps to prevent reoccurrence, the IG's Report concluded that "the FBI took appropriate action to stop the use of exigent letters and to address the problems created by their use."

Post-Amendment Judicial Action

Following the 2006 USA PATRIOT Act amendments, the U.S. District Court for the Southern District of New York revisited the issue and concluded that the revised NSL procedures violated both First Amendment and separation of powers principles. It enjoined Justice Department officials from issuing NSLs under Section 2709, the communications section, or from enforcing compliance with existing orders. However, it stayed the order pending appeal. The U.S. Court of Appeals for the Second Circuit did not disagree, but concluded that the government could invoke the secrecy and judicial authority of the communications NSL statute, and the review statute in a limited but constitutionally permissible manner.

The issues before the Court of Appeals were (1) whether the nondisclosure features of NSL communications statute should be subject to First Amendment strict scrutiny and (2) whether judicial review subject to the conclusive weight of an executive branch certification under the review section posed constitutional concerns.

The pre-amendment Doe cases had concluded that the communications NSL statute, which then broadly prohibited disclosure of receipt of an NSL, "work[ed] as both a prior restraint on speech and a content-based restriction, and hence, [was] subject to strict scrutiny." "Under strict scrutiny review," the Supreme Court had explained, "the Government must demonstrate that the nondisclosure requirement is narrowly tailored to promote a compelling Government interest." Moreover, the Court had observed, there can be "no less restrictive alternatives that would be at least as effective in achieving the legitimate purpose that the statute was enacted to serve." When a suspect prior restraint comes in the form of a licensing scheme, under which expression is banned for want of government permission as in Freedman v. Maryland , Court precedent suggested that the scheme must include prompt judicial review at the petition and burden of the regulator.

Yet, the courts had been unwilling to classify as constitutionally suspect all instances of apparent prior restraint. The government in its presentation to the Second Circuit pointed to a number of instances where withstanding an apparent prior restraint regulators were held to a less demanding standard—citing cases involving pre-trial discovery gag orders, grand jury secrecy, the confidentiality surrounding inquiry into judicial misconduct, and the secrecy agreements signed by national security employees.

In fact, when the Supreme Court had assessed the First Amendment validity of a pre-trial discovery gag order, it concluded that the relevant questions were two: first, "whether the practice in question furthers an important or substantial governmental interest unrelated to the suppression of expression;" and second, "whether the limitation of First Amendment freedoms is no greater than is necessary or essential to the protection of the particular governmental interest involved."

The members of the Second Circuit panel could not agree on whether the NSL statute, as amended, constituted a prior restraint subject to strict scrutiny analysis, or should be judged by a somewhat less demanding standard. The lack of consensus proved of little consequence, because the government conceded that strict scrutiny analysis was appropriate, and because the panel agreed the result would be the same under the factor common to both standards—whether the restriction on expression crafted to protect the government's interest was narrowly tailored for that purpose.

The government's interest in national security is indisputably compelling. Unwilling to read the NSL statutory procedure as a licensing scheme, the Second Circuit panel nevertheless concluded that "in the absence of Government-initiated judicial review, [the review statute,] §3511(b) [was] not narrowly tailored to conform to First Amendment protected standards." Moreover, the First Amendment demands real judicial review. The procedure must "place on the Government the burden to show a good reason to believe that disclosure may result in an enumerated harm, i.e. a harm related to an authorized investigation to protect against international terrorism or clandestine intelligence activities." Such judicial review may occur ex parte and in camera, but it may not be bound by the executive's conclusive certification of harm feature of Section 3511. In the eyes of the court, there is no meaningful judicial review "of the decision of the Executive Branch to prohibit speech if the position of the Executive Branch that speech would be harmful is 'conclusive' on the reviewing court, absent only a demonstration of bad faith." "To accept deference to that extraordinary degree would be to reduce strict scrutiny to no scrutiny, save only in the rarest of situations where bad faith could be shown," it concluded.

Yet the court envisioned a procedure under which NSL secrecy provision might survive:

We deem it beyond the authority of a court to "interpret" or "revise" the NSL statutes to create the constitutionally required obligation of the Government to initiate judicial review of a nondisclosure requirement. However, the Government might be able to assume such an obligation without additional legislation….

If the Government uses the suggested reciprocal notice procedure as a means of initiating judicial review, there appears to be no impediment to the Government's including notice of a recipient's opportunity to contest the nondisclosure requirement in an NSL. If such notice is given, time limits on the nondisclosure requirement pending judicial review, as reflected in Freedman , would have to be applied to make the review procedure constitutional. We would deem it to be within our judicial authority to conform subsection 2709(c) to First Amendment requirements, by limiting the duration of the nondisclosure requirement, absent a ruling favorable to the Government upon judicial review, to the 10-day period in which the NSL recipient decides whether to contest the nondisclosure requirement, the 30-day period in which the Government considers whether to seek judicial review, and a further period of 60 days in which a court must adjudicate the merits, unless special circumstances warrant additional time. If the NSL recipient declines timely to precipitate Government-initiated judicial review, the nondisclosure requirement would continue, subject to the recipient's existing opportunities for annual challenges to the nondisclosure requirement provided by subsection 3511(b). If such an annual challenge is made, the standards and burden of proof that we have specified for an initial challenge would apply, although the Government would not be obliged to initiate judicial review.

Given the possibility of constitutional application, the court saw no reason to invalidate the NSL statute and Section 3511(b) in toto. The exclusive presumptions of Section 3511 made binding on the review court could not survive, the court declared, but the First Amendment finds no offense in the remainder of the two sections except "to the extent that they fail to provide for Government-initiated judicial review. The Government can respond to this partial invalidation ruling by using the suggested reciprocal notice procedure."

On remand under the procedure suggested by the Court of Appeals, the government submitted the declaration of the senior FBI official concerning the continued need for secrecy concerning the NSL. Following an ex parte, in camera hearing, the district court concluded the government had met its burden, but granted the plaintiff's motion for an unclassified, redacted summary of the FBI declaration.

The possibility of a conflicting view arose in the Ninth Circuit. A federal district court there agreed with the Second Circuit that the NSL confidentiality and judicial review provisions were constitutionally suspect. Yet it could not agree with the Second Circuit that NSL authority might be used if the confidentiality and judicial review provisions were implemented to satisfy constitutional demands. The statutory language was too clear and the congressional intent too apparent for the court to feel it could move in the opposite direction. It declared,

The statutory provisions at issue—as written, adopted and amended by Congress in the face of a constitutional challenge—are not susceptible to narrowing conforming constructions to save their constitutionality ... [I]n amending and reenacting the statute as it did, Congress was concerned with giving the government the broadest powers possible to issue NSL nondisclosure orders and to preclude searching judicial review of the same ... [T]he sorts of multiple inferences required to save the provisions at issue are not only contrary to evidence of Congressional intent, but also contrary to the statutory language and structure of the statutory provisions actually enacted by Congress.

The district court also concluded that, if the confidentiality and judicial review provisions could not survive, neither could the remainder of the NSL authority. The court, therefore, barred the government from using the communication NSL statute's authority and from enforcing the related NSL confidentiality provisions. It stayed the order pending appeal.

Recommendations of the President's Review Group

In the wake of leaks relating to the National Security Agency's (NSA's) purported bulk meta-data collection program under the Foreign Intelligence Surveillance Act (FISA), the President established a Review Group on Intelligence and Communications Technology (Group). The Group released its report and recommendations on December 12, 2013. Several of its recommendations addressed NSLs. NSL procedures, it said, should more closely resemble those of FISA "business record" court orders ("§215 orders"). Thus, it proposed that (1) the courts approve all NSLs except in emergency circumstances; (2) Section 215 orders be used only in international terrorism and international espionage investigations; (3) the NSL statutes be amended to track Section 215 minimization requirements; (4) both NSLs and Section 215 orders should be subject to greater oversight and public reporting requirements.

Section 215 of the USA PATRIOT Act had amended the business records provisions of FISA. As amended, FISA authorizes court orders for the production of tangible items held by individuals and private entities in certain foreign intelligence cases. Section 215 orders provide government access to business records in certain intelligence investigations; NSLs also provide government access to business records in certain intelligence investigations. FISA court judges issue Section 215 orders; FBI officials issue NSLs. The Group recommended that "statutes that authorize the issuance of National Security Letters should be amended to permit the issuance of National Security Letters only upon a judicial finding that: (1) the government has reasonable grounds to believe that the particular information sought is relevant to an authorized investigation intended to protect 'against international terrorism or clandestine intelligence activities' and (2) like a subpoena, the order is reasonable in focus, scope, and breadth." It explained that

For all the well-established reasons for requiring neutral and detached judges to decide when government investigators may invade an individual's privacy, there is a strong argument that NSLs should not be issued by the FBI itself.... [F]oreign intelligence investigations are especially likely to implicate highly sensitive and personal information and to have potentially severe consequences for the individuals under investigation. We are unable to identify a principled reason why NSLs should be issued by FBI officials when [Section] 215 orders and orders for pen registers and trap-and-trace surveillance must be issued by the [FISA court].

Without further adjustments, the proposed Section 215-NSL symmetry would be less than perfect. Requiring judicial approval of both would be a first step in that direction. The Group, however, did not suggest that the FISA court should approve all NSLs. It readily conceded that the 60-a-day rate at which the FBI issues NSLs would overwhelm the FISA court as currently constituted. It offered several alternative solutions, including enlarging the FISA court, but endorsed none of the alternatives.

The Group would also eliminate the gap that exists between when an NSL may be issued and when a Section 215 order may be issued. Section 215 orders are available for investigations in addition to the international terrorism or international espionage inquiries that support NSL issuance under most statutes. Beyond terrorism and espionage, Section 215 orders are available to secure "foreign intelligence information" as long as it does not relate to a "U.S. person." Foreign intelligence information encompasses information about foreign nations and foreign entities useful for the conduct of U.S. foreign relations. The Group endeavored to create compatibility by shaving off the difference; it would allow Section 215 orders only in conjunction with international terrorism or espionage investigations.

Section 215 orders are subject to limitations as to how the information they generate may be used, stored, shared, and kept or disposed of (minimization standards). The Group considered "the oversight and minimization requirements governing the use of NSLs ... much less rigorous than those imposed in the use of [Section] 215 orders." Consequently, it recommended that NSLs be held to Section 215 standards.

Finally, the Group made a series of recommendations with an eye to greater oversight and public disclosure. Their proposals would apply to NSLs, Section 215 orders, trap and trace orders, Section 702 orders, and orders of the kind that gave rise to the purported NSA bulk meta-data collection. It suggested as a general matter that information concerning these authorities should be available in detail to Congress and the public, consistent with the need to protect classified information. More specifically, it recommended that nondisclosure orders (gag orders) issued to communications carriers and other recipients should be limited to cases involving human safety, maintaining congenial diplomatic relations, or similar substantial governmental concerns. The Group would allow recipients to periodically disclose the number of times they had received NSLs, Section 215 orders, and the like. It also proposed that the government be required to issue regular public reports on the use of such orders.

USA FREEDOM Act

Congress did not adopt the recommendations of the President's Review Group, but the USA FREEDOM Act addresses the judicially perceived NSL shortcomings in other ways. It eliminates the prospect of Section 215-like bulk metadata collection under NSL authority. It revises the procedures for the issuance of NSL nondisclosure provisions and for judicial review of their issuance. Finally, it augments existing reporting requirements for greater transparency.

Each of the NSL statutes now includes a requirement that the NSL demand be limited to specifically identified information rather than insisting on delivery of record information for all of a recipient's customers.

The USA FREEDOM Act handles the judicial review of nondisclosure orders with complementary amendments to the NSL statutes and to Section 3511. Nondisclosure orders under the amended NSL statutes are available only if the issuance officials notify recipients of their right to judicial review and certify that disclosure may result in a danger to national security; in interference with a criminal, counterterrorism, or counterintelligence investigation; in interference with diplomatic relations; or in the endangerment of an individual's physical safety.

A nondisclosure order notwithstanding, a recipient may disclose to those necessary for execution of the order, to an attorney for related legal advice, and to anyone else approved by the issuance agency. The exception is conditioned upon the recipient's notification of the issuance agency and advising those he tells of the nondisclosure requirements binding each of them.

The USA FREEDOM Act amends Section 3511 so that the issuing agency must petition for judicial review upon request of the recipient. The petition must include a statement of specific facts evidencing the risks that warrant a nondisclosure order—a risk of a danger to national security, of interference with diplomatic relations or with particular investigation, or of physical injury. The court must issue the order if it finds reason to believe disclosure "during the applicable time period" would bring with it such risks.

The reference to "the applicable time period" is the only indication of the permissible tenure of a nondisclosure order. The phrase seems to contemplate that the petition will propose a time limit on any nondisclosure order or at least the court will impose one. The legislative history suggests that this reflects the practice immediately prior to enactment of the USA FREEDOM Act. Of course, the government was operating at the time under the pre-USA FREEDOM Act version of Section 3511, which afforded the opportunity for annual (and only annual) judicial review, and in the shadow of the Second Circuit's John Doe, Inc. decision.

The USA FREEDOM Act's final NSL adjustment occurs in the area of public disclosures. It directs the Director of National Intelligence to post on his website annually the number of NSLs issued and the number of requests covered by those NSLs during the previous year. It also permits a recipient of a FISA order or an NSL to publicly report, in one of four statutorily defined alternatives, the total number of such FISA orders and NSLs and the total number of customers covered by such orders or requests.

Current NSL Attributes

Addressees and Certifying Officials

The five NSL statutes share a number of common attributes, although each has its own individual features as well. They are most distinctive with respect to the nature of the businesses to which they may be addressed. The Electronic Communication Privacy Act NSLs are addressed to communications providers. Those issued under the authority of the Right to Financial Privacy Act may be directed to financial institutions, such as banks, credit unions, credit card companies, car dealers, jewelers and a number of entities that are likely to be involved large cash transactions. The Fair Credit Reporting Act NSLs may be addressed to consumer credit reporting agencies. Recipients of the National Security Act NSLs may include financial institutions and consumer credit reporting agencies, as well as any commercial entity with information concerning an agency employee's travel.

FBI officials are authorized to provide the initial certification required for issuance of an NSL under any of the five statutes. In three instances, the authority is exclusive; in the other two, it is enjoyed by other federal officials as well. In the case of the Electronic Communications Privacy Act NSL section, the Right to Financial Privacy Act section, and one of the Fair Credit Report Act NSL sections, issuance requires the certification of either the Director of the FBI, a senior FBI official (no lower than the Deputy Assistant Director), or the Special Agent in Charge of an FBI field office.

Certifying officials under the other statutes are described more broadly. The National Security Act NSL section contemplates certification by officials from a wider range of agencies; the second Fair Credit Reporting Act NSL section allows certification by both a wider range of agencies and a wider range of officials. Senior officials no lower than Assistant Secretary or Assistant Director of an agency whose employee with access to classified material is under investigation may certify a National Security Act NSL request. A designated supervisory official of any agency "authorized to conduct investigations of, or intelligence or counterintelligence activities and analysis related to, international terrorism" may certify an NSL request under the second, more recent Fair Credit Reporting Act section.

Purpose, Standards, Information Covered

Although variously phrased, the purpose for each of the NSLs is to acquire information related to the requesting agency's national security concerns. The most common statement of purpose is "to protect against international terrorism or clandestine intelligence activities." The more recent of the Fair Credit Reporting Act NSL sections simply indicates that the information must be sought for the requesting intelligence agency's investigation, activity, or analysis. The National Security Act NSL authority is available to conduct law enforcement investigations, counterintelligence inquiries, and security determinations. As to standards, the Electronic Communications Privacy Act authorizes NSLs for relevant information. The same standard may apply to the others, which are a little more cryptic, authorizing NSLs when the information is "sought for" or "is necessary" for the statutory purpose.

The communications NSL provision and the earlier of the two credit agency NSL statutes are fairly specific in their descriptions of the information that may be requested through an NSL. An Electronic Communications Privacy Act NSL may request a customer's name, address, length of service, and billing records. The older of the two Fair Credit Report Act sections authorizes an NSL to acquire name, address or former address, place or former place of employment, and the name and address of any financial institution with which the consumer has or once had an account. The Right to Financial Privacy Act NSL provision covers the financial records of a financial institution's customers; the second and more recent Fair Credit Reporting Act NSL provision covers a consumer reporting agency's consumer reports and "all other" consumer information in its files. The National Security Act provision is at once the most inclusive and the most restricted. It authorizes NSLs for financial information and records and consumer reports held by any financial agency, institution, holding company, or consumer reporting agency, and for travel information held by any commercial entity. On the other hand, it is the only provision that limits the information provided to that pertaining to the target of the agency's investigation and to information of a kind whose disclosure the target has previously approved.

Confidentiality

Prior to their amendment in the 109 th Congress, the NSL statutes generally featured an open-ended confidentiality clause. The communications NSL provision for example declared, "No wire or electronic communication service provider, or officer, or employee, or agent thereof, shall disclose to any person that the Federal Bureau of Investigation has sought or obtained access to information or records under this section." The statutes did not indicate whether a recipient might consult an attorney in order to ascertain his rights and obligations, or whether the clause might ever be lifted. It was this silence in the face of a seemingly absolute, permanent nondisclosure command that the early Doe courts found constitutionally unacceptable and that perhaps led to the reconstruction of the NSL confidentiality requirements.

After amendment, secrecy is not absolutely required. Rather, NSL recipients are bound to secrecy only upon the certification of the requesting agency—and the agreement of the court should the recipient seek, or ask that the requesting agency to seek, judicial review—that disclosure of the request or response might result in a danger to national security; might interfere with diplomatic relations or with a criminal, counterterrorism, or counterintelligence investigation; or might endanger the physical safety of an individual.

A recipient may disclose the request to those necessary to comply with the request; to an attorney the recipient, consulted for related legal advice or assistance; and to others with the government's approval. In doing so, the recipient must advise them of the secrecy requirements. Aside from its attorney and at the agency's election, the recipient must identify for the requester those to whom it has disclosed the request.

If an NSL contains a nondisclosure notice, it must advice the recipient of its right to seek, or to have the agency seek, judicial review. At the recipient's request, the issuing agency must petition the court for review, stating the specific facts that support its belief that disclosure might result in one or more of the statutorily identified adverse consequences. If the court agrees that such a risk may exist, it must issue a nondisclosure order.

Failure to honor a nondisclosure order is punishable as contempt of court, and if committed knowingly and with the intent to obstruct an investigation or related judicial proceedings is punishable by imprisonment for not more than five years and/or a fine of not more than $250,000 (not more than $500,000 for an organization).

Judicial Review and Enforcement

In addition to authority to review and set aside NSL nondisclosure requirements, the federal courts enjoy jurisdiction to review and enforce the underlying NSL requests. Recipients may petition and be granted an order modifying or setting aside an NSL, if the court finds that compliance would be unreasonable, oppressive, or otherwise unlawful. The standard is reminiscent of the one used for subpoenas issued under the Federal Rules of Criminal Procedure. There a subpoena may be modified or quashed if compliance would be unreasonable or oppressive. The Rule affords protection against undue burdens and protects privileged communications.

Compliance with a particular NSL might be unduly burdensome in some situations, but the circumstances under which NSLs are used suggest few federally recognized privileges. The Rule also imposes a relevancy requirement, but in the context of a grand jury investigation a motion to quash will be denied unless it can be shown that "there is no reasonable possibility that the category of materials the Government seeks will produce information relevant" to the investigation. The authority to modify or set aside an NSL that is unlawful affords the court an opportunity to determine whether the NSL in question complies with the statutory provisions under which it was issued. On the other hand, the court's authority may be invoked to enforce the NSL against a recalcitrant recipient and here to failure to comply thereafter is punishable as contempt of court.

Dissemination

Attorney General guidelines govern the sharing of information acquired in response to NSLs under two statutes. A third, the older of the two Fair Credit Report Act sections, limits dissemination to sharing within the FBI, with other agencies to the extent necessary to secure approval of a foreign counterintelligence investigation, or with military investigators when the information concerns a member of the Armed Forces. The National Security Act authorizes dissemination of NSL information to the agency of the employee under investigation, to the Justice Department for law enforcement or counterintelligence purposes, or to another federal agency if the information is clearly relevant to its mission. The more recent Fair Credit Reporting Act NSL section has no explicit provision on restricting dissemination.

Liability, Fees and Oversight

Since judicial enforcement is a feature new to all but one of the NSL statutes, the statutes might be expected to include other incentives to overcome recipient resistance. Three offer immunity from civil liability for recipients who comply in good faith, and two offer fees or reimbursement to defer the costs of compliance.

The confidentiality that necessarily surrounds NSL requests could give rise to concerns of governmental overreaching. Consequently, regular reports on the use of NSL authority must be made to the congressional intelligence and judiciary committees and in some instances to the banking committees. Moreover, Section 119 of the USA PATRIOT Improvement and Reauthorization Act instructs the Inspector General of the Department of Justice to audit and to report to the judiciary and intelligence committees as to the Department's use of the authority in the years following expansion of the authority in the USA PATRIOT Act. The section also directs the Attorney General and the Director of National Intelligence to report to Congress on the feasibility of establishing minimization requirements for the NSLs. The USA FREEDOM Act instructs the Director of National Intelligence to publish annual on his website the number of NSLs issued in previous year. It authorizes recipients to periodically disclose publicly the number of NSLs and requests they have received as well.

The chart that follows summarizes the differences among the five NSL sections: