National Security Letters: Proposals in the 113th Congress
Released: 2015-01-22T00:00:00

Introduction

A National Security Letter (NSL) is roughly comparable to an administrative subpoena. An NSL needs no prior judicial approval. Intelligence agencies issue them for intelligence gathering purposes to telephone companies, Internet service providers, consumer credit reporting agencies, banks, and other financial institutions, directing the recipients to turn over certain customer records and similar information. The 111 th and 112 th Congresses as well as the 113 th Congress saw a number of proposals to amend NSL authority. None were enacted. In the 112 th Congress, they were closely associated with the scheduled expiration of various provisions of the Foreign Intelligence Surveillance Act (FISA). In the 113 th Congress, they were often grouped with legislation that addressed the exercise of FISA authority. The House passed such a bill, H.R. 3361 , and many of its features were included in S. 2685 . S. 2685 , however, failed to secure the three-fifths vote necessary for cloture. Congress took no final action on S. 2685 , H.R. 3361 , or any other NSL proposal prior to adjournment.

Background

Prior to the USA PATRIOT Act, the NSL statutes were four. One, 18 U.S.C. 2709, obligated communications providers to supply certain customer information upon the written request of the Director of the Federal Bureau of Investigation (FBI) or a senior FBI headquarters official. When customer identity, length of service, and toll records were sought, the letters had to certify (1) that the information was relevant to a foreign counterintelligence investigation and (2) that specific and articulable facts gave reason to believe the information pertained to a foreign power or its agents. When only customer identity and length of service records (but not toll records) were sought, the letters had to certify (1) again that the information was relevant to a foreign counterintelligence investigation, but (2) that specific and articulable facts gave reason to believe that the customer information pertained to use of the provider's facilities to communicate with foreign powers, their agents, or those engaged in international terrorism or criminal clandestine intelligence activities.

In like manner a second statute, Section 1114(a)(5) of the Right to Financial Privacy Act, obligated financial institutions to provide the FBI with customers' financial records upon written certification of the FBI Director or his designee (1) that the records were sought for foreign counterintelligence purposes and (2) that specific and articulable facts gave reason to believe that the records were those of a foreign power or its agents.

And so it was with a third, Section 626 of the Fair Credit Report Act, which obligated consumer credit reporting agencies to provide customer identification, and the names and addresses of financial institutions at which a designated consumer maintained accounts. Here too, the obligation was triggered by written certification of the FBI Director or his designee (1) that the information was necessary for a foreign counterintelligence investigation, and (2) that specific and articulable facts gave reason to believe that the consumer was either a foreign power, a foreign official, or the agent of a foreign power and was engaged in international terrorism or criminal clandestine intelligence activities.

The fourth, Section 802 of the National Security Act, was a bit different. It reached a wider range of potential recipients at the demand of a large group of federal officials, but for a more limited purpose. It rested the obligation to provide consumer reports, together with financial information and records, upon consumer reporting agencies, financial agencies, and financial institutions, or holding companies. The requirement was triggered by the certification of senior officials of law enforcement and intelligence agencies, but confined to information pertaining to federal employees with access to classified information and being sought for clearance purposes and inquiries into past or potential security leaks.

USA PATRIOT Act

Section 505 of the USA PATRIOT Act altered the FBI's NSL authority under Section 2709 (communications information), the Right to Financial Privacy Act (financial information), and the Fair Credit Reporting Act (consumer credit information) in several ways:

it expanded issuing authority to include the heads of FBI field offices (special agents in charge (SACs)); it eliminated the requirement of specific and articulable facts demonstrating a nexus to a foreign power or its agents; it required instead that the information was sought for or relevant to various national security investigations; and It directed that no NSL related investigation of a "U.S. person" (American citizen or foreign resident alien) be predicated exclusively on First Amendment protected activities.

The National Security Act NSL section remained unchanged, but Section 358(g) of the USA PATRIOT Act added a new Fair Credit Reporting Act NSL Section 627, 15 U.S.C. 1681v. The new section obligated consumer reporting agencies to provide consumer information and reports to a federal agency "authorized to conduct investigations of, or intelligence or counterintelligence activities or analysis related to, international terrorism." Senior federal agency officials were empowered to issue the NSL with a certification that the information was "necessary for the agency's conduct or such investigation, activity, or analysis."

2006 Amendments

Several of the USA PATRIOT Act's intelligence gathering provisions were temporary and originally set to expire after five years. The NSL statutes were not among them, but Congress amended the NSL statutes in the USA PATRIOT Improvement and Reauthorization Act of 2005 and the USA PATRIOT Act Additional Reauthorizing Amendments Act of 2006 nonetheless. The NSL amendments were driven both by sensitivity to an Administration desire for more explicit enforcement authority and by judicial developments which had raised questions as to the statutes' constitutional vitality as then written. The early statutes came with open-ended nondisclosure provisions which barred recipients from disclosing the fact or content of the NSL—to anyone, ever. Yet, they featured neither a penalty provision should the confidential requirement be breached or in most cases an enforcement mechanism should an NSL obligation be ignored (the original Fair Credit Report Act statute alone had an explicit judicial enforcement component).

The amendments

created a judicial enforcement mechanism and a judicial review procedure for both the requests and accompanying nondisclosure requirements; established specific penalties for failure to comply with the nondisclosure requirements; made it clear that the nondisclosure requirements did not preclude a recipient from consulting an attorney; provided a process to ease the nondisclosure requirement; expanded congressional oversight; and called for Inspector General's audits of use of NSL authority.

IG Reports

The First IG Report

The Department of Justice Inspector General reports, one released in March of 2007, the second in March of 2008, and the third in January of 2010, were less than totally favorable. The first report noted that FBI use of NSLs had increased dramatically, expanding from 8,500 requests in 2000 to 47,000 in 2005, IG Report I at 120. During the three years under review, the percentage of NSLs used to investigate Americans ("U.S. persons") increased from 39% in 2003 to 53% in 2005. A substantial majority of the requests involved records relating to telephone or e-mail communications.

The report and the subsequent report a year later provided a glimpse at how the individual NSL statutes were used and why they were considered valuable. In case of the 18 U.S.C. 2709, the Electronic Communications Privacy Act (ECPA) NSL statute, the reports explained that

Through national security letters, an FBI field office obtained telephone toll billing records and subscriber information about an investigative subject in a counterterrorism case. The information obtained identified the various telephone numbers with which the subject had frequent contact. Analysis of the telephone records enabled the FBI to identify a group of individuals residing in the same vicinity as the subject. The FBI initiated investigations on these individuals to determine if there was a terrorist cell operating in the city.

Headquarters and field personnel told us that the principal objective of the most frequently used type of NSL—ECPA NSLs seeking telephone toll billing records, electronic communication transactional records, or subscriber information (telephone and e-mail)—is to develop evidence to support applications for FISA orders.

The Right to Financial Privacy Act (RFPA) NSL statute, 12 U.S.C. 3414(a)(5), also affords authorities access to a wide range of information (bank transaction records v. telephone transaction records) as demonstrated by the instances where it proved useful:

The FBI conducted a multi-jurisdictional counterterrorism investigation of convenience store owners in the United States who allegedly sent funds to known Hawaladars (persons who use the Hawala money transfer system in lieu of or parallel to traditional banks) in the Middle East. The funds were transferred to suspected Al Qaeda affiliates. The possible violations committed by the subjects of these cases included money laundering, sale of untaxed cigarettes, check cashing fraud, illegal sale of pseudoephedrine (the precursor ingredient used to manufacture methamphetamine), unemployment insurance fraud, welfare fraud, immigration fraud, income tax violations, and sale of counterfeit merchandise.

The FBI issued national security letters for the convenience store owners' bank account records. The records showed that two persons received millions of dollars from the subjects and that another subject had forwarded large sums of money to one of these individuals. The bank analysis identified sources and recipients of the money transfers and assisted in the collection of information on targets of the investigation overseas.

The Fair Credit Reporting Act NSL statutes, 15 U.S.C. 1681u (FCRAu) and 1681v (FCRAv) can be even more illuminating: "The supervisor of a counterterrorism squad told us that the FCRA NSLs enable the FBI to see 'how their investigative subjects conduct their day-to-day activities, how they get their money, and whether they are engaged in white collar crime that could be relevant to their investigations.'"

Overall, the report notes that the FBI used the information gleaned from NSLs for a variety of purposes, "to determine if further investigation is warranted; to generate leads for other field offices, Joint Terrorism Task Forces, or other federal agencies; and to corroborate information developed from other investigative techniques." Moreover, information supplied in response to NSLs provides the grist of FBI analytical intelligence reports and various FBI databases.

The report was somewhat critical, however, of the FBI's initial performance:

[W]e found that the FBI used NSLs in violation of applicable NSL statutes, Attorney General Guidelines, and internal FBI policies. In addition, we found that the FBI circumvented the requirements of the ECPA NSL statute when it issued at least 739 "exigent letters" to obtain telephone toll billing records and subscriber information from three telephone companies without first issuing NSLs. Moreover, in a few other instances, the FBI sought or obtained telephone toll billing records in the absence of a national security investigation, when it sought and obtained consumer full credit reports in a counterintelligence investigation, and when it sought and obtained financial records and telephone toll billing records without first issuing NSLs.

More specifically, the report found that

a "significant number of NSL-related possible violations were not being identified or reported" as required; the only FBI data collection system produced "inaccurate" results; the FBI issued over 700 exigent letters acquiring information in a manner that "circumvented the ECPA NSL statute and violated the Attorney General's Guidelines ... and internal FBI policy"; the FBI's Counterterrorism Division initiated over 300 NSLs in a manner that precluded effective review prior to approval; 60% of the individual files examined showed violations of FBI internal control policies; the FBI did not retain signed copies of the NSLs it issued; the FBI had not provided clear guidance on the application of the Attorney General's least-intrusive-feasible-investigative-technique standard in the case of NSLs; the precise interpretation of toll billing information as it appears in the ECPA NSL statute is unclear; SAC supervision of the attorneys responsible for review of the legal adequacy of proposed NSLs made some of the attorneys reluctant to question the adequacy of the underlying investigation previously approved by the SAC; there was no indication that the FBI's misuse of NSL authority constituted criminal conduct; personnel both at FBI headquarters and in the field considered NSL use indispensable; and information generated by NSLs was fed into a number of FBI systems.

Exigent Letters

Prior to enactment of the Electronic Communications Privacy Act (ECPA), the Supreme Court held that customers had no Fourth Amendment protected privacy rights in the records the telephone company maintained relating to their telephone use. Where a recognized expectation of privacy exists for Fourth Amendment purposes, the Amendment's usual demands such as those of probable cause, particularity, and a warrant may be eased in the face of exigent circumstances. For example, the Fourth Amendment requirement that officers must knock and announce their purpose before forcibly entering a building to execute a warrant can be eased in the presence of certain exigent circumstances such as the threat of the destruction of evidence or danger to the officers. Satisfying Fourth Amendment requirements, however, does not necessarily satisfy statutory prohibitions.

The ECPA prohibits communications service providers from supplying information concerning customer records unless one of the statutory exceptions applies. There are specific exceptions for disclosure upon receipt of a grand jury subpoena or an NSL. A service provider who knowingly or intentionally violates the prohibition is subject to civil liability, but there are no criminal penalties for the breach.

The Inspector General found that contrary to assertions that "the FBI would obtain telephone records only after it served NSLs or grand jury subpoenas, the FBI obtained telephone bill records and subscriber information prior to serving NSLs or grand jury subpoenas" by using "exigent letters." The FBI responded that it had barred the use of exigent letters, but emphasized that the term "exigent letter" does not include emergency disclosures under the exception now found in 18 U.S.C. 2702(c)(4). Thus, the FBI might request that a service provider invoke that exception to the record disclosure bar "if the provider reasonably believes that an emergency involving immediate danger of death or serious physical injury to any person justifies disclosure of the information." Moreover, the Justice Department's Office of Legal Counsel subsequently advised the FBI in a classified memorandum that "under certain circumstances the ECPA does not prohibit electronic communications service providers from disclosing certain call detail records to the FBI on a voluntary basis without legal process or a qualifying emergency under Section 2702."

The Second IG Report

The second IG Report reviewed the FBI's use of national security letter authority during calendar year 2006 and the corrective measures taken following the issuance of the IG's first report. The second report concluded that

"the FBI's use of national security letters in 2006 continued the upward trend ... identified ... for the period covering 2003 through 2005"; "the percentage of NSL requests generated from investigations of U.S. persons continued to increase significantly, from approximately 39% of all NSL requests issued in 2003 to approximately 57% of all NSL requests issued in 2006"; the FBI and DOJ are committed to correcting the problems identified in IG Report I and "have made significant progress in addressing the need to improve compliance in the FBI's use of NSLs"; and "it [was] too early to definitively state whether the new systems and controls developed by the FBI and the Department will eliminate fully the problems with NSLs that we identified."

The Third IG Report

The third IG Report examined the FBI's use of exigent letters and other informal means of acquiring communication service providers' customer records rather than relying on NSL authority during the period from 2003 to 2007. The IG's Office discovered that "the FBI's use of exigent letters became so casual, routine, and unsupervised that employees of all three communications service providers sometimes generated exigent letters for FBI personnel to sign and return to them."

Some of the informality was apparently the product of proximity. In order to facilitate cooperation, communications providers had assigned employees to FBI offices. In addition to a relaxed exigent letter process, the on-site feature gave rise to a practice of sneak peeks, that is, of providing the FBI with "a preview of the available information for a targeted phone number, without documentation of any justification for the request." "In fact, at times the service providers' employees simply invited FBI personnel to view the telephone records on their computer screens. One senior FBI counterterrorism official described the culture of casual requests for telephone records by observing, 'It [was] like having the ATM in your living room.'"

Not surprisingly, the IG's review

found widespread use by the FBI of exigent letters and other informal requests for telephone records. These other requests were made ... without first providing legal process or even exigent letters. The FBI also obtained telephone records through improper 'sneak peeks,' community of interest █████, and hot-number ████ Many of these practices violated FBI guidelines, Department policy, and the ECPA statute. In addition, we found that the FBI also made inaccurate statements to the FISA Court related to its use of exigent letters.

Although critical of the FBI's initial response and recommending further steps to prevent reoccurrence, the IG's Report concluded that "the FBI took appropriate action to stop the use of exigent letters and to address the problems created by their use."

Secrecy, Judicial Review, and the Judicial Reaction

At least for the time being, the current secrecy and judicial review provisions applicable to NSLs must be read in light of the Second Circuit's John Doe, Inc. v. Mukasey decision. Under the NSL statutes, secrecy is not absolutely required. Instead, NSL recipients are bound to secrecy only upon the certification of the requesting agency that disclosure of the request or response may result in a danger to national security; may interfere with diplomatic relations or with a criminal, counterterrorism, or counterintelligence investigation; or may endanger the physical safety of an individual. A recipient may disclose the request to those necessary to comply with the request and to an attorney the recipient consults for related legal advice or assistance. In doing so, the recipient must advise them of the secrecy requirements. Aside from its attorney the recipient must also identify, at the requesting agency's election, those to whom it has disclosed the request.

Judicial Review of NSLs

Under the judicial review statute, 18 U.S.C. 3511, a recipient may petition the court to modify or extinguish any NSL secrecy requirement within a year of issuance. Thereafter, it may petition to have the veil of secrecy lifted, although it may resubmit a rejected request only once a year. Section 3511 provides that the court may modify or set aside the restriction if it finds "no reason to believe that disclosure may" endanger national security or personal safety or interfere with diplomatic relations or a criminal, counterterrorism, or counterintelligence investigation. The section, however, binds the court to the assertion of a senior executive branch official that such an adverse consequence is possible .

In addition to authority to review and set aside NSL nondisclosure requirements, the federal courts also enjoy jurisdiction to review and enforce the underlying NSL requests. Section 3511 permits recipients to petition and authorizes the court to grant an order modifying or setting aside an NSL, if the court finds that compliance would be unreasonable, oppressive, or otherwise unlawful. The "unreasonable or oppressive" standard is used for grand jury and other subpoenas issued under the Federal Rules of Criminal Procedure. The Rules afford protection against undue burdens and protect privileged communications. Compliance with a particular NSL might be unduly burdensome in some situations, but the circumstances under which NSLs are used suggest few federally recognized privileges. The Rules also impose a relevancy requirement, but in the context of a grand jury investigation a motion to quash will be denied unless it can be shown that "there is no reasonable possibility that the category of materials the Government seeks will produce information relevant" to the investigation. The authority to modify or set aside an NSL that is "unlawful" affords the court an opportunity to determine whether the NSL in question complies with the statutory provisions under which it was issued. Section 3511 also vests the court with authority to enforce the NSL against a recalcitrant recipient. Failure to comply with the court's order thereafter is punishable as contempt of court. A breach of a confidentiality requirement committed knowingly and with the intent to obstruct an investigation or related judicial proceedings is punishable by imprisonment for not more than five years and/or a fine of not more than $250,000 (not more than $500,000 for an organization).

The Second Circuit concluded that the procedure can survive First Amendment scrutiny only if it involves the following:

notice to NSL recipients that they may contest any secrecy order; expeditious government petition for judicial review of a secrecy order upon recipient request; government burden to establish the validity of its narrowly tailored secrecy order; no conclusive weight may be afforded governmental assertions; and recipients may apply or reapply annually for judicial review where the government's burden remains the same.

On remand, the district upheld continuation of the nondisclosure order under the procedure suggested by the Second Circuit.

The District Court for the Northern District of California agreed with the Second Circuit that the secrecy provisions as written violate the First Amendment and that the judicial review section as written violates both the First Amendment and separation of powers principles. The court, however, did not agree that NSL authority might be exercised by reading into the statutes the constitutionally required limitations noted above. Moreover, the court felt that constitutional defects in the confidentiality components of the NSL statutes invalidated the statutes as a whole.

Proposed Amendments in the 113th Congress

Bills in 113 th Congress that would have amended the NSL statutes and related provisions proposed adjustments in four areas: (1) the grounds for issuing an NSL; (2) confidentiality requirements, enforcement, and judicial review; (3) reports and audits; and (4) sunset and repeal. Some were focused on a single category; others were more comprehensive.

Grounds for Issuance

Prior to the USA PATRIOT Act, the communications, financial institution, and consumer credit NSL statutes each required certification by a senior FBI official that "specific and articulable" facts exist to support the belief that the relevant information sought related to a foreign power or the agent of a foreign power. For instance, the communications provider NSL statute declared the following:

The Director of the Federal Bureau of Investigation ... may - (1) request the name, address, length of service, and local and long distance toll billing records of a person or entity if the Director ... certifies in writing to the ... provider to which the request is made that - (A) the ... records sought are relevant to an authorized foreign counterintelligence investigation; and (B) there are specific and articulable facts giving reason to believe that the person or entity to whom the information sought pertains is a foreign power or an agent of a foreign power....

The USA PATRIOT Act eliminated those requirements, so that the amended communications NSL for example now states the following:

The Director of the Federal Bureau of Investigation ... may - (1) request the name, address, length of service, and local and long distance toll billing records of a person or entity if the Director ... certifies in writing to the ... provider to which the request is made that the ... records sought are relevant to an authorized investigation to protect against international terrorism or clandestine intelligence activities, provided that such an investigation of a United States person is not conducted solely on the basis of activities protected by the first amendment to the Constitution of the United States.

A witness at an earlier congressional hearing indicated that the "specific and articulable" facts standard grew out of the standards employed in counterintelligence investigations and did not always translate well in a counterterrorism context:

My point is that the "specific and articulable facts" standard was particularly suited to the counterintelligence operations of the era in which it was created. A FBI counterintelligence investigation involved examining a linear connection between a foreign intelligence officer (about whom much was known) and his contacts (potential spies). The information known about the intelligence officer was specific in nature, and could be readily used to meet the NSL legal standards.... Unlike the traditional linear counterintelligence case, in which the foreign agent tried to recruit the domestic spy using infrequent and highly secure forms of communication, many counterterrorism cases involved complex networks generating a much larger volume of communication and financial transactions. In counter-terrorism cases, the starting point was often not a clearly identifiable agent of a foreign power (as in counterintelligence); indeed, the relevant "foreign power" was itself an imperfectly understood terrorist organization that might defy precise definition. As a consequence, counter-terrorism investigators often had a far more difficult time meeting the "specific and articulable facts" standard.

On the other hand, a later hearing witness argued that relaxation of the specific-and-articulable-facts standard eliminates an individualized suspicion requirement with the result that information is gathered about individuals who have a remote connection to a suspected foreign agent, at best.

S. 1551 (Wyden) would have reestablished the specific-and-articulable-facts standard in the three basic NSL statutes, and would have described three categories of individuals whose records an NSL may reach (A) foreign powers or their agents; (B) the activities of a suspected foreign agent who is the target of the investigation; or (C) "an individual in contact with, or known to, a suspected foreign agent."

Taking a somewhat similar approach, S. 1599 (Leahy) would have amended the three NSL statutes to include specific references to the three categories of individuals cited in S. 1551 whose records may be captured.

Instead of reestablishing the specific-and-articulable-facts standard, however, they would have insisted that the information sought—which now need only be "relevant to an authorized investigation to protect against international terrorism or clandestine intelligence activities"—be both relevant and material. Information is relevant when it relates to a matter under investigation, when it has probative value. It is material when it of sufficient significance to have the natural tendency to influence a decision.

The bills would have each preserved the post-USA PATRIOT Act prohibition on use of the authority in an investigation based solely on the basis of First Amendment-protected activities.

H.R. 3361 (House-passed) and S. 2685 (Leahy) would have established a different means of confining the scope of the four major NSL statutes, one characterized as limiting requests for bulk collection dumps. They would have restricted NSL requests for communications, financial records, or credit information related to a "specific selection term," for example: "The Director of the Federal Bureau of Investigation ... may, using a term that specifically identifies a person, entity, telephone number, or account as the basis for a request —request the name, address, length of service ... if the Director ... certifies ... that the name, address, length of service ... are relevant to an authorized investigation.... "

H.R. 3361 (House-passed) and S. 2685 (Leahy) would likewise have left in place the post-USA PATRIOT Act prohibition on use of the authority in an investigation based solely on the basis of First Amendment-protected activities.

Confidentiality and Judicial Review

Each of the NSL statutes has a nondisclosure provision. They state that the issuing agency may prohibit recipients from ever disclosing the request to anyone other than their attorney and those necessary to comply with the request. In order to activate the authority, agency officials must certify that disclosure may endanger national security or individual safety, or may interfere with diplomatic relations or with a criminal, counterintelligence, or counterterrorism investigation.

The statutes declare that a federal district court may modify or set aside an NSL secrecy requirement on the petition of a recipient, if it concludes that there is no reason to believe that disclosure might result in any such danger or interference. If the petition for review is filed more than a year after issuance of the NSL, the agency must either terminate the gag order or recertify the need for its continuation. They make no explicit provision for disclosure to the party to whom the information pertains.

The Second Circuit in John Doe, Inc. v. Mukasey held that these provisions only survive First Amendment scrutiny if the agency petitions for judicial review and convinces the court that the agency's proposed order is narrowly crafted to meet to the statutorily identified adverse consequences of disclosure. The district court opinion in the Ninth Circuit, In re National Security Letter , now stayed pending appeal, concluded these confidentiality provisions are constitutionally invalid on their face and cannot be saved by tailored application within constitutional bounds. Moreover, the district court opined that the provisions are not severable and consequently take down with them the NSL statutes of which they are a part.

S. 1599 (Leahy) and S. 2685 (Leahy) would have modified the statutory provisions governing the issuance and judicial review of NSL nondisclosure orders. They would have continued in place the personal safety and interference with diplomatic immunity grounds, and in the case of S. 1599 would have replaced the references to risk of interference with a criminal, counterterrorism, or counterintelligence investigation with more specific grounds: the risk of flight, destruction of evidence, witness intimidation, or alerting the target of an investigation. They would also have narrowed the danger-to-national-security justification to instances involving a risk of "serious" "substantial" danger to national security.

The newly added specifics—destruction of evidence, suspect flight, and witness intimidation—are the kind of factors considered exigent circumstances in other contexts. As noted earlier, they permit entry to execute a warrant without first announcing the officers' purposes and authority, for instance.

S. 1599 (Leahy) and S. 2685 (Leahy) would have amended the statutory provisions governing judicial review of NSLs nondisclosure orders. They would have codified a procedure comparable in many respects to that which the Second Circuit identified as constitutionally acceptable. The agency issuing the NSL would have been required to make the initial determination of whether to include a nondisclosure provision in the NSL and that determination would have been subject to judicial review. They would have included the expanded list of concerns a requesting official might rely upon in order to impose a nondisclosure order: reason to believe disclosure may substantially endanger national security or individual safety; interfere with diplomatic relations; result in flight, destruction of evidence, or witness intimidation; or alert a target of the investigation.

The agency would have been required to notify the recipient of the right to judicial review and petition for review within 30 days of a recipient's request for judicial review. The agency's application for judicial approval or review would have been required to include a statement of facts giving reason to believe that disclosure might result in one of the statutory list of adverse consequences—risk of substantially endangering national security or individual safety, destruction of evidence, etc. Should the court feel the agency had met its burden, it would have been required to issue a nondisclosure order.

Both bills would have amended the NSL statutes to make it clear that the NSLs are subject to judicial review and that the recipient is to be notified of that fact.

S. 1215 (Leahy) proposed many of the same alterations in the procedures governing the issuance and judicial review of nondisclosure orders. It would have left unchanged, however, the risks of adverse consequences upon which an official might base the decision to include a confidentiality requirement and upon which a court might approve one: danger to national security; interference with a criminal, counterterrorism, or counterintelligence investigation; interference with diplomatic relations; or individual safety. Otherwise, the bill would have required notice to recipient of the right to appeal a nondisclosure order and imposed the obligation to proceed within 30 days upon the government. Unlike S. 1599 and S. 2685 , however, under S. 1215 the court would have been required to give "substantial weight" to the government's certification of the risk of adverse consequences of a failure to uphold the secrecy requirement.

Reports and Audits

Two sections of the USA PATRIOT Improvement and Reauthorization Act called for NSL-related reports and audits. Some of the NSL statutes provide for periodic reports to various congressional committees. Section 118(a) of the USA PATRIOT Improvement and Reauthorization Act added the House and Senate Judiciary Committees to the list of required recipients of such reports. Section 118(c) directed the Attorney General to prepare, in unclassified form, an annual report to Congress on the number of NSLs issued in the previous year. Section 119 directed the Inspector General of the Department of Justice to audit and report on the use of NSL authority for calendar years 2002 through 2006. A number of bills in the 113 th Congress would have expanded one or both of the report and the audit requirements.

S. 1215 (Leahy) and S. 1599 (Leahy) each contemplated more detailed reports in both classified and unclassified forms. The bills would have required the Attorney General to submit each report to the House and Senate judiciary, intelligence, and banking committees twice a year on the number of NSL requests submitted during the reporting period that relate to each of several categories: U.S. persons; non-U.S. persons; subjects of an investigation; those who were linked to the subject of an investigation; and those not themselves the subject of an investigation. The bills would have eliminated the current exclusion of requests for communications subscriber information.

S. 1551 (Wyden) would have required a breakdown of reported totals according to U.S persons; non-U.S. persons; those who are the subject to the national security investigation; and those who are not the subject of such investigations.

S. 2685 (Leahy) would have insisted upon good faith estimates of the number of U.S. persons and the number of those who are not U.S. persons, concerning whom information was disclosed in response to NSLs.

Several bills would have permitted public reporting by the recipients of NSLs and Foreign Intelligence Surveillance Act (FISA) orders. Thus, S. 2685 (Leahy) and H.R. 3361 (House-passed) would have allowed any recipient of NSLs to publicly disclose information relating to the number of requests it received in a sixth month period. H.R. 3035 (Lofgren), S. 1551 (Wyden), and S. 1599 (Leahy) each would have allowed recipients to issue periodic reports on the number of NSL requests they received, organized according to the NSL statute under which the requests were received or by categories of the authorizing statutes. They would also have immunized providers from civil and criminal liability for any good faith exercise of the authority the bills would have provided.

Section 119 called an NSL audit by the Department of Justice Inspector General for the time period covering 2002 through 2006. S. 1215 (Leahy) and S. 1599 (Leahy) would have called for a similar audit covering 2010 through 2013. The bills would have called for audits by the intelligence community Inspectors General as well. In the case of S. 1215 , these intelligence assessments would have been required of the Inspectors General of the various agencies of the intelligence community. In the case of S. 1599 , the Inspector General of the Intelligence Community would have performed the assessment. In either case, the audit would have covered the period from 2010 to 2013 and would have included (a) an assessment of the importance of NSL information; (b) inquiry into the manner of NSL information collection, retention, analysis, and dissemination; (c) point out any noteworthy acts (including in the case of S. 1599 , and any improper or illegal practices); and (d) looked into the use of NSLs (or in the case of S. 1215 , examined the minimization procedures used).

Sunset and Repeal

Section 627 of the Fair Credit Reporting Act, the NSL statute created in the USA PATRIOT Act, is arguably the most sweeping of the NSL statutes. It offers the most extensive array of information (all information pertaining to a consumer held by a consumer credit reporting agency) to the widest range of requesters (any federal agency "authorized to conduct investigations of, or intelligence or counterintelligence activities or analysis relating to, international terrorism").

Several bills would have repealed it. Its repeal might be seen to facilitate oversight, since it would centralize authority to issue NSLs in the FBI (other than in the case of employee security investigations under the National Security Act). Moreover, the Justice Department IG reported that both the FBI and consumer reporting agencies had experienced difficulty distinguishing between authority under 1681u and 1681v.

Congress has not previously made either the NSL statutes or their USA PATROT Act amendments temporary. S. 1215 (Leahy) and S. 1599 (Leahy) would have changed that. Effective June 1, 2015, the bills would have returned NSL statutes to their pre-USA PATRIOT Act form. They would have established a transition provision under which the law prior to May 31, 2015, would have continued to apply with respect to investigations or offenses begun prior to June 1, 2015.

The USA PATRIOT Act expanded existing authority under 18 U.S.C. 2709, the Right to Financial Privacy Act, and the Fair Credit Reporting Act. It did not expand the reach of the National Security Act NSL statute. A return to the state of the law prior to enactment of the USA PATRIOT Act would have the effect of eliminating the amendments it made in the pre-existing NSL statutes.

In general terms for the three pre-existing NSL statutes that the USA PATRIOT Act amended, the act

expanded issuing authority to include the heads of FBI field offices (special agents in charge (SACs)); eliminated the requirement of specific and articulable facts demonstrating a nexus to a foreign power or its agents; required instead that the information was sought for or relevant to various national security investigations; and directed that no NSL-related investigation of a "U.S. person" (American citizen or foreign resident alien) be predicated exclusively on First Amendment protected activities.

This meant that

NSLs were more readily available to FBI field agents at a lower level of supervisory control; NSLs could be used to obtain information pertaining to individuals two, three, or more steps removed from the foreign power or agent of a foreign power that is the focus of the investigation; and NSL-related investigations could not be predicated solely on the basis of activities protected by the First Amendment.

A return to the state of the law prior to the effective date of the USA PATRIOT Act would have meant that NSLs would need to be approved by the FBI Director or a senior FBI headquarters official, and they would have to be based on specific and articulable facts giving reason to believe that the information sought pertains to a foreign power or agent of a foreign power.

The language precluding NSL-related investigations grounded exclusively on the exercise of First Amendment rights would also have disappeared. It is at best unclear, however, that the First Amendment unaided does not embody a comparable prohibition.

Prior to the USA PATRIOT Act, the NSL statutes strictly prohibited recipients from disclosing the request to anyone, ever. Yet, they afforded recipients no explicit means to challenge or seek limited release from the nondisclosure requirement, even for such narrow purposes as consulting their attorneys for advice on their obligations to comply. On the other hand, they provided the FBI with no explicit remedy should recipients violate the nondisclosure requirement.

In the USA PATRIOT Improvement and Reauthorization Act, Congress addressed the issue in three ways. First, it amended the federal obstruction of justice statute to outlaw unjustified disclosures. Second, it amended the NSL statutes to make it clear that a recipient remained free to seek the advice of counsel before complying. These amendments, unlike the obstruction of justice amendment, would disappear should the NSL statutes return to their earlier versions. Congress's third response, however, would mitigate impact of the disappearance. Third, Congress created a permanent statutory section for review of NSLs, 18 U.S.C. 3511.

By and large, Section 3511 governs judicial review of NSL nondisclosure requirements. When implemented as required by the Second Circuit's decision in John Doe, Inc. v. Mukasey , 549 F.3d 861 (2d Cir. 2008), and at the election of the recipient, the government has the burden of persuading the court of the validity of the gag order under the same standards as found in the expired portions of the NSL statutes. S. 1215 and S. 1599 's amendments to the judicial review provisions in Section 3511, designed to accommodate the concerns raised in John Doe, Inc ., would remain in effect after sunset.

The National Security Act NSL statute, left unamended by the USA PATRIOT Act, is arguably the least intrusive. It reaches only information pertaining to federal employees who have consented to their disclosure.

When the Senate Judiciary Committee approved comparable provisions in the 112 th Congress, it explained that

[S]unset was added not as an expression of desire for the authority to expire, but to guarantee that Congress [would] carefully review how NSLs are issued. After the standard for issuing an NSL was lowered in 2001, the use of NSLs spiked. Fewer than 10,000 NSLs were issued in 2001, but nearly 50,0000 were issued in 2006. Seeing the growth, Congress included Inspector General audits of NSLs in the 2005 USA PATIROT Act Reauthorization bill. The audits showed vast over-collection of information and abuse of the NSL authority.

The Minority Views in the Senate Judiciary Committee report objected to a return of the NSL statutes to their earlier versions:

S. 193 rescinds these valuable tools by, starting in 2013, requiring the government to follow the cumbersome pre-PATRIOT Act NSL standard. Prior to the PATRIOT Act, not only did the requested records have to be relevant to an investigation, but the FBI also had to have specific and articulable facts giving reason to believe that the information requested pertained to a foreign power or an agent of a foreign power, such as a terrorist or spy. This pre-PATRIOT Act requirement kept the FBI from using NSLs to develop evidence at the early stages of an investigation, which is precisely when they are the most useful, and often prevented investigators from acquiring records that were relevant to an ongoing international terrorism or espionage investigation.

It makes little sense to roll back the sensible NSL reforms that were made as part of the USA PATRIOT Act. Criminal investigators have long been able to use administrative or grand jury subpoenas to obtain records, so long as they are relevant to their investigation.

Text of NSL Statutes on October 25, 2001, and Now (emphasis added)

12 U.S.C. 3414(a)(5) (on October 25, 2001)

* * *

(a) ....

(5)(A) Financial institutions, and officers, employees, and agents thereof, shall comply with a request for a customer's or entity's financial records made pursuant to this subsection by the Federal Bureau of Investigation when the Director of the Federal Bureau of Investigation (or the Director's designee) certifies in writing to the financial institution that such records are sought for foreign counter intelligence purposes and that there are specific and articulable facts giving reason to believe that the customer or entity whose records are sought is a foreign power or the agents of a foreign power as defined in section 1801 of title 50 .

(B) The Federal Bureau of Investigation may disseminate information obtained pursuant to this paragraph only as provided in guidelines approved by the Attorney General for foreign intelligence collection and foreign counterintelligence investigations conducted by the Federal Bureau of Investigation, and, with respect to dissemination to an agency of the United States, only if such information is clearly relevant to the authorized responsibilities of such agency.

(C) On a semiannual basis the Attorney General shall fully inform the Permanent Select Committee on Intelligence of the House of Representatives and the Select Committee on Intelligence of the Senate concerning all requests made pursuant to this paragraph.

(D) No financial institution, or officer, employee, or agent of such institution, shall disclose to any person that the Federal Bureau of Investigation has sought or obtained access to a customer's or entity's financial records under this paragraph.

12 U.S.C. 3414(a)(5) (now)

* * *

(a) ...

(5)(A) Financial institutions, and officers, employees, and agents thereof, shall comply with a request for a customer's or entity's financial records made pursuant to this subsection by the Federal Bureau of Investigation when the Director of the Federal Bureau of Investigation (or the Director's designee in a position not lower than Deputy Assistant Director at Bureau headquarters or a Special Agent in Charge in a Bureau field office designated by the Director ) certifies in writing to the financial institution that such records are sought for foreign counter intelligence purposes to protect against international terrorism or clandestine intelligence activities, provided that such an investigation of a United States person is not conducted solely upon the basis of activities protected by the first amendment to the Constitution of the United States.

(B) The Federal Bureau of Investigation may disseminate information obtained pursuant to this paragraph only as provided in guidelines approved by the Attorney General for foreign intelligence collection and foreign counterintelligence investigations conducted by the Federal Bureau of Investigation, and, with respect to dissemination to an agency of the United States, only if such information is clearly relevant to the authorized responsibilities of such agency.

(C) On the dates provided in section 415b of Title 50, the Attorney General shall fully inform the congressional intelligence committees (as defined in section 401a of Title 50) concerning all requests made pursuant to this paragraph.

(D) Prohibition of certain disclosure.—

(i) If the Director of the Federal Bureau of Investigation, or his designee in a position not lower than Deputy Assistant Director at Bureau headquarters or a Special Agent in Charge in a Bureau field office designated by the Director, certifies that otherwise there may result a danger to the national security of the United States, interference with a criminal, counterterrorism, or counterintelligence investigation, interference with diplomatic relations, or danger to the life or physical safety of any person , no financial institution, or officer, employee, or agent of such institution, shall disclose to any person (other than those to whom such disclosure is necessary to comply with the request or an attorney to obtain legal advice or legal assistance with respect to the request) that the Federal Bureau of Investigation has sought or obtained access to a customer's or entity's financial records under subparagraph (A).

(ii) The request shall notify the person or entity to whom the request is directed of the nondisclosure requirement under clause (i).

(iii) Any recipient disclosing to those persons necessary to comply with the request or to an attorney to obtain legal advice or legal assistance with respect to the request shall inform such persons of any applicable nondisclosure requirement. Any person who receives a disclosure under this subsection shall be subject to the same prohibitions on disclosure under clause (i).

(iv) At the request of the Director of the Federal Bureau of Investigation or the designee of the Director, any person making or intending to make a disclosure under this section shall identify to the Director or such designee the person to whom such disclosure will be made or to whom such disclosure was made prior to the request, except that nothing in this section shall require a person to inform the Director or such designee of the identity of an attorney to whom disclosure was made or will be made to obtain legal advice or legal assistance with respect to the request for financial records under subparagraph (A).

15 U.S.C. 1681u(a), (b)(on October 25, 2001)

(a) Identity of financial institutions

Notwithstanding section 1681b of this title or any other provision of this subchapter, a consumer reporting agency shall furnish to the Federal Bureau of Investigation the names and addresses of all financial institutions (as that term is defined in section 3401 of Title 12) at which a consumer maintains or has maintained an account, to the extent that information is in the files of the agency, when presented with a written request for that information, signed by the Director of the Federal Bureau of Investigation, or the Director's designee, which certifies compliance with this section. The Director or the Director's designee may make such a certification only if the Director or the Director's designee has determined in writing that—

(1) such information is necessary for the conduct of an authorized foreign counterintelligence investigation; and

(2) there are specific and articulable facts giving reason to believe that the consumer—

(A) is a foreign power (as defined in section 1801 of title 50) or a person who is not a United States person (as defined in such section 1801 of title 50) and is an official of a foreign power; or

(B) is an agent of a foreign power and is engaging or has engaged in an act of international terrorism (as that term is defined in section 1801(c) of title 50) or clandestine intelligence activities that involve or may involve a violation of criminal statutes of the United States.

(b) Identifying information

Notwithstanding the provisions of section 1681b of this title or any other provision of this subchapter, a consumer reporting agency shall furnish identifying information respecting a consumer, limited to name, address, former addresses, places of employment, or former places of employment, to the Federal Bureau of Investigation when presented with a written request, signed by the Director or the Director's designee, which certifies compliance with this subsection. The Director or the Director's designee may make such a certification only if the Director or the Director's designee has determined in writing that—

(1) such information is necessary to the conduct of an authorized counterintelligence investigation; and

(2) there is information giving reason to believe that the consumer has been, or is about to be, in contact with a foreign power or an agent of a foreign power (as defined in section 1801 of title 50).

* * *

15 U.S.C. 1681u(a), (b)(now)

(a) Identity of financial institutions

Notwithstanding section 1681b of this title or any other provision of this subchapter, a consumer reporting agency shall furnish to the Federal Bureau of Investigation the names and addresses of all financial institutions (as that term is defined in section 3401 of Title 12) at which a consumer maintains or has maintained an account, to the extent that information is in the files of the agency, when presented with a written request for that information, signed by the Director of the Federal Bureau of Investigation, or the Director's designee in a position not lower than Deputy Assistant Director at Bureau headquarters or a Special Agent in Charge of a Bureau field office designated by the Director , which certifies compliance with this section. The Director or the Director's designee may make such a certification only if the Director or the Director's designee has determined in writing, that such information is sought for the conduct of an authorized investigation to protect against international terrorism or clandestine intelligence activities, provided that such an investigation of a United States person is not conducted solely upon the basis of activities protected by the first amendment to the Constitution of the United States.

(b) Identifying information

Notwithstanding the provisions of section 1681b of this title or any other provision of this subchapter, a consumer reporting agency shall furnish identifying information respecting a consumer, limited to name, address, former addresses, places of employment, or former places of employment, to the Federal Bureau of Investigation when presented with a written request, signed by the Director or the Director's designee in a position not lower than Deputy Assistant Director at Bureau headquarters or a Special Agent in Charge of a Bureau field office designated by the Director , which certifies compliance with this subsection. The Director or the Director's designee may make such a certification only if the Director or the Director's designee has determined in writing that such information is sought for the conduct of an authorized investigation to protect against international terrorism or clandestine intelligence activities, provided that such an investigation of a United States person is not conducted solely upon the basis of activities protected by the first amendment to the Constitution of the United States .

* * *

18 U.S.C. 2709 (as of October 25, 2001)

(a) Duty to provide.—A wire or electronic communication service provider shall comply with a request for subscriber information and toll billing records information, or electronic communication transactional records in its custody or possession made by the Director of the Federal Bureau of Investigation under subsection (b) of this section.

(b) Required certification.—The Director of the Federal Bureau of Investigation, or his designee in a position not lower than Deputy Assistant Director, may—

(1) request the name, address, length of service, and local and long distance toll billing records of a person or entity if the Director (or his designee in a position not lower than Deputy Assistant Director) certifies in writing to the wire or electronic communication service provider to which the request is made that—

(A) the name, address, length of service, and toll billing records sought are relevant to an authorized foreign counterintelligence investigation; and

( B) there are specific and articulable facts giving reason to believe that the person or entity to whom the information sought pertains is a foreign power or an agent of a foreign power as defined in section 101 of the Foreign intelligence Surveillance Act of 1978 (50 U.S.C. 1801 ); and

(2) request the name, address, and length of service of a person or entity if the Director (or his designee in a position not lower than Deputy Assistant Director) certifies in writing to the wire or electronic communication service provider to which the request is made that—

(A) the information sought is relevant to an authorized foreign counterintelligence investigation; and

(B) there are specific and articulable facts giving reason to believe that communication facilities registered in the name of the person or entity have been used, through the services of such provider, in communications with—

(i) an individual who is engaging or has engaged in international terrorism as defined in section 101(c) of the Foreign Intelligence Surveillance Act or clandestine intelligence activities that involve or may involve a violation of the criminal statutes of the United States; or

(ii) a foreign power or agent of a foreign power under circumstances giving reason to believe that the communication concerned international terrorism as defined in section 101(c) of the Foreign Intelligence Surveillance Act or clandestine intelligence activities that involve or may involve a violation of the criminal statutes of the United States.

(c) Prohibition of certain disclosure.—No wire or electronic communication service provider, or officer, employee, or agent thereof, shall disclose to any person that the Federal Bureau of Investigation has sought or obtained access to information or records under this section.

(d) Dissemination by bureau.—The Federal Bureau of Investigation may disseminate information and records obtained under this section only as provided in guidelines approved by the Attorney General for foreign intelligence collection and foreign counterintelligence investigations conducted by the Federal Bureau of Investigation, and, with respect to dissemination to an agency of the United States, only if such information is clearly relevant to the authorized responsibilities of such agency.

(e) Requirement that certain congressional bodies be informed.—On a semiannual basis the Director of the Federal Bureau of Investigation shall fully inform the Permanent Select Committee on Intelligence of the House of Representatives and the Select Committee on Intelligence of the Senate, and the Committee on the Judiciary of the House of Representatives and the Committee on the Judiciary of the Senate, concerning all requests made under subsection (b) of this section.

18 U.S.C. 2709 (now)

(a) Duty to provide.—A wire or electronic communication service provider shall comply with a request for subscriber information and toll billing records information, or electronic communication transactional records in its custody or possession made by the Director of the Federal Bureau of Investigation under subsection (b) of this section.

(b) Required certification.—The Director of the Federal Bureau of Investigation, or his designee in a position not lower than Deputy Assistant Director at Bureau headquarters or a Special Agent in Charge in a Bureau field office designated by the Director , may—

(1) request the name, address, length of service, and local and long distance toll billing records of a person or entity if the Director (or his designee) certifies in writing to the wire or electronic communication service provider to which the request is made that the name, address, length of service, and toll billing records sought are relevant to an authorized investigation to protect against international terrorism or clandestine intelligence activities, provided that such an investigation of a United States person is not conducted solely on the basis of activities protected by the first amendment to the Constitution of the United States ; and

(2) request the name, address, and length of service of a person or entity if the Director (or his designee) certifies in writing to the wire or electronic communication service provider to which the request is made that the information sought is relevant to an authorized investigation to protect against international terrorism or clandestine intelligence activities, provided that such an investigation of a United States person is not conducted solely upon the basis of activities protected by the first amendment to the Constitution of the United States .

(c) Prohibition of certain disclosure.—

(1) If the Director of the Federal Bureau of Investigation, or his designee in a position not lower than Deputy Assistant Director at Bureau headquarters or a Special Agent in Charge in a Bureau field office designated by the Director, certifies that otherwise there may result a danger to the national security of the United States, interference with a criminal, counterterrorism, or counterintelligence investigation, interference with diplomatic relations, or danger to the life or physical safety of any person , no wire or electronic communications service provider, or officer, employee, or agent thereof, shall disclose to any person (other than those to whom such disclosure is necessary to comply with the request or an attorney to obtain legal advice or legal assistance with respect to the request) that the Federal Bureau of Investigation has sought or obtained access to information or records under this section.

(2) The request shall notify the person or entity to whom the request is directed of the nondisclosure requirement under paragraph (1).

(3) Any recipient disclosing to those persons necessary to comply with the request or to an attorney to obtain legal advice or legal assistance with respect to the request shall inform such person of any applicable nondisclosure requirement. Any person who receives a disclosure under this subsection shall be subject to the same prohibitions on disclosure under paragraph (1).

(4) At the request of the Director of the Federal Bureau of Investigation or the designee of the Director, any person making or intending to make a disclosure under this section shall identify to the Director or such designee the person to whom such disclosure will be made or to whom such disclosure was made prior to the request, except that nothing in this section shall require a person to inform the Director or such designee of the identity of an attorney to whom disclosure was made or will be made to obtain legal advice or legal assistance with respect to the request under subsection (a).

(d) Dissemination by bureau.—The Federal Bureau of Investigation may disseminate information and records obtained under this section only as provided in guidelines approved by the Attorney General for foreign intelligence collection and foreign counterintelligence investigations conducted by the Federal Bureau of Investigation, and, with respect to dissemination to an agency of the United States, only if such information is clearly relevant to the authorized responsibilities of such agency.

(e) Requirement that certain congressional bodies be informed.—On a semiannual basis the Director of the Federal Bureau of Investigation shall fully inform the Permanent Select Committee on Intelligence of the House of Representatives and the Select Committee on Intelligence of the Senate, and the Committee on the Judiciary of the House of Representatives and the Committee on the Judiciary of the Senate, concerning all requests made under subsection (b) of this section.

(f) Libraries.—A library (as that term is defined in section 213(1) of the Library Services and Technology Act (20 U.S.C. 9122(1)), the services of which include access to the Internet, books, journals, magazines, newspapers, or other similar forms of communication in print or digitally by patrons for their use, review, examination, or circulation, is not a wire or electronic communication service provider for purposes of this section, unless the library is providing the services defined in section 2510(15) ("electronic communication service") of this title.

15 U.S.C. 1681v (as of October 25, 2001)

NONE. This section was created by the USA PATRIOT Act, effective October 26, 2001.

15 U.S.C. 1681v (now)

(a) Disclosure

Notwithstanding section 1681b of this title or any other provision of this subchapter, a consumer reporting agency shall furnish a consumer report of a consumer and all other information in a consumer's file to a government agency authorized to conduct investigations of, or intelligence or counterintelligence activities or analysis related to, international terrorism when presented with a written certification by such government agency that such information is necessary for the agency's conduct or such investigation, activity or analysis.

(b) Form of certification

The certification described in subsection (a) of this section shall be signed by a supervisory official designated by the head of a Federal agency or an officer of a Federal agency whose appointment to office is required to be made by the President, by and with the advice and consent of the Senate.

(c) Confidentiality

(1) If the head of a government agency authorized to conduct investigations of intelligence or counterintelligence activities or analysis related to international terrorism, or his designee, certifies that otherwise there may result a danger to the national security of the United States, interference with a criminal, counterterrorism, or counterintelligence investigation, interference with diplomatic relations, or danger to the life or physical safety of any person, no consumer reporting agency or officer, employee, or agent of such consumer reporting agency, shall disclose to any person (other than those to whom such disclosure is necessary to comply with the request or an attorney to obtain legal advice or legal assistance with respect to the request), or specify in any consumer report, that a government agency has sought or obtained access to information under subsection (a) of this section.

(2) The request shall notify the person or entity to whom the request is directed of the nondisclosure requirement under paragraph (1).

(3) Any recipient disclosing to those persons necessary to comply with the request or to any attorney to obtain legal advice or legal assistance with respect to the request shall inform such persons of any applicable nondisclosure requirement. Any person who receives a disclosure under this subsection shall be subject to the same prohibitions on disclosure under paragraph (1).

(4) At the request of the authorized government agency, any person making or intending to make a disclosure under this section shall identify to the requesting official of the authorized government agency the person to whom such disclosure will be made or to whom such disclosure was made prior to the request, except that nothing in this section shall require a person to inform the requesting official of the identity of an attorney to whom disclosure was made or will be made to obtain legal advice or legal assistance with respect to the request for information under subsection (a) of this section.

(d) Rule of construction

Nothing in section 1681u of this title shall be construed to limit the authority of the Director of the Federal Bureau of Investigation under this section.

(e) Safe harbor

Notwithstanding any other provision of this subchapter, any consumer reporting agency or agent or employee thereof making disclosure of consumer reports or other information pursuant to this section in good-faith reliance upon a certification of a government agency pursuant to the provisions of this section shall not be liable to any person for such disclosure under this subchapter, the constitution of any State, or any law or regulation of any State or any political subdivision of any State.

(f) Reports to Congress

(1) On a semi-annual basis, the Attorney General shall fully inform the Committee on the Judiciary, the Committee on Financial Services, and the Permanent Select Committee on Intelligence of the House of Representatives and the Committee on the Judiciary, the Committee on Banking, Housing, and Urban Affairs, and the Select Committee on Intelligence of the Senate concerning all requests made pursuant to subsection (a) of this section.

(2) In the case of the semiannual reports required to be submitted under paragraph (1) to the Permanent Select Committee on Intelligence of the House of Representatives and the Select Committee on Intelligence of the Senate, the submittal dates for such reports shall be as provided in section 415b of Title 50.

Sec. 802 of the National Security Act (50 U.S.C. 436 (as of October 25, 2001))

(a) Generally

(1) Any authorized investigative agency may request from any financial agency, financial institution, or holding company, or from any consumer reporting agency, such financial records, other financial information, and consumer reports as may be necessary in order to conduct any authorized law enforcement investigation, counterintelligence inquiry, or security determination. Any authorized investigative agency may also request records maintained by any commercial entity within the United States pertaining to travel by an employee in the executive branch of Government outside the United States.

(2) Requests may be made under this section where—

(A) the records sought pertain to a person who is or was an employee in the executive branch of Government required by the President in an Executive order or regulation, as a condition of access to classified information, to provide consent, during a background investigation and for such time as access to the information is maintained, and for a period of not more than three years thereafter, permitting access to financial records, other financial information, consumer reports, and travel records; and

(B)(i) there are reasonable grounds to believe, based on credible information, that the person is, or may be, disclosing classified information in an unauthorized manner to a foreign power or agent of a foreign power;

(ii) information the employing agency deems credible indicates the person has incurred excessive indebtedness or has acquired a level of affluence which cannot be explained by other information known to the agency; or

(iii) circumstances indicate the person had the capability and opportunity to disclose classified information which is known to have been lost or compromised to a foreign power or an agent of a foreign power.

(3) Each such request—

(A) shall be accompanied by a written certification signed by the department or agency head or deputy department or agency head concerned, or by a senior official designated for this purpose by the department or agency head concerned (whose rank shall be no lower than Assistant Secretary or Assistant Director), and shall certify that—

(i) the person concerned is or was an employee within the meaning of paragraph (2)(A);

(ii) the request is being made pursuant to an authorized inquiry or investigation and is authorized under this section; and

(iii) the records or information to be reviewed are records or information which the employee has previously agreed to make available to the authorized investigative agency for review;

(B) shall contain a copy of the agreement referred to in subparagraph (A)(iii);

(C) shall identify specifically or by category the records or information to be reviewed; and

(D) shall inform the recipient of the request of the prohibition described in subsection (b) of this section.

(b) Disclosure of requests

Notwithstanding any other provision of law, no governmental or private entity, or officer, employee, or agent of such entity, may disclose to any person that such entity has received or satisfied a request made by an authorized investigative agency under this section.

* * *

Sec. 802 of the National Security Act (50 U.S.C. 3162 (now))

(a) Generally

(1) Any authorized investigative agency may request from any financial agency, financial institution, or holding company, or from any consumer reporting agency, such financial records, other financial information, and consumer reports as may be necessary in order to conduct any authorized law enforcement investigation, counterintelligence inquiry, or security determination. Any authorized investigative agency may also request records maintained by any commercial entity within the United States pertaining to travel by an employee in the executive branch of Government outside the United States.

(2) Requests may be made under this section where—

(A) the records sought pertain to a person who is or was an employee in the executive branch of Government required by the President in an Executive order or regulation, as a condition of access to classified information, to provide consent, during a background investigation and for such time as access to the information is maintained, and for a period of not more than three years thereafter, permitting access to financial records, other financial information, consumer reports, and travel records; and

(B)(i) there are reasonable grounds to believe, based on credible information, that the person is, or may be, disclosing classified information in an unauthorized manner to a foreign power or agent of a foreign power;

(ii) information the employing agency deems credible indicates the person has incurred excessive indebtedness or has acquired a level of affluence which cannot be explained by other information known to the agency; or

(iii) circumstances indicate the person had the capability and opportunity to disclose classified information which is known to have been lost or compromised to a foreign power or an agent of a foreign power.

(3) Each such request—

(A) shall be accompanied by a written certification signed by the department or agency head or deputy department or agency head concerned, or by a senior official designated for this purpose by the department or agency head concerned (whose rank shall be no lower than Assistant Secretary or Assistant Director), and shall certify that—

(i) the person concerned is or was an employee within the meaning of paragraph (2)(A);

(ii) the request is being made pursuant to an authorized inquiry or investigation and is authorized under this section; and

(iii) the records or information to be reviewed are records or information which the employee has previously agreed to make available to the authorized investigative agency for review;

(B) shall contain a copy of the agreement referred to in subparagraph (A)(iii);

(C) shall identify specifically or by category the records or information to be reviewed; and

(D) shall inform the recipient of the request of the prohibition described in subsection (b) of this section.

(b) Prohibition of certain disclosure

(1) If an authorized investigative agency described in subsection (a) of this section certifies that otherwise there may result a danger to the national security of the United States, interference with a criminal, counterterrorism, or counterintelligence investigation, interference with diplomatic relations, or danger to the life or physical safety of any person, no governmental or private entity, or officer, employee, or agent of such entity, may disclose to any person (other than those to whom such disclosure is necessary to comply with the request or an attorney to obtain legal advice or legal assistance with respect to the request) that such entity has received or satisfied a request made by an authorized investigative agency under this section.

(2) The request shall notify the person or entity to whom the request is directed of the nondisclosure requirement under paragraph (1).

(3) Any recipient disclosing to those persons necessary to comply with the request or to an attorney to obtain legal advice or legal assistance with respect to the request shall inform such persons of any applicable nondisclosure requirement. Any person who receives a disclosure under this subsection shall be subject to the same prohibitions on disclosure under paragraph (1) .

(4) At the request of the authorized investigative agency, any person making or intending to make a disclosure under this section shall identify to the requesting official of the authorized investigative agency the person to whom such disclosure will be made or to whom such disclosure was made prior to the request, except that nothing in this section shall require a person to inform the requesting official of the identity of an attorney to whom disclosure was made or will be made to obtain legal advice or legal assistance with respect to the request under subsection (a) of this section.

* * *

P.L. 109-177, Sec. 118 (text)

Reports on National Security Letters.

(a) Existing Reports—Any report made to a committee of Congress regarding national security letters under section 2709(c)(1) of title 18, United States Code, sections 626(d) or 627(c) of the Fair Credit Reporting Act (15 U.S.C. 1681u(d) or 1681v(c)), section 1114(a)(3) or 1114(a)(5)(D) of the Right to Financial Privacy Act (12 U.S.C. 3414(a)(3) or 3414(a)(5)(D)), or section 802(b) of the National Security Act of 1947 (50 U.S.C. [3126](b)) shall also be made to the Committees on the Judiciary of the House of Representatives and the Senate.

* * *

( c) Report on Requests for National Security Letters-

(1) IN GENERAL- In April of each year, the Attorney General shall submit to Congress an aggregate report setting forth with respect to the preceding year the total number of requests made by the Department of Justice for information concerning different United States persons under—

(A) section 2709 of title 18, United States Code (to access certain communication service provider records), excluding the number of requests for subscriber information;

(B) section 1114 of the Right to Financial Privacy Act (12 U.S.C. 3414) (to obtain financial institution customer records);

(C) section 802 of the National Security Act of 1947 (50 U.S.C. [3126]) (to obtain financial information, records, and consumer reports);

(D) section 626 of the Fair Credit Reporting Act (15 U.S.C. 1681u) (to obtain certain financial information and consumer reports); and

(E) section 627 of the Fair Credit Reporting Act (15 U.S.C. 1681v) (to obtain credit agency consumer records for counterterrorism investigations).

(2) UNCLASSIFIED FORM- The report under this section shall be submitted in unclassified form.

(d) National Security Letter Defined- In this section, the term 'national security letter' means a request for information under one of the following provisions of law:

(1) Section 2709(a) of title 18, United States Code (to access certain communication service provider records).

(2) Section 1114(a)(5)(A) of the Right to Financial Privacy Act (12 U.S.C. 3414(a)(5)(A)) (to obtain financial institution customer records).

(3) Section 802 of the National Security Act of 1947 (50 U.S.C.[3162]) (to obtain financial information, records, and consumer reports).

(4) Section 626 of the Fair Credit Reporting Act (15 U.S.C. 1681u) (to obtain certain financial information and consumer reports).

(5) Section 627 of the Fair Credit Reporting Act (15 U.S.C. 1681v) (to obtain credit agency consumer records for counterterrorism investigations).

P.L. 109-177, Sec. 119 (text)

Audit of Use of National Security Letters.

(a) Audit—The Inspector General of the Department of Justice shall perform an audit of the effectiveness and use, including any improper or illegal use, of national security letters issued by the Department of Justice.

(b) Requirements- The audit required under subsection (a) shall include—

(1) an examination of the use of national security letters by the Department of Justice during calendar years 2003 through 2006;

(2) a description of any noteworthy facts or circumstances relating to such use, including any improper or illegal use of such authority; and

(3) an examination of the effectiveness of national security letters as an investigative tool, including—

(A) the importance of the information acquired by the Department of Justice to the intelligence activities of the Department of Justice or to any other department or agency of the Federal Government;

(B) the manner in which such information is collected, retained, analyzed, and disseminated by the Department of Justice, including any direct access to such information (such as access to 'raw data') provided to any other department, agency, or instrumentality of Federal, State, local, or tribal governments or any private sector entity;

(C) whether, and how often, the Department of Justice utilized such information to produce an analytical intelligence product for distribution within the Department of Justice, to the intelligence community (as such term is defined in section 3(4) of the National Security Act of 1947 (50 U.S.C. 401a(4))), or to other Federal, State, local, or tribal government departments, agencies, or instrumentalities;

(D) whether, and how often, the Department of Justice provided such information to law enforcement authorities for use in criminal proceedings;

(E) with respect to national security letters issued following the date of the enactment of this Act, an examination of the number of occasions in which the Department of Justice, or an officer or employee of the Department of Justice, issued a national security letter without the certification necessary to require the recipient of such letter to comply with the nondisclosure and confidentiality requirements potentially applicable under law; and

(F) the types of electronic communications and transactional information obtained through requests for information under section 2709 of title 18, United States Code, including the types of dialing, routing, addressing, or signaling information obtained, and the procedures the Department of Justice uses if content information is obtained through the use of such authority.

(c) Submission Dates-

(1) PRIOR YEARS- Not later than one year after the date of the enactment of this Act, or upon completion of the audit under this section for calendar years 2003 and 2004, whichever is earlier, the Inspector General of the Department of Justice shall submit to the Committee on the Judiciary and the Permanent Select Committee on Intelligence of the House of Representatives and the Committee on the Judiciary and the Select Committee on Intelligence of the Senate a report containing the results of the audit conducted under this subsection for calendar years 2003 and 2004.

(2) CALENDAR YEARS 2005 AND 2006- Not later than December 31, 2007, or upon completion of the audit under this subsection for calendar years 2005 and 2006, whichever is earlier, the Inspector General of the Department of Justice shall submit to the Committee on the Judiciary and the Permanent Select Committee on Intelligence of the House of Representatives and the Committee on the Judiciary and the Select Committee on Intelligence of the Senate a report containing the results of the audit conducted under this subsection for calendar years 2005 and 2006.

(d) Prior Notice to Attorney General and Director of National Intelligence; Comments-

(1) NOTICE- Not less than 30 days before the submission of a report under subsections (c)(1) or (c)(2), the Inspector General of the Department of Justice shall provide such report to the Attorney General and the Director of National Intelligence.

(2) COMMENTS- The Attorney General or the Director of National Intelligence may provide comments to be included in the reports submitted under subsections (c)(1) or (c)(2) as the Attorney General or the Director of National Intelligence may consider necessary.

(e) Unclassified Form- The reports submitted under subsections (c)(1) or (c)(2) and any comments included under subsection (d)(2) shall be in unclassified form, but may include a classified annex.

(f) Minimization Procedures Feasibility- Not later than February 1, 2007, or upon completion of review of the report submitted under subsection (c)(1), whichever is earlier, the Attorney General and the Director of National Intelligence shall jointly submit to the Committee on the Judiciary and the Permanent Select Committee on Intelligence of the House of Representatives and the Committee on the Judiciary and the Select Committee on Intelligence of the Senate a report on the feasibility of applying minimization procedures in the context of national security letters to ensure the protection of the constitutional rights of United States persons.

(g) National Security Letter Defined- In this section, the term 'national security letter' means a request for information under one of the following provisions of law:

(1) Section 2709(a) of title 18, United States Code (to access certain communication service provider records).

(2) Section 1114(a)(5)(A) of the Right to Financial Privacy Act (12 U.S.C. 3414(a)(5)(A)) (to obtain financial institution customer records).

(3) Section 802 of the National Security Act of 1947 (50 U.S.C. 436) (to obtain financial information, records, and consumer reports).

(4) Section 626 of the Fair Credit Reporting Act (15 U.S.C. 1681u) (to obtain certain financial information and consumer reports).

(5) Section 627 of the Fair Credit Reporting Act (15 U.S.C. 1681v) (to obtain credit agency consumer records for counterterrorism investigations).