5 ms·

> The EFF believes you can't be compelled to lie This always sounded fishy to me. When a NSL is served, they order you to keep silent about it, so you can't te

> The EFF believes you can't be compelled to lie This always sounded fishy to me. When a NSL is served, they order you to keep silent about it, so you can't tell e.g. your own CISO. But if the CISO comes and asks, you're not ordered to lie and say you haven't received one? So if the CISO just asks you every morning, the NSL's order of keeping silent is defeated? I can't believe the courts and the executive that support NSLs in the first place would allow such a loophole.

geocar 10y ago
If you find yourself in such a situation, you should consult with an attorney: Telling your CISO may put you and them at risk that you cannot understand.
- SpaceManiac 10y ago
  While maybe literally true, "risk that you cannot understand" is a little overthreatening. Are you implying extrajudicial financial ruin, torture, murder? I doubt it, so what?
  - geocar 10y ago
    I'm trying not to imply anything, because every situation is different. Nevertheless, violating a federal order could have serious consequences, and if you need advice on this subject, you should talk to an attorney about it.
    - dingaling 10y ago
      Do you think the average retained attorney will be well-versed in the subtleties of NSL disclosure? The point being made upthread is that there is no black and white guidance, there is no secret NSL Guide Book for attornies.
      - geocar 10y ago
        Yes, actually I do. Gag orders aren't unique to the NSL and if your attorney believes the case is too complicated they will be able to help you find a specialist. The FBI does in fact has some guidance that your attorney will be able to locate[1] [1]: https://vault.fbi.gov/National%20Security%20Letters%20%28NSL%29/National%20Security%20Letters%20%28NSL%29%20Part%201%20of%201/view https://vault.fbi.gov/National%20Security%20Letters%20%28NSL...
- danarmak 10y ago
  Firstly, if it is illegal to tell the CISO about the NSL, it may also be illegal to tell some details to an attorney. At least, by going to an attorney, you're already taking some legal risk, in addition to incurring the extralegal wrath of the FBI. Secondly, the FBI can serve an NSL to the CEO, a separate one to the CISO, and so on down the chain to the tech people whose job would be to fulfill the order. They can choose to serve one or some or all of these orders, and they can order some served people to cooperate and others to keep silent or lie to one another. It's not feasible to expect all of these people, some of whom are not officers of the company, to consult lawyers.
  - geocar 10y ago
    The FBI has some good material on this subject[1] and specifically permits you to disclose the NSL to your attorney so that you can comply with it. Something important to understand is that non-disclosure is not an automatic feature of the NSL, but that disclosure binds the parties to the terms in the NSL. [1]: https://vault.fbi.gov/National%20Security%20Letters%20%28NSL%29/National%20Security%20Letters%20%28NSL%29%20Part%201%20of%201/view https://vault.fbi.gov/National%20Security%20Letters%20%28NSL... > Secondly, the FBI can serve an NSL to the CEO, a separate one to the CISO, and so on down the chain to the tech people whose job would be to fulfill the order Yes, they can, however that's not what happens. The general council may advise the CEO to disclose certain requirements or aspects of the NSL to the CISO or to other parties for the purposes of complying with the NSL. They will almost certainly not recommend disclosing or distributing the NSL "down the chain to the tech people".
    - danarmak 10y ago
      > They will almost certainly not recommend disclosing or distributing the NSL "down the chain to the tech people". I meant they might target the tech people directly from the start - or someone who isn't a C-level executive, anyway - if they think the CxOs would go to a lawyer and the lower level people would just comply.
      - geocar 10y ago

geocar 10y ago

If you find yourself in such a situation, you should consult with an attorney: Telling your CISO may put you and them at risk that you cannot understand.

SpaceManiac 10y ago
While maybe literally true, "risk that you cannot understand" is a little overthreatening. Are you implying extrajudicial financial ruin, torture, murder? I doubt it, so what?
- geocar 10y ago
  I'm trying not to imply anything, because every situation is different. Nevertheless, violating a federal order could have serious consequences, and if you need advice on this subject, you should talk to an attorney about it.
  - dingaling 10y ago
    Do you think the average retained attorney will be well-versed in the subtleties of NSL disclosure? The point being made upthread is that there is no black and white guidance, there is no secret NSL Guide Book for attornies.
    - geocar 10y ago
      Yes, actually I do. Gag orders aren't unique to the NSL and if your attorney believes the case is too complicated they will be able to help you find a specialist. The FBI does in fact has some guidance that your attorney will be able to locate[1] [1]: https://vault.fbi.gov/National%20Security%20Letters%20%28NSL%29/National%20Security%20Letters%20%28NSL%29%20Part%201%20of%201/view https://vault.fbi.gov/National%20Security%20Letters%20%28NSL...
danarmak 10y ago
Firstly, if it is illegal to tell the CISO about the NSL, it may also be illegal to tell some details to an attorney. At least, by going to an attorney, you're already taking some legal risk, in addition to incurring the extralegal wrath of the FBI. Secondly, the FBI can serve an NSL to the CEO, a separate one to the CISO, and so on down the chain to the tech people whose job would be to fulfill the order. They can choose to serve one or some or all of these orders, and they can order some served people to cooperate and others to keep silent or lie to one another. It's not feasible to expect all of these people, some of whom are not officers of the company, to consult lawyers.
- geocar 10y ago
  The FBI has some good material on this subject[1] and specifically permits you to disclose the NSL to your attorney so that you can comply with it. Something important to understand is that non-disclosure is not an automatic feature of the NSL, but that disclosure binds the parties to the terms in the NSL. [1]: https://vault.fbi.gov/National%20Security%20Letters%20%28NSL%29/National%20Security%20Letters%20%28NSL%29%20Part%201%20of%201/view https://vault.fbi.gov/National%20Security%20Letters%20%28NSL... > Secondly, the FBI can serve an NSL to the CEO, a separate one to the CISO, and so on down the chain to the tech people whose job would be to fulfill the order Yes, they can, however that's not what happens. The general council may advise the CEO to disclose certain requirements or aspects of the NSL to the CISO or to other parties for the purposes of complying with the NSL. They will almost certainly not recommend disclosing or distributing the NSL "down the chain to the tech people".
  - danarmak 10y ago
    > They will almost certainly not recommend disclosing or distributing the NSL "down the chain to the tech people". I meant they might target the tech people directly from the start - or someone who isn't a C-level executive, anyway - if they think the CxOs would go to a lawyer and the lower level people would just comply.
    - geocar 10y ago