8 ms·
A Developer’s Guide to Responding to National Security Letters
- yeukhon 9y agoSo how does one verify the letter? I propose a tl;dr version: get a lawyer. Do not deal with it yourself. It's cool to read about how a company (with a team of legals) can respond to the letter. "A Developer's Guide" is not the same as "A Company's Guide". "A [d]eveloper" is an individual, not an organization entity.
- zekevermillion 9y agoOK, but as an individual you are extremely unlikely to receive such a request. You are probably only going to see an NSL if you are working for a company that stores or processes user data. Of course if you're an individual dev, and you host your project in the cloud, then the cloud provider may get served with an NSL that covers your users, without you even learning this happened (unless the company, like Twilio, has a really well-thought-out process for dealing with these and is willing to negotiate them a bit where the law permits).
- yeukhon 9y agoSure, I agree with you. But the title appears to advise what developers should do. It doesn't even address "how to verify the letter", and certainly doesn't seem to suggest seeking legal help. In the worst language, this blog post is only addressing what Twilio, which is the standard procedure for a company to do anyway, and therefor the title is misleading and is inaccurate. Anytime we find ourselves in trouble with law enforcement, please seek legal help. Providing a template so one (individual or an organization) can talk to FBI and whatnot is wrong because that's encouraging people NOT to seek help. This is not some insurance appeal letter. Your lawyer should know what to do, not you. If the NLS is accompanied with a gag order, the gag order will never prevent the recipient to seek legal help.
- zekevermillion 9y agoThere are very few lawyers who have any experience dealing with an NSL. Let's see, Marcia Hoffman, and... well, you could always try contacting Marcia Hoffman. This post may be just as helpful, if not moreso, to a lawyer than to a developer! But as a developer, I would think you would find some comfort using twilio in knowledge that they put a lot of thought into privacy. Like, maybe that is the real intent here, some pretty high-quality marketing -- not so much an instructional. And as a secondary thing, any organization that has a spine when it comes to user privacy wants some company. If the industry as a whole gets behind a standard approach, then no one is going to get singled out for unwanted special attention.
- JumpCrisscross 9y ago> There are very few lawyers who have any experience dealing with an NSL Any lawyer is better than no lawyer, particularly when it comes to convoluted legal domains such as those authorizing NSLs.
- yeukhon 9y agoYes, and I think what you are providing is very helpful, and that was my point to Twilio: the author should provide more information on how to get help as an individual (or for any startup founders). This is a serious matter, download a template is really not helpful.
- JoshTriplett 9y ago> I propose a tl;dr version: get a lawyer. There's still a huge cloud of uncertainty around NSLs, to the point that many people seem uncertain about whether they can even disclose having received one to their counsel.
- torstenvl 9y agoYou can disclose that you murdered someone and hid the body to your lawyer. Attorney-client privilege is the strongest privilege known to the law.
- JoshTriplett 9y agoNot arguing with that, but the FUD around NSLs is powerful.
- ENGNR 9y agoAnd yet they still have to request that a judge be allowed to see the NSL
- geofft 9y agoThe letters Twilio has posted say, "In accordance with 18 U.S.C. § 2709(c)(2), you ... are prohibited from disclosing this letter or disclosing that the FBI has sought or obtained access to information, other than to those to whom disclosure is necessary to comply with the letter or to an attorney to obtain legal advice or legal assistance with respect to this letter." I think the other letters I've seen posted online say something similar, and 18 USC 2709 itself says much the same thing. https://www.law.cornell.edu/uscode/text/18/2709 https://www.law.cornell.edu/uscode/text/18/2709
- schoen 9y agoOne reason for confusion about this is that this wasn't as clear statutorily before a 2005 amendment: https://en.wikipedia.org/wiki/History_of_the_Patriot_Act#Reauthorization_legislative_history https://en.wikipedia.org/wiki/History_of_the_Patriot_Act#Rea...
- themodelplumber 9y agoYou still haven't stated why an attorney is necessary...
- debt 9y agoBecause the government has at its disposal many legal tools of which an individual developer may not be properly equipped or knowledgeable enough to deal with. Subpoenas, search warrants, etc.
- mirimir 9y agoPeople need attorneys for DUIs, and often for less serious moving violations. So for NSLs, having an attorney is essential. There are two primary reasons. First, you want to comply only as legally required. And second, you want to avoid making mistakes that have criminal penalties. Edit: Even if your firm has general counsel, it's not uncommon to hire outside attorneys for specific matters.
- wolco 9y agoSome firms will pull the company lawyer and costs will be on you personally if you decide you need your own lawyer.
- mirimir 9y agoThere's some confusion here about what "you" means. I can't imagine how an individual developer at some firm would receive an NSL individually. So it's the firm that would be deciding whether or not to hire outside counsel.
- sseveran 9y agoOf course. If you think you need a lawyer you want to be the one paying them. A company lawyer ultimately works for the company.
- geofft 9y agoBecause whether or not we like it, the law is non-obvious to people who haven't studied it deeply, this is a particularly non-obvious area of the law, and you will be better off with an expert. Same reason you want to find someone who knows C very well to review your security-sensitive C code. It would be nice if C didn't come with rules about undefined behavior that are surprising to people who haven't deeply studied C, but it does, and no amount of wishing it didn't will change the fact that you are inviting immense and needless risk by not finding an expert (or, if you'd prefer, spending years becoming one yourself, which you can certainly do if you have the luxury of years).
- JumpCrisscross 9y agoI was surprised to see this post never mention the terms “lawyer” or “general counsel.” If you are a developer at a company and receive an NSL, it’s a company legal matter. Do not address it yourself. It would be prudent to also ask your own lawyer for advice around what you should and should not do, on your own volition or at the company’s direction. If you are personally served an NSL, absolutely retain a lawyer.
- jakcst 9y agofsafsdafsdafsdafsdafsa
- jakcst 9y agotest
- mirimir 9y agoMaybe a better question is how to prepare in advance. You can design your systems to avoid retaining user data. Or you can do business from a jurisdiction that doesn't recognize NSLs. Or perhaps from an unknown jurisdiction.
- jonnybgood 9y ago> Or you can do business from a jurisdiction that doesn't recognize NSLs. Or perhaps from an unknown jurisdiction. That means not doing business in the US at all.
- JetSpiegel 9y agoWhich makes it fair game for direct targeted attacks by the NSA.
- jonnybgood 9y agoYou can still be targeted if you’re a foreign business operating in the US.
- mirimir 9y agoYes, you can and will be targeted. So if you go that route, you'd better know what you're doing.
- bpanon 9y agoThe entire universe is fair game for the NSA.
- mirimir 9y agoRight. They pretty much do whatever they want, and lie as necessary to frustrate oversight, and protect operational methods. They are, after all, a branch of the military.
- cesarb 9y ago
- Nrbelex 9y agoFrom a slightly different perspective, perhaps more useful to a legal team: Legal Responses and Countermeasures to National Security Letters, https://openscholarship.wustl.edu/cgi/viewcontent.cgi?article=1867&context=law_journal_law_policy https://openscholarship.wustl.edu/cgi/viewcontent.cgi?articl... [PDF]
- ISL 9y agoAmendment I: Congress shall make no law respecting an establishment of religion or prohibiting the free exercise thereof, or abridging the freedom of speech or of the press, or the right of the people peaceably to assemble and to petition the government for a redress of grievances. Given that the above is the law of our land, how can a recipient of an NSL be barred from publishing it in its entirety or giving it to a news outlet to do so? "No law" is clear in both meaning and intent.
- dandare 9y agoJust a guess: The constitution is interpreted by the Supreme Court, which decides about reasonable exceptions, for instance in the case of national security.
- dboreham 9y ago'And thirdly, the code is more what you'd call "guidelines" than actual rules.'
- deleted 9y ago[deleted]
- tallanvor 9y agoEven those judges that claim to follow a strict interpretation of the constitution as written (as opposed to the spirit) have recognized there are legitimate exceptions to the first amendment with regards to free speech, which include fighting words, obscenity, defamation (slander/libel), some court proceedings (gag orders), and national security concerns. Most of these are fairly narrow. National security letters are generally the most questionable limitation, although their use has been clarified somewhat.
- reacweb 9y agoIMHO, a NDA should always be limited in time. I am pretty sure twillio would not request a judicial review for a NDA lasting a couple of weeks. For a NDA lasting more than a year, a judicial review seems justified. Avoidind judicial review may be a good motivation for FBI to use shorter NDA. This would benefit to transparency.
- Cyranix 9y agoThe "A" in NDA stands for "agreement", but NSLs are not jointly agreed upon: they are the one-sided assertion of the government's authority. Not disagreeing with the idea that there aren't a variety of reforms that seem mutually beneficial, such as shorter timeframes — just noting that there are not equivalent to NDAs.
- jameshart 9y agoAstounded that this doesn’t say ‘immediately call the legal team, and do not say anything’. Does Twilio’s employee handbook also include ‘a developer’s guide to Defusing bombs’ and ‘a developer’s guide to performing open heart surgery’?
- drspacemonkey 9y agoMaybe it's just me, but this reads like an attempt to say they recently received another national security letter.
- dboreham 9y agoI think this thought is driven by the headline, which I suspect has been changed (perhaps on advice of a lawyer!?). The article body just talks about how they respond to an NSL, clearly all steps taken under direct and careful legal advice. So the title might have been "What our Lawyers do When we Receive an NSL".
- yeukhon 9y agoWell since our honest feedback, they added a footnote “Please note that these best practices do not constitute legal advice. You should consult an attorney if you have any questions in how to respond to requests for information from government agencies. For example, even with the nondisclosure requirement, National Security Letters expressly permit the recipient to consult “an attorney to obtain legal advice or legal assistance with respect to this letter.”
- cryoshon 9y ago>In the National Security Letter dated May 19, 2017, the US Department of Justice withdrew the request entirely rather than proceed with judicial review. if the DOJ would rather not get any information at all rather than have their request for information scrutinized by a court, there is something seriously wrong with the national security letter process. people who have had a pulse in recent years will chime in that there are many other problems with the NSL process. but this one is a bit different, because shows that the FBI is explicitly avoiding the rule of law as a policy. aren't they the ones responsible for upholding the rule of law as part of the department of justice? why yes, yes they are. they have dirt to hide, and they are not good at deflecting guilt. they know they can consistently over-reach with these NSLs to violate the rights of companies and individuals. so they do it. this behavior implies ongoing abuse that they would rather have covered up than accomplish their agency's goals, even if those goals are wrong. i guess my solution would be to clean house. fire people (and revoke security clearance) starting at the top and work your way down while promoting people who weren't abusers. at the same time, start firing from the bottom, targeting those who complied with bad orders from above. replace them with new recruits who can be trained to have their heart in the right place. the agency is back to citizen-friendly operating order within 5 years or so. a blink of the eye in the timeline of the twilight years of a former empire.
- ballenf 9y agoOr there were developments in the case that obviated the need for the information. It could have simply been: what's the fastest way to get the info and there were two options. One quickly became the slow option and was ruled out. That's my charitable interpretation.
- crb002 9y agoOr tell them to piss off, find a magistrate, and get a warrant. In the history of NSLs has DOJ ever not done this when pressed?
- Cyranix 9y agoIs there any forum in which the justifications used to diminish the impact of NSLs can be shared? It strikes me that one of the daunting aspects of objecting to NSLs is that precedents are not well-known. Is it legal to share any details about the circumstances under which nondisclosure, scope, or other impacts of NSLs have been reduced or removed from the DoJ's demands?
- BrandoElFollito 9y agoI wonder why a company which is at risk of getting such a letter and willing to inform their customer does not work in multiple jurisdictions. Any unusual access to data in one country automatically informs customers (or triggers an alert), with this information being sourced from the other country. This protects both the employees in the US (they did not say anything) and bypasses the letter requirements