5 ms·

So how does one verify the letter? I propose a tl;dr version: get a lawyer. Do not deal with it yourself. It's cool to read about how a company (with a team o

So how does one verify the letter? I propose a tl;dr version: get a lawyer. Do not deal with it yourself. It's cool to read about how a company (with a team of legals) can respond to the letter. "A Developer's Guide" is not the same as "A Company's Guide". "A [d]eveloper" is an individual, not an organization entity.

zekevermillion 9y ago
OK, but as an individual you are extremely unlikely to receive such a request. You are probably only going to see an NSL if you are working for a company that stores or processes user data. Of course if you're an individual dev, and you host your project in the cloud, then the cloud provider may get served with an NSL that covers your users, without you even learning this happened (unless the company, like Twilio, has a really well-thought-out process for dealing with these and is willing to negotiate them a bit where the law permits).
- yeukhon 9y ago
  Sure, I agree with you. But the title appears to advise what developers should do. It doesn't even address "how to verify the letter", and certainly doesn't seem to suggest seeking legal help. In the worst language, this blog post is only addressing what Twilio, which is the standard procedure for a company to do anyway, and therefor the title is misleading and is inaccurate. Anytime we find ourselves in trouble with law enforcement, please seek legal help. Providing a template so one (individual or an organization) can talk to FBI and whatnot is wrong because that's encouraging people NOT to seek help. This is not some insurance appeal letter. Your lawyer should know what to do, not you. If the NLS is accompanied with a gag order, the gag order will never prevent the recipient to seek legal help.
  - zekevermillion 9y ago
    There are very few lawyers who have any experience dealing with an NSL. Let's see, Marcia Hoffman, and... well, you could always try contacting Marcia Hoffman. This post may be just as helpful, if not moreso, to a lawyer than to a developer! But as a developer, I would think you would find some comfort using twilio in knowledge that they put a lot of thought into privacy. Like, maybe that is the real intent here, some pretty high-quality marketing -- not so much an instructional. And as a secondary thing, any organization that has a spine when it comes to user privacy wants some company. If the industry as a whole gets behind a standard approach, then no one is going to get singled out for unwanted special attention.
    - JumpCrisscross 9y ago
      > There are very few lawyers who have any experience dealing with an NSL Any lawyer is better than no lawyer, particularly when it comes to convoluted legal domains such as those authorizing NSLs.
    - yeukhon 9y ago
      Yes, and I think what you are providing is very helpful, and that was my point to Twilio: the author should provide more information on how to get help as an individual (or for any startup founders). This is a serious matter, download a template is really not helpful.
JoshTriplett 9y ago
> I propose a tl;dr version: get a lawyer. There's still a huge cloud of uncertainty around NSLs, to the point that many people seem uncertain about whether they can even disclose having received one to their counsel.
- torstenvl 9y ago
  You can disclose that you murdered someone and hid the body to your lawyer. Attorney-client privilege is the strongest privilege known to the law.
  - JoshTriplett 9y ago
    Not arguing with that, but the FUD around NSLs is powerful.
  - ENGNR 9y ago
    And yet they still have to request that a judge be allowed to see the NSL
- geofft 9y ago
  The letters Twilio has posted say, "In accordance with 18 U.S.C. § 2709(c)(2), you ... are prohibited from disclosing this letter or disclosing that the FBI has sought or obtained access to information, other than to those to whom disclosure is necessary to comply with the letter or to an attorney to obtain legal advice or legal assistance with respect to this letter." I think the other letters I've seen posted online say something similar, and 18 USC 2709 itself says much the same thing. https://www.law.cornell.edu/uscode/text/18/2709 https://www.law.cornell.edu/uscode/text/18/2709
  - schoen 9y ago
    One reason for confusion about this is that this wasn't as clear statutorily before a 2005 amendment: https://en.wikipedia.org/wiki/History_of_the_Patriot_Act#Reauthorization_legislative_history https://en.wikipedia.org/wiki/History_of_the_Patriot_Act#Rea...
themodelplumber 9y ago
You still haven't stated why an attorney is necessary...
- debt 9y ago
  Because the government has at its disposal many legal tools of which an individual developer may not be properly equipped or knowledgeable enough to deal with. Subpoenas, search warrants, etc.
- mirimir 9y ago
  People need attorneys for DUIs, and often for less serious moving violations. So for NSLs, having an attorney is essential. There are two primary reasons. First, you want to comply only as legally required. And second, you want to avoid making mistakes that have criminal penalties. Edit: Even if your firm has general counsel, it's not uncommon to hire outside attorneys for specific matters.
  - wolco 9y ago
    Some firms will pull the company lawyer and costs will be on you personally if you decide you need your own lawyer.
    - mirimir 9y ago
      There's some confusion here about what "you" means. I can't imagine how an individual developer at some firm would receive an NSL individually. So it's the firm that would be deciding whether or not to hire outside counsel.
    - sseveran 9y ago
      Of course. If you think you need a lawyer you want to be the one paying them. A company lawyer ultimately works for the company.
- geofft 9y ago
  Because whether or not we like it, the law is non-obvious to people who haven't studied it deeply, this is a particularly non-obvious area of the law, and you will be better off with an expert. Same reason you want to find someone who knows C very well to review your security-sensitive C code. It would be nice if C didn't come with rules about undefined behavior that are surprising to people who haven't deeply studied C, but it does, and no amount of wishing it didn't will change the fact that you are inviting immense and needless risk by not finding an expert (or, if you'd prefer, spending years becoming one yourself, which you can certainly do if you have the luxury of years).
JumpCrisscross 9y ago
I was surprised to see this post never mention the terms “lawyer” or “general counsel.” If you are a developer at a company and receive an NSL, it’s a company legal matter. Do not address it yourself. It would be prudent to also ask your own lawyer for advice around what you should and should not do, on your own volition or at the company’s direction. If you are personally served an NSL, absolutely retain a lawyer.

zekevermillion 9y ago

OK, but as an individual you are extremely unlikely to receive such a request. You are probably only going to see an NSL if you are working for a company that stores or processes user data. Of course if you're an individual dev, and you host your project in the cloud, then the cloud provider may get served with an NSL that covers your users, without you even learning this happened (unless the company, like Twilio, has a really well-thought-out process for dealing with these and is willing to negotiate them a bit where the law permits).

yeukhon 9y ago
Sure, I agree with you. But the title appears to advise what developers should do. It doesn't even address "how to verify the letter", and certainly doesn't seem to suggest seeking legal help. In the worst language, this blog post is only addressing what Twilio, which is the standard procedure for a company to do anyway, and therefor the title is misleading and is inaccurate. Anytime we find ourselves in trouble with law enforcement, please seek legal help. Providing a template so one (individual or an organization) can talk to FBI and whatnot is wrong because that's encouraging people NOT to seek help. This is not some insurance appeal letter. Your lawyer should know what to do, not you. If the NLS is accompanied with a gag order, the gag order will never prevent the recipient to seek legal help.
- zekevermillion 9y ago
  There are very few lawyers who have any experience dealing with an NSL. Let's see, Marcia Hoffman, and... well, you could always try contacting Marcia Hoffman. This post may be just as helpful, if not moreso, to a lawyer than to a developer! But as a developer, I would think you would find some comfort using twilio in knowledge that they put a lot of thought into privacy. Like, maybe that is the real intent here, some pretty high-quality marketing -- not so much an instructional. And as a secondary thing, any organization that has a spine when it comes to user privacy wants some company. If the industry as a whole gets behind a standard approach, then no one is going to get singled out for unwanted special attention.
  - JumpCrisscross 9y ago
    > There are very few lawyers who have any experience dealing with an NSL Any lawyer is better than no lawyer, particularly when it comes to convoluted legal domains such as those authorizing NSLs.
  - yeukhon 9y ago
    Yes, and I think what you are providing is very helpful, and that was my point to Twilio: the author should provide more information on how to get help as an individual (or for any startup founders). This is a serious matter, download a template is really not helpful.

JoshTriplett 9y ago

> I propose a tl;dr version: get a lawyer. There's still a huge cloud of uncertainty around NSLs, to the point that many people seem uncertain about whether they can even disclose having received one to their counsel.

torstenvl 9y ago
You can disclose that you murdered someone and hid the body to your lawyer. Attorney-client privilege is the strongest privilege known to the law.
- JoshTriplett 9y ago
  Not arguing with that, but the FUD around NSLs is powerful.
- ENGNR 9y ago
  And yet they still have to request that a judge be allowed to see the NSL
geofft 9y ago
The letters Twilio has posted say, "In accordance with 18 U.S.C. § 2709(c)(2), you ... are prohibited from disclosing this letter or disclosing that the FBI has sought or obtained access to information, other than to those to whom disclosure is necessary to comply with the letter or to an attorney to obtain legal advice or legal assistance with respect to this letter." I think the other letters I've seen posted online say something similar, and 18 USC 2709 itself says much the same thing. https://www.law.cornell.edu/uscode/text/18/2709 https://www.law.cornell.edu/uscode/text/18/2709
- schoen 9y ago
  One reason for confusion about this is that this wasn't as clear statutorily before a 2005 amendment: https://en.wikipedia.org/wiki/History_of_the_Patriot_Act#Reauthorization_legislative_history https://en.wikipedia.org/wiki/History_of_the_Patriot_Act#Rea...

themodelplumber 9y ago

You still haven't stated why an attorney is necessary...

debt 9y ago
Because the government has at its disposal many legal tools of which an individual developer may not be properly equipped or knowledgeable enough to deal with. Subpoenas, search warrants, etc.
mirimir 9y ago
People need attorneys for DUIs, and often for less serious moving violations. So for NSLs, having an attorney is essential. There are two primary reasons. First, you want to comply only as legally required. And second, you want to avoid making mistakes that have criminal penalties. Edit: Even if your firm has general counsel, it's not uncommon to hire outside attorneys for specific matters.
- wolco 9y ago
  Some firms will pull the company lawyer and costs will be on you personally if you decide you need your own lawyer.
  - mirimir 9y ago
    There's some confusion here about what "you" means. I can't imagine how an individual developer at some firm would receive an NSL individually. So it's the firm that would be deciding whether or not to hire outside counsel.
  - sseveran 9y ago
    Of course. If you think you need a lawyer you want to be the one paying them. A company lawyer ultimately works for the company.
geofft 9y ago
Because whether or not we like it, the law is non-obvious to people who haven't studied it deeply, this is a particularly non-obvious area of the law, and you will be better off with an expert. Same reason you want to find someone who knows C very well to review your security-sensitive C code. It would be nice if C didn't come with rules about undefined behavior that are surprising to people who haven't deeply studied C, but it does, and no amount of wishing it didn't will change the fact that you are inviting immense and needless risk by not finding an expert (or, if you'd prefer, spending years becoming one yourself, which you can certainly do if you have the luxury of years).

JumpCrisscross 9y ago

I was surprised to see this post never mention the terms “lawyer” or “general counsel.” If you are a developer at a company and receive an NSL, it’s a company legal matter. Do not address it yourself. It would be prudent to also ask your own lawyer for advice around what you should and should not do, on your own volition or at the company’s direction. If you are personally served an NSL, absolutely retain a lawyer.