14 ms·

Secret FBI Subpoenas Scoop Up Personal Data from Scores of Companies

329 points by tysone 7y ago

olliej 7y ago
Seriously, we need to kill off this warrant workaround that the US gov has decided is valid. Almost every product you buy now ends up sending your data to some company, and the government has decided that means you have no expectation of privacy, which is clearly nonsense.
nullc 7y ago
The use of administrative subponeas with effectively limitless gags is very concerning, but I also feel that the attention is somewhat misplaced. The US government receives far more private data about people from companies selling it or simply giving it away, than they get via administrative subpoena. The practice of paying for requested data also makes companies complicit in these orders, when they are issued-- they're a revenue center. Without stronger laws barring the collection of data and providing stiff civil or even criminal penalties for disclosure (including to the government) the bulk of the situation will not be much improved.
sroussey 7y ago
I really got worried when I stopped getting these and other subpoenas from 3 letter agencies. I knew we had to beef up our server defenses. :/
stjohnswarts 7y ago
I am the odd duck libertarian who believes we need a minimum income welfare safety net and health care as a right. However, I scoff at giving the government more power in the areas of surveillance and police power. I just do not understand people backing up the government in taking away civil rights and personal freedom in the name of "making us safer". Honestly we are far safer than even as recent as the 90s, let alone the 1890s. People will always find things to clutch their pearls over, and it's all relative.
fulldecent2 7y ago
I am surprised that more NSLs have not been leaked or "hacked". Just store the NSLs next to your user data so that when it gets stolen and published then your NSL is published as well.
situational87 7y ago
We can't keep pretending this is still a Democracy when we have a completely unaccountable NSA/CIA/FBI that seems to repeatedly hide their mistakes and the dubious legality of their sources & methods behind the classification and national security walls.
- president 7y ago
  What would be the alternative? For a functional national security program, some aspects need to be secret from the general public in order to protect against compromise.
  - cwkoss 7y ago
    Judges should have to sign off on warrants to access data, and there must be a process to (at least retroactively) sue if the basis of the warrant was fraudulent or fabricated. Further, the 'gag order' component should be temporary and of minimum necessary duration. The arrest of a target should automatically invalidate the gag order because keeping this information from the defendant is a violation of due process.
    - cwkoss 7y ago
      If anyone really wants to poke the tiger, they could get a bunch of cheap data by sending out fake National Security Letters. Good way to go to prison for a long time, but one person's success could force the system to overhaul.
- tempodox 7y ago
  Data seizures of this kind used to be based on probable cause. Now the probable cause is “living on this planet in this time”. Like, “you're a suspect, we just don't know of what yet”.
  - aphextim 7y ago
    >Data seizures of this kind used to be based on probable cause. I think they get away with this because they are just collecting the information in mass and are not targeting an individual. There was a point where they were only scooping up information on foreign entities, and at some point that shifted and they started collecting all foreign and domestic information. I believe it was right around the time 9/11 happened. This is what caused William Binney to leave the NSA https://en.wikipedia.org/wiki/William_Binney_(intelligence_official) https://en.wikipedia.org/wiki/William_Binney_(intelligence_o... In order to parse that information and look up information about a particular subject or individual, I believe they still require a subpoena, but who is to say someone with access doesn't use this giant trove of information nefariously. It also opens up the possibility of someone getting blackmail/dirt on a competitor and bribing a NSA employee to get the information. Also what is to prevent someone from retroactively going back through the information on what used to be allowed but now has changed to being illegal because of an administration change/laws being passed. The alphabet agencies definitively need more oversight, however I feel anyone tasked with that job ends up becoming entrenched in the corruption and have a hard time holding them accountable.
Merrill 7y ago
Subpoenas have been used frequently for decades to request "records kept in the ordinary course of business". The only thing different in this case seems to be that there is a perpetual gag order. But if the local prosecutor subpoenas your phone records because you are being investigated for bribing an athletic coach at a university, I don't think the phone company will tell you about it.
- sneak 7y ago
  The major thing that is different is that no judge or court is involved - these are issued by the requesting organization directly with no oversight.
hammock 7y ago
NSLs are not subpoenas. They are "administrative subpoenas," the difference being that they are not issued by a court and have no review or oversight by any judge or court officer. They are about as much a subpoena, as the FISA "court" is a court of law.
- Merrill 7y ago
  >"In most instances, a subpoena can be issued and signed by an attorney on behalf of a court in which the attorney is authorized to practice law. If the subpoena is for a high-level government official (such as the Governor, or agency head), then it must be signed by an administrative law judge. In some cases, a non-lawyer may issue a subpoena if acting on his or her own behalf (known as pro se representation)." https://litigation.findlaw.com/going-to-court/what-is-a-subpoena.html https://litigation.findlaw.com/going-to-court/what-is-a-subp... A judge's approval is not needed. The attorney (e.g. a prosecuting attorney) is the "court officer".
  - hammock 7y ago
    You missed the point. Your citation refers to a traditional subpoena, which I was saying is distinct from these "subpoenas." NSLs are not issued by prosecuting attorneys.
    - Merrill 7y ago
      >However, the most commonly used type of NSL can be issued directly by the FBI Director, an Assistant Director, and also by all FBI Special Agents in Charge, who are commanding officers stationed across the country at FBI field offices. https://www.eff.org/issues/national-security-letters/faq#3 https://www.eff.org/issues/national-security-letters/faq#3 Most of these, and certainly the Director, are also attorneys. At least James Comey was. Plus they have FBI staff attorneys to consult with. Practically speaking, how does this differ from the local prosecutor issuing a subpoena? The local country prosecutor is essentially part of law enforcement and reports up to the AG in the executive branch of government. The local county prosecutor has dozens of detectives working for her.
jenvalentino 7y ago
Hi. I'm the reporter on this story. Thanks for discussing it! I thought it might be helpful for me to make a couple points. First, national security letters have been around, AND controversial, for years now. A number of tech companies have fought the gag orders. The news here is really that we are seeing for the first time which other specific companies get a lot of these — especially banks, credit agencies and so forth, which have all been silent on the subject. Second, @hammock is correct to say that these are not approved by a judge. Nor are they grand jury subpoenas. They are administrative subpoenas, but unlike other administrative subpoenas, almost all of these come with stringent, long-term gag orders. So, they're a pretty special type of subpoena, not one with which everyone is familiar. Thanks again for reading.
- Porthos9K 7y ago
  This is an excellent and deeply disturbing article, but all I can do in response right now is suspect that if J. Edgar Hoover were still alive to see what shenanigans the modern FBI gets up to when nobody is looking, he would wholeheartedly approve. It's obvious that the agency has learned all the wrong lessons from the exposure of COINTELPRO. The FBI is still The House J. Edgar Built, and Congress ought to tear it down.
  - chrischen 7y ago
    You can't assume that Hoover would have been against increasing the power available to himself and his agency.
    - Porthos9K 7y ago
      He didn't seem to mind when he was actually running the FBI. So, assuming life-after-death isn't just a fantasy, why expect that he's changed his mind? People usually don't unless forced to do so.
    - wallace_f 7y ago
      No this is right. If left-, right-politics have taught me anything, it is that your personal business, emails, and bedroom behavior are the concern of the federal government and its electorate--at least the 50% that agree with it.
xfitm3 7y ago
I spent a long time in the hosting industry, most of which was in early 00s. When the feds couldn't get a court to order to hand over data we simply sold the data to them. They paid, quite handsomely at times.
- Accujack 7y ago
  This is pretty telling of the present state of U.S. law... there's no law against this (even today). The existing laws that protect privacy and what can be done with information companies collect have never been updated post computer revolution... the same generation that was in power before then is still in power, and they've never had any interest in changing that. The US government started failing a long time ago, and everyone in that generation is either part of the problem or unwilling to admit it IS a problem.
malicioususer11 7y ago
The FBI needs a new mandate to ethically abstain from strictly politically motivated probes IMHO... Either side can just simply call for a distraction oriented manhunt atm and its scary...
no_opinions 7y ago
Based on what I read online in discussions and in the news, there's little nuance into the circumstances around the data retrieval: - Is it related to someone stealing classified information, spying / or spy cell, or could be planning a terrorist attack? In that case, they may be more sophisticated, or the investigation shifts to preventing something from occurring in the future, or its a matter of trying to figure out what a cell of foreigners from Russia/etc. are trying to get. - Is it something related to a drug investigation? If it's involving drugs, countries everywhere have roving wiretap abilities because druglords use burner phones, and like above, they go to great lengths to hide / mask what they're doing as if it's legitimate business. - Is it related to any other criminal investigation? Police has more ability to intercept communications than civilians. There is a whole world inside here of nuances. An example in USA is subpoena'ing email records where unopened email is treated as abandoned, they don't require a search warrant. Not that there's many cases prosecuted relying on abandoned email retrieved that'd be thrown out if the law changed :P - Protect/regulation around data of medical (HIPAA in US, I think GDPR in EU), children (COPPA in US) - Normal consumer privacy protections (GDPR in EU) Here's an example of Germany's constitution (Article 10 [Privacy of correspondence, posts and telecommunications] , https://www.bundesregierung.de/breg-en/chancellor/basic-law-470510 https://www.bundesregierung.de/breg-en/chancellor/basic-law-...): > (1) The privacy of correspondence, posts and telecommunications shall be inviolable. But, then it says: > (2) Restrictions may be ordered only pursuant to a law. If the restriction serves to protect the free democratic basic order or the existence or security of the Federation or of a Land, the law may provide that the person affected shall not be informed of the restriction and that recourse to the courts shall be replaced by a review of the case by agencies and auxiliary agencies appointed by the legislature. The above basically gets you what most countries have anyway, so maybe it wouldn't address the concerns people have. If there was a constitutional check for privacy over the wire/data in the cloud it'd be upheld at the judicial level to check the executive / legislative branch. However, there'd still be mechanisms where the government can access data, one way or another. It'd probably end up having the phraseology around them narrowly tailored, there'd be less swept in when decisions are in a gray area.
- wsy 7y ago
  The citation from Germany's constitution is a bit misleading. In Germany, law enforcement warrants must be signed by a judge (in urgent cases, a prosecutor can sign them, and they have to be confirmed soon afterwards by a judge). There is an exception for communication interception by the intelligence services: those warrants must be confirmed by the G-10 committee which is organized like a court, but directly appointed by parliament. The main differences to the US system are strict separation between law enforcement and intelligence services, and direct oversight of the latter by the parliament.
mLuby 7y ago
A gag order can be reasonable: "give us what you have on user John Smith birthday 1/1/1950 but don't tell him anything" makes sense if you're, say, investigating a criminal ring John is part of. What is unreasonable is that companies can't reveal they've been gagged, or what type of data they were compelled to reveal, even after the fact. Companies should be allowed to say "we have disclosed access logs, location history, searches, encrypted backups for 1-50 accounts in response to lawful request from law enforcement." And they should be able to disclose the letter after an investigation has closed (whether it resulted in legal action against the individual or not).
- cameldrv 7y ago
  Yes, a gag order can be reasonable. Wiretaps with warrants usually have them. IMO, there should be no gag order, and the subject of the subpoena should be required to be notified and allowed to challenge the subpoena if it is issued without a judge. Gag orders should be allowed, but only if signed off on by a judge, and only for a reasonable amount of time to complete an investigation. If the government gets your information, and decides not to bring charges, you should have the right to know about that at some point.
  - GhettoMaestro 7y ago
    > If the government gets your information, and decides not to bring charges, you should have the right to know about that at some point. Disagree. There are numerous cases where it takes multiple investigations to "get" a career criminal (think organized crime). If each batch of subpoenas or sealed warrants were exposed even when there is no charge this time, that gives said suspect a very nice opportunity to clean up loose ends. TLDR: If people know they are being actively looked at they will attempt to destroy/suppress/hide evidence.
    - hobs 7y ago
      And then the obvious next conclusion is you can argue with a judge on whether or not that's reasonable. We already have laws on the books to deal with organized crime - why would we give up our rights so that something we have no evidence for might happen?
deleted 7y ago
[deleted]
andrerm 7y ago
And don't forget FBI is the one pushing against encryption
- inscionent 7y ago
  The Justice Department as a whole has this agenda under Barr, not just FBI.
- deleted 7y ago
  [deleted]
deleted 7y ago
[deleted]
deleted 7y ago
[deleted]
deleted 7y ago
[deleted]

329 points by tysone 7y ago

Seriously, we need to kill off this warrant workaround that the US gov has decided is valid. Almost every product you buy now ends up sending your data to some company, and the government has decided that means you have no expectation of privacy, which is clearly nonsense.

nullc 7y ago

The use of administrative subponeas with effectively limitless gags is very concerning, but I also feel that the attention is somewhat misplaced. The US government receives far more private data about people from companies selling it or simply giving it away, than they get via administrative subpoena. The practice of paying for requested data also makes companies complicit in these orders, when they are issued-- they're a revenue center. Without stronger laws barring the collection of data and providing stiff civil or even criminal penalties for disclosure (including to the government) the bulk of the situation will not be much improved.

sroussey 7y ago

I really got worried when I stopped getting these and other subpoenas from 3 letter agencies. I knew we had to beef up our server defenses. :/

stjohnswarts 7y ago

I am the odd duck libertarian who believes we need a minimum income welfare safety net and health care as a right. However, I scoff at giving the government more power in the areas of surveillance and police power. I just do not understand people backing up the government in taking away civil rights and personal freedom in the name of "making us safer". Honestly we are far safer than even as recent as the 90s, let alone the 1890s. People will always find things to clutch their pearls over, and it's all relative.

fulldecent2 7y ago

I am surprised that more NSLs have not been leaked or "hacked". Just store the NSLs next to your user data so that when it gets stolen and published then your NSL is published as well.

situational87 7y ago

We can't keep pretending this is still a Democracy when we have a completely unaccountable NSA/CIA/FBI that seems to repeatedly hide their mistakes and the dubious legality of their sources & methods behind the classification and national security walls.

president 7y ago
What would be the alternative? For a functional national security program, some aspects need to be secret from the general public in order to protect against compromise.
- cwkoss 7y ago
  Judges should have to sign off on warrants to access data, and there must be a process to (at least retroactively) sue if the basis of the warrant was fraudulent or fabricated. Further, the 'gag order' component should be temporary and of minimum necessary duration. The arrest of a target should automatically invalidate the gag order because keeping this information from the defendant is a violation of due process.
  - cwkoss 7y ago
    If anyone really wants to poke the tiger, they could get a bunch of cheap data by sending out fake National Security Letters. Good way to go to prison for a long time, but one person's success could force the system to overhaul.
tempodox 7y ago
Data seizures of this kind used to be based on probable cause. Now the probable cause is “living on this planet in this time”. Like, “you're a suspect, we just don't know of what yet”.
- aphextim 7y ago
  >Data seizures of this kind used to be based on probable cause. I think they get away with this because they are just collecting the information in mass and are not targeting an individual. There was a point where they were only scooping up information on foreign entities, and at some point that shifted and they started collecting all foreign and domestic information. I believe it was right around the time 9/11 happened. This is what caused William Binney to leave the NSA https://en.wikipedia.org/wiki/William_Binney_(intelligence_official) https://en.wikipedia.org/wiki/William_Binney_(intelligence_o... In order to parse that information and look up information about a particular subject or individual, I believe they still require a subpoena, but who is to say someone with access doesn't use this giant trove of information nefariously. It also opens up the possibility of someone getting blackmail/dirt on a competitor and bribing a NSA employee to get the information. Also what is to prevent someone from retroactively going back through the information on what used to be allowed but now has changed to being illegal because of an administration change/laws being passed. The alphabet agencies definitively need more oversight, however I feel anyone tasked with that job ends up becoming entrenched in the corruption and have a hard time holding them accountable.

Merrill 7y ago

Subpoenas have been used frequently for decades to request "records kept in the ordinary course of business". The only thing different in this case seems to be that there is a perpetual gag order. But if the local prosecutor subpoenas your phone records because you are being investigated for bribing an athletic coach at a university, I don't think the phone company will tell you about it.

sneak 7y ago
The major thing that is different is that no judge or court is involved - these are issued by the requesting organization directly with no oversight.

hammock 7y ago

NSLs are not subpoenas. They are "administrative subpoenas," the difference being that they are not issued by a court and have no review or oversight by any judge or court officer. They are about as much a subpoena, as the FISA "court" is a court of law.

Merrill 7y ago
>"In most instances, a subpoena can be issued and signed by an attorney on behalf of a court in which the attorney is authorized to practice law. If the subpoena is for a high-level government official (such as the Governor, or agency head), then it must be signed by an administrative law judge. In some cases, a non-lawyer may issue a subpoena if acting on his or her own behalf (known as pro se representation)." https://litigation.findlaw.com/going-to-court/what-is-a-subpoena.html https://litigation.findlaw.com/going-to-court/what-is-a-subp... A judge's approval is not needed. The attorney (e.g. a prosecuting attorney) is the "court officer".
- hammock 7y ago
  You missed the point. Your citation refers to a traditional subpoena, which I was saying is distinct from these "subpoenas." NSLs are not issued by prosecuting attorneys.
  - Merrill 7y ago
    >However, the most commonly used type of NSL can be issued directly by the FBI Director, an Assistant Director, and also by all FBI Special Agents in Charge, who are commanding officers stationed across the country at FBI field offices. https://www.eff.org/issues/national-security-letters/faq#3 https://www.eff.org/issues/national-security-letters/faq#3 Most of these, and certainly the Director, are also attorneys. At least James Comey was. Plus they have FBI staff attorneys to consult with. Practically speaking, how does this differ from the local prosecutor issuing a subpoena? The local country prosecutor is essentially part of law enforcement and reports up to the AG in the executive branch of government. The local county prosecutor has dozens of detectives working for her.

jenvalentino 7y ago

Hi. I'm the reporter on this story. Thanks for discussing it! I thought it might be helpful for me to make a couple points. First, national security letters have been around, AND controversial, for years now. A number of tech companies have fought the gag orders. The news here is really that we are seeing for the first time which other specific companies get a lot of these — especially banks, credit agencies and so forth, which have all been silent on the subject. Second, @hammock is correct to say that these are not approved by a judge. Nor are they grand jury subpoenas. They are administrative subpoenas, but unlike other administrative subpoenas, almost all of these come with stringent, long-term gag orders. So, they're a pretty special type of subpoena, not one with which everyone is familiar. Thanks again for reading.

Porthos9K 7y ago
This is an excellent and deeply disturbing article, but all I can do in response right now is suspect that if J. Edgar Hoover were still alive to see what shenanigans the modern FBI gets up to when nobody is looking, he would wholeheartedly approve. It's obvious that the agency has learned all the wrong lessons from the exposure of COINTELPRO. The FBI is still The House J. Edgar Built, and Congress ought to tear it down.
- chrischen 7y ago
  You can't assume that Hoover would have been against increasing the power available to himself and his agency.
  - Porthos9K 7y ago
    He didn't seem to mind when he was actually running the FBI. So, assuming life-after-death isn't just a fantasy, why expect that he's changed his mind? People usually don't unless forced to do so.
  - wallace_f 7y ago
    No this is right. If left-, right-politics have taught me anything, it is that your personal business, emails, and bedroom behavior are the concern of the federal government and its electorate--at least the 50% that agree with it.

xfitm3 7y ago

I spent a long time in the hosting industry, most of which was in early 00s. When the feds couldn't get a court to order to hand over data we simply sold the data to them. They paid, quite handsomely at times.

Accujack 7y ago
This is pretty telling of the present state of U.S. law... there's no law against this (even today). The existing laws that protect privacy and what can be done with information companies collect have never been updated post computer revolution... the same generation that was in power before then is still in power, and they've never had any interest in changing that. The US government started failing a long time ago, and everyone in that generation is either part of the problem or unwilling to admit it IS a problem.

malicioususer11 7y ago

The FBI needs a new mandate to ethically abstain from strictly politically motivated probes IMHO... Either side can just simply call for a distraction oriented manhunt atm and its scary...

no_opinions 7y ago

Based on what I read online in discussions and in the news, there's little nuance into the circumstances around the data retrieval: - Is it related to someone stealing classified information, spying / or spy cell, or could be planning a terrorist attack? In that case, they may be more sophisticated, or the investigation shifts to preventing something from occurring in the future, or its a matter of trying to figure out what a cell of foreigners from Russia/etc. are trying to get. - Is it something related to a drug investigation? If it's involving drugs, countries everywhere have roving wiretap abilities because druglords use burner phones, and like above, they go to great lengths to hide / mask what they're doing as if it's legitimate business. - Is it related to any other criminal investigation? Police has more ability to intercept communications than civilians. There is a whole world inside here of nuances. An example in USA is subpoena'ing email records where unopened email is treated as abandoned, they don't require a search warrant. Not that there's many cases prosecuted relying on abandoned email retrieved that'd be thrown out if the law changed :P - Protect/regulation around data of medical (HIPAA in US, I think GDPR in EU), children (COPPA in US) - Normal consumer privacy protections (GDPR in EU) Here's an example of Germany's constitution (Article 10 [Privacy of correspondence, posts and telecommunications] , https://www.bundesregierung.de/breg-en/chancellor/basic-law-470510 https://www.bundesregierung.de/breg-en/chancellor/basic-law-...): > (1) The privacy of correspondence, posts and telecommunications shall be inviolable. But, then it says: > (2) Restrictions may be ordered only pursuant to a law. If the restriction serves to protect the free democratic basic order or the existence or security of the Federation or of a Land, the law may provide that the person affected shall not be informed of the restriction and that recourse to the courts shall be replaced by a review of the case by agencies and auxiliary agencies appointed by the legislature. The above basically gets you what most countries have anyway, so maybe it wouldn't address the concerns people have. If there was a constitutional check for privacy over the wire/data in the cloud it'd be upheld at the judicial level to check the executive / legislative branch. However, there'd still be mechanisms where the government can access data, one way or another. It'd probably end up having the phraseology around them narrowly tailored, there'd be less swept in when decisions are in a gray area.

wsy 7y ago
The citation from Germany's constitution is a bit misleading. In Germany, law enforcement warrants must be signed by a judge (in urgent cases, a prosecutor can sign them, and they have to be confirmed soon afterwards by a judge). There is an exception for communication interception by the intelligence services: those warrants must be confirmed by the G-10 committee which is organized like a court, but directly appointed by parliament. The main differences to the US system are strict separation between law enforcement and intelligence services, and direct oversight of the latter by the parliament.

mLuby 7y ago

A gag order can be reasonable: "give us what you have on user John Smith birthday 1/1/1950 but don't tell him anything" makes sense if you're, say, investigating a criminal ring John is part of. What is unreasonable is that companies can't reveal they've been gagged, or what type of data they were compelled to reveal, even after the fact. Companies should be allowed to say "we have disclosed access logs, location history, searches, encrypted backups for 1-50 accounts in response to lawful request from law enforcement." And they should be able to disclose the letter after an investigation has closed (whether it resulted in legal action against the individual or not).

cameldrv 7y ago
Yes, a gag order can be reasonable. Wiretaps with warrants usually have them. IMO, there should be no gag order, and the subject of the subpoena should be required to be notified and allowed to challenge the subpoena if it is issued without a judge. Gag orders should be allowed, but only if signed off on by a judge, and only for a reasonable amount of time to complete an investigation. If the government gets your information, and decides not to bring charges, you should have the right to know about that at some point.
- GhettoMaestro 7y ago
  > If the government gets your information, and decides not to bring charges, you should have the right to know about that at some point. Disagree. There are numerous cases where it takes multiple investigations to "get" a career criminal (think organized crime). If each batch of subpoenas or sealed warrants were exposed even when there is no charge this time, that gives said suspect a very nice opportunity to clean up loose ends. TLDR: If people know they are being actively looked at they will attempt to destroy/suppress/hide evidence.
  - hobs 7y ago
    And then the obvious next conclusion is you can argue with a judge on whether or not that's reasonable. We already have laws on the books to deal with organized crime - why would we give up our rights so that something we have no evidence for might happen?

deleted 7y ago

[deleted]

andrerm 7y ago

And don't forget FBI is the one pushing against encryption

inscionent 7y ago
The Justice Department as a whole has this agenda under Barr, not just FBI.
deleted 7y ago
[deleted]

deleted 7y ago

[deleted]

deleted 7y ago

[deleted]

deleted 7y ago

[deleted]