> I'm puzzled why it's not 1-249 with 0 being a different group. So this law basically means that as long as you send less than 250 requests to a single company

> I'm puzzled why it's not 1-249 with 0 being a different group. So this law basically means that as long as you send less than 250 requests to a single company you're fine. I think you just answered your own question. The difference between 0 and 1 is pretty important. Think of it this way: until relatively recently, Github would return either a 500 or a login page (I forget which) if a logged-out user tried to access a private repo, whereas they would return a 404 if a logged-out user tried to access a nonexistent repo. If someone thought that you were working on a secret project and they had an idea what the project name might be, they would be able to confirm this with a simple HTTP request. They don't even need to see the contents of the repository in order to obtain what could be potentially damaging information (the mere existence of the project). This way, one can never be sure whether a company has received any letters, which is itself a rather valuable piece of information, until they have already received a large number (and presumably for a large number of targets).