The FBI has withdrawn a secret administrative order seeking the name, address and online activity of a patron of the Internet Archive after the San Francisco-based digital library filed suit to block the action.
It is one of only three known instances in which the FBI has backed off from such a data demand, known as a "national security letter," or NSL, which is not subject to judicial approval and whose recipient is barred from disclosing the order's existence.
NSLs are served on phone companies, Internet service providers and other electronic communications service providers, but because of the gag order provision, the public has little way to know about them. Their use soared after the September 2001 terrorist attacks, when Congress relaxed the standard for their issuance. FBI officials now issue about 50,000 such orders a year.
The order against the Internet Archive was served Nov. 26, and the nonprofit challenged it based on a provision of the reauthorized USA Patriot Act, which protects libraries from such requests. The privacy advocacy group Electronic Frontier Foundation (EFF) represented the archive in the suit, which was joined by the American Civil Liberties Union (ACLU).
The archive also alleged that the gag order that accompanied the data demand violated the Constitution.
As part of their settlement, the FBI agreed to drop the gag order and the archive agreed to withdraw the complaint. The case was unsealed Monday. On Wednesday, redacted versions of key documents were filed, allowing the parties to discuss the case.
"We see this as an unqualified success," said Brewster Kahle, the archive's co-founder and digital librarian. "The goal here was to help other recipients of NSLs to understand that you can push back."
Every time an NSL has been challenged in court, the FBI has backed off, said Melissa Goodman, an ACLU staff attorney. "That calls into question how much the FBI needed the information in the first place, and finally, whether the FBI needs this kind of sweeping and unchecked surveillance power."
The two other instances of NSL withdrawals involved a library and an Internet consulting business. In February 2004, the FBI served an NSL on the Internet firm. In November 2006, the FBI withdrew the letter, after a lawsuit by the ACLU, but maintained the gag order, which is why the firm has not been publicly identified. The lawsuit, which challenges the constitutionality of the law authorizing NSLs, is still pending.
In July 2005, the FBI served an NSL on Library Connection, a library consortium in Connecticut. That year, the ACLU sued on grounds similar to the other case. In April 2006, the FBI withdrew the gag order. Three months later, it withdrew the NSL as well.
FBI Assistant Director John Miller said the information requested in the Internet Archive NSL was "relevant to an ongoing, authorized national security investigation." NSLs, he said, "remain indispensable tools for national security investigations and permit the FBI to gather the basic building blocks for our counterterrorism and counterintelligence investigations."
The Internet Archive, founded in 1996, works with national libraries, museums and universities to offer free access to a variety of materials. One of its unique features is the Wayback Machine, which stores archived versions of Web sites. The FBI, CIA, federal prosecutors and other law enforcement officials have regularly turned to the archive for information, especially from the Wayback Machine.
Last fall, the FBI served the data demand on the archive's attorneys at EFF, a nonprofit in San Francisco. It directed the archive to turn over data, including length of service and all e-mail header information for a particular patron, as identified by an "address." Kahle's attorneys declined to say whether that referred to an e-mail address or an Internet protocol, or IP, address.
The archive, in keeping with longstanding traditions of libraries in the United States, seeks to guard patron privacy, Kahle said. It collects but does not verify the e-mail addresses of patrons wishing to sign up for archive library cards, use its message forums or post materials on the site. It does not keep or track IP addresses. Kahle said the archive has issued about 500,000 library cards.
According to a document filed in the case, the archive does keep records that may include the date a patron's account was opened, the screen names associated with the account, the unconfirmed e-mail addresses and messages of those who communicate with the archive via e-mail.
Because they initially were not allowed to discuss the NSL over the phone, Kahle and his attorneys had to drive to one another's offices whenever they wanted to talk about the case.
"Not being able to talk about it with our board, with my wife, made it very difficult," said Kahle, who is also on EFF's board. "I can imagine a hurried staffer sticking a gag into a hurried bill. But gags don't seem to be necessary, and now, what we've discovered in practice, gagging librarians is horrendous."
Under a law enacted in 1986 and modified several times, NSLs may be issued to obtain "subscriber information," "toll billing records information" and e-mail transactional records, but not content. The Justice Department inspector general has documented cases in which providers have supplied more information than was requested, including content.
A bipartisan bill in the House would restore the requirement that NSLs could be used only to collect information that pertains to "a foreign or agent of a foreign power" and would limit the gag order to 30 days, unless a court authorized an extension.
FBI backs off secret order for data after lawsuit