176: NSL

0:00JACK: There’s a funny story that happened back in 1980 — no, 1888. [Music] There was this undertaker guy named Strowger, and when someone died, he would get a telephone call to come take care of the body, and business was doing well for him. But then suddenly he started receiving fewer calls. Business stopped. But he knew people were dying, so it’s like, what’s going on? See, back then, when you called someone on the phone, you would tell the operator who you wanted to call, and they had a patch panel where they would connect a physical cable from your phone to

0:30their phone. It was all manual. What this undertaker figured out is that the lady who was working as the phone operator, her husband was trying to start an undertaker business. So, anytime somebody would call asking for the undertaker, she would just connect them to her husband’s phone. So, this Strowger guy was so upset that she was intercepting his incoming calls and rerouting them, and he thought, I bet I could automate her job. So, he set out to work to build an automatic way to connect calls from one person to another without the need of an operator,

1:04and this was the first telephone switch ever invented, in 1889, invented because one guy didn't trust humans to connect the calls and decided to use technology to solve his problem. [Intro music] These are true stories from the dark side of the internet. I’m Jack Rhysider. This is Darknet Diaries.

1:47JACKFor this episode, I sat down and had a talk with Nick Merrill.

NICKLet’s begin.

JACKAlright. Yeah, and you could have your drink on the table; it’s fine. I don't...

NICKI just thought it would make a noise when I put it down or something, cause you more editing work.

JACKOh, that’s my whole life. [Crosstalk]

NICKI used to work — when I was a kid, I used to work in video and film post-production. It was one of my first jobs.

JACKSo, let’s start in the eighties.

NICKSo, conscious of that.

Yeah. JACKYeah. What were you doing in the eighties?

NICK[Music] I grew up in New York City. At some point I was in Grand Central Station,

2:21the famous Grand Central Station, and they had amazing news stands back then that had like, thousands of titles. I had some time to kill before this train came, and I was looking all around, and I found this little, tiny magazine called 2600 Magazine. It’s a hacker magazine. I was fascinated by this, and I bought a copy, and I read it cover to cover. I just devoured this magazine. It was super interesting. At the end of the magazine they mentioned that

2:52they did in-person get-togethers, and the one in Manhattan was held in the city court building. JACK: Wow, what a special place to be back then. Some legendary hackers were knocking about in that city court building back then, and I covered exactly what went on in that building in Episodes 168 and 169, titled LOD and MOD. If you want to hear the story of these legendary hackers, go back and check out those episodes. But suffice to say, Nick had some pretty incredible hackers around him when he was a kid,

3:22and has been in the hacking scene for decades now. I’ve seen him at DEF CON multiple times.

NICKI was pretty young, though, when I went. I was only fourteen. So, I met all these people, but I got a sense that there was just a lot going on that I didn't understand, so I mostly kept to myself and just listened, picked up a lot of stuff.

JACKThis is what kick-started his interest in computers. He got an Apple computer, started a BBS, and tried to keep up with everyone else who was doing cool stuff back then. After high school, he went on to attend college.

3:53NICKI was doing computer science and philosophy, both courses at the same time. I remember one of my big challenges in school was just deciding exactly what to focus on and then just focusing like a laser on that. I wasn't — I didn't feel like that at the time. So, I was like, I want to take some art, I want to do some law, I want to study history, and all kinds of other stuff.

JACKBut his mind was hungry to learn about all kinds of stuff, so he took a huge variety of classes. At one point he took a class which really stuck with him.

4:27NICKI took a constitutional law class. This class was a full overview of all the landmark cases in constitutional law, going back to the beginning.

JACK[Music] Landmark cases are interesting because a Supreme Court decision is basically just as powerful as a full-fledged law. Take Miranda rights. I’m sure you've heard ‘you have the right to remain silent. Anything you say can and will be used against you in court.’ Well, that came from a Supreme Court case called Miranda vs. Arizona. A guy named Ernesto

4:58Miranda was arrested, questioned for hours, and he confessed to his crime. But later on he learned that he didn't have to confess. The Fifth Amendment says you have the right to not self-incriminate. So, in court he said, I didn't know I could stay silent. I didn't know I could get a lawyer before I could talk to the cops. The Supreme Court said, you know what? You're right, Miranda. It’s hard to know what rights you have when cops are questioning you constantly, and they should have told you that you do have the right to remain silent. It’s your Fifth Amendment right. So, from now on, all cops must tell you your rights before they can use anything you say against you. So,

5:34every cop across the country now informs you of your rights before they arrest you. It’s not a law that Congress passed. It’s a rule made in a court, and that’s the power of landmark cases, and Nick found all this very fascinating. Eventually, Nick finished school, and at the same time, the internet started sprouting websites, which made it way easier for people to share ideas and communicate with each other instead of the old-fashioned BBSs. He saw a shift from things being for educational purposes to commercial usage of the internet.

6:06NICK: I remember thinking at the time, this is how you could make real change. This is how you could connect people all over the country and all over the world who have one thought or an idea or want to do something, and you could — while sitting at home, you could connect to millions of people everywhere and get ideas out there. I remember also thinking at the time, there’s newspapers, there’s television, there’s radio, and the licensing for television and radio

6:36is strictly controlled by FCC, and as far as I know, they're not really issue — even back then, they didn't really issue any new licenses. All the licenses were out there, and you could buy and sell the existing licenses for like, tens of millions of dollars. Then they would tell you what words you could say or what words you couldn't say. There was a lot of talk at that time about the words that you can't say on the radio and what’s too obscene for television and all that. So, I remember thinking that it

7:08was a tightly controlled media environment, and the bar to entry was incredibly high. It was like into the tens of millions. Then here’s the internet, which at that time had no regulation at all, and the bar to entry was really low. It was so low that when my grandfather died and I inherited literally a few thousand dollars, that was enough for me to get in. I ended up starting one of the first internet service providers in New York City. JACK: Nick was pretty early to the game when it came to getting on the internet,

7:40and saw its potential and wanted to get more people involved in this kind of technology. So, at the age of twenty, he learned everything he needed to start his own internet service provider. NICK: Yeah, this was in my very first apartment on East Tenth Street in the East Village in Manhattan, and my apartment had an old, no-longer-working fireplace that was wasted space, 'cause you couldn't have a fire in it and the chimney was plugged up. But I filled that space

8:13with a bunch of modems. I ended up getting — I think it was something like eight modems, and I had them all in there, and one server running Linux, which was super new at that point.

JACKThe name of the ISP was called Calyx, and now that he had it stood up, he had to go around and talk to people and convince them to be customers.

NICKPeople who I knew in New York City that were trying to do some type of either activism or social change or just trying to have some — trying to create a social movement, and things like that.

8:51So, I went around and I tried to convince them that this internet thing was gonna be huge and just a paradigm-changing thing that they needed to find out about. I remember getting a lot of pushback from people who were like, no, that’s not for us. That’s for them. We don't really want that. I was literally just trying to get people to get e-mail and domain names and just put out a

9:22newsletter or put up a little web page, something. It was hard to convince people at the time.

JACKIt’s crazy to think back then people were not interested in spreading their message online. But yeah, that was a time when the internet was very geeky and difficult to use, and it was new to everyone, so it made sense why people just weren't quite ready yet. He kept trying to sell internet access to others, and finally got some customers near the end of 1994.

NICKSo, one of the first organizations that I got online was called the New York Civil

9:55Liberties Union, which is the — yeah, it’s the New York branch of the ACLU. You know, they were pretty prominent in New York. You always heard about them on the news. [Music] They were protecting people’s rights, all that kind of stuff.

JACKFrom there, the ball kept rolling. Word of mouth was spreading, and Nick’s ISP was gaining more and more customers. Within two years, he had outgrowed his apartment and had to get a bigger place to hold all the modems and servers he needed.

NICKOver time, it kind of morphed or transitioned from like an end-user access

10:29ISP to more of a hosting kind of an ISP and security consulting ISP. By the early 2000s, I wasn't giving individuals internet access anymore and I didn't have modems anymore. I had fibre optic lines and T3 connections, and I was hosting these big, corporate clients.

JACKCan you name a few of these corporate clients?

NICKYeah, I had Mitsubishi Motors of America and IKEA and Snapple Iced Tea.

11:08JACKOkay, 'cause you're dealing with larger data links, and so, bigger companies can afford it while the home user doesn't — I mean, it was, what, $1,000 a month for a T3 back then, right?

NICKOh, it was like, $1,000 a month for a T1.

JACKYeah.

NICKAnd that was 1.5 megabits. A T3 — for those who don't remember, a T3 — 'cause this is ancient history. A T3 was 45 megabits per second, and that was astronomically huge at the time.

JACKYeah, he was selling huge data links at this point to big businesses, and not just connections to the internet, but he was also hosting their websites,

11:41which means he had a bunch of servers and a ton of bandwidth to keep their websites online.

NICKBut deep down in my heart, I was still trying to work with people that were trying to create change in the world. So, I had all kinds of pro-bono clients that I charged either nothing or some token amount like $20 or something hosting their websites. I still — and NYCLU is still kind of a client of mine at that time.

JACKThis ISP of his kept growing, and things were looking better than ever. He had over a hundred clients at this point.

12:15NICKI started working with these advertising agencies that had those big clients, and they brought me one and then two and then three and four and five, and pretty soon I had another advertising agency. Then I was hosting the Amtrak site and all these other sites. They were really big. So, yeah, things were going really well until one day I get a weird phone call.

JACKThis was the phone call that changed everything. It changed his whole trajectory in

12:51life, and it would tie him up for the next decade or more and turn him into a whole new person. NICK: One day the phone rings, and a person on the other end of the line says, I’m calling from the FBI and we have a letter for you. I said something like — I thought about it for like a second, and I wasn't even sure that it was for real, and I didn't really quite believe it. So, I said, okay, cool, thanks. Then we hung up the call, and that was it. Where my office was,

13:30was in Lower Manhattan where all the federal buildings are and where all the courts are in Lower Manhattan. So, I hung up the call from the supposed FBI person who I didn't really believe, and I just went back to work. Within less than an hour, there was a knock on the door. It was like — and it was the most official police knock. It was like, like that kind of a thing. [Music] I go to the door, and here’s this person that looks like the

14:05most classic FBI agent from Central Casting; gray hair, side part, some kind of gel hair product, tan trench coat, shiny, black patent leather shoes, suit, everything. It was just so obvious who it was when I opened the door, 'cause I didn't usually see people like that. This guy came inside and reached into his inner pocket of his coat and pulled out an envelope and

14:38gave it to me and said, here, I have this for you. So, I — in front of him I — I was — instantly was like, intrigue. I opened the envelope and I opened this letter and I quickly skimmed it. It basically said that the FBI wanted all this information from me about one of the clients of the company, and that I was never to tell any person that they had approached me. Then the entire second or third

15:16page was just a long bullet-point list of all the types of data that they were demanding that I hand over to them. At the end of the letter there was a signature, and it said that it was an attorney from the FBI. That was what the signature was from. So, thinking back to all the constitutional law stuff I learned about and the Fourth Amendment and what it requires to do a search and seizure of

15:49documents, I thought to myself, well, where’s the — there’s no stamp on this from a court. There’s no judge’s signature. This isn't being issued by a court. This is just coming directly from the FBI. JACK: He got a letter from the FBI which was asking him to give them data about one of his customers, and all they gave him was an e-mail address that the customer had. This was someone Nick knew personally, and he found it really surprising that this person was under

16:21investigation. He knew them, and he thought there was no way they committed some sort of crime that the FBI would be investigating. But the letter said you cannot tell anyone about this request or letter, anyone. Is this right, though? Can the FBI just ask for data without a warrant or a sign off from a judge? The Fourth Amendment says we have the right to privacy, and the government needs to have a warrant in order to conduct a search. So, this all felt very strange to Nick.

16:52NICK: I think I paused when I got to the part on the first page when it said I could never tell anyone. I said to him, well, what about my lawyer and what about my business partners? He — in my memory he must have been over sixty. He was not a young guy. He seemed pretty senior to me. He wasn't like a messenger boy. He said, I don't know. I’m just here to deliver this letter. I can't really answer your questions. So, he just kind of gave me the stiff arm and

17:25refused to engage or tell me anything. So, I just sort of took that for what it was. I think I asked to see his ID, and he pulled out a wallet which was really big. It was like — it almost was like a check book. He opened it up, and in it he had this very elaborate FBI ID. So, I understood that he was the real deal. And that was it. He left. JACK: What is this nonsense? You can't tell anyone you got this letter,

17:58not even your lawyer or business partner? Can you imagine getting such a letter? Like, shh, secret FBI stuff. Hand us over your data and don't tell anybody we were here. No explanation of what crime this customer did or what’s being investigated or any reason why they want the data. NICK: So, I’m left with this letter, and the letter has a whole kind of preamble which explains the basis and the authority under which they're asking me for this information. I remember that

18:30it cited two different things. It cited — and I can remember it by heart even today. It cited Executive Order 12333, and it cited Title 18 US Code Section 2709. I was like, well, what’s that, you know? I took one semester of constitutional law. I wasn't really familiar with the entire federal code. I never really read all the executive orders. So, I decided to try to

19:03figure out what this was about, because it was pretty confusing to me. So, I started to do a little bit of research on the two citings in the letter, the executive order and the federal code, and one thing that I figured out was that Section 2709 is the National Security Letter Provision. But it had been amended multiple times over the years, and the last time it

19:35was amended was under the Patriot Act. So, amendments, if you ever read them, in Congress when they pass laws, they’ll say, in Section 2709, after the third paragraph, insert these two or three more paragraphs that now add additional meaning or things like that. So, I started to understand that in order to really grasp the meaning of Section 2709, you'd have to read all the different amendments that had ever happened and then piece it all

20:06together. You'd probably really need to go to a law library, and I didn't know how to do that research. The executive order — there was some information about it, but not enough for me to truly understand what it implied or what it meant. [Music] I felt really stuck at that point. JACK: Yeah, I would be, too. The Patriot Act was passed after two planes flew into buildings in New York City on 9/11. It was passed to try to stop terrorism, and it granted the authority for the

20:41FBI to conduct searches without a warrant. But was the FBI investigating a terrorist plot here? Were they using this power as it was intended? Nobody had ever seen these letters before, because any time they were sent to someone, that person wasn't allowed to tell anyone else. So, these letters were entirely out of the public eye. The only people who knew they existed was the FBI and the people that the FBI gave it to. The letter is called a national security letter, or NSL.

21:14NICKI think if I recall back, it may have been dated several days before when I actually got it. So, that sort of to me implied that it wasn't super time sensitive. It wasn't like, a nuclear bomb’s gonna go off in ten minutes; you better do this or we're all gonna die. It was more like they weren't in such a hurry. I think that it was dated a week before they actually showed up. So, I was like, okay.

JACKSo, he sat down and looked at the letter closer. Under his interpretation,

21:45this letter violated three of this constitutional rights. The First Amendment is your right to free speech. This letter suppressed his speech. He wasn't allowed to talk about this letter. The Fourth Amendment is your right to privacy unless the government has a warrant, and there was no warrant, just a letter that came off some random printer in the FBI’s office. He thought if he can't tell anyone, then that includes telling a lawyer, and if the government is restricting your right to get a lawyer, then that would violate the Fifth Amendment. Remember the Miranda rights that the cops have to tell you that you have a right to a

22:17lawyer? That comes out of the Fifth Amendment. Was this letter saying he has no right to a lawyer? It’s really tricky because he wasn't being charged for a crime. He was more of a witness, and not even to a crime, but just to someone who the FBI was interested in. NICK: So, eventually I thought about it and I thought about it, and I think the big — the first big light-bulb-over-my-head moment was they — the letter commanded me to never tell any person. But I was like, whatever, I can still talk to a lawyer. They can't tell me that I can't.

22:53That part I was very clear on from all the law I had studied. There’s no such thing as denying you the right to counsel. So, I think what helped me also was that the lawyer that I used at the time, before he was a lawyer, he was my friend and I knew him really well for a long time, for a bunch of years. So, I reached out to him and I asked if we could just meet in person. When I met with him in person, I showed him this letter and I said, you know, hey,

23:29you know I’m not a lawyer, but my understanding of how search and seizure works is you have to go to court, and they haven't gone to court. They're telling me I can never tell anyone, but here I am telling you. What’s this all about? My lawyer said, I agree with you. This doesn't seem right. This doesn't seem legal. But he kind of demurred and said something like, I’m a business lawyer. I do leases and I do business contracts and this and that,

24:02and I’m not a constitutional rights attorney, and this is a bit over my pay grade, so I think we should seek a little bit more expert opinions on what to do about this. I said to him, well, one cool thing is that the New York Civil Liberties Union are my client, and I host their website. So, maybe we can call them. He was like, yeah, perfect. Let’s call them. So, he and I sat there, and we picked up the phone and we called the New York Civil Liberties Union.

24:34Because they knew who I was, right on that first phone call, instead of them just taking down a memo and putting it on a stack of all the people that had called in that day, on that first phone call I got put on the phone with a legal director of the NYCLU. Once we kind of described that I had received this letter and the vague outline of what it said, [music] I was told to get in a taxi right now, go to their office immediately, and bring the letter. So, I did.

25:13JACKHe was very nervous on the ride there. The tone of all this was very serious, and he was wondering if he’s doing the right thing or getting himself in serious trouble.

NICKWhen I got there I met with the legal director who I had not met previously. He looked at the letter, he read the letter, and then he asked me, would it be alright if he called in another one of his colleagues from the national ACLU, who he said are just on the next floor. I said — I thought about it for a minute. I said okay, but in my mind I’m thinking, okay,

25:50this letter said you can never tell any person. So, the first thing I did was I told my lawyer, and now he recommended that I tell another lawyer. So, now I’ve broken it twice. Now he’s asking if he can bring a third person in. So, now I’m breaking it a third time. In my mind I’m just see-sawing back and forth between like, well, they can't tell me I can't have a lawyer, but at the same time they're saying that all the constitutional rights and habeas corpus

26:22and all that stuff doesn't matter anymore because we're at war and it’s an existential danger. So, I was just a little bit worried about what the ramifications of this would be. I said okay, the other colleague could come chat with us. So, this younger fellow came down. He was a super smart attorney from ACLU, and he looked at this letter and was just a little bit shocked. I’ve since had discussions with them about what they were thinking at that time,

26:56and understood that they knew that national security letters were being used, but nobody had ever brought them one and they had never seen one. No copy of one had ever become public before. So, it was the first time they had ever seen it and understood the language used in it and understood how they were being used. So, to them it represented this amazing opportunity because you can't challenge something unless you can show that it’s happened,

27:31and you have to prove standing in court. So, they thought, wow, this is an opportunity to challenge the constitutionality of this type of — what I would call an illegal search. JACK: Whoa, this just escalated really fast. The ACLU was like, ready for battle the moment they saw this, ready to sue the government and ride or die with Nick. They wanted to challenge the legality of this FBI letter, and never had the chance to do it before because nobody’s ever seen

28:03this thing before. They were already pulling up their sleeves, coming up with a plan of attack, and they were so excited about this opportunity that they said they'd represent him for free. Because in their mind, fighting this could result in a landmark case, and those are rare, and some lawyers would love a shot at creating a landmark case to change laws that they think are unjust. So, the ACLU told Nick, let’s fight this, [music] and they started preparing to sue the government, and they were going to claim that this letter violated three constitutional rights.

28:34The Fourth Amendment violation is particularly interesting here because of why the Fourth Amendment was made in the first place. During colonial times when New England was under British rule, the king of England issued what’s called Writs of Assistance to British soldiers, which granted the British soldiers the right to be able to search any home at any time without specifying what they were looking for and without probable cause. So, British soldiers had carte blanche access to search anyone’s personal belongings at any time. There was absolutely no right to

29:07privacy in New England at the time. But after the colonists beat the British in the war and declared independence, that’s when they decided that it’s very important to preserve our privacy. NICK: In reaction to what the American colonists felt were abuses of that kind of executive power from the king of England, when they started writing the constitutional amendments,

29:38they designed the Fourth Amendment to have checks and balances built in so that law enforcement or intelligence forces within the government would have to go before a court and prove that either a crime had occurred or was likely to occur with evidence. They would have to prove probable cause. Based on that, they would have to also say what the thing or things were that they intended to

30:09seize and exactly where they would find them. So, the idea is that a court is supposed to exert some type of oversight authority over these attempts to curtail the rights of individuals. So, the problem with the Patriot Act and the national security letter provision amendments that happened in the Patriot Act is that they sidestep that whole system of checks and balances and they allow not just the FBI but all kinds of government agencies to skip the whole showing probable cause,

30:44skip the whole system of checks and balances, and just unilaterally go and seize information. JACK: Sheesh, how far we’ve come, huh? It’s like we’ve forgotten how bad things can get when governments have too much power. There’s a term I learned here called prior restraint, which is when someone suppresses your speech before you say something. There have been landmark cases in the past where it’s illegal for the government to issue prior restraint to people, such as when the Pentagon Papers came out, the New York Times, the Washington Post, got evidence that

31:18the US government lied about the circumstances that led us into the Vietnam war. When Nixon heard that these news outlets got these leaked papers, he demanded they not publish it. So, do you comply with an executive order like that or do you challenge it in court? They challenged it, and it went all the way to the Supreme Court, and they ruled on the side of the news outlets, saying you cannot stop speech before it happens. That is the essence of censorship and a direct violation of the First Amendment. So, this provision in the NSL that Nick got that

31:53says you can't tell anybody, this made the whole letter feel really unconstitutional.

NICKWe filed a legal challenge, a constitutional challenge, to the validity of the national security letter provision of the Patriot Act, and because I couldn't talk about it, the case had to be filed under the name John Doe. So, it couldn't say my name because that would be admitting that I got it.

JACKWho’d you sue?

NICK[Music] The case was against the Department of Justice and the FBI.

32:28JACKOkay, so, is there a name on the case?

NICKYeah, at the time the attorney general of the United States was John Ashcroft. So, the case was called Doe vs.

Ashcroft. JACKOh dang, they're suing the attorney general of the United States, who is the head of the Department of Justice. This is about to get good. I’m gonna take a quick break here and get some popcorn, because when we get back, the battle begins. So,

33:01Nick and the ACLU were going to challenge the legality of this letter in court, and at this point Nick was about thirty years old, and he was all in.

NICKSo, it seemed to me that it would be a supremely unpatriotic act to just let this go.

JACKWow, he thought it was an extremely unpatriotic act to comply with a national security letter. But I guess you have to feel that strongly about it to try to fight the whole Department of Justice over it.

NICK[Music] But the irony was that I couldn't really tell anyone. I couldn't say like, hey,

33:35mom and dad, if I just disappear tomorrow, it’s probably because these people got me. Or, I couldn't tell my friends, I couldn't tell my parents, I couldn't tell anyone. So, no one knew that this was going on. It was just something that I completely kept to myself. JACK: Man, this is why I love making this show, to hear about all these secret things that I’m not supposed to know about. We were never supposed to know about these letters. We were never supposed to know that Nick got one of these letters, but not today. Today we're bringing what’s in the dark to the light. [Music] So, on April 9,

34:072004, the ACLU entered the courtroom to represent Nick Merrill in this case.

NICKI was not in court. I was never allowed to go to court.

JACKYou weren't allowed to go to court.

NICKNo, because then — they were closed court sessions because it was classified stuff, and I wasn't allowed to go because then I would have identified myself. So, my attorneys went to court without me, and then they told me about what happened, and I got to read the transcripts and all that kind of stuff. But I wasn't allowed to attend.

JACKSo, he had to wait somewhere else for court to finish,

34:40then the ACLU called him up and told him what happened.

NICKWhat happened was the judge issued a decision saying this is unconstitutional.

JACKBoom. There it is. Easy win. NSLs are unconstitutional. The judge ruled it so.

NICKThere was a lot of news coverage of the case and it was written up in all the papers. It was in the New York Times and the Washington Post, and it was all over the AP news wire. But all the stories said something like, anonymous internet provider sues government and overturns Patriot Act.

35:11JACKHot dog, he overturned the Patriot Act. Congrats, Nick. Geez. But this wasn't the Supreme Court. This was a district court in New York, and immediately upon the judge ruling that it was unconstitutional, the DOJ appealed the case, meaning they wanted a retrial, but this time in a higher court.

NICKWhat happened was the judge issued a decision saying this is unconstitutional, but I’m issuing a stay on the decision. So, what the decision was — it said that

35:45the government could no longer issue national security letters. They were unconstitutional.

JACKThe government could no longer issue national security letters.

NICKRight.

JACKYou busted that up.

NICKSort of. That’s the whole thing. Then the judge issued the stay, saying that essentially it’s like — he paused his order while the government is appealing. The government issued a notice of intent to appeal, and so, he said, okay, you can't do it, but I’m pausing the order that says that you can't do it while you appeal.

36:18JACK: Ah, how maddening, to win the case but then nothing is changed. The Patriot Act was not, in fact, overturned, and this meant he was still under a gag order and could not talk about any of this. So, they won the first district court and are now advancing to the next level to defeat the next boss, which meant that this case is now going to the Second Circuit Court of Appeals. Since John Ashcroft was no longer the attorney general, the case got changed to Doe. vs. Gonzales, which was the attorney general at the time. [Music] A new fighter entered the ring. Four librarians from Connecticut? Yeah, get this;

36:52the win from the first case made enough news that when a library in Connecticut got issued an NSL, the librarians there formed up and said, let’s go to the ACLU and fight this, too.

NICKThey decided to merge my case with the librarians’ case. So, we were now a group of plaintiffs.

JACKGreat. This is even more ammo. It’s kind of ironic that the FBI told a bunch of librarians to hush, but apparently they wanted information on one of the members that came to the library, again without a warrant, and again, you can't tell them that you gave them information to the

37:26FBI. Just do it because we say, because the Patriot Act says we can. So this now bigger case went to the Second Circuit Court of Appeals, and again, neither Nick or the librarians were allowed in court. This is where the government started to play dirty.

NICKOne thing that I learned is that it’s never gonna be a level playing field when you're an individual and you're challenging the federal government. I mean, I guess that’s so obvious. Like, okay, Captain Obvious.

JACKDuring the trial, the government made a change to the law simply clarifying that if you

38:01get an NSL, yeah, you are allowed to speak to a lawyer. So, they at least made that much clear. So, the judge said, well, we can't continue this case now because the law has changed. NICK: The law that you started suing about in 2004, the 2004 version of the law is different from the current version of the law. Therefore, the whole case is moot. You have to go back to step one again and start over and challenge it at the same lowest court with this new version of the law.

38:31JACKOh my gosh, going back to the beginning and starting over — ah! Man, if this was me, I would have ripped up that original letter and said, okay, well, if you think this NSL is no longer valid in courts, then I guess it’s no longer valid for me to follow, either. But he didn't do that. He felt set back, but he wasn't done.

NICKSo, this was already six or seven years of my life under a gag order.

JACKYeah, it’s so maddening he can't tell anyone. Like, he can't report this to the news or say something like, look how unfair the government is being. He’s under a very strict gag order, because if he tells anyone, he’d be in big trouble.

39:05Since he wants to win this lawsuit, he needs to do everything right. So, him and the librarians and the ACLU went back to that first district court that they already won at and saw the same judge again, and that same judge declared that NSLs are still unconstitutional, of course. But a court case like this takes a ton of time and money and effort. But they won it again. The government appealed this case again, so the judge issued a stay, which means nothing is actually changed until the appeal process is complete. This brought them back to the Second Circuit Court of Appeals again, which is where they were forced to start

39:39over last time. But at this point there was yet another attorney general, so this case was renamed to Doe vs. Mukasey, and that court case they won, too. Well, mostly. The judge declared the suppression of speech to be unconstitutional, but again, the judge issued a stay on it, which means nothing actually changes until the government finishes their appeal process. NICK: [Music] Six or seven years into the suit, the government decided to withdraw the letter from me, 'cause I think they saw we were headed to the Supreme Court and they were likely to lose again,

40:12and if that happened, then it would just be final and it would apply nationally. So, the government decided to withdraw the letter. They said, okay, forget the letter. Forget that we issued this letter to you. As I mentioned earlier, you have to have standing to bring a lawsuit.

JACKYeah, now you don't have standing.

NICKNow you no longer have standing.

JACKThe way the courts work in America is that you need to be an involved party to sue someone. You can't just sue someone on behalf of someone else or for the potential of a problem happening. There has to be a problem, and you have to be a part of that problem. Now,

40:47since he didn't have a letter, he had no ability to take this to court anymore. So, he had no choice but to drop this whole crusade, because when the government withdrew the letter from him, it essentially meant that they won the case. The lawsuit was no longer valid.

NICKBut the funny thing was — or, I’m using ‘funny’ in a light way — they withdrew the letter but they decided to try to leave the gag order in place...

JACKWhat?

NICK…so I still couldn't talk about it.

41:19JACK: This is so maddening. He was still gagged for life? Yeah, these NSLs would gag you for life, because there’s no expiration on when you're allowed to talk about things. If you get an NSL for the rest of your life, you're never allowed to tell anyone ever that you got one, except your lawyer. So, he went back to the district court to try to remove this gag order, but this time just for him, not for the whole country. By this time, the attorney general was Holder, so this case changed to Doe vs. Holder.

41:50NICKWe made a settlement with the government at that point. Sometimes I think when people hear settlement, they think that means, oh, someone paid someone else. Usually that’s — those are settlements in civil suits. But this was different. This was just an agreement. The agreement was I would stop fighting in this particular case and they would un-gag me and let me tell the story of what happened. So, I felt like I needed to be able to go public with this story.

JACKBy the time that case was over, Nick was finally allowed to reveal his real name

42:22and put it on the case. At that point, the attorney general was Loretta Lynch. So, this case ended up being called Merrill vs. Lynch, almost like the investment firm. So, this cleared up all three of the constitutional violations he faced. When they amended the law, they said you can, in fact, talk with a lawyer. So, that fixed the Fifth Amendment. When they withdrew the NSL, they were no longer asking for a warrantless search. Now that this gag order was removed, that cleared up the First Amendment issue, but again, just for him. Everyone else who got these NSLs still were not allowed to talk about them. But

42:55now that they retracted the NSL and lifted the gag order, he can't fight it in court anymore, which in my opinion is such a shady move, because I think they took it back because he was probably gonna win in the Supreme Court. The government should be serving the people, not fighting them, playing dirty like this to keep the upper hand. The government also withdrew their NSL that they gave the librarians, so the librarians didn't have any standing, either. [To Nick] And that’s all you can do, right? ‘Cause you no longer have standing.

43:27NICKPretty much, yeah. I mean, what happened, though, I guess afterwards, was that other companies started to fight these national security letters, which hadn't been happening previously.

JACKYes; in fact, more people did fight these letters, and one person in particular was Cindy Cohn.

CINDYYeah, my name is Cindy Cohn. I’m the executive director of the Electronic Frontier Foundation.

JACKExecutive director. But you are — you've been a lawyer there as well?

CINDYYes, I was the legal director from 2000 to 2015, and I’ve been the executive

44:02director since 2015 ‘til today. In the — in both capacities I have served as counsel in impact litigation trying to push the law in ways that protect people’s privacy and security.

JACKIn 2007 both Cindy and Nick saw a report that got released from the inspector general about these NSLs. It said...

NICKSince 2001 through 2005, they had put out hundreds of thousands of these letters.

44:33JACKBut the thing that surprised me was that only 550 people were prosecuted for terrorism in that time.

CINDYCorrect, correct. So, it just showed you that they were really using this tool way broadly compared to how often it was actually being used in ways that I think most people would think were reasonable, which is to try to investigate terrorists.

JACKYeah, because if this power was granted in the Patriot Act response to 9/11, then it should be used to prevent more terrorist activity, right? If hundreds

45:07of thousands of letters are being sent which aren't terrorism-related, does that prove the government is abusing this power, using it for other reasons, maybe overreaching? CINDY: I mean, I just think that it’s important that we have a moment where we decide whether these tools that we give the government are worth it, and are they being abused? Are they vulnerable to abuse, which NSLs clearly are, and are they in fact being abused? Which these numbers really demonstrate. There’s gotta be something going on here, right? The number of people who had their

45:42information handed over to the FBI versus how many people they actually were able to prosecute shows that there’s some kind of disconnect going on here, and I don't think the disconnect is there are hundreds of thousands of terrorists running around that they're not catching. I think that when you give the government this powerful a tool and you don't put checks and balances on it, and in this particular instance you make it secret — and so, you gag the companies that are impacted by it from ever telling anybody what happened, it’s just a recipe for abuse.

46:13JACKSo, Cindy and her legal team at the EFF had seen Nick’s case play out and was itching to join the fight, too. If you don't know, the EFF is the Electronic Frontier Foundation. It’s an organization dedicated to protecting our rights online. After Nick made this whole thing public, someone brought their NSL to the EFF.

CINDY[Music] Well, so, the first case we brought forth on a smallish telephone company, and they called me and they wanted to fight the NSL that they received. We weren't able

46:44to reveal their names to the public for six years. We had to fight this secret battle in sealed courtrooms and with secret briefs and things like that before we were finally able to reveal to the public that our client was a little phone company called CREDO Mobile.

JACKCould the client even be in the courtroom?

CINDYYeah, they were in the courtroom, but the courtroom was cleared. The general counsel could be in the courtroom, but they weren't able to tell their board of directors what was going on,

47:15or much less more broadly, and EFF wasn't able to tell its board of directors that we were involved.

JACKBut that’s so crazy. So, this company — only one person in the company knew they were in this lawsuit?

CINDYThere were maybe three people in the company. There was the president, their head of policy, and their general counsel, and probably at least one tech, 'cause they had to get the information. For us, it was just the lawyers who were involved in the case and our legal secretary. We couldn't tell the board of directors or the leadership at EFF

47:50who our clients were. They knew we were doing a case, but they didn't know on behalf of who. JACK: Gosh, not even the board of directors could know that someone got an NSL. This is crazy. I really wanted to talk with Cindy about this because she just published a new book called Privacy’s Defender, where she documented her battle with NSLs. So, Cindy and her client, the telecom provider called CREDO, sued the government over this NSL that CREDO got, and guess what? Immediately upon suing the government, the government sued her client back.

48:22CINDYThey sure did.

JACKWhat is — how? Why would they sue?

CINDYI mean, they had some cockamamie theory that they had to as a result of the Mukasey decision. It didn't make a lot of sense to us and it didn't make a lot of sense to the judge. But they claimed that we were interfering — essentially that our clients were interfering with the investigation by seeking to determine whether the NSL was valid or not under the Constitution.

48:54It was pretty surprising and outrageous, right? I mean, this is a company that was gagged. They couldn't tell their own board. They only had several people who could tell. They tried to stand up in court, and then they got sued for it and basically called kind of un-American in interfering with the investigation. It was really aggressive. JACK: Man, what an intimidation move. It’s already scary enough to go into battle against the government, but now for the government to choose to go into battle against you? The government should be working with the people, not fighting them,

49:27and they're such a big and scary entity to fight. You've really got to be sure that what you're doing is the right thing when you fight the government. Her client did, in fact, think this was the right move and wasn't pressured to back down even after being sued by the government. CINDY: So, we were hoping to be able to tell our judge in the Northern District of California, which goes up to the Ninth Circuit, that the Mukasey court was right that there were problems here, but they were wrong about what would fix it, and the only thing that would fix it would be to throw the statute out as unconstitutional. So, that was our job, was to try to build on what

50:01the ACLU and Nick had done. We were able to do that. The initial decision from the judge agreed with us not only that the statute was unconstitutional, the NSLs were unconstitutional, but that what the Mukasey court had done wasn't sufficient. So, that was the initial decision, which was great. It was a great ruling. JACK: But even though they won, the judge once again issued a stay, saying while the NSL is unconstitutional, nothing actually changes until the government can appeal. So, the case was going

50:34to have to go to the appeals court next, and they had to wait to see what happened there. CINDY: So, just as we won the first case on behalf of CREDO, we had heard from Cloudflare, who is a service provider that helps protect against DDOS attacks and things like that. Cloudflare had received an NSL, and they saw what we were doing. They didn't know who our client was, but they knew that we were fighting this in the courts. So, they came to us and said, we got one of these, too. Will you represent us? So, just as we actually got the first

51:05decision from the judge, the same day we filed on behalf of Cloudflare, and that was already in the works beforehand. We didn't really know when the decision was gonna come out, but the timing was very kind of advantageous. So, we thought, well, we just won the first one; we’ll go back in and we’ll win the second one, and it didn't go that way. JACK: So, the EFF started calling these the Alphabet Cases. Since they couldn't use their client names, they had to just come up with code names. So, this case with CREDO, the telecom provider, was called Case Q, and the case with Cloudflare they called Case Z. Strangely, almost immediately upon CREDO winning their first case, they got served another NSL.

51:40CINDY: Yeah, so right away they issued another one. We were very surprised. One of the things I think that signalled to us is that these — the FBI had gotten really used to these — this tool and really wasn't ready to stop using it even though they had gotten a bad decision, which was — made us feel vindicated that we were gonna keep fighting for these, that it wasn't one and done for them. They liked

52:11having this authority and they were gonna keep pushing. So, we had to keep pushing.

JACKOkay, well, another NSL means another lawsuit against the government. So, the EFF called that Case W, and now had three lawsuits against the US government, declaring these things are unconstitutional and the law should be changed. [To Cindy] So, every time you sued the government in each of these cases, the government sued you right back.

CINDYYeah, I think so. They definitely did for the first CREDO case. I think they might have stopped at some point because the judge told them not to, but they definitely did. ‘Cause she didn't think that was right for them to do.

52:46JACKSo, just when she felt like she was getting momentum on these cases, the government started to play unfair.

CINDYThen, while the case was going on, Congress actually amended the statute and wrote a lot of those Mukasey processes into it, and also said basically that these gag orders couldn't be eternal anymore. They are three — up to three years initially, but then there has to be an evaluation about whether there’s still an ongoing reason to have the gag, and the FBI is supposed to file a declaration

53:21about it. If they don't have an ongoing reason to have a gag order, they should lift the gag. JACK: [Music] So, because this statute got amended, this meant all her cases had to be reset and retried in the lower courts, starting from square one. So, she went back to the lower court and saw the same judge she saw before. However, this change they made is actually a big step forward, because previously when you got an NSL, you were silenced for life. But now they decided to reduce that to three years. However, it’s still very limited of what you

53:53could say even after that. I think you can say you received an NSL, but you can't say who for. CINDY: After the new statute got passed, the court sent us back down to the lower court, and Judge Illston, who was the judge who we’d had in the lower court, said, well, they fixed it enough. It’s not eternal anymore. We’ve got this process. They're not gonna be suing people for seeking this, and you can tell your lawyers. So, that’s enough to bring it within the First Amendment, the gag orders in the First Amendment.

54:26JACK: [Sighs] This was a big blow. The same judge who emphatically thought these NSLs were unconstitutional seemed to have lost her courage in her ruling and changed her mind. They tried to appeal the decision, but the court basically said, no, it’s over. Go home. That was it for the EFF, who tried to fight this, too. After that ruling, the courts were done with them. So, the status today is that this is still going on, and we have no idea how many NSLs

54:59are being issued, and very little has changed since this battle started. We know that Google got these NSLs because they also thought it was unconstitutional, and they also sued the government. They were able to get as far as the Ninth Circuit Court of Appeals in California, but the judge there ruled on the side of the NSL, saying, no, Google, you have to comply with these letters. So, even Google couldn't get this to change and was forced to give the FBI whatever data they were asking for. Cindy still thinks that more needs to change about these NSLs.

55:32CINDY: It’s not great. Let me tell you, I’m not happy. I would like NSLs to require the FBI to go to a judge first and ask for the judge — show the judge what they're doing in their investigation and say, is there enough here for me to go to the ISP and ask for this information about a particular person? I don't know that it needs to be a full probable cause warrant like the Fourth Amendment requires, but there’s plenty of in-between sorts of court orders for this kind of information,

56:05and it ought to be in one of those categories. That’s what ought to have happened. So, we're still far from where it needed to be, but we're also pretty far from what the FBI wanted. JACK: [Music] What I learned from Cindy’s book and Nick’s case is that there’s three ways that you can deal with this particular issue. You can do legislation, where you petition Congress to change the law. We know how hard that is, especially when it comes to such a secretive thing like NSLs. There’s just not enough people who know about this to be outraged to make a meaningful petition

56:38to get this changed. Because these NSLs come with a gag order, if you get hit with one, you can't go to Congress and say, hey, look at how terrible of a situation I’m in, 'cause you're not allowed to tell anybody. So, Congress just doesn't do anything to help us here. The second thing is litigation, which is exactly what Cindy and Nick did, to go through the court system, which is supposed to be the check and balance to laws and has the power to overturn laws and write new laws, but that didn't work for them. NICK: Then what’s the third way? The third way is technology. What if we build systems

57:13that make it harder to spy on people? Why are all the systems that we have for communication so transparent and so just open to surveillance? JACK: Yeah, it’s a good point. Can technology alone solve this problem? I think so. Just in my lifetime there has been an extraordinary boom in math and cryptography, and we could do things now that we’ve never been able to do before. The best encryption today still holds up against the best cracking tools around. So, can we create companies in such a manner that

57:44encrypt user data in such a way that an NSL would be pointless? That’s what Nick set out to do. NICK: I learned about the philosophy called privacy by design. Privacy by design means that when you're building something, from the first meeting you have when you're conceptualizing something, you think about how to make it private. I decided to sort of go off in this third direction of technology, thinking that, well,

58:15I believe in math, I believe in encryption, I believe in all this kind of stuff, and I think that we as technologists can do something to make the problem better. JACK: So, he pivoted with his company, Calyx. Instead of it being an ISP, he turned it into a privacy-focused company which created a bunch of things, but the stuff that they're most notable for is the CalyxOS and the Calyx hotspot. See, Nick wanted to help as many people as possible become more private, and thought that the best way that he could do this was to create a mobile operating system that is private by design. He

58:45thought this would have the biggest impact since phones are ubiquitous worldwide and everyone’s online with them. They're cheap and everywhere. The two dominating mobile OSs today are Apple’s IOS and Google’s Android. Since we know they probably both comply with NSLs, any activity you do on there means the government can ask for it whenever they want without a warrant. So, what about an alternative phone OS that doesn't know anything about its users? That way, if the government sent an NSL to Calyx, they wouldn't have a clue who’s using their OS.

59:19What they did is they took the Android OS, ripped out all the Google stuff so it stopped sending telemetry to Google or even Calyx, for that matter. I personally use GrapheneOS on my phone, which is very similar. There’s no trace of Google on my phone, and I love it. To fund it, they rely on donations, but they also have a hotspot service that they offer, which I actually pay for and use. You basically give them a yearly donation and they send you a Wi-Fi hotspot that works good for a year, and the hotspot is not connected to my name. I paid for it anonymously using cash at DEF CON,

59:50and the only thing they have on me is my e-mail address, which is a burner e-mail. This little hotspot has been doing great for me for years, and it’s going really well for Calyx, too. I’ve seen their booth at DEF CON year after year. But Nick has recently started a whole new project. NICK: I started a mobile phone company trying to use the whole principle of privacy by design to be more private than the existing phone companies. There’s been a lot of historic stuff that led to

1:00:21the phone companies keeping tons of records about people, about their communications, about who they communicate with, collecting all kinds of metadata, collecting location data. I think that companies can do better. So, I built a company called Phreeli, the concept of which is that you can sign up for it and give almost no information about yourself. In fact, you can sign up and give as little as just your zip code. JACK: First off, he doesn't want to know who his customers are, so he made it impossible

1:00:54to connect the dots between who the paying user is and what phone number they have, or SIM card. The way he did that is kind of like buying chips in a casino or tokens at an arcade. In those places, you go to the cashier, you hand them cash, and they give you chips or tokens to play the games. None of the games have any way to know exactly who was playing since the tokens aren't connected to your name and can be mixed around with other people’s tokens. So, his customers buy sort of an anonymous voucher using their credit card, or if they wish,

1:01:24an anonymous way like through cryptocurrency, and then they can redeem that voucher at Phreeli in order to get their phone service. So, it’s not possible to trace who had what voucher. At least, that’s the simplified version, the way I understand it. He uses a ton of encryption, which is really interesting and amazing, but it’s very geeky. I just love how tech actually solves these problems. Second, he logs as little as possible, which I believe is what he’s legally required to retain, which is zip codes for customers for tax reasons and aggregate call data just to show how many minutes were spent calling

1:01:59between the northwest and southwest regions of the US. Oh, and I think he monitors how much bandwidth users have so that he can charge them appropriately. It’s not perfect privacy, but it’s far more private than the average cell phone provider, and that makes me think if this is something that Nick can just up and make because he cares about his customers’ privacy that much, then how come our cell providers don't take our privacy as seriously as Nick does? So, this is what it looks like when technology fights back to solve a problem that Nick saw with

1:02:30the NSLs. But it solves way more than just the NSL problem. It enhances privacy for all users. So many of these services we pay for, they just sell our data to data brokers, and Nick doesn't even have your data to sell it. [To Nick] Yeah, see, Nick, we just talked about how you got hit with an NSL and for the government wanting data from one of your customers. I have a feeling that — I mean, maybe it’s a conspiracy theory that all these ISPs — not ISPs, but mobile carriers have backdoors with the government to allow

1:03:03them to see everything. I have a feeling that the government’s gonna come to you knocking on your door again asking to see some customer data, and this is all gonna start over all over again. NICK: You know, it may. Clearly I’m a sucker for punishment or a slow learner or something like that, but I’m actually trying to draw upon all my experiences in the past and make it easier for me to actually just be able to say, no, that’s impossible. You can't get blood from a stone.

1:03:33I don't know who the customers are, and I can't connect phone numbers to identities. Honestly, I wish I could help you solve whatever problem you're trying to figure out, but I simply can't, and you're gonna have to figure out another way to track down whoever it is you're looking for. Outro: [Outro music] A big thank you to Nick Merrill for coming on the show and telling

1:04:05us about NSLs. He was the first person ever to challenge it. What a brave soul. You can learn more about his companies by visiting calyx.com and phreeli.com, which is spelled P-H-R-E-E-L-I. Also, thank you to Cindy Cohn for coming on and telling us about her NSL fights, and you should definitely check out her book, which is called Privacy’s Defender. It’s a great book and only one part of it goes into NSLs, and there are other parts that are very interesting about a bunch of other times that she sued the government to fight for our digital rights.

1:04:35CINDY: Yes, I wrote the book in part because I think there is some really good history of hackers and people who care about security more generally really standing up for what’s right, doing things as courageous as what Nick did, but even doing things that are — don't quite put yourself at that level of risk but really stand up for what’s right. I wanted to collect some of these stories and tell them, because I feel like there’s a lot of people who feel powerless right now, and while that’s a understandable feeling,

1:05:06it’s not really true. There’s a lot of courage in these stories that is important for people today. JACK: Once again, that book is called Privacy’s Defender. She wrote this at the end of her twenty-six-year-long career at the EFF, because she just stepped down as executive director last month. So, thank you for all your work defending our digital rights, Cindy. The internet would not be the same if it wasn't for you. Listen, everyone, I’m putting the final touches on a second podcast I’m making. It’s a five-part limited series, and the show is going

1:05:36to be called Low. I’m so excited about it. I’ve been working on this story for eight years, and it’s by far the craziest and darkest and wildest story I’ve ever heard, much less anyone tell me. But listen, if you want to be the first to hear it, you need to pitch in by going to plus.darknetdiaries.com and sign up for our Plus feed to get bonus episodes and an ad-free version of the show, and you'll be able to listen to this new podcast way sooner than everyone else. So, please visit plus.darknetdiaries.com and help

1:06:10support the show. Thank you. This episode was created by me, the Club Mate addict, Jack Rhysider. Our editor is the packet-grabber, Tristan Ledger, mixing by Proximity Sound. Our intro music is by the mysterious Breakmaster Cylinder. Remember, the cloud is just someone else’s computer who might be sharing your data. This is Darknet Diaries.