From the wired
The Internet Archive, a project to create a digital library of the web for posterity, successfully fought a secret government Patriot Act order for records about one of its patrons and won the right to make the order public, civil liberties groups announced Wednesday morning.
On November 26, 2007, the FBI served a controversial National Security Letter (.pdf) on the Internet Archive's founder Brewster Kahle, asking for records about one of the library's registered users, asking for the user's name, address and activity on the site.
The Electronic Frontier Foundation, the Internet Archive's lawyers, fought the NSL, challenging its constitutionality in a December 14 complaint (.pdf) to a federal court in San Francisco. The FBI agreed on April 21 to withdraw the letter and unseal the court case, making some of the documents available to the public.
The Patriot Act greatly expanded the reach of NSLs, which are subpoenas for documents such as billing records and telephone records that the FBI can issue in terrorism investigations without a judge's approval. Nearly all NSLs come with gag orders forbidding the recipient from ever speaking of the subpoena, except to a lawyer.
Brewster Kahle called the gag order "horrendous," saying he couldn't talk about the case with his board members, wife or staff, but said that his stand was part of a time-honored tradition of librarians protecting the rights of their patrons.
"This is an unqualified success that will help other recipients understand that you can push back on these," Kahle said in a conference call with reporters Wednesday morning.
Though FBI guidelines on using NSLs warned of overusing them, two Congressionally ordered audits revealed that the FBI had issued hundreds of illegal requests for student health records, telephone records and credit reports. The reports also found that the FBI had issued hundreds of thousands of NSLs since 2001, but failed to track their use. In a letter to Congress last week, the FBI admitted it can only estimate how many NSLs it has issued.
The Internet Archive's case is only the third known court challenge to an NSL, all of which ended with the FBI rescinding the NSL, according to the ACLU's Melissa Goodman.
"That makes you wonder about the the hundreds of thousands of NSLs that haven't been challenged," Goodman said, suggesting that the FBI had collected sensitive information on innocent Americans.
The EFF, joined by the ACLU, initially used the letter to challenge the constitutionality of NSLs generally, saying the gag order violates the First Amendment. They also argued that the specific NSL used was illegal since the Internet Archive is a library, not a communications provider.
The settlement with the government (.pdf) puts an end to that challenge and still keeps Kahle and his lawyers from discussing -- even in the most general terms -- what the FBI was after and what public information the Internet Archive turned over to the FBI. For instance, the lawyers declined to say what kind of information the target was looking at or uploading -- such as animal rights information or Muslim literature.
The ACLU has successfully quashed two other NSLs, including one request to a library system asking for web surfing histories of patrons and another to a small New York hosting provider asking for data about a website it hosted. The Internet Archive case is only the second time the courts allowed the recipient of a Patriot Act National Security Letter to reveal his or her identity.
In the case of a NSL sent to a small ISP in New York, a judge ruled that the entire NSL statute is unconstitutional because of the gag order, but that ruling is under appeal. Though the FBI withdrew the request for information on one of the websites the ISP hosted, the target of that letter is still bound by a gag order, though he did write an op-ed for the Washington Post about the experience.
Though Kahle wouldn't say what the feds were after, he stressed that the Internet Archive stores very little non-public information -- only an unverified email address for those who choose to provide it -- and does not log IP addresses.