Subpoenas and Gag Orders Show Government Overreach, Tech Companies Argue
SAN FRANCISCO — It has been six months since the Justice Department backed off on demands that Apple help the F.B.I. break the security of a locked iPhone.
But the government has not given up the fight with the tech industry. Open Whisper Systems, a maker of a widely used encryption app called Signal, received a subpoena in the first half of the year for subscriber information and other details associated with two phone numbers that came up in a federal grand jury investigation in Virginia.
The subpoena arrived with a court order that said Open Whisper Systems was not allowed to tell anyone about the information request for one year.
Technology companies contend that court-imposed gag orders are being used too often by law enforcement and that they violate the Bill of Rights. The companies also complain that law enforcement officials are casting a wide net over online communications — often too wide — in their investigations.
Justice officials, for their part, argue that these gag orders are necessary to protect developing cases and to avoid tipping off potential targets. The officials say that they are simply following leads where they take them.
The information request made of Open Whisper Systems is particularly sensitive, since its encryption app is used around the world, and it is often recommended to journalists and human rights activists.
Microsoft sued the Justice Department over the gag order practice in April, arguing that law enforcement was relying on these orders too often. Specifically, the software giant said the gag orders violate the Fourth Amendment right of its customers to know if the government searches or seizes their property and also the company’s First Amendment right to speak to its customers.
Microsoft also complained that the orders often came without time limits, unlike the Open Whisper Systems order. Dozens of other technology, media and civil liberties groups filed briefs supporting Microsoft last month, and the case is pending.
Part of the gag order on Open Whisper Systems was lifted after a court challenge by the American Civil Liberties Union, and redacted versions of documents related to the information request were made public last week. But the small San Francisco company was still not allowed to tell specific account holders about the investigation.
The documents made public show that the government asked Open Whisper Systems to turn over data associated with two telephone numbers, including web browsing histories and data stored in the tracking “cookies” of the web browsers attached to those accounts. But one of Signal’s biggest draws is that it does not collect most of that information.
“The Signal service was designed to minimize the data we retain,” said Moxie Marlinspike, the founder of Open Whisper Systems. Mr. Marlinspike said Signal uses a technology called end-to-end encryption that kept the service from gaining access to the contents of its users’ messages. The company also does not store information on those with whom its users are communicating.
Civil liberties lawyers argue the Justice Department request fell well outside the bounds of what is typically covered by a subpoena, including basic subscriber information. Additional information, such as computer logs or content, would require a search warrant under the 1986 Electronic Communications Privacy Act.
“The Justice Department is pushing the envelope,” said Jennifer Granick, director of civil liberties at the Stanford Law School Center for Internet and Society. Big companies like Apple and Microsoft have the wherewithal to push back, she said. But smaller companies may cave, rather than risk an expensive fight.
The Justice Department came to Open Whisper Systems with a menu of information needs, including subscriber details, addresses, telephone numbers, email addresses and method of payment. The request went on to demand information on internet addresses, browsers and internet providers that the account holders could have used, according to court records.
One of the phone numbers the government was investigating was not a Signal user after all. For the other phone number, Open Whisper Systems turned over the only pieces of data it could: the time the user’s account had been created and the last time it had connected to the service — far less than the government sought.
In other circumstances, the government has tried to force companies via court order to re-engineer their services to collect missing pieces of information, as it did with Apple earlier this year and in a similar case in 2013 against Lavabit, a small encrypted messaging service used by the former defense contractor Edward J. Snowden.
The government did not make that request of Open Whisper Systems. “They need to pick those cases carefully,” Ms. Granick said. “They are only picking cases where they think they’re going to have the people on their side.”
The Justice Department and F.B.I. tried to force Apple to break its own software security in the case of an iPhone used by a gunman in last year’s San Bernardino terrorist attacks, she said.
Companies are having some success in getting courts to lift gag orders. Last year, Nicholas Merrill, the owner of a now-defunct internet service provider, got a gag order lifted, though it took more than a decade. After the court decision in Mr. Merrill’s case, a federal judge in the Eastern District of New York denied gag orders in more than a dozen cases related to Facebook subpoenas last May. And in June, Yahoo was successful in getting a court to lift gag orders on a number of law enforcement information requests.
“Gag orders should be used in exceptional cases,” said Brett M. Kaufman, the staff attorney with the A.C.L.U. who represented Open Whisper Systems. “This one demonstrates that the exception has become the rule in routine proceedings.”
SAF CALLS GUN SHOW LICENSE PLATE SCANS A ‘CIVIL RIGHTS OUTRAGE,’ WANTS PROBEBELLEVUE, WA – The Second Amendment Foundation today is calling for a probe by the House Oversight Committee on an effort by the federal Immigration and Customs Enforcement agency to record license plate information on all cars belonging to gun show customers in Southern California, calling the project a “civil rights outrage.”
The Wall Street Journal reported Sunday that federal agents apparently persuaded local police officers in 2010 to scan those license plates, ostensibly to detect possible gun smuggling. But SAF founder and Executive Vice President Alan M. Gottlieb said the effort appears to have been “one more gun control affront launched during the Obama administration.”
“Attending a gun show is not a criminal activity,” Gottlieb observed. “American citizens engaged in a perfectly legal activity should not have to worry about the government monitoring their exercise of various civil rights, including freedom of association and the right to keep and bear arms.
“Instead of worrying about people attending gun shows,” he continued, “maybe the same attention could have been paid to criminals walking guns across the border under the Fast and Furious fiasco. Oh, wait, that was a debacle created by government agents, also during the Obama administration.
“Unless there is clear evidence of criminal activity,” Gottlieb stated, “it is none of the government’s business who comes and goes at a lawfully-operated gun show. This kind of snooping should require a court order, and unless some illegal activity was detected, all license plate information gathered during this effort should be destroyed, and Congress should determine how it may have been used, or misused.
“We think this revelation by the Wall Street Journal raises enough questions that the House Committee on Oversight and Government Reform should launch an inquiry,” he said. “If this kind of monitoring dealt with any activity other than a gun show, you can bet the liberal media would be screaming. The Obama administration and its media cheerleaders should understand that gun owners have privacy rights, too.”