176: NSL

National Security Letters (NSLs) — administrative demands for customer records paired with gag orders — are the subject of Jack Rhysider’s interview with Nick Merrill and EFF lawyer Cindy Cohn. Merrill recounted how, after building an ISP called Calyx and hosting clients including the New York Civil Liberties Union and later corporate customers, he received an FBI letter demanding customer data. The letter invoked Executive Order 12333 and 18 U.S.C. §2709, commanded nondisclosure, and did not come with a judge‑signed warrant. Merrill turned to the NYCLU and then the ACLU; on April 9, 2004 the ACLU entered court on his behalf (Doe v. Ashcroft) and a federal judge found the NSL provision unconstitutional but stayed enforcement pending government appeal. That pattern — district wins, immediate stays, appeals, statutory tweaks and renamed cases (Gonzales, Mukasey, Holder, then Merrill v. Lynch) — repeated for years. The DOJ ultimately withdrew Merrill’s NSL, depriving him of standing and undercutting a final Supreme Court resolution, while the gag lingered until a settlement un‑gagged him so he could speak publicly.

Cindy Cohn described parallel litigation the Electronic Frontier Foundation mounted for telecoms and providers (CREDO, Cloudflare) and the institutional frustrations those cases exposed. An Inspector General tally cited in the episode showed hundreds of thousands of NSLs issued from 2001–2005 while only about 550 terrorism prosecutions occurred — a statistic Cohn used to argue that the tool had been used far beyond counterterrorism and was vulnerable to abuse because recipients were secret‑gagged. Congress later amended the statute to curtail perpetual gag orders (introducing a three‑year initial period and required review), but courts often sent amended versions back to lower courts, and several appeals judges favored government secrecy, leaving the overall regime largely intact. Both guests agreed that litigation and legislation achieved partial, incremental change; they also converged on a third path — technology. Merrill explained how Calyx pivoted to privacy‑by‑design products (CalyxOS, privacy hotspots) and launched Phreeli, a carrier built to minimize identity linkage (voucher system, minimal logs, optional anonymous payment), to make NSLs less useful in practice. The episode traces the legal fight, its tactical setbacks, and the turn toward engineering systems that reduce surveillance risk when courts and Congress fall short.