176: NSL

One day Nick got a visit from the FBI demanding he give them data on one of his customers. They asked for it in the form of a National Security Letter or NSL. Something wasn’t right about this letter. It seemed to violate the constitution. So he set out to change the law. Learn more about Nicks work at calyxinstitute.org https://calyxinstitute.org/ and phreeli.com https://www.phreeli.com/. Check out Cindy’s book Privacy’s Defender: My Thirty-Year Fight Against Digital Surveillance https://amzn.to/4gXuK2J (https://amzn.to/4gXuK2J). SponsorsSupport for this show comes from ThreatLocker® https://www.threatlocker.com/. ThreatLocker® is a Zero Trust Endpoint Protection Platform that strengthens your infrastructure from the ground up. With ThreatLocker® Allowlisting and Ringfencing™, you gain a more secure approach to blocking exploits of known and unknown vulnerabilities. ThreatLocker® provides Zero Trust control at the kernel level that enables you to allow everything you need and block everything else, including ransomware! Learn more at www.threatlocker.com https://www.threatlocker.com/. Support for this episode comes from NetSuite https://www.netsuite.com/darknet. NetSuite gives you visibility and control of your financials, planning, budgeting, and of course - inventory - so you can manage risk, get reliable forecasts, and improve margins. NetSuite helps you identify rising costs, automate your manual business processes, and see where to save money. KNOW your numbers. KNOW your business. And get to KNOW how NetSuite can be the source of truth for your entire company. Visit www.netsuite.com/darknet https://www.netsuite.com/darknet to learn more. This show is sponsored by Maze http://mazehq.com/darknet. Maze uses AI agents to triage and remediate cloud vulnerabilities by figuring out what’s actually exploitable, not just what’s theoretically risky. They remove the noise, prioritize vulns that matter, and manage remediation, so your team stops wasting time on meaningless vulns. Visit MazeHQ.com/darknet http://mazehq.com/darknet for more information. View all active sponsors. https://darknetdiaries.com/sponsors/ Sources https://www.democracynow.org/2010/8/11/gagged_for_6_years_nick_merrill https://globalfreedomofexpression.columbia.edu/cases/u-s-nicholas-merrill-v-loretta-e-lynch-14-cv-9763-vm/ https://clearinghouse.net/case/12966/ https://www.theguardian.com/law/2015/dec/06/fbi-national-security-letter-gag-order-nick-merrill https://www.aclu.org/documents/national-security-letters https://www.eff.org/cases/re-matter-2011-national-security-letter Cindy’s Book: Privacy’s Defender: My Thirty-Year Fight Against Digital Surveillance https://amzn.to/4gXuK2J

Speaker names marked ? are inferred from speaking time and the show’s known hosts — they are not voice-verified.

• 0:00Jack Rhysider?

  There's a funny story that happened back in 1980, no, 1888. There was this undertaker guy named Stroger. And when someone died, he would get a telephone call to come take care of the body. And business was doing well for him. But then suddenly, he started receiving fewer calls. Business stopped. But he knew people were dying, so it's like, what's going on? See, back then, when you called someone on the phone, you would tell the operator who you wanted to call. And they had a patch panel where they would connect a physical cable from your phone to their phone. It was all manual. And what this undertaker figured out is that the lady who was working as the phone operator, her husband was trying to start an undertaker business. So anytime somebody would call asking for the undertaker,

• 0:43Jack Rhysider?

  she would just connect him to her husband's phone. So this Stroger guy was so upset that she was intercepting his incoming calls and rerouting them. And he thought, I bet I can automate her job. So he set out to work to build an automatic way to connect calls from one person to another without the need of an operator. And this was the first telephone switch ever invented in 1889. Invented because one guy didn't trust humans to connect the calls and decided to use technology to solve his problem.

• 1:22Jack Rhysider?

  These are true stories from the dark side of the internet.

• 1:29Jack Rhysider?

  I'm Jack Resider. This is Darknet Diaries.

• 1:50Jack Rhysider?

  This episode is sponsored by Delete Me. Have you ever thought, I should really be doing something to protect myself from stalkers, scammers, and hackers? But you're not sure what? Here's what you do. Go to joindelete.me/darknetdiaries and enter code DD20 and you'll get 20% off Delete Me. A few years ago, I signed up. And ever since then, Delete Me has been busy. Scouring the internet for my name and giving me reports on what they found and deleted stuff. Take control of your data and keep your private life private by signing up for Delete Me. Now at a special discount just for my listeners. Get 20% off your Delete Me plan when you go to www.joindelete.me/darknetdiaries and use promo code DD20 at checkout.

• 2:33Jack Rhysider?

  The only way to get 20% off is to go to www.joindelete.me/darknetdiaries and enter code DD20 at checkout. That's www.joindelete.me/darknetdiaries code DD20. This episode is sponsored by ShipStation. During Black Friday and Cyber Monday, things can get a bit hectic. Millions of people scrambling to find the lowest price online and then all clicking buy multiple times within a 72-hour period. Now, retailers all over have to somehow ship those orders out on time, and that seems like a whole new level of hectic, one that ShipStation is built to help businesses manage.

• 3:16Jack Rhysider?

  ShipStation is an end-to-end order fulfillment platform built to handle the order surge of peak season and bring all your orders into one place so your team isn't scrambling when volume spikes. Over 1 million businesses have learned on ShipStation to get through peak season, scaling fulfillment up to 40x while cutting costs up to 30%. If I needed to ship a lot of stuff, I would definitely be using ShipStation. Peak season doesn't wait, and neither should you. Get ahead of it today with ShipStation. Get 60 days free at shipstation.com and use code DARKNET. That's shipstation.com code DARKNET. Taxes and fees apply. For this episode, I sat down and had a talk with Nick Merrill.

• 4:01Speaker 01

  Let's begin. All right. Yeah, and you can have your drink on the table. It's fine. I just thought it would make a noise when I put it down or something, cause you more editing work. That's my

• 4:10Jack Rhysider?

  Whole life.

• 4:12Speaker 01

  I used to work.

• 4:13Jack Rhysider?

  Learned to enjoy.

• 4:13Speaker 01

  When I was a kid, I used to work in video and film post-production.

• 4:16Jack Rhysider?

  Oh, yeah.

• 4:16Speaker 01

  It's one of my first jobs.

• 4:17Jack Rhysider?

  So let's, let's start in the eighties.

• 4:19Speaker 01

  Conscious of that. Yeah.

• 4:20Jack Rhysider?

  Yeah. What were you doing in the eighties?

• 4:24Speaker 01

  I grew up in New York City. At some point, I was in Grand Central Station, the famous Grand Central Station. And they had an amazing newsstands back then that had like thousands of titles. And I, I had some time to kill before this train came. And I was looking all around and I found this little tiny magazine called Twenty Six Hundred Magazine. It's Hacker Magazine. You know, I was fascinated by this and I bought a copy and I read it cover to cover. I just devoured this magazine and it was super interesting. And at the end of the magazine, they mentioned that they did in-person get togethers. Uh, and the one in Manhattan was held in the City Court Building.

• 5:08Jack Rhysider?

  Wow, what a special place to be back then. Some legendary hackers were knocking about in that City Court Building back then. And I covered exactly what went on in that building in episodes one sixty-eight and one sixty-nine titled LOD and MOD. If you want to hear the story of these legendary hackers, go back and check out those episodes. But suffice to say, Nick had some pretty incredible hackers around him when he was a kid and has been in the hacking scene for decades now. I've seen him at DEFCON multiple times.

• 5:35Speaker 01

  I was pretty young, though, when I went. I was only fourteen. Um, and so I met all these people, but I got a sense that there was just a lot going on that I didn't understand. So I mostly kept to myself and just listened and I picked up a lot of stuff.

• 5:51Jack Rhysider?

  This is what kickstarted his interest in computers. He got an Apple computer, started a BBS and tried to keep up with everyone else who was doing cool stuff back then. After high school, he went on to attend college.

• 6:02Speaker 01

  I was doing computer science and philosophy, both, both courses at the same time. Uh, I remember one of my big challenges in school was, was just. Deciding exactly what to focus on and then just focusing like a laser on that. I wasn't, I didn't feel like that at the time. And so I was like, I want to take some art. I want to do some law. I want to study history and all kinds of other stuff.

• 6:27Jack Rhysider?

  But his mind was hungry to learn about all kinds of stuff. So he took a huge variety of classes. And at one point, he took a class which really stuck with him.

• 6:36Speaker 01

  I took a constitutional law class. This class was a full overview of like all the landmark cases in constitutional law, going back to the beginning.

• 6:46Jack Rhysider?

  Landmark cases are interesting because a Supreme Court decision is basically just as powerful as a full fledged law. Take Miranda rights. I'm sure you've heard, "You have the right to remain silent. Anything you say can and will be used against you in court." Well, that came from a Supreme Court case called Miranda versus Arizona. A guy named Ernesto Miranda was arrested, questioned for hours, and he confessed to his crime. But later on, he learned that he didn't have to confess. The Fifth Amendment says you have the right to not self-incriminate. And so in court, he said, "I didn't know I could stay silent. I didn't know I could get a lawyer before I could talk to the cops." And the Supreme Court said, "You know what? You're right, Miranda. It's hard to know what rights you have when cops are questioning you constantly.

• 7:30Jack Rhysider?

  And they should have told you that you do have the right to remain silent. It's your Fifth Amendment right. So from now on, all cops must tell you your rights before they can use anything you say against you." And so every cop across the country now informs you of your rights before they arrest you. It's not a law that Congress passed. It's a rule made in a court. And that's the power of landmark cases. And Nick found all this very fascinating. Eventually, Nick finished school, and at the same time, the internet started sprouting websites, which made it way easier for people to share ideas and communicate with each other instead of the old fashioned BBSs. He saw a shift from things being for educational purposes to commercial usage of the internet.

• 8:14Speaker 01

  And I remember thinking at the time, this is how you could make real change. This is how you could connect people all over the country and all over the world who have one thought or an idea or want to do something. And you could, while sitting at home, you could connect to millions of people everywhere and get ideas out there. And I remember also thinking at the time, there's newspapers, there's television, there's radio, and the licensing for television and radio is strictly controlled by FCC. And as far as I know, they're not really issue, even back then, they didn't really issue any new licenses. Like, all the licenses were out there, and you could buy and sell the existing licenses

• 8:58Speaker 01

  for like tens of millions of dollars. And then they would tell you what words you could say or what words you couldn't say. There was a lot of talk at that time about, you know, the words that you can't say on the radio and what's too obscene for television and all that. And so I remember thinking that it was a tightly controlled media environment, and the bar to entry was incredibly high. It was like into the tens of millions. And then here's the internet, which at that time had no regulation at all. And the bar to entry was really low. Like, it was so low that when my grandfather died and I inherited like literally a few thousand dollars, like, that was enough for me to get in. And I ended up starting

• 9:42Speaker 01

  one of the first internet service providers in New York City.

• 9:46Jack Rhysider?

  Nick was pretty early to the game when it came to getting on the internet and saw its potential and wanted to get more people involved in this kind of technology. So at the age of 20, he learned everything he needed to start his own internet service provider.

• 9:59Speaker 01

  Yep, this was in my very first apartment on East 10th Street in the East Village in Manhattan. And my apartment had an old, no longer working fireplace that was wasted space because you couldn't have a fire in it. And the chimney was plugged up. But I filled that space with a bunch of modems. I ended up getting, I don't know, something like eight modems, and I had them all in there, and like one server, running Linux, which was like super new at that point.

• 10:34Jack Rhysider?

  The name of the ISP was called Calix. And now that he had it stood up, he had to go around and talk to people and convince them to be customers.

• 10:41Speaker 01

  People who I knew in New York City that were trying to do...

• 10:49Speaker 01

  Some type of either activism or social change, or you know, just trying to trying to have some trying to create a social movement and things like that. And and so I went around and I tried to convince them that

• 11:05Speaker 01

  that this internet thing was going to be huge and and just like a paradigm changing thing that they needed to find out about. And I remember getting a lot of pushback from people who were like, no, that's not for us, that's that's for them. We don't, we don't really want that. And I was literally just trying to get people to get email and domain names and just like put out a newsletter or put up a little webpage, something. And and it was hard to convince people at the time.

• 11:37Jack Rhysider?

  It's crazy to think back then, people were not interested in spreading their message online. But yeah, there was a time when the internet was very geeky and difficult to use. And it was new to everyone. So it made sense why people just weren't quite ready yet. And he kept trying to sell internet access to others and finally got some customers near the end of 1994.

• 11:57Speaker 01

  So one of the first organizations that I got online was called the New York Civil Liberties Union, which is the, yeah, it's the New York branch of the ACLU. And you know, they were pretty, they were pretty prominent in New York. You always heard about them on the news. They were protecting people's rights, all that kind of stuff.

• 12:20Jack Rhysider?

  And from there, the ball kept rolling. Word of mouth was spreading and Nick's ISP was gaining more and more customers. Within two years, he had outgrown his apartment and had to get a bigger place to hold all the modems and servers he needed.

• 12:31Speaker 01

  Over time, it kind of morphed or transitioned from like an end user access ISP to more of a hosting kind of an ISP and security consulting ISP. And by the early 2000s, I wasn't giving individuals internet access anymore and I didn't have modems anymore. I had like fiber optic lines and T three connections and and I was hosting these big corporate clients.

• 13:04Jack Rhysider?

  Can you name a few of these corporate clients?

• 13:06Speaker 01

  Yeah, I had Mitsubishi Motors of America.

• 13:12Speaker 01

  And IKEA and Snapple iced tea.

• 13:17Jack Rhysider?

  Okay, because you're dealing with larger data links. And so bigger companies can afford it while the home user doesn't. Doesn't quite hit. I mean, it was what $1,000 a month for a T3 back then, right?

• 13:28Speaker 01

  Oh, it was like a thousand a month for a T1.

• 13:31Jack Rhysider?

  Yeah.

• 13:31Speaker 01

  And that was 1.5 megabits. And a T3, for those who don't remember, a T3, because this is ancient history. A T3 was 45 megabits per second.

• 13:40Jack Rhysider?

  Yeah.

• 13:40Speaker 01

  And that was astronomically huge at the time.

• 13:43Jack Rhysider?

  Yeah, he was selling huge data links at this point to big businesses. And not just connections to the internet, but he was also hosting their websites, which means he had a bunch of servers and a ton of bandwidth to keep their websites online.

• 13:54Speaker 01

  But deep down in my heart, I was still trying to work with people that were trying to create change in the world. And so I had all kinds of pro bono clients that I charged either nothing or some token amount like $20 or something, hosting their websites. And I still, and NYCLU is still kind of a client of mine at that, at that time.

• 14:17Jack Rhysider?

  This ISP of his kept growing and things were looking better than ever. He had over 100 clients at this point.

• 14:24Speaker 01

  You know, I started working with these advertising agencies that had those big clients. And they brought me one and then two and then three and four and five. And pretty soon I had another advertising agency. And, uh, you know, then I was hosting the Amtrak site and all these other sites. And they were, they were really big. So, um, yeah, things were growing really well. Uh, until, uh, one day I get a weird phone call.

• 14:53Jack Rhysider?

  This was the phone call that changed everything. It changed his whole trajectory in life. And it would tie him up for the next decade or more and turn him into a whole new person.

• 15:07Speaker 01

  One day the phone rings and a person on the other end of the line says, um, I'm calling from the FBI and we have a letter for you. And, uh, and I said something like, you know, I thought about it for like a second and I, I wasn't even sure that it was for real and I didn't really quite believe it. So I said, okay, cool. Thanks. And then we hung up the call and that was it. And, uh,

• 15:37Speaker 01

  You know, where my office was, was in lower Manhattan, where all the federal buildings are and where all the courts are in lower Manhattan. And so I hung up the call from the supposed FBI person who I didn't really believe. And I just went back to work and, and within less than an hour, there was a knock on the door. It was like, and it was like the most official police knock. It was like, you know, like that kind of a thing. And I go to the door and here's this person that looks like the most classic FBI agent from like Central Casting, like, you know,

• 16:18Speaker 01

  gray hair, side part, some kind of gel hair product, like tan trench coat, like shiny black patent leather shoes, you know, suit, everything. And it was just so obvious like who it was when I opened the door because I didn't usually see people like that. And this guy came inside and reached into his inner pocket of his coat and pulled out an envelope and gave it to me and said, here, I have this for you. And so I, in front of him, I, you know, I was instantly was like intrigued. I opened the envelope. Uh, and I opened this letter and I quickly skimmed it.

• 17:04Speaker 01

  And it basically said that, uh, that the FBI wanted all this information from me about one of the clients of the company. And that I was never to tell any person that they had approached me. And then the entire second or third page was just a long bullet point list of all the types of data that they were demanding that I hand over to them. And at the end of the letter, there was a signature. And it said that it was an attorney from the FBI. That was what the signature was from.

• 17:46Speaker 01

  And so, thinking back to all the constitutional law stuff I learned about and the Fourth Amendment and, you know, what it requires to do a search and a seizure of documents. I thought to myself, well, where is that? There's no stamp on this from a court. There's no judge's signature. This isn't being issued by a court. This is just coming directly from the FBI.

• 18:12Jack Rhysider?

  He got a letter from the FBI, which was asking him to give them data about one of his customers. And all they gave him was an email address that the customer had. And this was someone Nick knew personally. And he found it really surprising that this person was under investigation. He knew them, and he thought there was no way they committed some sort of crime that the FBI would be investigating. But the letter said, "You cannot tell anyone about this request or letter. Anyone." Is this right, though? Can the FBI just ask for data without a warrant or a sign-off from a judge? The Fourth Amendment says we have the right to privacy, and the government needs to have

• 18:56Jack Rhysider?

  a warrant in order to conduct a search. So this all felt very strange to Nick.

• 19:02Speaker 01

  I think I paused when I got to the part on the first page when it said I could never tell anyone. And I said to him, "Well, what about my lawyer? And what about my business partners?" And he, in my memory, he must have been over 60. He was not a young guy. And he seemed pretty senior to me. He wasn't like a messenger boy. And he said, "I don't know. I'm just here to deliver this letter. I can't really answer your questions." And so he just kind of, you know, gave me the stiff arm and refused to engage or tell me anything. And so I just sort of took that for what it was. And And I think I asked to see his ID.

• 19:47Speaker 01

  And he pulled out a wallet, which was really big. It was like, it almost was like a checkbook. And he opened it up and in it, he had this very elaborate FBI ID. And so I understood that he was the real deal. And that was it. He left.

• 20:04Jack Rhysider?

  What is this nonsense? You can't tell anyone you got this letter? Not even your lawyer or business partner? Can you imagine getting such a letter? Like, shh, secret FBI stuff, handing us over your data. And don't tell anybody we were here. No explanation of what crime this customer did? Or what's being investigated? Or any reason why they want the data?

• 20:24Speaker 01

  So I'm left with this letter. And the letter has a whole kind of preamble, which explains the basis and the authority under which they're asking me for this information. And I remember that it cited two different things. It cited, and I can remember it by heart even today. It cited Executive Order 12333. And it cited Title 18 U.S. Code, Section 2709. And I was like, well, what's that? You know, I took one semester of constitutional law. I wasn't really familiar with the entire federal code. I had never really read all the executive orders.

• 21:09Speaker 01

  So I decided to try to figure out what this was about because it was pretty confusing to me. So I started to do a little bit of research on the two sightings in the, in the letter, the executive order and the, and the federal code. And one thing that I figured out was that Section 2709 is the national security letter provision. But It had been amended multiple times over the years. And the last time it was amended was under the Patriot Act. And so amendments, if you ever read them in Congress when they pass laws,

• 21:52Speaker 01

  they'll say, in section 2709, after the third paragraph, insert these two or three more paragraphs that now, you know, add additional meaning or things like that. And so I started to understand that in order to really grasp the meaning of section 2709, you'd have to read all the different amendments that had ever happened and then piece it all together. And you'd probably really need to go to a law library. And I didn't know how to do that research. And the executive order, there was some information about it, but not enough for me to truly understand what it implied or what it meant. And I felt really stuck at that point.

• 22:38Jack Rhysider?

  Yeah, I would be too. The Patriot Act was passed after two planes flew into buildings in New York City on 9/11. It was passed to try to stop terrorism. And it granted the authority for the FBI to conduct searches without a warrant. But was the FBI investigating a terrorist plot here? Were they using this power as it was intended? Nobody had ever seen these letters before because any time they were sent to someone, that person wasn't allowed to tell anyone else. So these letters were entirely out of the public eye. And the only people who knew they existed was the FBI and the people that the FBI gave it to. The letter is called a national security letter, or NSL.

• 23:23Speaker 01

  And I think if I recall back, it may have been dated like several days before when I actually got it. So that sort of, to me, implied that it wasn't super time sensitive. It wasn't like a nuclear bomb's gonna go off in 10 minutes. You better do this or we're all gonna die. It was more like... They weren't in such a hurry. Like, I think that it was dated like a week before they actually showed up. So I was like, okay.

• 23:51Jack Rhysider?

  So he sat down and looked at the letter closer. Under his interpretation, this letter violated three of his constitutional rights. The First Amendment is your right to free speech. This letter suppressed his speech. He wasn't allowed to talk about this letter. The Fourth Amendment is your right to privacy unless the government has a warrant. And there was no warrant, just a letter that came off some random printer in the FBI's office. He thought if he can't tell anyone, then that includes telling a lawyer. And if the government is restricting your right to get a lawyer, then that would violate the Fifth Amendment. Remember the Miranda rights that the cops have to tell you that you have a right to a lawyer? That comes out of the Fifth Amendment. Was this letter saying he has no right to a lawyer? It's really tricky because he wasn't being charged for a crime.

• 24:36Jack Rhysider?

  He was more of a witness and not even to a crime, but just to someone who the FBI was interested in.

• 24:43Speaker 01

  And so eventually I thought about it and I thought about it. And I think the big, the first big light bulb over my head moment was they, you know, the, the letter commanded me to never tell any person. But I was like, whatever, I can still talk to a lawyer. They can't tell me that I can't. I mean, that, that, that part I was very clear on from all the law I had studied. There's no such thing as denying you the right to counsel. And so, you know, I think what helped me also is that the lawyer that I used at the time, before he was a lawyer, he was my friend. And I knew him really well for a long time, for a bunch of years.

• 25:25Speaker 01

  And so I reached out to him and I asked if we could just meet in person. And when I met with him in person, I showed him this letter. And I said, you know, hey, you know, I'm not a lawyer. But my understanding of how search and seizure works is you have to go to court. And they haven't gone to court. They're they're telling me I can never tell anyone, but here I am telling you and and you know, what's this all about? And my lawyer said, you know, I agree with you. Uh, this doesn't seem right. This doesn't seem legal. But he kind of demurred him and said something like, you know, I'm like a business lawyer.

• 26:06Speaker 01

  I do I do leases and I do business contracts and this and that. And I'm not, I'm not a constitutional rights attorney. And this is a bit over my pay grade. So I think we should seek a little bit more expert opinions on what to do about this. And I said to him, well, one cool thing is that the New York Civil Liberties Union are my client, and I host their website. So maybe we can call them. And he was like, yeah, perfect. Let's call them. So he and I sat there and we picked up the phone and we called the New York Civil Liberties Union. And because they knew who I was, um, right on that first phone call, instead of them

• 26:50Speaker 01

  just taking down a memo and putting it on a stack of, you know, all the people that had called in that day, on that first phone call, I got put on the phone with the legal director of the NYCLU. And once we kind of described that I had received this letter and the vague outline of what it said, I was told to get in a taxi right now, go to their office immediately and bring the letter. And so, uh, I did.

• 27:22Jack Rhysider?

  He was very nervous on the ride there. The tone of all this was very serious and he was wondering if he's doing the right thing or getting himself in serious trouble.

• 27:32Speaker 01

  When I got there, uh, I met with the legal director, who I had not met previously. And he looked at the letter, he read the letter. And then he asked me, would it be all right if he called in another one of his colleagues from the National ACLU, who he said were just on the next floor? And I said, I thought about it for a minute. I said, okay, but in my mind, I'm thinking, okay, this letter said you can never tell any person. Right. And so the first thing I did was I told my lawyer. And now he recommended that I tell another lawyer. So now I've broken it twice. And now he's asking if he can bring a third person in. So now I'm breaking it a third time.

• 28:16Speaker 01

  And, you know, in my mind, I'm, I'm just seesawing back and forth between like, well, they can't tell me I can't have a lawyer. But at the same time, they're saying that all the constitutional rights and habeas corpus and all that stuff doesn't matter anymore because we're at war and it's an existential danger. So I was, I was just a little bit worried about what the ramifications of this would be. I said, okay, the other colleague could come chat with us. And so this younger fellow came down. He was a super smart attorney from ACLU. And he looked at this letter and was just a little bit shocked. And,

• 29:00Speaker 01

  you know, I've, I've since had discussions with them about what they were thinking at that time and understood that they knew that national security letters were being used, but nobody had ever brought them one and they had never seen one. No, no copy of one had ever become public before. So it was the first time they had ever seen it and understood the language used in it and understood how they were being used. And so to them, it represented this amazing opportunity because you can't challenge something unless you can show that it's happened. And you have to prove standing in court. So

• 29:45Speaker 01

  they thought, wow, this is an opportunity to challenge the constitutionality of this type of.

• 29:54Speaker 01

  What I would call an illegal search.

• 29:56Jack Rhysider?

  Whoa, this just escalated really fast. The ACLU was like, ready for battle the moment they saw this. Ready to sue the government and ride or die with Nick. They wanted to challenge the legality of this FBI letter and never had the chance to do it before because nobody's ever seen this thing before. They were already pulling up their sleeves, coming up with a plan of attack, and they were so excited about this opportunity that they said they'd represent him for free. Because in their mind, fighting this could result in a landmark case. And those are rare, and some lawyers would love a shot at creating a landmark case to change laws that they think are unjust. So the ACLU told Nick, "Let's fight this." And they started preparing to sue the government.

• 30:39Jack Rhysider?

  And they were going to claim that this letter violated three constitutional rights. And the Fourth Amendment violation is particularly interesting here because of why the Fourth Amendment was made in the first place. During colonial times, when New England was under British rule, the King of England issued what's called writs of assistance to British soldiers, which granted the British soldiers the right to be able to search any home at any time without specifying what they were looking for and without probable cause. And so British soldiers had carte blanche access to search anyone's personal belongings at any time. There was absolutely no right to privacy in New England at the time.

• 31:20Jack Rhysider?

  But after the colonists beat the British in the war and declared independence, that's when they decided that it's very important to preserve our privacy.

• 31:30Speaker 01

  And in reaction to what the American colonists felt were abuses of that kind of executive power from the King of England, when they started writing the constitutional amendments, they designed the Fourth Amendment to have checks and balances built in so that...

• 31:54Speaker 01

  Law enforcement or intelligence forces within the government would have to go before a court and prove that either a crime had occurred or was likely to occur with evidence. They would have to prove probable cause. And based on that, they would have to also say what the thing or things were that they intended to seize and exactly where they would find them. And so the idea is that, you know, court is supposed to exert some type of oversight authority over these attempts to curtail the rights of individuals. And so the problem with the Patriot Act and the national security letter provision amendments

• 32:37Speaker 01

  that happened in the Patriot Act is that they sidestep that whole system of checks and balances and they allow not just the FBI, but all kinds of government agencies to skip the whole showing probable cause, skip the whole system of checks and balances and just unilaterally go and seize information.

• 32:58Jack Rhysider?

  How far we've come, huh? It's like we've forgotten how bad things can get when governments have too much power. And there's a term I learned here called prior restraint, which is when someone suppresses your speech before you say something. And there have been landmark cases in the past where it's illegal for the government to issue prior restraint to people, such as when the Pentagon Papers came out. The New York Times, the Washington Post got evidence that the US government lied about the circumstances that led us into the Vietnam War. When Nixon heard that these news outlets got these leaked papers, he demanded they not publish it. And so, do you comply with an executive order like that?

• 33:41Jack Rhysider?

  Or do you challenge it in court? They challenged it and it went all the way to the Supreme Court and they ruled on the side of the news outlets, saying, "You cannot stop speech before it happens." That is the essence of censorship and a direct violation of the First Amendment. So this provision in the NSL that Nick got that says you can't tell anybody, this made the whole letter feel really unconstitutional.

• 34:07Speaker 01

  We filed a legal challenge, a constitutional challenge to the validity of the national security letter provision of the Patriot Act. And because I couldn't talk about it, the case had to be filed under the name John Doe. So it couldn't say my name because that would be, you know, admitting that I got it.

• 34:30Jack Rhysider?

  And then who'd you sue?

• 34:33Speaker 01

  The case was against the Department of Justice and the FBI.

• 34:37Jack Rhysider?

  Okay, so is there a name on the case?

• 34:41Speaker 01

  Yeah, at the time, the Attorney General of the United States was John Ashcroft. So the case was called Doe versus Ashcroft.

• 34:49Jack Rhysider?

  Oh dang, they're suing the Attorney General of the United States, who is the head of the Department of Justice. This is about to get good. I'm gonna take a quick break here and get some popcorn because when we get back, the battle begins.

• 35:11Jack Rhysider?

  This episode is sponsored by Vanta. As AI adoption grows, so do your company's security risks and requirements. New frameworks, audits, and vendors keep piling on, but your team isn't getting any bigger. Most compliance tools promise automation, but you're really stuck doing all the work by hand, chasing screenshots, validating controls, and playing catch up when audit season is coming around the corner again. Vanta works differently. Their Agentic Trust platform is built to scale with you, not slow you down. With over 1,400 automated tests across 400-plus integrations, Vanta collects evidence and monitors your controls year-round, cutting your audit prep by 82%. Plus, you can access the Vanta agent everywhere you work, whether your team is in Vanta every day

• 35:56Jack Rhysider?

  or living in tools like Claude or Cursor. Want proof? Over 16,000 fast-growing companies like Ramp, Writer, and Harvey save time and resources while scaling fast with Vanta. Learn more at vanta.com/darknet. That's spelled V-A-N-T-A. Vanta.com/darknet.

• 36:19Jack Rhysider?

  So Nick and ACLU were going to challenge the legality of this letter in court. And at this point, Nick was about 30 years old and he was all in.

• 36:28Speaker 01

  And so it seemed to me that it would be a supremely unpatriotic act to just let this go.

• 36:34Jack Rhysider?

  Wow, he thought it was an extremely unpatriotic act to comply with a national security letter. But I guess you have to feel that strongly about it to try to fight the whole Department of Justice over it.

• 36:48Speaker 01

  But the irony was all I couldn't really tell anyone. I couldn't say like, "Hey, Mom and Dad, like if I just disappear tomorrow, it's probably because these people got me." Like, or I couldn't tell my friends, I couldn't tell my parents, I couldn't tell anyone. And so no one knew that this was going on. It was just something that I completely kept to myself.

• 37:11Jack Rhysider?

  Man, this is why I love making this show, to hear about all these secret things that I'm not supposed to know about. We were never supposed to know about these letters. We were never supposed to know that Nick got one of these letters, but not today. Today, we're bringing what's in the dark to the light. So on April 9th, 2004, the ACLU entered the courtroom to represent Nick Merrill in this case.

• 37:30Speaker 01

  I was not in court. I was never allowed to go to court.

• 37:33Jack Rhysider?

  We weren't allowed to go to court?

• 37:34Speaker 01

  No, because then there were closed court sessions because it was classified stuff. And I wasn't allowed to go because then I would have identified myself. So my attorneys went to court without me and then they told me about what happened and I got to read the transcripts and all that kind of stuff. But I wasn't allowed to attend.

• 37:56Jack Rhysider?

  So he had to wait somewhere else for court to finish? Then the ACLU called him up and told him what happened?

• 38:01Speaker 01

  What happened was the judge issued a decision saying this is unconstitutional.

• 38:06Jack Rhysider?

  Boom, there it is. Easy win. NSLs are unconstitutional. The judge ruled it so.

• 38:12Speaker 01

  There was a lot of news coverage of the case and it was written up in all the papers. It was in the New York Times and the Washington Post and it was all over the AP News Wire. But all the stories said something like anonymous internet provider, you know, sues government and overturns Patriot Act.

• 38:29Jack Rhysider?

  Hot dog, he overturned the Patriot Act. Congrats, Nick. Jeez.

• 38:35Jack Rhysider?

  But this wasn't the Supreme Court. This was a district court in New York. And immediately upon the judge ruling that it was unconstitutional, the DOJ appealed the case, meaning they wanted a retrial, but this time in a higher court.

• 38:50Speaker 01

  What happened was the judge issued a decision saying, "This is unconstitutional, but I'm issuing a stay on the decision." And so what the decision was, it said that the government could no longer issue national security letters. They were unconstitutional.

• 39:07Jack Rhysider?

  The government could no longer issue national security letters?

• 39:10Speaker 01

  Right.

• 39:10Jack Rhysider?

  You busted that up.

• 39:12Speaker 01

  Sort of. That's the whole thing. And then the judge issued the stay, saying that essentially it's like he paused his order while the government is appealing. The government issued a notice of intent to appeal. And so he said, "Okay, you can't do it, but I'm pausing the order that says that you can't do it while you appeal."

• 39:37Jack Rhysider?

  Ah, how maddening, to win the case, but then nothing has changed? The Patriot Act was not, in fact, overturned. And this meant he was still under a gag order and could not talk about any of this. So they won the first district court and are now advancing to the next level, to defeat the next boss, which meant that this case is now going to the Second Circuit Court of Appeals. And since John Ashcroft was no longer the Attorney General, the case got changed to Doe versus Gonzalez, which was the Attorney General at the time. And a new fighter entered the ring. Four librarians from Connecticut? Yeah, get this. The win from the first case made enough news that when a library in Connecticut got issued an NSL, the librarians there formed up and said, "Let's go to the ACLU and fight this too."

• 40:20Speaker 01

  And they decided to merge my case with the librarian's case. So we were now a group of plaintiffs.

• 40:28Jack Rhysider?

  Great, this is even more ammo. It's kind of ironic that the FBI told a bunch of librarians to hush. But apparently, they wanted information on one of the members that came to the library. Again, without a warrant. And again, you can't tell them that you gave them information to the FBI. Just do it because we say, because the Patriot Act says we can. So this now bigger case went to the Second Circuit Court of Appeals. And again, neither Nick or the librarians were allowed in court. And this is where the government started to play dirty.

• 41:01Speaker 01

  One thing that I learned is that, you know, it's never going to be a level playing field when you're an individual and you're challenging the federal government. I mean, that's, I guess that's so obvious. It's like, okay, Captain Obvious.

• 41:14Jack Rhysider?

  During the trial, the government made a change to the law. Simply clarifying that if you get an NSL yet, you are allowed to speak to a lawyer. So they at least made that much clear. And so the judge said, well, we can't continue this case now because the law has changed.

• 41:30Speaker 01

  And the law that you started suing about in 2004, the 2004 version of the law is different from the current version of the law. Therefore, the whole case is moot. You have to go back to step one again and start over and challenge it at the same lowest court with this new version of the law.

• 41:50Jack Rhysider?

  Oh my gosh, going back to the beginning and starting over. Ah. Man, if this was me, I would have ripped up that original letter and said, okay, well, if you think this NSL is no longer valid in courts, then I guess it's no longer valid for me to follow either. But he didn't do that. He felt set back, but he wasn't done.

• 42:06Speaker 01

  So this was already like six or seven years of my life under a gag order.

• 42:10Jack Rhysider?

  Yeah, it's so maddening. He can't tell anyone. Like he can't report this to the news or say something like, look how unfair the government is being. He's under a very strict gag order because if he tells anyone, he'd be in big trouble. And since he wants to win this lawsuit, he needs to do everything right. So him and the librarians and the ACLU went back to that first district court that they already won at and saw the same judge again. And that same judge declared that NSLs are still unconstitutional. Of course, but a court case like this takes a ton of time and money and effort. But they won it again. And the government appealed this case again. So the judge issued a stay, which means nothing is actually changed until the appeal process is complete. And this brought them back to the Second Circuit Court of Appeals again,

• 42:55Jack Rhysider?

  which is where they were forced to start over last time. But at this point, there was yet another Attorney General. So this case was renamed to Doe versus Mukasey. And that court case, they won too. Well, mostly. The judge declared the suppression of speech to be unconstitutional. But again, the judge issued a stay on it, which means nothing actually changes until the government finishes their appeal process.

• 43:18Speaker 01

  Six or seven years into the suit, the government decided to withdraw the letter from me. Because I think they saw we were headed to the Supreme Court, and they were likely to lose again. And if that happened, then it would just be final. And it would apply nationally. So the government decided to withdraw the letter. They said, OK, forget the letter. Forget that we issued this letter to you. And as I mentioned earlier, you have to have standing to bring a lawsuit.

• 43:47Jack Rhysider?

  Now you don't have standing.

• 43:49Speaker 01

  Now you no longer have standing.

• 43:50Jack Rhysider?

  The way the courts work in America is that you need to be an involved party to sue someone. You can't just sue someone on behalf of someone else or for the potential of a problem happening. There has to be a problem, and you have to be part of that problem. And now, since he didn't have a letter, he had no ability to take this to court anymore. And so he had no choice but to drop this whole crusade. Because when the government withdrew the letter from him, it essentially meant that they won the case. The lawsuit was no longer valid.

• 44:25Speaker 01

  But the funny thing was, or I'm using funny in a light way. They withdrew the letter, but they decided to try to leave the gag order in place. So I still couldn't talk about it.

• 44:37Jack Rhysider?

  God, this is so maddening. He was still gagged for life? And yeah, these NSLs would gag you for life because there's no expiration on when you're allowed to talk about things. If you get an NSL for the rest of your life, you're never allowed to tell anyone ever that you got one, except your lawyer. So he went back to the district court to try to remove this gag order, but this time just for him, not for the whole country. And by this time, the attorney general was Holder. So this case changed to Doe versus Holder.

• 45:08Speaker 01

  We made a settlement with the government at that point. And sometimes I think when people hear settlement, they think that means, oh, like someone paid someone else. Usually, those are like settlements in civil suits. But this was different. This was just an agreement. And the agreement was I would stop fighting in this particular case, and they would ungag me and let me tell the story of what happened. And so I felt like I needed to be able to go public with the story.

• 45:36Jack Rhysider?

  By the time that case was over, Nick was finally allowed to reveal his real name and put it on the case. And at that point, the attorney general was Loretta Lynch. So this case ended up being called Merrill versus Lynch, almost like the investment firm. So this cleared up all three of the constitutional violations he faced. When they amended the law, they said you can, in fact, talk with the lawyers. So that fixed the Fifth Amendment. And when they withdrew the NSL, they were no longer asking for a warrantless search. And now that this gag order was removed, that cleared up the First Amendment issue. But again, just for him. Everyone else who got these NSLs still were not allowed to talk about them. But now that they retracted the NSL and lifted the gag order, he can't fight it in court anymore, which, in my opinion, is such a shady move.

• 46:21Jack Rhysider?

  Because I think they took it back because he was probably going to win in the Supreme Court. The government should be serving the people, not fighting them, playing dirty like this to keep the upper hand. And the government also withdrew their NSL that they gave the librarians. So the librarians didn't have any standing either. And that is all you can do, right? Because you no longer have standing.

• 46:46Speaker 01

  Pretty much, yeah. I mean, what happened, though, I guess afterwards, was that other companies started to fight these national security letters, which hadn't been happening previously.

• 46:58Jack Rhysider?

  Yes, in fact, more people did fight these letters. And one person in particular was Cindy Cohen.

• 47:03Speaker 02

  Yeah, my name is Cindy Cohen. I'm the executive director of the Electronic Frontier Foundation.

• 47:08Jack Rhysider?

  Executive director. But you've been... A lawyer there as well?

• 47:14Speaker 02

  Yes, I was the legal director from 2000 to 2015. And I've been the executive director since 2015 till today. And in the, in both capacities, I have served as counsel in impact litigation, trying to push the law in ways that protect people's privacy and security.

• 47:37Jack Rhysider?

  And in 2007, both Cindy and Nick saw a report that got released from the inspector general about these NSLS. It said-

• 47:44Speaker 01

  Since 2001 through 2005, they had put out hundreds of thousands of these letters.

• 47:51Jack Rhysider?

  But the thing that surprised me was that only 550 people were prosecuted for terrorism in that time.

• 47:57Speaker 02

  Correct, correct. And so it just shows you that they were really using this tool way broadly compared to how often it was actually being used in ways that I think most people would think were reasonable, which is to try to investigate terrorists.

• 48:15Jack Rhysider?

  Yeah, because if this power was granted in the Patriot Act response to 9/11, then it should be used to prevent more terrorist activity, right? And if hundreds of thousands of letters are being sent, which aren't terrorism-related, does that prove the government is abusing this power? Using it for other reasons, maybe overreaching?

• 48:35Speaker 02

  I mean, I just think that it's important that we have a moment where we decide whether these tools that we give the government are, are worth it and, and are they being abused? Are they vulnerable to abuse, which NSLS clearly are? And are they in fact being abused? Which these numbers really demonstrate, there's got to be something going on here, right? Like, the, the, the number of people who had their information handed over to the FBI versus how many people they actually were able to prosecute shows that there's some kind of disconnect going on here. And I don't think the disconnect is that there are hundreds of thousands of terrorists running around that they're not catching. I think that when you give the government this powerful a tool,

• 49:17Speaker 02

  and you don't put checks and balances on it, and in this particular instance, you make it secret, and so you gag the companies that are impacted by it from ever telling anybody what happened. It's just a recipe for abuse.

• 49:31Jack Rhysider?

  And so Cindy and her legal team at the EFF had seen Nick's case play out and was itching to join the fight too. And if you don't know, the EFF is the Electronic Frontier Foundation. It's an organization dedicated to protecting our rights online. And after Nick made this whole thing public, someone brought their NSL to the EFF.

• 49:51Speaker 02

  Well, so the first case we brought forth on a smallish telephone company, and they called me and they wanted to fight the NSL that they received. And we weren't able to reveal their names to the public for six years. We had to fight this secret battle in, you know, sealed courtrooms and with secret briefs and things like that before we were finally able to reveal to the public that, you know, our client was a little phone company called Credo Mobile.

• 50:22Jack Rhysider?

  Could the client even be in the courtroom?

• 50:24Speaker 02

  Yeah, they were in the courtroom, but the courtroom was cleared. The general counsel could be in the courtroom, but they weren't able to tell their board of directors what was going on, or much less, you know, kind of more broadly. And EFF wasn't able to tell its board of directors that we were involved.

• 50:41Jack Rhysider?

  Well, that's so crazy. So this company, only like one person in the company knew they were in this lawsuit?

• 50:48Speaker 02

  And there were maybe three people in the company. There was the president, their head of policy, and their general counsel, and probably at least one tech because they had to get the information. And for us, it was just the lawyers who were involved in the case and our legal secretary. We couldn't, we couldn't tell the board of directors or the leadership at EFF who our clients were. They knew we were doing case, but they didn't know on behalf of whom.

• 51:14Jack Rhysider?

  Gosh, not even the board of directors can know that someone got an NSO. This is crazy. I really wanted to talk with Cindy about this because she just published a new book called Privacy's Defender, where she documented her battle with NSOs. So Cindy and her client, the telecom provider called Credo, sued the government over this NSO that Credo got. And guess what? Immediately upon suing the government, the government sued her client back.

• 51:41Speaker 02

  They sure did.

• 51:41Jack Rhysider?

  What is, how, why would they sue?

• 51:44Speaker 02

  I mean, they had some cockamamie theory that they had to as a result of the Mukasee decision. It didn't make a lot of sense to us and it didn't make a lot of sense to the judge. But they claimed that we were interfering, essentially that our clients were interfering with the investigation by seeking to determine whether the NSO was valid or not under the Constitution.

• 52:11Speaker 02

  It was, it was pretty, it was pretty surprising and outrageous, right? I mean, this is a company that was gagged. They couldn't tell their own board. They only had several people who could tell. They tried to stand up in court and then they got sued for it and basically called kind of, you know, un-American and interfering with a, with a investigation. Like, it was really aggressive.

• 52:34Jack Rhysider?

  Man, what an intimidation move. It's already scary enough to go into battle against the government, but now for the government to choose to go into battle against you? The government should be working with the people, not fighting them. And they're such a big and scary entity to fight. You've really got to be sure that what you're doing is the right thing when you fight the government. And her client did, in fact, think this was the right move and wasn't pressured to back down, even after being sued by the government.

• 52:58Speaker 02

  And so we were hoping to be able to, to, to tell our judge in the, in the Northern District of California, which goes up to the Ninth Circuit, that, you know, the Mukasee Court was right that there were problems here, but they were wrong about what would fix it. And the only thing that would fix it would be to throw the statute out as unconstitutional. So that was our, our job, was to try to build on what the ACLU and NIC had done. And we were able to do that. You know, the initial decision from the judge agreed with us. Not only that the statute was unconstitutional, the NSOs were unconstitutional, but that what the Mukasee Court had done wasn't sufficient. And so that was the initial decision, which was great. It was a great ruling.

• 53:43Jack Rhysider?

  But even though they won, the judge once again issued a stay, saying while the NSL is unconstitutional, nothing actually changes until the government can appeal. And so the case was going to have to go to the appeals court next, and they had to wait to see what happened there.

• 53:57Speaker 02

  So just as we won the first case on behalf of Credo, we had heard from Cloudflare, who is a service provider that helps protect against DDoS attacks and things like that. And Cloudflare had received an NSL. And they saw what we were doing. They didn't know who our client was, but they knew that we were fighting this in the court. So they came to us and said, we got one of these two. Will you represent us? So just as we actually got the first decision from the judge, the same day we filed on behalf of Cloudflare, and that was already in the works beforehand. We didn't really know when the decision was going to come out. But the timing was very advantageous. And so we thought, well, we just won the first one. We'll go back in and we'll win the second one. And it didn't go that way.

• 54:40Jack Rhysider?

  So the EFF started calling these the alphabet cases. Since they couldn't use their client names, they had to just come up with code names. So this case with Credo, the telecom provider, was called Case Q. And the case with Cloudflare, they called Case Z. And strangely, almost immediately upon Credo winning their first case, they got served another NSL.

• 54:58Speaker 02

  Yeah, so right away, they issued another one. And I, you know, we were, we were very surprised. And, you know, one of the things I think that signaled to us is that these, you know, the FBI had gotten really used to these, this tool and really wasn't ready to stop using it, even though they'd gotten a bad decision, which was, you know, made us feel vindicated that we were going to keep fighting for these. You know, that, that it wasn't, it wasn't one and done for them. They liked having this authority and they were going to keep pushing. So we had to keep pushing.

• 55:34Jack Rhysider?

  Okay, well, another NSL means another lawsuit against the government. So the EFF called that Case W. And now had three lawsuits against the US government, declaring these things are unconstitutional and the law should be changed. And so every time you sued the government in each of these cases, the government sued you right back?

• 55:51Speaker 02

  Yeah, I think so. They, they definitely did for the first Credo case. I think they might have stopped at some point because the judge told them not to. But they definitely did. Because she didn't think that was right for them to do.

• 56:04Jack Rhysider?

  So just when she felt like she was getting momentum on these cases, the government started to play unfair.

• 56:10Speaker 02

  And then while the case was going on, Congress actually amended the statute and wrote a lot of those Mukasey processes into it and also said basically that these gag orders couldn't be eternal anymore.

• 56:27Speaker 02

  They are three, up to three years initially, but then there has to be an evaluation about whether there's still an ongoing reason to have the gag and the FBI is supposed to file a, you know, a declaration about it. And if they don't have an ongoing reason to have a gag order, they, they should lift the gag.

• 56:45Jack Rhysider?

  So because this statute got amended, this meant all her cases had to be reset and retried in the lower courts, starting from square one. So she went back to the lower court and saw the same judge she saw before. However, this change they made is actually a big step forward because previously when you got an NSL, you were silenced for life. But now they decided to reduce that to three years. However, it's still very limited of what you could say even after that. I think you can say you received an NSL, but you can't say who for.

• 57:16Speaker 02

  After the new statute got passed, the court sent us back down to the lower court. And Judge Ilnston, who was the judge who we'd had in the lower court, said, well, they fixed it enough. It's not eternal anymore. We've got this process, you know, where they're not going to be suing people for, for seeking this and, and you can tell your lawyers. So that's enough to bring it within the first, the First Amendment, the gag orders in the First Amendment.

• 57:46Jack Rhysider?

  This was a big blow. The same judge who emphatically thought these NSLs were unconstitutional seemed to have lost her courage in her ruling and changed her mind. They tried to appeal the decision, but the court basically said, no, it's over. Go home.

• 58:04Jack Rhysider?

  And that was it for the EFF who tried to fight this too. After that ruling, the courts were done with them. And so the status today is that this is still going on. And we have no idea how many NSLs are being issued. And very little has changed since this battle started. We know that Google got these NSLs because they also thought it was unconstitutional and they also sued the government. And they were able to get as far as the Ninth Circuit Court of Appeals in California, but the judge there ruled on the side of the NSLs saying, no, Google, you have to comply with these letters. And so even Google couldn't get this to change and was forced to give the FBI whatever data they were asking for.

• 58:47Jack Rhysider?

  Cindy still thinks that more needs to change about these NSLs.

• 58:51Speaker 02

  It's not great, let me tell you. I'm not happy. I would like NSLs to require the FBI to go to a judge first and ask for the judge, show the judge what they're doing in their investigation and say, is there enough here for me to go to the ISP and ask for this information about a particular person? I don't know that it needs to be a full probable cause warrant like the Fourth Amendment requires, but there's plenty of kind of in-between sorts of court orders for this kind of information and it ought to fit in one of those categories. That's what ought to have happened. So we're still far from where it needed to be, but we're also pretty far from what the FBI wanted.

• 59:37Jack Rhysider?

  What I learned from Cindy's book and Nick's case is that there's three ways that you can deal with this particular issue. You can do legislation where you petition Congress to change the law. We know how hard that is, especially when it comes to such a secretive thing like NSLs. There's just not enough people who know about this to be outraged, to make a meaningful petition to get this changed. And because these NSLs come with a gag order, if you get hit with one, you can't go to Congress and say, hey, look at how terrible of a situation I'm in, because you're not allowed to tell anybody. So Congress just doesn't do anything to help us here. And the second thing is litigation, which is exactly what Cindy and Nick did, to go through the court system, which is supposed to be the check and balance to laws and has

• 1:00:20Jack Rhysider?

  the power to overturn laws and write new laws. But that didn't work for them.

• 1:00:25Speaker 01

  And then what's the third way? The third way is technology. Like, what if we build systems that make it harder to spy on people? Why are all the systems that we have for communication so transparent? And so just open to surveillance?

• 1:00:41Jack Rhysider?

  Yeah, it's a good point. Can technology alone solve this problem? I think so. Just in my lifetime, there has been an extraordinary boom in math and cryptography. And we could do things now that we've never been able to do before. The best encryption today still holds up against the best cracking tools around. So can we create companies in such a manner that encrypt user data in such a way that an NSL would be pointless? That's what Nick set out to do.

• 1:01:09Speaker 01

  And I learned about a philosophy called privacy by design. And privacy by design means that when you're building something, from like the first meeting you have, when you're conceptualizing something, you think about how to make it private. I decided to sort of go off in this third direction of technology. Thinking that like, well, I believe in, I believe in math. I believe in encryption. I believe in all this kind of stuff. And I think that we as technologists can, can do something to make the problem better.

• 1:01:42Jack Rhysider?

  So he pivoted with his company, Calyxt. Instead of it being an ISP, he turned it into a privacy focused company, which created a bunch of things. But the stuff that they're most notable for is the Calyxt OS and the Calyxt Hotspot. See, Nick wanted to help as many people as possible become more private and thought that the best way that he could do this is to create a mobile operating system that is private by design. He thought this would have the biggest impact since phones are ubiquitous worldwide and everyone's online with them. They are cheap and everywhere. The two dominating mobile OSs today are Apple's iOS and Google's Android. And since we know they probably both comply with NSLs, any activity you do on there means the government can ask for it whenever they want without a warrant.

• 1:02:25Jack Rhysider?

  So what about an alternative phone OS that doesn't know anything about its users? That way, if the government sent an NSL to Calyxt, they wouldn't have a clue who's using their OS. What they did is they took the Android ripped out all the Google stuff. So it stopped sending telemetry to Google or even Calyx for that matter. I personally use Graphene OS on my phone, which is very similar. There's no trace of Google on my phone and I love it. To fund it, they rely on donations, but they also have a hotspot service that they offer, which I actually paid for and use. You basically give them a yearly donation and they send you a Wi-Fi hotspot that works good for a year and the hotspot is not connected to my name. I paid for it anonymously using cash at DEF CON and the only thing they have on me is

• 1:03:09Jack Rhysider?

  my email address, which is a birder email. And this little hotspot has been doing great for me for years and it's going really well for Calyx too. I've seen their booth at DEF CON year after year. But Nick has recently started a whole new project.

• 1:03:24Speaker 01

  I started a mobile phone company trying to use the whole principle of privacy by design to be more private than the existing phone companies. You know, there's been a lot of historic stuff that led to the phone companies keeping tons of records about people, about their communications, about who they communicate with, collecting all kinds of metadata, collecting location data. And I think that companies can do better. And so I built a company called Freely, the concept of which is that you can sign up for it and give almost no information about yourself. In fact, you can sign up and give as little as just your zip code.

• 1:04:09Jack Rhysider?

  First off, he doesn't want to know who his customers are. So he made it impossible to connect the dots between who the paying user is and what phone number they have or SIM card. And the way he did that is kind of like buying chips in a casino or tokens at an arcade. In those places, you go to the cashier, you hand them cash and they give you chips or tokens to play the games. And none of the games have any way to know exactly who is playing since the tokens aren't connected to your name and can be mixed around with other people's tokens. So his customers buy sort of an anonymous voucher using their credit card or if they wish an anonymous way like through cryptocurrency and then they can redeem that voucher at Freely. In order to get their phone service. So it's not possible to trace who had what voucher.

• 1:04:54Jack Rhysider?

  At least that's the simplified version, the way I understand it. He uses a ton of encryption, which is really interesting and amazing, but it's very geeky. And I just love how tech actually solves these problems. And second, he logs as little as possible, which I believe is what he's legally required to retain, which is zip codes for customers for tax reasons and aggregate call data just to show how many minutes were spent like calling between the Northwest and Southwest regions of the US. Oh, and I think he monitors how much bandwidth users have so that he can charge them appropriately. It's not perfect privacy, but it's far more private than the average cellphone provider. And that makes me think, if this is something that Nick can just up and make because he cares about his customers' privacy that much,

• 1:05:37Jack Rhysider?

  then how come our cell providers don't take our privacy as seriously as Nick does? So this is what it looks like when technology fights back to solve a problem that Nick saw with the NSLs. But it solves way more than just the NSL problem. It enhances privacy for all users. So many of these services we pay for, they just sell our data to data brokers. And Nick doesn't even have your data to sell it. Yeah, see, Nick, we just talked about how you got hit with an NSL and for the government wanting data from one of your customers. I have a feeling that, I mean, maybe it's a conspiracy theory that all these ISPs, not ISPs, but mobile carriers have backdoors with the government to allow them to see everything.

• 1:06:23Jack Rhysider?

  And I have a feeling that the government's going to come to you knocking on your door again, asking to see some customer data. And this is all going to start over all over again.

• 1:06:32Speaker 01

  You know, it may. I mean, clearly I'm a sucker for punishment or a slow learner or something like that. But I'm, but I'm actually trying to draw upon all my experiences in the past and make it easier for me to actually just be able to say like, no, that's impossible. You can't get blood from the stone. I don't know who the customers are and I can't connect phone numbers to identities. And, you know, honestly, I wish I could help you solve whatever problem you're trying to figure out, but I simply can't. And you're going to have to figure out another way to, to track down whoever it is you're looking for.

• 1:07:20Jack Rhysider?

  A big thank you to Nick Merrill for coming on this show and telling us about NSLs. He was the first person ever to challenge it. What a brave soul. You can learn more about his companies by visiting callex.com and freely.com, which is spelled P-H-R-E-E-L-I. Also, thank you to Cindy Cohen for coming on and telling us about her NSL fights. And you should definitely check out her book, which is called Privacy's Defender. It's a great book. And only one part of it goes into NSLs. And there are other parts that are very interesting about a bunch of other times that she sued the government to fight for our digital rights.

• 1:07:54Speaker 02

  Yes, I wrote the book in part because I think there is some really good history of hackers and people who care about security more generally, really standing up for what's right, doing things as courageous as what Nick did, but even doing things that are, don't quite put yourself at that level of risk, but really stand up for what's right. And I wanted to collect some of these stories and tell them because I feel like there's a lot of people who feel powerless right now. And while that's an understandable feeling, it's not really true. There's a lot of courage in these stories that is important for people today.

• 1:08:30Jack Rhysider?

  Once again, that book is called Privacy's Defender. And she wrote this at the end of her 26-year-long career at the EFF, because she just stepped down as executive director last month. So, thank you for all your work defending our digital rights, Cindy. The internet would not be the same if it wasn't for you. This show is brought to you by the lovely people who support the show. If you find this show valuable, please consider supporting it too. As a premium listener, you'll not only show a new ethic for directly supporting the people that you appreciate, but you'll also get bonus episodes of this show and an ad-free version too. Just visit plus.darknetdiaries.com and become a premium subscriber today. Thank you. This episode was created by me, the club mate addict, Jack Rees-Sider.

• 1:09:14Jack Rhysider?

  Our editor is the packet grabber Tristan Ledger. Mixing by Proximity Sound, our intro music is by the mysterious Breakmaster Cylinder. Remember, the cloud is just someone else's computer who might be sharing your data. This is Darknet Diaries.