Feeds

FBI withdraws secret Internet Archive probe

Abuse of power alleged

Using blade systems to cut costs and sharpen efficiencies

The FBI has withdrawn a secret order that used new anti-terrorism powers to demand information about a user of the Internet Archive without a court order after attorneys challenged it as an unconstitutional abuse of power.

The victory for the San Francisco-based digital library meant that its founder was able to speak publicly about the sweeping demand, known as an NSL or national security letter, for the first time on Wednesday. Up until now, the demand for personal information about an undisclosed Internet Archive patron was protected by a gag order that prevented all but a handful of people from knowing it even existed.

Since the 9/11 attacks, the use of NSLs has proved a popular tool for getting information in government investigations if it is deemed relevant to terrorism or espionage. More than 200,000 of them were issued between 2003 and 2006, and yet, because of the secrecy surrounding them, only three have been known to have been challenged in court. Remarkably, all three challenges have succeeded.

"The NSL basically allows the FBI to demand extremely sensitive personal information about innocent people without any prior court approval, often in total secrecy without any meaningful judicial review," Melissa Goodman, one of the attorneys representing the Internet Archive, said during a telephone conference with reporters. "It makes you wonder about the hundreds of thousands of other NSLs that have never been challenged and we know there are many."

The FBI withdrew the NSL after the American Civil Liberties Union and the Electronic Frontier Foundation, which represented the Internet Archive, filed a complaint (PDF) arguing that the Patriot Act statute that expanded the use of NSLs was unconstitutional.

Among other things, the lawsuit argued that the law was a violation of freedom-of-speech guarantees because it allowed the FBI to unilaterally gag NSL recipients with no prior court approval or judicial review afterwards. Rather than fight the case in court, the FBI agreed to withdraw the NSL and lift much of the gag order surrounding it.

Not an 'unqualified success'

Contrary to claims by Brewster Kahle, founder and chairman of the Internet Archive, that it was an "unqualified success" for all libraries seeking to protect their patrons from unwarranted government fishing expeditions, it was clear that the FBI was still managing to squelch considerable discussion about the case. Kahle and his lawyers repeatedly refused to say exactly what information the FBI sought and what, if any, was ultimately provided.

They refused to say, for example, whether they supplied the FBI with an email address the patron had used to register an Internet Archive account. They even declined to say what their reasons were for withholding such details.

"You're always in an extremely difficult place when the FBI is still gagging us, not pursuant to the NSL but because of the settlement agreement," Goodman said. "We have to be cautious in those situations and its always difficult. It's terribly frustrating to us."

They were also forbidden from saying who the patron was or what the person had done to attract the attention of investigators in the first place. Even though the NSL was served in November, it remains unknown if the patron has been notified that he or she is the target of the NSL.

Given the limits of the legal victory, it's interesting to learn that the FBI was likely limited in the information it could have gained, thanks to fairly sensible policies at the Internet Archive about the information it stores. The site doesn't collect IP addresses of its visitors and doesn't log what users do while browsing through its extensive catalog of music, videos and historical documents.

"As a library, we know that we've long protected patrons from government intrusions," Kahle (whose name rhymes with "pale") said. "Our document retention policies did exactly what we intended them to do."

Think about that, the next time you're surfing Google. ®

Boost IT visibility and business value

More from The Register

next story
Secure microkernel that uses maths to be 'bug free' goes open source
Hacker-repelling, drone-protecting code will soon be yours to tweak as you see fit
14 antivirus apps found to have security problems
Vendors just don't care, says researcher, after finding basic boo-boos in security software
Only '3% of web servers in top corps' fully fixed after Heartbleed snafu
Just slapping a patched OpenSSL on a machine ain't going to cut it, we're told
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Israel's Iron Dome missile tech stolen by Chinese hackers
Corporate raiders Comment Crew fingered for attacks
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Application security programs and practises
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
Securing Web Applications Made Simple and Scalable
Learn how automated security testing can provide a simple and scalable way to protect your web applications.