To be fair, that's literally the point of a search warrant (/subpoena/"demand letter"). It's a bit like saying that the phone company has already done all the work identifying who you call. Well, yes, that's what you use them for. I assume your point is more that we use these services for more than any one service in the past.

The real issue in this case, however, is that the FBI can request the data and no one will ever know that they did. That can only lead to abuse. How many of those 192,499 requests were actually used to fight terrorism? Well, we can't find out...

National Security Letters are warrant-less. A search by the government is [should be] only legal if it meets the conditions of the Fourth Amendment.

Not all searches under the 4th amendment require a warrant.

The structure of the 4th amendment is a little bit non-obvious (see: http://lawlibrary.unm.edu/nmlr/10/1/03_stelzner_fourth.pdf‎).

The text reads: "The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized."

The ", and" between "violated" and "no Warrants" complicates the interpretation.[1] At common law, there was a well-understood universe of things that required warrants. Thus, the comma can be read as creating two separate requirements:

1) All searches must be reasonable; and 2) All warrants (to the extent that a search requires a warrant) must be supported by probable cause.

This reading admits the possibility of searches that are reasonable but don't require warrants. And this is a common sense category (e.g. very few people would say that police should have to go get a warrant to search a robber caught at the crime scene for weapons).

Contemporary battles tend to be over what kinds of searches require warrants.

This isn't just a battle over grammar, however. It's a question of: "what did we agree on the scope of the government's powers being?" As a general rule, the law doesn't constraint the government's ability to subpoena information from a third party without a warrant. E.g. if you're being prosecuted for fraud, the government doesn't need a warrant to subpoena your business partners requesting all documents they have from their dealings with you. The purpose of the 4th amendment is to protect you from the indignity of the search, not to protect the information itself. Under that logic, you can make a reasonable case that nothing should stop the government from subpoenaing any information Google or AT&T have about you.

The real problem here is the secret nature of the NSL's, not the 4th amendment issues, IMHO. One of the things that justifies the far-reaching subpoena powers of common law courts is the fact that they are distributed, transparent entities--nearly everything is a matter of public record.

[1] In plain speech, I might say: "I eat pizza, and I eat cake." The ", and" combines two independent thoughts without any necessary relationship between them, other than the fact that I like both. It could be the case that I never eat pizza and cake in the same meal.

Many of the warranted search battles when dealing with online information center around who owns the data. "Persons, houses, papers, and effects" might have made a lot of sense when indirect communication only could travel via letters, and knowledge only stored in books and memoirs.

If a jewelry store puts up cameras to track people in the store, the jewelry store owns the footage and information. If Google tracks user queries, Google owns the tracking data (even if its about me). If I buy a storage locker, a warrant is needed to open it up without my consent. If Google "sells" me data storage either directly or indirectly, I assume I own the data stored within and it should take a warrant to access it, regardless of how easy it might be for the superintendent of the service to access it.

Right, but remember that NSL's are about metadata. Extending the 4th amendment to your Dropbox is an easier case than extending it to Google's metadata about what sites you visit and who you e-mail.

And as a practical matter, the legal status of online information needs to catch up not just in the police context. If Public Storage loses the contents of my locker due to their negligence, I can sue. Can I sue Google if they accidentally lose the contents of my gdrive? Can I insure the contents of my gdrive?

"Metadata" in this context is such a silly concept. It's another example of the hilarity that ensues when lawmakers attempt to use analogies to shoehorn digital concepts into the traditions of physical reality.

What's silly about it? The distinction is one that transcends "digital versus physical": information a third party collects about you versus information you yourself communicate. The relevant differences don't stop being relevant simply because everything is stored as bits instead of say paper records. If the government can ask a shopkeeper at a brick and mortar store what you bought there, it makes sense that it can ask a digital retailer what you bought there. That's not because we analogize from brick and mortar stores to digital retailers, but because in both cases we're dealing with information third parties have collected about you, based on your voluntary dealings with them.

Lawmakers use analogies because they're conceptually very powerful. Say you have two things: 1 and 2. 1 has characteristics X, Y, and Z, and 2 has characteristics X, U, and V. A rule applies to 1 because of characteristic X. Analogizing from 1 to 2 on the basis of the shared characteristic X is an intuitive (and logically valid!) way to argue that the rule should also apply to 2. Not because 1 and 2 are identical or even very similar, but because the animating force behind the rule is the shared characteristic X that is present in both 1 and 2.

It's silly because the specific examples you gave, which websites you visit and who you e-mail, are both deeply personal and speak to the innermost thoughts of a person. Attempting to trivialize the impact of their disclosure by calling them "metadata"[0] is detrimental to everyone but the police.

Physical-to-digital analogies are very dangerous in a lawmaking setting because lawmakers rarely understand the implications of applying a physical power they wield in the digital realm. Examples include the lobbyist-proposed law allowing IP owners to infiltrate others' computers and delete ostensibly stolen files, while simultaneously destroying the entire concept of digital security, and the DMCA making it illegal to recycle printer cartridges or switch cellular carriers.

[0] Yes, I know that is the technical term for data about data, but there are plenty of examples where technical terms and legal terms differ in definition, intent, and hidden implications.

> It's silly because the specific examples you gave, which websites you visit and who you e-mail, are both deeply personal and speak to the innermost thoughts of a person.

Except they're not personal at all, being visible to god knows how many intermediaries and being recorded in plain text for any sysadmin to see. Maybe we'd like to treat them as such, and legislate accordingly, but that's not their inherent nature.

I think the problem here isn't lawmakers not understanding the implications of digital technology, but technologists adhering to a romantic view of technology rather than a literal one. Forget the law, forget the philosophy, just look at the mechanics of the process. Reading a web page is not a private act. It involves plain text communications over public networks through intermediaries to a host that is free to and does record identifying information. Privacy is not a core tenant of the internet protocols, whether you're talking about TCP/IP, HTTP, or SMTP.

This is not an example of an impedance mismatch between a technical term and the same legal term. We don't treat mailing addresses the same and e-mail addresses the same because they both have "mail" in the name. We do it because both have the characteristic of being routing information visible to third parties outside the communication. The idea is that routing information can't be all that "deeply personal" if you voluntarily expose it to a bunch of people. It's irrelevant whether its digital versus physical, or whether you call it "metadata" or something else, or whether the "bunch of people" is the postal service or your e-mail hosting service.

Isn't it more important to advocate a policy than to try to interpret the placement of a comma?

Notwithstanding the constitution, what policy would you advocate?

> Isn't it more important to advocate a policy than to try to interpret the placement of a comma?

I mean that question is the "emacs versus vi" of holy wars in the legal community. My legal philosophy tends to lean towards pragmatic/conservative, which means I think it's generally more important to interpret the placement of the comma. The reason is that, like conservatives generally, I tend to view the Constitution as an agreement, the last time Americans ever agreed on anything (and then just barely). So given the extreme lack of consensus today, I think it's at least a principled position to fall back to the existing agreement.

At the same time, I'm pragmatically concerned about judicial legitimacy, which is a function of how the judiciary spends its political capital. The farther judicial decisions stray from the original intent of the laws, the more political capital is spent. Every time the judiciary disagrees with the elected branches, political capital is spent (see, e.g., the response to Citizens United, which is an excellent interpretation of the law, but went against what the political branches wanted). I don't think its wrong for judges to "legislate from the bench" but I recognize that it costs political capital to do so, and that this political capital is best saved for situations in which there is an acute need to overturn the existing agreement (e.g. I'll concede that Roe v. Wade was a very tenuous interpretation of the law, but I also think it was one of the rare cases where it was necessary for the court to make up law out of thin air).

But that's my two cents. As I said, it's the subject of much religious zealotry. Lots of people would say that the most important thing is to establish the "right" policies. In terms of what policy I think is best, I'm a huge fan of judicial oversight, so I think the only exceptions to the warrant requirements should be exigent circumstances (e.g. searching a suspect for weapons at a crime scene).

If the great majority of America agrees with that interpretation, despite 200 years of the contrary, I may have to resign my commission.

Agrees with what interpretation, Niels? That it's "reasonable OR with a validly issued warrant", or that it's "reasonable AND with a validly issued warrant"?

The key is to understand that "unreasonable" qualifies the set of searches that may not be undertaken without a warrant. And therein lies the gray fog of uncertainty...and potential abuse.

To be fair the NSL is the same thing as a warrant minus the judicial oversight (and possible paper trail). A NSL isn't diametrically different than a warrant.

> A NSL isn't diametrically different than a warrant.

The whole judicial oversight is the main and most important difference. Justice is supposed to be a balance and in these case the other side is loading the scale.

A NSL is a government order to produce something, so is a warrant. The difference is that a warrant has oversight as a check against abuse, and a NSL has removed all oversight (no judge, can't talk about it, etc).

  | The whole judicial oversight is the main and
  | most important difference

Not necessarily. If Google (or whomever) could publish all of the NSLs that they get, it would have the possibility to cause public backlash that spurns Congress into action. Let's not forget that if we use the 'secret court' (e.g. FISA) to approve these NSLs, there's a 99.9% chance of them being approved. The FISA court rarely rejects what is put to it (which makes it sort of telling that the government doesn't even want to deal with the formality of the FISA court).

  | Justice is supposed to be a balance and in
  | these case the other side is loading the scale.

You are trying to say that because you don't like National Security Letters, but you do agree with warrants that they have to contain no similarities. I disagree with NSLs, but talking about NSLs like warrants without judicial oversight doesn't require some addendum of, "OMG! NSLs ARE NOT WARRANTS! WAKE UP SHEEPLE!"

Well, yes. Both are legal requests, if you want to think of it that way. But types of requests can be differentiated. We can draw a distinction, for instance, between a charity requesting that you voluntarily donate $$$ and an armed man on the sidewalk pulling a gun and requesting $$$. :)

That's not correct. You can only request "non-content" data with a NSL, e.g. IP addresses, times of access, headers, etc. You need a warrant if you want actual content of communications, etc.

(that's legally, of course. Many companies will roll over for even an informal request if they don't know better or to play ball (see: the telecom industry))

The fact that there is no judicial oversight, and thus almost no paper trail, is the real problem. They may not be completely different; they are different enough to be a cause for concern.

I have never thought about it that way before.

Does anyone know if they're actually precluded from this, or if it's just a matter of it being far more convenient to NSL a company that already has the data? As least in the latter scenario, they're not simply collecting data on everyone all the time.