Not to jump on you in particular -- there are many posts in this thread alone conflating things -- but I've noticed that there exists a great confusion about National Security Letters here on HN, even amongst those who seem to think they're following these things very closely.

A NSL is not a catch-all. It can only compel disclosure of metadata, aka non-content data, aka pretty much what's covered under Smith v Maryland (third party doctrine and all that). That alone is damaging, of course: when the police were getting phone number records in 1976, technology was very different from say, the ability to track your every movement just from the IDs of the cell phone towers that your phone connects to as you move around your city.

However, a NSL cannot compel someone to write a backdoor into a program, or force you to hand over your private encryption keys, or even hand over the content of a single email. There are many other legal approaches to these other things (like a real court order from a judge), and there is a decent chance that a company is completely spineless and rolls over for the government without any need for the request to be legal (a la AT&T and room 641A), but those approaches have nothing to do with National Security Letters.

I wish people would learn a little bit about this before thinking they know a lot about this...

Gag orders aside, is there any evidence that a national security letter can be used to compel a company to create or help create a backdoor like that?

Everything I've seen about NSLs says that they allow the government to compel production of (some) information about an individual or group if they say it's part of a national security investigation. As I understand it, the big objection to NSLs from groups like the EFF and ACLU is that they're outside the normal system of court order and subpoenas, lack enough restrictions on when they can be used and have the gag order provision...not that they give the government power to ask companies to do whatever they want.

Apple is on the record as having never received an NSL. NSLs may prohibit you from disclosing information, but they cannot force you to lie (especially by one you've never received).

This is not correct. You're thinking of Apple's "warrant canary", which covered only Section 215 of the USA PATRIOT Act, "Access to records and other items under the Foreign Intelligence Surveillance Act", aka mass FISA requests.

Apple almost certainly has received many NSLs, which is why they can only disclose "1000-2000 account information requests" for the first half of 2013 in their transparency report. That number combines law enforcement and national security order requests in order to keep vague the exact number of the latter. If you take a look at that transparency report[1], you can see they come as close as you can to confirming that they have received NSLs when (so far) you can of course not confirm that you've ever received NSLs.

[1] https://www.apple.com/pr/pdf/131105reportongovinforequests3....

I was under the impression that section 215 was the NSL since it mentions the bit about gag orders on Wikipedia:

>The section carries a gag order stating that "No person shall disclose to any other person (other than those persons necessary to produce the tangible things under this section) that the Federal Bureau of Investigation has sought or obtained tangible things under this section"

No, the modern NSL was defined in section 505 of the USA PATRIOT Act, though it modifies statutes going back many decades. It was section 505, though, that let the FBI go hog-wild with them.

They can force you to lie. If not lying would conceivably tip off a subject of an investigation that they are under surveillance, than not lying would be in violation of the NSL. That is the entire point of the gag order.

"Apple has never received an order under Section 215 of the USA Patriot Act. We would expect to challenge such an order if served on us."

So are you suggesting they've received a NSL letter about nothing in particular forcing them to lie in this instance?

If they get one in the future what happens? Are they allowed to not make this claim next time, which strongly implies that they got one? Open question, is there any US precedent as to what they're allowed to do there?

If they get one in the future then they drop the statement from their report.

moron4hire seems to believe that they would force them to keep the statement (and thus lie), but I'm going to need a source on that.

That seems like the obvious answer, and I'm inclined to believe it, but it seems like a very strong implication that they did get one if they do that. If they're not allowed to tell, are they allowed to imply this strongly?

I'm not suggesting that they have or have not received a NSL. I am saying, if they are in compliance with the gag order portion of the NSL, then they must always deny that they ever received a NSL for any reason. The government views not denying receipt of a NSL as confirming receipt. If they hadn't received a NSL, of course they would say they hadn't received one. If they had received a NSL, or course they would say they hadn't received one. The only reply to the question of "have you received a NSL" that is ever legal, is to deny receipt.

So whatever their true status is, it cannot be judged from their own statements, as long as we assume that nobody at Apple gives two shits enough to stick their neck out and risk incarceration for violating a NSL.

Or we could believe their statement about fighting the order. So much speculation and no facts.

They can make that statement and they did make that statement. You can go down the rabbit hole a very long way with "conspiracy theories" or you can believe Apple.