Building Anonymous Mobile Services

There's a funny story that happened back in nineteen eighteen eighty eight. There was this undertaker guy named Stroger. and when someone died, he would get a telephone call to come take care of the body. And business was doing well for him, but then suddenly He started receiving fewer calls. Business stopped, but he knew people were dying. so it's like, what's going on? Back then when you called someone on the phone, you would tell the operator who you wanted to call And they had a patch panel where they would connect a physical cable from your phone to their phone. It was all manual And what this undertaker figured out is that the lady who was working as the phone operator, her husband was trying to start an undertaker business. So anyt time somebody would call asking for the undertaker, she would just connect them to her husband's phone So this strogger guy was so upset that she was intercepting his incoming calls and rerouting them. and he thought that I can automate her job So he set out to work to build an automatic way to connect calls from one person to another without the need of an operator And this was the first telephone switch ever invented in eighteen eighty nine invvented because one guy didn't trust humans to connect the calls and decided to use technology to solve his problem These are true stories from the dark S side of the internet Reiter This is Dark Net Diaries This episode is sponsored by Thry Lock The weird part about modern cyber attacks is how normal they look. The attacker logs in from Chrome, uses Powerhell, runs a remote admin tool your IT team already trusts. There's no custom malware, no dramatic movie hacker moment, just normal tools used in the wrong way. That's part of why Threat Lgger exists Site loocker helps organizations control what software can run, what it can do, and how systems communicate If attackers get credentials or land on a machine, they'll have a much harder time moving through the environment Because security teams are realizing something important The problem isn't always unknown software anymore Sometimes it's trusted software being used by the wrong person If you want to see how Threatlocker works, go to threatlocker d. com slash dark n I book a demo today That's threat loocker d. com slash darkNet to book a demo This episode is sponsored by my friends over at Maze. GitHub saw nearly a billion commits last year This year, with AI agents writing code, they're on pace for fourteen billionars Code is shipping faster than ever, and its vulnerabilities are piling up just as quickly. Legacy SEA and SAST tools weren't built for this kind of scale That's why Me just launched Me Code. They're using AI agents to investigate every vulnerability in your dependencies and in the code your team writes The agents use context from your code and cloud to prove what's really exploitable in your environment. notot just theoretically risky Then they go further, catching the business logic flaws, other tools miss. and when something's exploitable Find the fix and send it straight to the right developer or your coding agent Check out Maze at mazhq. com slash darknet. It's Mae spelled M AZ E MehQ d. com slash DarkNet. For this episode, I sat down and had a talk with Nick Merrill Let's begin All right Yeah, and you can have your drink on the table. It's fine. I dont I just thought we'd make a noise when I put a down or something cause you more editing work Oh that's my whole life. It' work learn. When I was a kid, I used to work in video and film post production.'s one of my first jobs. So let's start in the eighties. just of that. Yeah Yeah What are you doing the eighties I grew up in New York City. At some point I was in Grand Central Station, the famous Grand Central Station and they had a Amazing new stands back then that had like thousands of titles And I had some time to kill before this train came and I was looking all around and I found this little Tiny magazine called twenty six hundred magazine. It's Hacker magazine. You know, I was fascinated by this and I bought a copy and I read it cover to cover. I just devoured this magazine And it was super interesting And at the end of the magazine They mentioned that they did in person get togethers, and the one in Manhattan was held in the city Ct building What a special place to be back then. Some legendary hackers were knocking about in that city Ct building back then And I covered exactly what went on in that building in episodes one hundred sixty eight and one sixty nine titled LOD and MOD If you want to hear the story of these legendary hackers, go back and check out those episodes But suffice to say, Nick had some pretty incredible hackers around him when he was a kid And has been in the hacking scene for decades now. I've seen him at DevcOom multiple times. I was pretty young though when I went. I was only fourteen Um And so I met all these people, but I got a sense that there was just a lot going on that I didn't understand. So I mostly to myself and just listened picked up a lot of stuff. This is what kick started his interest in computers. He got an Apple computer, started a BBS, and tried to keep up with everyone else who was doing cool stuff back then After high school, he went on to attend college. I was doing computer science and philosophy. both courses at the same time. I remember one of my big challenges in school was was just deciding exactly what to focus on and then just focusing like a laser on that, I wasn't I didn't feel like that at the time And so I was like, I want to take some art, I want to do some law, I want to study history and all kinds of other stuff. But his mind was hungry to learn about all kinds of stuff. So he took a huge variety of classes. and at one point he took a class which really stuck with him took a constitutional law class. This class was a full overview of like all the landmark cases in constitutional law going back to the beginning Landmark cases are interesting because a Supreme Court decision basically just as powerful as a full fledged law take miranda rights. I'm sure you've heard you have the right to remain silent. Anything you say can and will be used against you in court Well, that came from a Supreme Court case called Miranda vers. Arizona. A guy named Ernesto Miranda was arrested, questioned for hours, and he confessed to his crime But later on, he learned that he didn't have to confess. The Fifth Amendment says you have the right to not self incriminate. And so in court, he said, I didn't know I could stay silent. I didn't know I could get a lawyer before I could talk to the cops. And the Supreme Court said, You know what? You're right, Miranda. It's hard to know what rights you have when cops are questioning you constantly. and they should have told you that you do have the right to remain silent. It's your fififth Amendment right So from now on, all cops must tell you your rights before they can use anything you say against you And so every cop across the country now informs you of your rights before they arrest you. It's not a law that Congress passed. It's a rule made in courts. And that's the power of landmark cases. And Nick found all this very fascinating. Eventually, Nick finished school and at the same time the internet started sprouting websites, which made it way easier for people to share ideas and communicate with each other instead of the old fashioned BBSs. He saw a shift from things being for educational purposes to commercial usage of the internet. And I remember thinking at the time, this is how you could make real change. This is how you could connect people all over the country and all over the world who have one thought or an idea or want to do something and you could While sitting at home, you could connect to millions of people everywhere and get ideas out there And I remember also thinking at the time, there's, you know, newspapers, there's television, there's radio, and The licensing for television and radio is like strictly controlled by FCC and U As far as I know, they don't really issue. evenven back then, they didn't really issue any new licenses. Like all the licenses were out there and you could buy and sell the existing licenses for like tens of millions of dollars And then They would tell you what words you could say what words you couldn't say. There was a lot of talk at that time about, you the the words that you can't say on the radio and what's too obscene for television and all that. And so I remember thinking that it was a tightly controlled media environment and and the bar to entry was incredibly high. It was like into the tens of millions and then here's the internet, which at that time had no regulation at all and the bar entry was really low. like it was so low that U when my grandfather died and I inherited like literally a few thousand dollars, like that was enough for me to get in And I ended up starting one of the first internet service providers in New York City Nick was pretty early to the game when it came to getting on the internet and saw his potential. and wanted to get more people involved in this kind of technology. So at the age of twenty, he learned everything he needed to start his own internet service provider This was in my very first apartment on East tenth Street in the East Village in Manhattan and my apartment have an old no longer working fireplace that was wasted space because you you couldn't have a fire in it and the chimney was plugged up But I filled that space with a bunch of modems. I ended up getting know was something like eight modems and I have them all in there and like one server, running Linux which was like super new at that point The name of the ISP was called Calx. and now that he had it stood up He had to go around and talk to people and convince them to be customers people who I knew u in New York City that we're trying to do some type of either activism or social change or you know, just trying to trying to have some trying to create a social movement and things like that and and so I went around and I tried to convince them that I don know yeah that this internet thing was going to be huge and just paradigm changing thing that they needed to find out about. and I remember getting a lot of pushback from people who were like, No, that's not for us. That's That's for them. We don't we don't really want that And I was literally just trying to get people to get email and domain names and just like put out a newsletter or put up a little webpage, something and it was hard to convince people at the time It's crazy to think back then, people were not interested in spreading their message online. But yeah, there was a time when the internet was very geeky and difficult to use. and it was new to everyone So it made sense why people just weren't quite ready yet He kept trying to sell internet access to others and finally got some customers near the end of nineteen ninety four. So one of the first organizations that I got online was called the New York Civil Liberties Union which is the Yeah, it's the New York branch of the ACLU And you know, they were pretty They were pretty prominent in New York. You always heard about them on the news. They were protecting people's rights, all that kind of stuff F From there, the ball kept rolling. word of mouth was spreading and Nick's ISP was gaining more and more customers. Within two years, he had outgrowed his apartment and had to get a bigger place to hold all the modems and servers he needed. Over time, it kind of morphed or transitioned from like an end user access ISP to more of a hosting kind of an ISP and security consulting ISP And by the early two thousands, I wasn't giving individuals internet access anymore, and I didn't have modems anymore Uh, I had like, fiber optic lines and T three connections and and I was hosting these big corporate clients Can you name a few of these corporate clas Yeah, I had Mitsubishi Motors of America. and IKEA And Snnaappple iced tea. Okay, because you're dealing with larger data links. And so bigger companies can afford it while the home user doesn' doesn't qu I mean, it was what one thousand dollars a month for a T three back then, right? Oh, it was like one thousand a month for a T one. Yeah. and that was one point five megabits and a T three for those who don't remember a T three because this is ancient history. A T three was forty five megabits per second And that was astronomically huge at the time Yeah, he was selling huge data links at this point to big businesses and not just connections to the internet, but he was also hosting their websites, which means he had a bunch of servers and a ton of bandwidth to keep their websites online. Deep down in my heart, I was still trying to work with people that were trying to create change in the world. and so I had all kinds of pro bono clients that I charged Either nothing or some token amount like twenty dollars or something, hosting their websites. And I still and NYCLU was still kind of a client of mine that at that time This ISP of his kept growing, and things were looking better than ever. He had over a hundred clients at this point. You know, I started working with these advertising agencies that have those big clients and They brought me one and then two and then three and four and five and pretty soon I had another advertising agency and You know, then I was hosting the Amtrak site and all these other sites and They were really big. So yeah, things were going really well U until one day I get a weird phone call This was the phone call that changed E everything It changed his whole trajectory in life And it would tie him up for the next decade or more turnurned him into a whole new person. One day the phone rings and a person on the other end of the line says I'm calling from the FBI and we have a letter for you and I And I said something like, you know, I thought about it for like a second and I I wasn't even sure that it was for real and I didn't really quite believe it So I said, Okaykay, cool, thanks And then we hung up to call And that was it. And You know where my office was was in lower Manhattan, where all the federal buildings are and where all the courts are in lower Manhattan And so I hung up the call from the supposed FBI person who I didn't really believe And I just went back to work. And within Less than an hour, there was a knock on the door. It was like and it was like the most official Police knock. who was like, you know that kind of a thing. And I go to the door And here's this person that looks like The most classic FBI agent from like central casting, like you know, gray hair, side part, some kind of gel hair product, like tan trench coat, like shiny black Pattent leather, shoes, you know, suit, everything And it was just so obvious like who it was when I opened the door because I didn't usually see people like that And this guy came inside and reached into his inner pocket of his coat and pulled out an envelope gave it to me and said, H I have this for you And so I in front of him, I You know, I was instantly was like intriguue. I opened the envelope and I opened this letter and I quickly Skimm did and It basically said that the FBI wanted all this information from me about one of the clients of the company. and that I was never to tell any person that they had approached me. And then the entire second or third page was just a long bullet point list of all the types of data that they were demanding that I hand over to them. and at the end of the letter, there was a signature And it said that it was an attorney from the FBI. That was what the signature was from And so thinking back to all the constitutional law, stuff I learned about in the Fourth Amendment and you know, what it requires to do a search and a seizure of documents I thought to myself, well, where is there's no stamp on this from a court. There's no judge's signature. this isn't being issued by a court. This is just coming directly from the FBI He got a letter from the FBI, which was asking him to give them data about one of his customers. And all they gave him was an email address that the customer had. And this was someone Nick knew personally And he found it really surprising that this person was under investigation. He knew them. And he thought there was no way they committed some sort of crime that the FBI would be investigating The letter said you cannot tell anyone about this request or letter anyone Is this right though Can the FBI just ask for data without a warrant or a sign off from a judge The Fourth Amendment says we have the right to privacy, and the government needs to have a warrant in order to conduct a search So this all felt very strange to Nick. I think I paused when I got to the part on the first page when I said I could never tell anyone. and I said to him, well, what about my lawyer and what about my business partners And he He in my in my memory, he must have been over sixty. He was he was not a young goy And he seemed Try senior to me wasn't like a messenger boy. And he said, I don't know. I'm just here to deliver this letter. I can't really answer your questions And so he just kind of you know, gave me the stiff arm and refused to engage or Tell me anything And so I just sort of took that for what it was and And I think I asked to see his ID and he pulled out a wallet, which was really big. It was like It almost look like a checkbook. And he opened it up and in it he had this very elaborate FBI ID. And so I understood that he was the real deal. and But that was it, he left What is this nonsense? You can't tell anyone you got this letter, not even your lawyer or business partner? Can you imagine getting such a letter like shh, secret FBI stuff, hand us over your data and don't tell anybody we were here No explanation of what crime this customer did or what's being investigated, or any reason why they want the data So I'm l with this letter and The letter has a whole kind of preamble which explains the basis and the authority under which they're asking me for this information. And I remember that it cited two different things. It cited And I can remember it by heart even today. It cited executive order one, two, three three three and it' cited Title eighteen US code. Section twenty sevenzer nine and I was like, well, what's that I took one semester of constitutional law. I wasn't really familiar with the entire federal code. I had never really read all the executive orders. So I decided to try to figure out what this was about because it was pretty confusing to me So I started to do a little bit of research on The two sightings in the letter, the executive order and the federal code. and One thing that I figured out was that Section twenty seven hundred nine is the National Security letter provision. But had been amended multiple times. over the years and the last time it was amended was under the Patriot Act And so amendments, if you ever read them in Congress when they pass laws, they'll say I In section twenty seven hundredh nine, after the third paragraph, insert these two or three more paragraphs that now add additional meaning things like that. And so I started to understand that in order to really grasp the meaning of Section twenty seven hundredh nine, you'd have to read all the different amendments that had ever happened and then piece it all together and I youd probably really need to go to a law library and I didn't know how to do that research and The executive order, there was some information about it, N not enough for you to truly understand it what it implied or what it meant and I felt really stuck at that point. Yeah, I would be too. The Patriot Act was passed after two planes flew into buildings in New York City on nine hundred and eleven It was passed to try to stop terrorism And it granted the authority for the FBI to conduct searches without a warrant But was the FBI investigating a terrorist plot here Were they using this power as it was intended Nobody had ever seen these letters before Because anytime they were sent to someone, that person wasn't allowed to tell anyone else. So these letters were entirely out of the public eye The only people who knew they existed. the FBI people that the FBI gave it to The letter is called a national security letter or NSL. And I think if I recall back It may have been dated like several days before when I actually got it So that sort of to me implied that it wasn't super time sensitive. It wasn't like A nuclear bomb is going to go off in ten minutes. You better do this or we're all going to die. It was more like They weren't in such a hurry. L I think that it was dated like a week before they actually showed up. So I was like, okay So we sat down and looked at the letter closer. Under his interpretation, this letter violated three of his constitutional rights First Amendment is your right to free speech. This letter suppressed his speech. He wasn't allowed to talk about this letter The Fourth Amendment is your right to privacy unless the government has a warrant, and there was no warrant. Just a letter that came off some random printer in the FBI's office He thought, if he can't tell anyone, then that includes telling a lawyer And if the government is restricting your right to get a lawyer, then that would violate the Fifth Amendment Remember the miranda rights that the cops have to tell you that you have a right to a lawyer. That comes out of the Fifth Amendment Was this letter saying he has no right to a lawyer It's really tricky because he wasn't being charged for a crime. He was more of a witness and not even to a crime, but just to someone who the FBI was interested in And so Eventually, I thought about it and I thought about it and I think the big the first big light bulb over my head moment was They, you know, the letter commanded me to never tell any person. But I was like, whatever, I can still talk to a lawyer. They can't tell me that I can't. I mean, that part I was very clear on from all the law I had studied There's no such thing as denying you the right to counsel And so You know, I think what helped me also is that the lawyer that I used at the time Before he was a lawyer, he was my friend And I knew him really well. for a long time, for a bunch of years And so I reached out to him And I asked if we could just meet in person And when I met with him in person, I showed him this letter. And I said, you know, hey, you know, I'm not a lawyer My understanding of how search and seizure works is you have to go to court. and they haven't gone to court. They're telling me I can never tell anyone, but here I am telling you and You know, what's this all about and My lawyer said You know, I agree with you this doesn't seem right. This doesn't seem legal But He kind of demured and said something like, you know, I'm like a business lawyer. I do leases and I do business contracts and this and that and I'm not I'm not a constitutional rights attorney. And this is a bit over my pay grade So I think we should seek a little bit more expert opinions on what to do about this. And I said to him, Well, one cool thing is that the New York Civil Liberties Union or my client and I host their website So maybe we can call them. And he was like, yeah, perfect. let's call them So he and I sat there And we picked up the phone and we called the New York Civil Liberties Union and Be they knew who I was right on that first phone call, instead of them just taking down a memo and putting it on a stack of, you know all the people that had called in that day, onn that first phone call, I got put on the phone with the legal director of the NYCLU and once we kind of described that I had received this letter and the vague outline of what it said I was told to get in a taxi right now. Go to their office immediately and bring the letter And so I did He was very nervous on the ride there The tone of all this was very serious, and he was a wonder if he's doing the right thing or getting himself in serious trouble And When I got there, I met with a legal director who I had not met previously. and he looked at the letter, he read the letter And then he asked me, would it be allright if he called in another one of his colleagues from the national ACLU, who he said were just on the next floor And I said I thought about it for a minute. I said, okay, but in my mind, I'm thinking, Okay, this letter said you can never tell any person right. And so the first thing I did was I told my lawyer And now he recommended that I tell another lawyer, so now I've broken it twice. And now he's asking if he can bring a third person in. so now I'm breaking it a third time And you know, in my mind, I'm just se sawing back and forth between like, well, they can't tell me I can't have a lawyer But at the same time They're saying that All the constitutional rights and habeas corpus and all that stuff doesn't matter anymore because we're at war and it's an existential danger. So I was just a little bit worried about what the ramifications of this would be I said, okay, the other colleague could come Chat with us. And so this younger fellow came down He was a super smart attorney from ACLU and he looked at this letter and I was just a little bit shocked and You know, I've since had discussions with them about what they were thinking at that time and understood that They knew that national security letters were being used, but Nobody had ever brought them one and they had never seen one. No copy of one had ever become public before It was the first time they had ever seen it and understood the language used in it and understood how they were being used And so to them, it represented this amazing opportunity because I You can't challenge something unless you can show that it's happened Um you have to prove standing in court Um, so they thought, wow, this is an opportunity to challenge the constitutionality of this type of U what I would call an illegal search Whoa, this just escalated really fast The ACLU was like ready for battle the moment they saw this. Ready to sue the government and ride or die with Nick. They wanted to challenge the legality of this FBI letter and never had the chance to do it before because nobody's ever seen this thing before They were already pulling up their sleeves, coming up with a plan of attack, and they were so excited about this opportunity that they said they'd represent him for free Because in their mind, fighting this could result in a landmark case. And those are rare. And some lawyers would love a shot at creating a landmark case to change laws that they think are unjust So the ACLU told Nick, let's fight this. And they started preparing to sue the government And they were going to claim that this letter violated three constitutional rights And the Fourth Amendment violation is particularly interesting here because of Why the Fourth Amendment was made in the first place During colonial times, when New England was under British rule, The King of England issued what's called Writs of asssistance British Soldiers, which granted the British soldiers the right to be able to search any home at any time without specifying what they were looking for and without probable cause And so British soldiers had carte blanche access to search anyone's personal belongings at any time. There was absolutely no right to privacy. New England at the time Butud A the colonists beat the British in the war and declared independence, That's when they decided that it's very important to preserve our privacy and in reaction to what the American Holinists felt were abuses of that kind of executive power from the King of England when they started writing the constitutional amendments, They designed the Fourth Amendment to to have checks and balances built in so that laaw enforcement or intelligence forces within the government would have to go before a court and prove that either a crime had occurred or was likely to occur with evidence, they would have to prove probable cause And based on that they would have to also say what the thing or things were that they intended to seize and exactly where they would find them And so the idea is that you, a court is supposed to exert some type of oversight authority over these attempts to curtail the rights of individuals. And so The problem with the Patriot Act and the National Security letter provision amendments that happened in the Patriot Act is that they sidestep that whole system of checks and balances and they allow not just the FBI, but all kinds of government agencies to skip the whole showing probable cause, skip the whole system of checks and balances and just unilaterally go and seize information How far we've come, huh It's like we've forgotten how bad things can get when governments have too much power And there's a term I learned here called Prior restraint which is when someone suppresses your speech before you say something There have been landmark cases in the past where it's illegal for the government to issue prior restraint to people Such as when the Pentagon papers came out, the New York Times, the Washington Post got evidence that the U. S. government lied about the circumstances that led us into the Vietnam War When Nixon heard that these news outlets got these leak papers, he demanded they not publish it. And so Do you comply with an executive order like that Or do you challenge it in court They challenged it and it went all the way to the Supreme Court and they ruled on the side of the news outlets saying, you cannot stop speech before it happens. That is the essence of censorship and a direct violation of the First Amendment So this provision in the NSL that Nick got that says, you can't tell anybody This made the whole letter feel really unconstitutional. We filed a legal challenge, a constitutional challenge to the validity of the national security letter provision of the Patriot Act And because I couldn't I Talk about it, the case had to be filed under the name John Doe So that it couldn't say my name because that would be you know, admitting that I got it. And so who just sue U The case was against the Department of Justice and the FBI Okay, so Is there a name on the case Yeah, at the time, the attorney general of the United States was John Ashcroft. So the case was called Doe versus Ashcroft Oh dang, they're suing the attorney general of the United States who is the head of the Department of Justice This is about to get good. I better take a quick break here and get some popcorn because when we get back Gs. This episode is sponsored by Net Sweet I'm reading that each day your business is late to AI, you fall two days behind So how do you keep up Fortunately, there's Net sweet You probably know Netuite. It's a unified suite that brings you financials, inventory, commerce, HR, and CRM into a single source of truth. NetSuite next is how your business leaps ahead because AI is built into everything you do It automatically surfaces custom insights. Throughout your day. AI agents work alongside you to solve problems and anytime you have a question, you can ask just like you would with any other colleague NetSuite is customized for a wide range of industries. It's time For Net Sweet next or your business meets AI. It's the service that I would use if I needed it For the first time ever, you can try NetSuite next for free. If your revenues are seven figures or above, go to netsuite. ai slash darknet. built for every industry Re ready for the boardroom NetSite. Ai slash dark Net. So Nick and ACLU were going to challenge the legality of this letter in court. And at this point, Nick was about thirty years old and he was all in And so it seemed to me that It would be a supremely unpatriotic act to just let this go. Wow, he thought it was an extremely unpatriotic act. to comply with a national security letter But I guess you have to feel that strongly about it to try to fight the whole Department of Justice over it The irony was o, I couldn't really tell anyone. I couldn't say like Hey, mom and dad, like if I just disappear tomorrow, it's probably because these people got me like or I couldn't tell my friends, I couldn't tell my parents, I couldn't tell anyone. And so no one knew that this was going on. It was just something that I completely kept to myself. And this is why I love making this show to hear about all these secret things that I'm not supposed to know about. We were never supposed to know about these letters. We were never supposed to know that Nick got one of these letters, but not today. Tod we're bringing what's in the dark to the light. So on april ninth, two thousand four, the ACLU entered the courtroom to represent Nick Merrill in this case I was not in court. I was never allowed to go to court. Weren't allowed to go to court? No, because then were they were closed court sessions because it was classified stuff And I wasn't allowed to go because then I would have identified myself So My attorneys went to court without me and then they told me about what happened and I got to read the transcripts and all that kind of stuff But I wasn't allowed to attemend So we had to wait somewhere else for court to finish Then the ACLU called him up and told him what happened What happened was the judge issued a decision saying, this is unconstitutional There it is. easy win. NSLs are unconstitutional. The judge ruled it so There was a lot of news coverage of the case. and It was written up in all the papers. It was in the New York Times and the Washington Post, and it was all over the AP newews wire All the story said something like anonymous internet provider you know, sues government and overturns Patriotarch. Doug, he overturned the Patriot Act. Congrats, Nick Jeez wasn't the Supreme Court. This was a district court in New York And immediately upon the judge ruling that it was unconstitutional, the DOJ appealed the case. Meaning they wanted a retrial This time in a higher court What happened was the judge issued a decision saying, this is unconstitutional I'm issuing a stay Um, on the decision And so what the decision was, it said that the government could no longer issue national security letters. They were unconstitutional. The government could no longer issue national security letters.. You busted that up sort of That's the whole thing. And then the judge issued the stay saying that Essentially, it's like Hmm paused his order while the government is appealing. The government issued a notice of intent to appeal And so he said, okay, you can't do it, but I'm pausing the order that says that you can't do it while you appeal A, how maddening to win the case, but then nothing is changed The Patriot Act was not in fact overturned, and this meant he was still under a gag order and could not talk about any of this So they won the first district court and are now advancing to the next level to defeat the next boss which meant that this case is now going to the Second Circuit Court of Appeals. And since John Ashcroft was no longer the attorney general, the case got changed to Doe versus Gonzalez, which was the attorney general at the time. and a new fighter entered the ring Four librarians from Connecticut. The win from the first case made enough news that when a library in Connecticut got issued in NSL, the librarians there formed up and said, let's go to the ACLU and fight this too And they decided to merge my case with the librarian's case. So we were now a group of plaintiffs This is even more ammmo And It's kind of ironic that the FBI told a bunch of librarians, Tosh Apparently they wanted information on one of the members that came to the library Again without a warrant. And again, you can't tell them that you gave them information to the FBI. Just do it because we say because the Patriot act says we can So this now bigger case went to the Second Circuit Court of Appeals And again, neither Nick nor the librarians were allowed in court. This is where the government started to play dirty One thing that I learned is that you know, it's never going to be a level playing field when you're an individual and you're challenging the federal government. I mean, that I guess that's so obvious. It's like, okay, Ctain obvious During the trial, the government made a change to the law. Simply clarifying that if you get an NSL yet, you are allowed to speak to a lawyer. So they at least made that much clearr And so the judge said, well, we can't continue this case now because the law has changed And the law that you started suing about in two thousand four, the two thousand four version of the law. is different from the current version of the law Therefore, the whole case is moot You have to go back to step one again and start over and challenge it at the same lowest court with this new version of the lock. Oh my gosh, going back to the beginning and starting over. ah man, if this was me, I would have ripped up that original letter and said, okay, well, if you think this NSL is no longer valid in courts, then I guess it's no longer valid for me to follow either But he didn't do that. He felt set back, but he wasn't done. So this was already like six or seven years of my life under a gag order Yeah, it's so maddening he can't tell anyone. Like he can't report this to the news or say something like, look how unfair the government is being under a very strict gag order Because if he tells anyone, he'd be in big trouble And since he wants to win this lawsuit, he needs to do everything right So him and the librarians and the ACLU went back to that first district court that they already won at and saw the same judge again, and that same judge declared that NSLs are still unconstitutional. Of course. But a court case like this takes a ton of time and money and effort But they've won it again And the government appealed this case again. So the judge issued a stay, which means nothing has actually changed until the appeal process is complete. And this brought them back to the Second Circuit Court of Appeals. Again which is where they were forced to start over last time At this point there was yet another attorney judge also this case was renamed to Doe versus B Casey. and that court case, they won too Well, mostly, the judge declared the suppression of speech to be unconstitutional, but again, the judge issued a stay on it, which means nothing actually changes until the government finishes their appeal process Six or seven years into the into the suit The government decided to withdraw the letter from me Be I think they saw, we were headed to the Supreme Court and they were likely to Lose again And if that happened, then it would just be final. and it would apply nationally So The government decided to withdraw the letter. They said, OkayK, forget the letter, forget that we issued this letter to you and As I mentioned earlier, you know, you have to have standing to Yeah, bring a lawsuit. Now you don't have standing. Now, you no longer have standing. The way the courts work in America is that you need to be an involved party to sue someone. You can't just sue someone on behalf of someone else or for the potential of a problem happening There has to be a problem and you have to be part of that problem Now since he didn't have a letter He had no ability to take this to court anymore And so he had no choice but to drop this whole crusade Because when the government withdrew the letter from him It essentially meant They won the case The lawsuit was no longer valid But the funny thing was or you know, I'm using funny in a light way They withdrew the letter, but they decided to try to leave the gag order in place. so I still didnn't talk about it This is so maddening He was still gagged For life? And yeah, these NSLs would gag you for life. Because there's no expiration on when you're allowed to talk about things. If you get an NSL for the rest of your life, you're never allowed to tell anyone ever that you got one accept your lawyer. So he went back to the district court to try to remove this gag order, but this time just for him, not for the whole country And by this time, the attorney general was Holder, So this case changed to Doe versus Holder We made a settlement with the government at that point And sometimes I think when people hear settlement, they think that means, oh, like someone paid someone else. Uually those are like settlements and civil suits. But this was different. This was just an agreement And the agreement was, I would stop fighting in this particular case And they would ungag me and let me tell the story of what happened And so I felt like I needed to be able to go public with the story. By the time that case was over, Nick was finally allowed to reveal his real name and put it on the case And at that point, the attorney general was Loretta Lynch. So this case ended up being called Merrill vers. Lynch, almost like the investment firm So this cleared up all three of the constitutional violations he faced. When they amended the law, they said you can in fact talk with the lawyers. so that fixed the Fifth Amendment. When they withdrew the NSL, they were no longer asking for a warrantless search. And that this GA order was removed, that cleared up to the First Amendment issue, But again, just for him, everyone else who got these NSLs still were not allowed to talk about Now that they retracted the NSL and lifted the gag order, he can't fight it in court anymore, which in my opinion is such a shady move, because I think they took it back because he was probably going to win in the Supreme Court government should be serving the people, not fighting them, playing dirty like this to keep the upper hand And the government also withdrew their NSL that they gave the librarians. So the librarians didn't have any standing either And that Is all you That's all you can do, right? Because you're no longer have standing Pretty much, yeah. I mean What happened though, I guess afterwards was that other compomanies started to fight these national security letters, which hadn't been happening previously Yes, in fact, more people did fight these letters, and one person in particular was Cindy Cohen Yeah, my name is Cindy Cohen. I'm the executive director of the Electronic Frontier Foundation. Executive director. you were you've been a lawyer there as well Yes, I was the legal director from two thousand to twenty fifteen, and I've been the executive director since twenty fifteen till today Um and in the in both capacities I have served U as counsel in impact litigation trying to push the law in ways that protect people's privacy and security And in two thousand seven, both Cindy and Nick saw a report that got released from the inspector general about these NSLs. It said, since two thousand one through two thousand five They had put out hundreds of thousands of these letters. But the thing that surprised me was that only five hundred and fifty people were prosecuted for terrorism at that time Correct. And so it just showed you that they were really using this tool way broadly compared to how often it was actually being used in ways that I think most people would think were reasonable, which is to try to investigate terrorists Yeah, because if this power was granted in the Patriot Act response to nine hundred eleven, then it should be used to prevent more terrorist activity, right And if hundreds of thousands of letters are being sent which aren't terrorism related Does that prove the government is abusing this power? Uing it for other reasons Maybe overreaching. I mean, I just think that it's important that we have a moment where we decide whether these tools that we give the government are are worth it and are they being abused? Are they vulnerable to abuse, which NSLs clearly are? And are they in fact being abused? which these numbers really demonstrate, there's got to be something going on here, right Like the number of people who had their information handed over to the FBI versus how many people they actually were able to prosecute shows that there's some kind of disconnect going on here. And I don't think the disconnect is that there are hundreds of thousands of terrorists running around that they're not catching I think that when you give the government this powerful a tool, and you don't put checks and balances on it. And in this particular instance, you make it secret. and so you gag the companies that are impacted by it from ever telling anybody what happened. It's just a recipe for abuse. And so Cindy and her legal team at the EFF had seen Nick's case play out and was itching to join the fight too And if you don't know the EFF is the Electronic Frontier Foundation. It's an organization dedicated to protecting our rights online. And after Nick made this whole thing public, someone brought their NSL to the EFF. Well, so the first case we brought forth on a smallish telephone company. and They called me and they wanted to fight the NSL that they received. and we weren't able to reveal their names to the public for six years. We had to fight this secret battle in you sealed courtrooms and with secret briefs and things like that before we were finally able to reveal to the public that our client was a little phone company called Creito Mobile Could the client even be in the courtroom Yeah, they were in the courtroom, but the courtroom was cleared The general counsel could be in the courtroom, but they weren't able to tell their board of directors what was going on or much less, you know, kind of more broadly, and EFF wasn't able to tell its board of directors that we were involved that's so crazy. So so this company, only like one person in the company knew they were in this lawsuit And there were maybe three people in the company. There was the president, their head of policy and their general counsel and probably at least one tech because they had to get the information. And for us, it was just the lawyers who were involved in the case and our legal secretary. We couldn't We couldn't tell the board of directors or the leadership at EFF who our clients were. They knew we were doing case But they know on behalf of who Gosh, not even the board of directors can know that someone got an NSL. This is crazy. I really wanted to talk with Cindy about this because she just published a new book called Privacies Defender, where she documented her battle with NSLs So Cindy and her client, the telecom provider called Cito, sued the government over this NSL that Cito got And guess what? Immediately upon suing the government, the government sued her client back. They sure did. What is whyy would they sue I mean They had some cockamamei theory that they had to as a result of the Muquze decision. It didn't make a lot of sense to us and it didn't make a lot of sense to the judge U But they claimed that we were interfering, essentially, our clients were interfering with the investigation by seeking to determine whether the NSO was valid or not under the Constitution It was it was pretty it was pretty surprising and outrageous, right? I mean, this is a company that was gagged They couldn't tell their own board. They only had several people who could tell. They tried to stand up in court and then they got sued for it and basically called kind of, you know, un American and interfering with the investigation. L it was really aggressive M what an intimidation move. It's already scary enough to go into battle against the government. But now for the government to choose to go into battle against you goovernment should be working with the people not fighting them. And they're such a big and scary entity to fight. You've really got to be sure that what you're doing is the right thing when you fight the government And her client did, in fact, think this was the right move and wasn't pressured to back down even after being sued by the government And so we were hoping to be able to tell our judge in the Northern District of California, which goes up to the ninth Circuit that you know, the McCasey Ct was right that there were problems here, but they were wrong about what would fix it. And the only thing that would fix it would be to throw the statute out as unconstitutional So that was our job was to try to build on what the ACLU and Nick had done And we were able to do that, you know, the initial decision from the judge U agreed with us notot only that the statute was unconstitutional, the NSLs were unconstitutional, but that what the Muasey court had done wasn't sufficient U And so that was the initial decision, which was great. It was a great ruling But even though they won, the judge once again issued a stay, saying, while the NSL is unconstitutional, nothing actually changes until the government can appeal And so the case was going to have to go to the appeals court next And they had to wait to see what happened there So just as we won the first case on behalf of Credo We had heard from Cloudflare who is a service provider that helps protect against DDS attacks and things like that. And Cloudflare had received an NSL, and they saw what we were doing. They didn't know who our client was, but they knew that we were fighting this in the court. So they came to us and said, we got one of these two, Will you represent us So just as we actually got the first decision from the judge, The same day we filed on behalf of Cloudflare and that was already in the works beforehand. We didn't really know when the decision was going to come out, but the timing was very kind of advantageous. And so we thought, well, we just won the first one, we'll go back in and we'll win the second one. and it didn't go that way So the EF started calling these the alphabet cases. Since they couldn't use their client names, they had to just come up with codeenames. So this case with Credo, the telecom provider was called case Q. and the case with Cloudflare, they called case Z And strangely, almost immediately upon Cito winning their first case, they got served another NSL. Yeah, so right away, they issued another one. and I, you know, we were we were very surprised Uh, and, you know, one of the things I think that signaled to us is that these, you know, the PI had gotten really used to this tool and really wasn't ready to stop using it even though they'd gotten a bad decision, which was, you know, made us feel vindigated that we were going to keep fighting for these, you know, that that it wasn't There wasn't one and done for them. They liked having this authority and they were going to keep pushing So we had to keep pushing Okay, well, another NSL means another lawsuit against the government. So the FF called that case W and now had three lawsuits against the US government, declaring these things are unconstitutional and the law should be changed. And so every time you sued the government in each of these cases, the government sued you right back Yeah, I think so. They They definitely did for the first Credo case. I think they might have stopped at some point because the judge told them not to, but they definitely did because she didn't think that was right for them to do So just when she felt like she was getting momentum on these cases, the government started to play unfair And then while the case was going on Congress actually amended the statute and wrote a lot of those Mukese processes into it and also said basically that these gag orders couldn't be eternal anymore Um, They are up to three years initially, but then there has to be an evaluation about whether there's still an ongoing reason to have the gag and the FBI is supposed to file a you know, a declaration about it. and if they don't have an ongoing reason to have a gag order, they they should lift the gag So because this statute got amended, this meant all her cases had to be reset and retried in the lower courts, starting from square one So she went back to the lower court and saw the same judge she saw before However, this change they made is actually a big step forward because previously when you got at NSL, you were silenced for life But now they decided to reduce that to three years However, it's still very limited of what you could say even after that. I think you can say you received an NSL, but you can't say who for After the new statute got passed, the court sent us back down to the lower court. and Judge Ilston, who was the judge who we'd had in the lower court, said Well, they fixed it enough It's not eternal anymore. We've got this process. you know, they're not going to be suing people for seeking this and you can tell your lawyers. So that's enough to bring it within the First Amendment, the gag orders in the First Amendment This was a big blow. The same judge who emphatically thought these NSLs were unconstitutional seemed to have lost her courage in her ruling and changed her mind tried to appeal the decision, but the court basically said It's over home And that was it. For the EFF who tried to fight this too After that ruling The courts were done with them. And so the status today is that this is still going on. and we have no idea how many NSLs are being issued And very little has changed since this battle started. We know that Google got these NSLs because they've also thought it was unconstitutional and they also sued the government And they were able to get as far as the Ninth Circuit Court of Aeals in California, but the judge there ruled on the side of the NSL saying, no, Google, you have to comply with these letters And so even Google couldn't get this to change and was forced to give the FBI whatever data they were asking for Cindy still thinks that more needs to change about these NSLs. It's not great. Let me tell you, I'm not happy. I would like NSLs to require the FBI to go to a judge first and ask for the judge, show the judge what they were doing in their investigation and say, is there enough here for me to go to the ISP and ask for this information about a particular person I don't know that it needs to be a full probable cause warrant like the Fourth Amendment requires, but there's plenty of kind of in between sorts of court orders for this kind of information and it ought to fit in one of those categories. that That's what ought to have happened So we're still far from where it needed to be But we're also pretty far from what the FBI wanted What I learned from Cindy's book, and Nick's case is that there's three ways that you can deal with this particular issue. You can do legislation where you petition Congress to change the law We know how hard that is, especially when it comes to such a secretive thing like NSLs. There's just not enough people who know about this, to be outraged, to make a meaningful petition to get this changed. And because these NSLs come with a gag order, if you get hit with one, you can't go to Congress and say, hey, look at how terrible of a situation I'm in because you're not allowed to tell anybody And so Congress just doesn't do anything to help us here And the second thing is litigation, which is exactly what Cindy enicked to go through the court system, which is supposed to be the check and balance to laws and has the power to overturn laws and write new laws That didn't work for them And then and then what's the third way? The third way is technology Like what if we build systems that make it harder to spy on people Why are all the systems that we have for communication so transparent And so just open to surveillance. Yeah, it's a good point. Can technology alone solve this problem? I think so J just in my lifetime, there has been an extraordinary boom in math and cryptography. And we could do things now that we've never been able to do before. The best encryption today still holds up against the best cracking tools around So can we create companies in such a manner that encrypt user data in such a way that an NSL would be pointless That's what Nick set out to do And I learned about a philosophy called privacy by design And privacy by design means that when you're building something From like the first meeting you have when you're conceptualizing something, you think about how to make it private. I decided to sort of go off in this third direction of technology thinking that like, well, I believe in I believe in math, I believe in encryption, I believe in all this kind of stuff. I think that we as technologists can do something to make the problem better So he pivoted with his company, Calx. Instead of it being an ISP, he turned it into a privacy focused company, which created a bunch of things, but the stuff that they're most notable for is the Calux OS and the Calux hotspot Nick wanted to help as many people as possible become more private and thought that the best way that he could do this is to create a mobile operating system that is private by design He thought this would have the biggest impact since phones are ubiquitous worldwide and everyone's online with them. They' cheap and everywhere The two dominating mobile OSs today are Apple's iOS and Google's Android. And since we know they probably both comply with NSLs, any activity you do on there means the government can ask for it whenever they want without a warrant So what about an alternative phone OS that doesn't know anything about its users? That way, if the government sent an NSL to Calx, they wouldn't have a clue who's using their OS. What they did is they took the Android OS, ripped out all the Google stuff, so it stopped sending telemetry to Google or even Calx for that matter I personally use graphene OS on my phone, which is very similar. There's no trace of Google on my phone and I love it to fund it, they rely on donations, but they also have a hotspot service that they offer, which I actually pay for and use. You basically give them a yearly donation and they send you a Wiifi hotspot that works good for a year. And the hotspot is not connected to my name. I paid for it anonymously using cash at Devcod. and the only thing they have on me is my email address which is a birer email. And this little hotspot has been doing great for me for years and it's going really well for Calx too. I've seen their booth at DevCOon year after year. But Nick has recently started a whole new project I started a mobile phone company trying to use the whole principle of privacy by design to be more private than the existing phone companies. You know, there's been a lot of historic stuff that led to the phone companies keeping tons of records about people about their communications, about who they communicate with collecting all kinds of metadata, collecting location data and I think that companies can do better And so I built a company called Freely The concept of which is that You can sign up for it and give almost no information about yourself. In fact, you can sign up and give as little as just your zip code First off, he doesn't want to know who his customers are. So he made it impossible to connect the dots between who the paying user is and what phone number they have, or SIM card And the way he did that is kind of like buying chips in a casino or tokens at an arcade. In those places you go to the cashier, you hand them cash and they give you chips or tokens to play the games. and none of the games have any way to know exactly Wh is playing since the tokens aren't connected to your name, it can be mixed around with other people's tokens his customers byy sort of an anonymous voucher using their credit card or if they wish an anonymous way, like through cryptocurrency And then they can redeem that voucher at freely in order to get their phone service So it's not possible to trace who had what voucher At least that's the simplified version, the way I understand it. He uses a ton of encryption, which is really interesting and amazing, but it's very geeky. And I just love how tech actually solves these problems And second, he logs as little as possible, which I believe is what he's legally required to retain, which is zip codes for customers for tax reasons and aggregate call data just to show how many minutes sp like coming between the Northwest and southwest regions of the U.S. Oh, and I think he monitors how much bandwidth users have so that he can charge them appropriately. It's not perfect privacy, but it's far more private than the average cell phone provider And that makes me think If this is something that Nick can just up and make because he cares about his customers's privacy that much, Anden how come our cell providers don't take our privacy as seriously as Nick does So this is what it looks like when technology fights back to solve a problem that Nick saw with the NSLs But it solves way more than just the NSL problem. It enhances privacy for all users. So many of these services we pay for, they just sell our data to data brokers The NC doesn't even have your data to sell it see, we just talked about how you got a head with an NSL and for the government wanting data from one of your customers, I have a feeling that Um, mean maybe it's a conspiracy theory that all these ISPs, not ISPs, but mobile carriers have back doors with the government to allow them to see everything. And I have a feeling that the government's going to come to you your knocking on your door again, asking to see some customer data. And this is all gonna start over all over again You know, it may. I mean, clearly I'm u a sucker for punishment or a slow learner or something like that. But I'm actually trying to draw upon all my experiences in the past.