FBI has consistently asked companies for more info via NSLs than they are obligated to give, and some firms without legal expertise have complied
The Intercept :
Context & Ripple Effects
This report lands mid-arc in a run of disclosures about how national security letters actually work in practice. A court ruling first exposed the scope of FBI NSL collection, confirming the bureau needs no warrant to obtain browsing history, online shopping records, and location data.
Since then, The Intercept has shown the FBI kept demanding email records even after DOJ concluded a warrant was required, and this piece adds the mechanism behind that pattern: requests routinely exceed what recipients are legally obligated to provide, and smaller firms without in-house legal expertise simply comply. Why it matters is that the over-request problem is now colliding with organized pushback — Cloudflare has joined CREDO and EFF in challenging the letters' constitutionality and their gag orders.
First-order effects
- Small providers without legal teams are handing over more subscriber data than NSL statutes require, effectively volunteering information the law does not compel them to surrender.
- Larger firms with counsel are positioned differently: they can parse the statutory limits, which means the same letter produces different disclosures depending on the recipient's legal sophistication.
Second-order effects
- As recipients like Cloudflare, CREDO, and EFF litigate the letters and their gag orders, the FBI faces mounting legal friction around a tool it had used quietly — consistent with issuance dipping to 12,150 letters in 2016 amid rising company challenges.
- The compliance asymmetry pressures smaller ISPs and email hosts either to retain outside counsel or to absorb reputational risk when their over-compliance surfaces in reporting like this.
Third-order effects
- If the litigation wave holds, NSL practice gets forced toward its statutory floor rather than its maximal reading — shifting the boundary of warrantless surveillance from FBI request templates to case law, one challenged letter at a time.
The trend: Warrantless surveillance via national security letters is migrating from quiet administrative compliance toward a litigated boundary, with tech companies' constitutional challenges setting the pace.