The national security letter is unusual in the set: compulsory, issued without a court, and historically accompanied by open-ended secrecy. Its scope has been narrowed substantially through litigation and legislation.
What an NSL is
An administrative demand issued by the FBI under several statutory authorities, certifying that the records sought are relevant to an authorised national security investigation. No judge approves it in advance.
Its reach is limited by statute to categories including:
- Subscriber name and address
- Length of service and type of service provided
- Toll billing records or electronic communication transactional records
Content is outside NSL authority. Whether particular categories of modern metadata fall within “electronic communication transactional records” has been contested, and the FBI’s reading has at times been broader than providers and courts accepted.
The secrecy problem, and how it changed
For years NSLs came with indefinite non-disclosure requirements and no clear route to challenge them. That drew sustained First Amendment litigation, and the USA FREEDOM Act introduced a reciprocal notice procedure requiring periodic review of whether secrecy remains necessary, plus judicial review on request.
| NSL | 2703(d) order | |
|---|---|---|
| Prior judicial approval | None | Required |
| Issued by | The FBI | A court |
| Reaches content | No | No |
| Built-in secrecy | Yes, subject to review | No, requires a separate order |
| Transparency reporting | Banded ranges only | Precise counts |
What it means for a company receiving one
- Check the demand against the statutory categories. An NSL asking for content or for records outside its authority should be narrowed, and providers have successfully pushed back on overbroad readings.
- Use the review procedures. Secrecy is reviewable, and recipients can trigger that review rather than treating the restriction as permanent.
- Report within the permitted bands. Precise counts are not permitted, and the banding rules are specific.
- Route these separately from criminal process. The authorities, the constraints, and the reporting rules all differ, and handling them in the same queue as ordinary subpoenas invites mistakes in both directions.