On January 27, 2014, the Attorney General and Director of National Intelligence announced that the U.S. government will allow Internet companies and telecommunications providers to disclose more information about government demands for customer data in national security investigations.  The government’s new transparency policy addresses legal demands served under two distinct statutory authorities.  First, under the Foreign Intelligence Surveillance Act (“FISA”), the government can apply to the U.S. Foreign Intelligence Surveillance Court (“FISC”) for orders compelling providers to disclose both the contents of their customers’ communications as well as non-content “metadata” relating to such communications.  Second, under the National Security Letter (“NSL”) statute, the FBI can compel companies to disclose certain non-content information about their customers.

Under the new policy announced on January 27, technology companies now have two options for reporting on the number of FISA orders and NSLs they receive:

Under the first option, companies may separately report FISA orders seeking content information, FISA orders seeking non-content information, and NSLs.  Each category of legal demand must be reported in bands of 1,000, starting with 0-999.  Companies may also report the number of user accounts affected by each category of demands, again within bands of 1,000.  Under this option, companies may report FISA and NSL numbers (in bands) every six months, but for FISA numbers, there must be a six-month delay between the reporting date and the period in which the orders covered by the report were served.  There is an additional two-year delay for reporting on “New Capability Orders” issued under FISA — i.e., orders that seek communications data from new platforms, products, or services.

Alternatively, under the second option, companies may report the total number of all national security demands they received, including all NSLs and FISA orders, reported as a single number in bands of 250, starting with 0-249.  Companies are also authorized to report the number of accounts affected under all national security orders, again within bands of 250, starting with 0-249.

The government’s new policy comes on the heels of coordinated lawsuits filed in the FISC last year by several large electronic communication service providers seeking a declaration under the First Amendment that they were entitled to report on aggregate data regarding government national security demands.  (Covington represented Microsoft Corporation in that litigation.)  After the government announced its new policy, the companies voluntarily dismissed their lawsuits.