Government Rescinds Gag on Secret Surveillance Order After ACLU Intervenes

The American Civil Liberties Union today released documents related to a secret subpoena and gag order sent to one of the country's main providers of encryption technology and communications services. The company, Open Whisper Systems, complied with the subpoena, turning over the limited customer information it had -- but the gag order was lifted after the ACLU formally protested it as a violation of the company's free speech rights.

Open Whisper makes the encrypted-communications app Signal, which allows users to have secure phone calls and text message conversations. The company is also behind the Signal Protocol, which powers the encryption built into Facebook Messenger, Google's Allo, and WhatsApp.

The new documents show that earlier this year, as part of a federal grand jury proceeding in Virginia, the Justice Department sent a subpoena to Open Whisper demanding a wide array of Signal account information associated with two phone numbers. It also sent a yearlong gag order -- signed by a federal magistrate judge -- preventing the company from revealing anything about the subpoena to anyone, on the grounds that such information could interfere with the case. The gag order meant not only that Open Whisper was prohibited from notifying individual account holders, but that it was forbidden from telling the public that any of Signal's millions of users had ever been the subject of a government request for data.

Open Whisper contacted the ACLU, which sent a letter to the government arguing that the blanket gag order was excessive and unnecessary. The government later agreed to have the gag order lifted, allowing today's document release.

"This case shows that the government is hiding its requests for Americans' records using extreme secrecy even where it is plainly unwarranted," said Brett Max Kaufman, a staff attorney with the ACLU. "The First Amendment protects companies like Signal who want to communicate basic information about government requests for customer data. The government should not be seeking all-encompassing gag orders by default, as it appears to be doing."

The account information sought by the government in the subpoena included the name, email, any associated accounts acquired through "cookie data," and IP addresses, which can show geographic location. The subpoena requested information for any accounts associated with two phone numbers, but one of the numbers was not associated with a Signal account. In the interests of its users' privacy, Open Whisper retains very little customer information. The company gave the government the data that it did have on the single account, which was the dates and times for when the account was created and when it last connected to Signal's servers.

Open Whisper said that this was the first time that it has received such a subpoena.

The documents released today are here:
https://www.aclu.org/open-whisper-systems-subpoena-documents

A blog post with more analysis by ACLU attorney Brett Max Kaufman is here:
https://www.aclu.org/blog/free-future/new-documents-reveal-government-effort-impose-secrecy-encryption-company