18 U.S.C. 2709 gives the FBI the power to compel telephone companies, internet service providers, and other communications providers to hand over subscriber information and transactional records without a warrant, court order, or grand jury subpoena. The request comes in the form of a National Security Letter, or NSL, and it almost always arrives with a gag order attached. The FBI issued 12,362 such letters in 2023, containing 39,214 individual requests for information.1Office of the Director of National Intelligence. Annual Statistical Transparency Report for Calendar Year 2023 If you receive one, you have a legal duty to comply, a right to consult an attorney, and a right to challenge both the demand and the secrecy requirement in federal court.
What the Statute Actually Authorizes
Section 2709 sits within Chapter 121 of Title 18, which governs access to stored electronic communications and transactional records. It obliges “wire or electronic communication service providers” to turn over two categories of information: subscriber details such as name, address, and length of service, and toll billing or transactional records.2Office of the Law Revision Counsel. 18 U.S. Code 2709 – Counterintelligence Access to Telephone Toll and Transactional Records The statute does not reach the content of communications. Emails, text messages, and call recordings are not obtainable through an NSL under 2709.
To issue the letter, the FBI must certify in writing that the records are “relevant to an authorized investigation to protect against international terrorism or clandestine intelligence activities.” Relevance is a considerably lower bar than the probable cause required for a warrant. One statutory guardrail applies: an investigation of a U.S. person cannot be predicated solely on activities protected by the First Amendment.2Office of the Law Revision Counsel. 18 U.S. Code 2709 – Counterintelligence Access to Telephone Toll and Transactional Records
The USA FREEDOM Act of 2015 added a specificity requirement. Each NSL must use “a term that specifically identifies a person, entity, telephone number, or account” as its basis, and bulk collection under the NSL statutes is permanently prohibited.3Federal Bureau of Investigation. Reauthorizing the USA Freedom Act of 2015
Who Can Be Compelled
Section 2709 reaches “wire or electronic communication service providers.” In practice, that covers telephone carriers, internet service providers, email platforms, and messaging services. Cloud storage providers and data aggregators increasingly fall within the same category when they hold subscriber or transactional records for others. A provider can receive an NSL even when it has no direct relationship with the person under investigation, as long as it holds relevant records.
Other federal statutes authorize NSLs to financial institutions and credit reporting agencies, but those operate under separate legal provisions. Section 2709 addresses communications records only. If you run a bank, a credit bureau, or, under the expanded Bank Secrecy Act definitions, a business like a travel agency or vehicle dealership, any NSL you receive is likely issued under a different authority.4U.S. Department of the Treasury. Treasury Department USA Patriot Act Update
How the Letter Gets Issued
No judge reviews an NSL before it goes out. The FBI Director signs it, or a designee ranked no lower than Deputy Assistant Director at headquarters or Special Agent in Charge at a field office.2Office of the Law Revision Counsel. 18 U.S. Code 2709 – Counterintelligence Access to Telephone Toll and Transactional Records Officials in acting capacities in these roles also have signing authority, according to the Department of Justice.5United States Department of Justice. Authority of Acting FBI Officials to Sign National Security Letters
The signed letter goes directly to the provider. It identifies the specific selector, whether that is a person, entity, phone number, or account, and it certifies the relevance finding. The statute imposes a duty to produce records but does not fix an explicit deadline. Most providers comply without pushing back, partly because the burden to trigger any judicial review falls on the recipient.
The Gag Order
Under 2709(c), the FBI can attach a nondisclosure requirement when a senior official certifies that disclosure could endanger someone’s safety, threaten national security, interfere with diplomatic relations, or compromise a criminal or intelligence investigation.2Office of the Law Revision Counsel. 18 U.S. Code 2709 – Counterintelligence Access to Telephone Toll and Transactional Records In practice, the FBI attaches this certification to most NSLs.
If a gag order applies, you cannot tell the customer, the public, or most employees that the request exists. You can disclose the NSL to people whose help you need to comply with it, and you can disclose it to an attorney for legal advice. If the FBI asks, you must identify anyone you told, though your attorney is exempt from that identification requirement.
The current gag framework is the product of litigation. In 2004, the Southern District of New York held in Doe v. Ashcroft that the NSL statute was unconstitutional under the First and Fourth Amendments, in part because it offered recipients no way to contest an indefinite secrecy order.6United States District Court for the District of Connecticut. John Doe v. Alberto Gonzales – Ruling on Plaintiffs Motion for Preliminary Injunction Congress responded with judicial review provisions in the 2005 Reauthorization Act.
Challenging the Request or the Gag
A companion statute, 18 U.S.C. 3511, gives recipients a formal path to court. You can petition a federal district court to modify or set aside either the data request or the nondisclosure order. File in the district where you do business or reside.7Office of the Law Revision Counsel. 18 U.S. Code 3511 – Judicial Review of Requests for Information
On the data request itself, the court can modify it or throw it out if compliance “would be unreasonable, oppressive, or otherwise unlawful.” On the gag order, the mechanics differ. You notify the government that you intend to challenge the nondisclosure requirement, and the government then has 30 days to apply to a court to keep the gag in place. If the government does not act within that window, the nondisclosure requirement lapses.7Office of the Law Revision Counsel. 18 U.S. Code 3511 – Judicial Review of Requests for Information
Expect the proceedings to be secret. Courts must close hearings, and petitions, filings, and orders are kept under seal. The government can also ask the court to review its submissions ex parte and in camera, which means your lawyers may never see the full justification for either the letter or the gag. Few recipients litigate, and this asymmetry is one reason.
Penalties for Refusing or Disclosing
If you refuse to hand over the records, the Attorney General can ask a federal district court to compel compliance. Disobeying that court order can be punished as contempt, with the risk of fines or incarceration.7Office of the Law Revision Counsel. 18 U.S. Code 3511 – Judicial Review of Requests for Information
Violating a gag order carries its own criminal exposure. A person who knowingly and willfully discloses an NSL after being notified of the nondisclosure requirement faces up to one year in prison. If the disclosure was intended to obstruct an investigation or judicial proceeding, the ceiling rises to five years. Those penalties are separate from any contempt sanction a court might impose.
Scale of Use and Oversight Findings
NSL volumes have run in the tens of thousands per year. The Office of the Director of National Intelligence reported 12,362 NSLs in 2023, 10,941 in 2022, and 11,158 in 2021.1Office of the Director of National Intelligence. Annual Statistical Transparency Report for Calendar Year 2023 Each letter can contain multiple requests, so the total number of individual requests runs two to three times higher.
The Department of Justice Office of the Inspector General has repeatedly flagged compliance problems. A 2007 review found that the FBI had issued NSLs in violation of the authorizing statutes, Attorney General guidelines, and internal policies. The IG identified instances where the FBI collected information it was not authorized to obtain, exceeded the scope of individual NSLs, and included inaccurate information in the letters. The FBI’s reporting to Congress significantly understated the true number of NSLs it had issued.8Department of Justice Office of the Inspector General. A Review of the FBI’s Use of National Security Letters Later reviews credited the FBI with improved policies and tracking, but noted that some compliance problems persisted.
Whether You Get Paid for Compliance
Chapter 121 contains a cost reimbursement provision at 18 U.S.C. 2706, requiring the government to pay a fee covering costs “reasonably necessary and directly incurred” in searching for, assembling, and producing records, including any disruption to normal business operations. The fee is set by agreement or, failing that, by a court.9Office of the Law Revision Counsel. 18 U.S. Code 2706 – Cost Reimbursement
By its terms, 2706 applies to disclosures under sections 2702 through 2704, not to NSL production under 2709. Providers responding to an NSL therefore lack a clear statutory right to reimbursement through the same framework. For companies handling high volumes of requests, the compliance cost can be significant, and the gap is worth factoring in when evaluating your obligations under a letter you receive.