EFF sues to uncover government demands to decrypt communications

The Electronic Frontier Foundation is suing the U.S. Department of Justice over its failure to disclose if Internet companies have been compelled to decrypt user data and communications.

The EFF action targets applications to and decisions by the Foreign Intelligence Surveillance Court (FISC), a Washington, D.C., based court that meets in secret to consider cases related to government surveillance and national security.

The court’s decisions are classified, and Internet companies are prohibited from disclosing any details about warrants received as a result of arguments in front of the court.

The result is that little is known about the extent of the court’s activities. In October, the EFF filed a freedom-of-information request seeking more information but, according to its lawsuit, the DOJ said it couldn’t find any documents relating to the issue.

The EFF filed a second freedom-of-information request in March this year seeking significant decisions or opinions issued by the FISC, but the group says it so far hasn’t received a satisfactory response. Those opinions must be declassified as part of surveillance reforms enacted in last year’s USA Freedom Act, the EFF argues.

The lawsuit, which was filed in the U.S. District Court for the Northern District of California in San Francisco, also argues the DOJ must disclose “if the government has ever sought or obtained an order from the FISC requiring third parties to provide technical assistance to carry out surveillance.”

Widespread user concern about the reach of domestic Internet surveillance by U.S. intelligence agencies has led major Internet companies to begin publishing “transparency reports” that detail in broad terms the number of times they have been ordered to turn over data to law enforcement agencies.

Many have also included a so-called “warrant canary” stating the company has never received a warrant from the national security court. When the language is removed from the report, it can be assumed the company has received at least one such warrant.