Compelled disclosure: Difference between revisions

Revision as of 23:31, 4 November 2026

Compelled disclosure is an order from a court or a government that requires a service provider to hand over data about its users. Some orders come with a gag that forbids the provider from saying it has received one. The Logos activist course Building a Parallel Society sorts a provider's possible responses into three: obey, close the service, or have nothing useful to hand over. It illustrates them with ProtonMail in 2021, Lavabit in 2013 and Signal from 2016 onwards.

The basics

What a provider can hand over depends on what it holds. A company that keeps account details, logs or encryption keys can be ordered to give them up. Signal argues that a provider that never collects such data has nothing to produce. Its published responses to legal requests say it cannot turn over information it never had access to in the first place.

Orders of this kind can come with secrecy. When Lavabit closed in 2013, its founder said he was not legally allowed to share the events that led to his decision.

In the United States one such order is the national security letter, an FBI demand for records that needs no approval from a judge. LAN, the Logos zine, traces its wider use to the USA PATRIOT Act of 2001. Its second issue argues that after the Act a vague relevance to an investigation was enough, without any actual suspicion of a crime and without a judge. It gives requests rising from about 8,500 in 2000 to about 56,000 in 2004. The letters, it adds, came with gag orders that courts for years had no real power to review. An ACLU summary of a 2007 Justice Department Inspector General review gives 8,500 for 2000 and 56,507 for 2004. See Issue 2/The Patriot Act at 25.

The cases below differ in what each provider held when the order arrived, and in what it then did.

How it applies to Logos

The course uses these three cases to argue that "Policy cannot protect us, only architecture can". It names three options: obey, refuse and die and have nothing to give. In the course's view only the third survives, and a resistant parallel society is built so that it cannot be coerced.

The course pairs this with a second risk, being switched off, which this wiki covers under Infrastructure shutdowns. It presents the Logos stack, made up of Logos Blockchain, Logos Storage and Logos Messaging, as its answer to both. In the course's account the stack runs as networks of independent machines all over the world, so there is no company to order and no switch to pull. Logos describes Basecamp as a local-first launcher for peer-to-peer apps built on Logos.

Examples

Obey: ProtonMail, 2021

In September 2021 Proton, the Swiss company behind the ProtonMail email service, published a response to the case of a climate activist arrested by French police. Proton said it had received a legally binding order from Swiss authorities that it was obliged to comply with, and that there was no possibility to appeal this particular request.

Engadget reported that French authorities sent the request via Europol and that ProtonMail gave up the activist's IP address to Swiss police. The Register, citing a French activist blog, reported that the group targeted was called Youth for Climate. It also noted that in January 2021 ProtonMail's homepage had said that by default it did not keep IP logs that could be linked to an anonymous account. That wording was later changed.

Proton's response highly recommended its onion site on the Tor network for users with heightened privacy needs.

Close the service: Lavabit, 2013

Lavabit was an encrypted email service run by Ladar Levison. In 2013 the US government obtained a pen/trap order to collect information in real time about the Lavabit email account of a specific investigatory target. To do this it demanded the service's encryption keys. An order of 1 August 2013 told Lavabit and Levison to hand over the keys by 2 August.

The keys protected the whole service. The US Court of Appeals for the Fourth Circuit later wrote that exposing one key-pair could affect all of Lavabit's estimated 400,000-plus email users. Levison first handed over the keys as an 11-page printout of largely illegible characters in 4-point type. The district court found Lavabit and Levison in contempt. After he provided the keys, he also shut Lavabit down entirely.

On 8 August 2013 Levison posted a statement. In it he wrote that he had been "forced to make a difficult decision: to become complicit in crimes against the American people or walk away from nearly ten years of hard work by shutting down Lavabit." The Electronic Frontier Foundation noted that the service had apparently been used by Edward Snowden. In April 2014 the Fourth Circuit upheld the contempt finding.

Have nothing to give: Signal, 2016 onwards

Signal publishes the legal requests it has been forced to answer on a page called Government Communication. As of 4 November 2026 its list runs from a 2016 grand jury subpoena in the Eastern District of Virginia to a subpoena from the District of Columbia in November 2026.

In the 2016 case Signal said the only information it could produce was the date and time a user registered and the last date the user connected to the service. In a 2021 case from the Central District of California it again gave only Unix timestamps for when each account was created and when each last connected. Signal says it has no access to users' messages, chat lists, groups, contacts, profile names or avatars.

Gag order: Calyx Internet Access, 2004

In 2004 the FBI served Nicholas Merrill, owner of the New York internet provider Calyx Internet Access, with a national security letter asking for records on one of his clients. According to the ACLU, the letter included a gag order that barred Calyx from telling anyone it had received the demand. Represented by the ACLU, Merrill challenged the law behind the letter under the pseudonym Doe, in the case Doe v. Ashcroft.

Merrill was allowed to identify himself in 2010. In a later suit, Merrill v. Lynch, Judge Victor Marrero of the US District Court for the Southern District of New York ruled in his favour in August 2015. The ACLU reported in November 2015 that the court had lifted the gag order in its entirety. In October 2026 Logos published an interview in which Merrill recalls the letter: "I could tell no person that they had asked me for this info."

Takes on this idea

None yet. See Takes.

Sources

Important clarifications regarding arrest of climate activist, Proton, 6 September 2021
ProtonMail under fire after giving authorities an activist's IP address, Engadget, 6 September 2021
ProtonMail deletes 'we don't log your IP' boast from website after French climate activist reportedly arrested, The Register, 7 September 2021
In re: Under Seal (United States v. Lavabit), No. 13-4625, US Court of Appeals for the Fourth Circuit, 16 April 2014
Lavabit Encrypted Email Service Shuts Down, Can't Say Why, Electronic Frontier Foundation, 8 August 2013
Government Communication, Signal, accessed 4 November 2026
Grand jury subpoena for Signal user data, Central District of California, Signal, 2021
Jameel Jaffer, A Decade-Old Gag Order, Lifted, ACLU, 30 November 2015
Merrill v. Lynch, Global Freedom of Expression, Columbia University, read 4 November 2026
Nick Merrill: The FBI Letter He Couldn't Tell Anyone About, Logos, 26 October 2026
ACLU Roadmap of Justice Department Inspector General's Review of the FBI's Use of National Security Letters, ACLU, 19 March 2007
"The Patriot Act at 25", LAN Issue 2, Logos, October 2026, p. 4
Basecamp, Logos, read 4 November 2026
Building a Parallel Society, Logos activist course, 2026

Page status: Outline. Stub · Outline · Usable · Guide · Star. Anyone can improve this page and change its status.

@@ Line 1: / Line 1: @@
-'''Compelled disclosure''' is an order from a court or a government that requires a service provider to hand over data about its users. Some orders come with a gag that forbids the provider from saying it has received one. The Logos activist course ''Building a Parallel Society'' groups a provider's possible responses into three: obey, close the service, or have nothing useful to hand over. It illustrates them with ProtonMail in 2021, Lavabit in 2013 and Signal from 2016 onwards.
+'''Compelled disclosure''' is an order from a court or a government that requires a service provider to hand over data about its users. Some orders come with a gag that forbids the provider from saying it has received one. The Logos activist course ''Building a Parallel Society'' sorts a provider's possible responses into three: obey, close the service, or have nothing useful to hand over. It illustrates them with ProtonMail in 2021, Lavabit in 2013 and Signal from 2016 onwards.
 == The basics ==
-What a provider can hand over depends on what it holds. A company that keeps account details, logs or encryption keys can be ordered to give them up. Signal argues that a provider that never collects such data has nothing to produce. In its published responses to legal requests it says it "cannot turn over information that we never had access to in the first place".
+What a provider can hand over depends on what it holds. A company that keeps account details, logs or encryption keys can be ordered to give them up. Signal argues that a provider that never collects such data has nothing to produce. Its published responses to legal requests say it cannot turn over information it never had access to in the first place.
 Orders of this kind can come with secrecy. When Lavabit closed in 2013, its founder said he was not legally allowed to share the events that led to his decision.
-In the United States one such order is the national security letter, an FBI demand for records that needs no approval from a judge. [[LAN]], the Logos zine, traces its wider use to the USA PATRIOT Act of 2001. Its second issue says that after the Act "vague relevance to an investigation, without any actual suspicion of a crime, was enough, and no judge had to be involved." It gives requests rising from about 8,500 in 2000 to about 56,000 in 2004. An ACLU summary of a 2007 Justice Department Inspector General review gives 8,500 for 2000 and 56,507 for 2004. LAN adds that the letters "came with gag orders that, for years, courts had no real power to review." See [[Issue 2/The Patriot Act at 25]].
+In the United States one such order is the national security letter, an FBI demand for records that needs no approval from a judge. [[LAN]], the Logos zine, traces its wider use to the USA PATRIOT Act of 2001. Its second issue argues that after the Act a vague relevance to an investigation was enough, without any actual suspicion of a crime and without a judge. It gives requests rising from about 8,500 in 2000 to about 56,000 in 2004. The letters, it adds, came with gag orders that courts for years had no real power to review. An ACLU summary of a 2007 Justice Department Inspector General review gives 8,500 for 2000 and 56,507 for 2004. See [[Issue 2/The Patriot Act at 25]].
 The cases below differ in what each provider held when the order arrived, and in what it then did.
 == How it applies to Logos ==
-The course uses these three cases to argue that "Policy cannot protect us, only architecture can". It describes the options as "Obey", "Refuse and die" and "Have nothing to give". The course argues that "Only the third option survives" and that "A resistant parallel society is built so it cannot be coerced."
+The course uses these three cases to argue that "Policy cannot protect us, only architecture can". It names three options: ''obey'', ''refuse and die'' and ''have nothing to give''. In the course's view only the third survives, and a resistant parallel society is built so that it cannot be coerced.
-The course pairs this with a second risk, being switched off, which this wiki covers under [[Infrastructure shutdowns]]. It presents the [[Logos]] stack as its answer to both. In its words, the stack "runs as networks of independent machines all over the world, so there is no company to order and no switch to pull." The initial stack is made up of [[Logos Blockchain]], [[Logos Storage]] and [[Logos Messaging]]. Logos describes [[Basecamp]] as "a local-first launcher for peer-to-peer apps built on Logos".
+The course pairs this with a second risk, being switched off, which this wiki covers under [[Infrastructure shutdowns]]. It presents the [[Logos]] stack, made up of [[Logos Blockchain]], [[Logos Storage]] and [[Logos Messaging]], as its answer to both. In the course's account the stack runs as networks of independent machines all over the world, so there is no company to order and no switch to pull. Logos describes [[Basecamp]] as a local-first launcher for peer-to-peer apps built on Logos.
 == Examples ==
 === Obey: ProtonMail, 2021 ===
-In September 2021 Proton, the Swiss company behind the ProtonMail email service, published a response to the case of a climate activist who had been arrested by French police. Proton said it had "received a legally binding order from Swiss authorities which we are obligated to comply with." It added that "There was no possibility to appeal this particular request."
+In September 2021 Proton, the Swiss company behind the ProtonMail email service, published a response to the case of a climate activist arrested by French police. Proton said it had received a legally binding order from Swiss authorities that it was obliged to comply with, and that there was no possibility to appeal this particular request.
-Engadget reported that French authorities sent the request via Europol and that ProtonMail "gave up a French climate activist's IP address to Swiss police." The Register, citing a French activist blog, reported that the group targeted was called Youth for Climate. It also noted that ProtonMail's homepage had said in January 2021 that by default it did not keep IP logs that could be linked to an anonymous account. That wording was later changed.
+Engadget reported that French authorities sent the request via Europol and that ProtonMail gave up the activist's IP address to Swiss police. The Register, citing a French activist blog, reported that the group targeted was called Youth for Climate. It also noted that in January 2021 ProtonMail's homepage had said that by default it did not keep IP logs that could be linked to an anonymous account. That wording was later changed.
-Proton's response said the use of its onion site on the Tor network was "highly recommended for users with heightened privacy needs".
+Proton's response highly recommended its onion site on the Tor network for users with heightened privacy needs.
 === Close the service: Lavabit, 2013 ===
-Lavabit was an encrypted email service run by Ladar Levison. In 2013 the US government obtained a "pen/trap" order to collect information in real time about "the specific investigatory target's Lavabit email account." To do this it demanded the service's encryption keys. An order of 1 August 2013 told Lavabit and Levison to hand over the keys by 2 August.
+Lavabit was an encrypted email service run by Ladar Levison. In 2013 the US government obtained a pen/trap order to collect information in real time about the Lavabit email account of a specific investigatory target. To do this it demanded the service's encryption keys. An order of 1 August 2013 told Lavabit and Levison to hand over the keys by 2 August.
-The keys protected the whole service. The US Court of Appeals for the Fourth Circuit later wrote that "exposing one key-pair could affect all of Lavabit's estimated 400,000-plus email users." Levison first handed over the keys as an 11-page printout "containing largely illegible characters in 4-point type." The district court found Lavabit and Levison in contempt. After he provided the keys, he "also shut Lavabit down entirely."
+The keys protected the whole service. The US Court of Appeals for the Fourth Circuit later wrote that exposing one key-pair could affect all of Lavabit's estimated 400,000-plus email users. Levison first handed over the keys as an 11-page printout of largely illegible characters in 4-point type. The district court found Lavabit and Levison in contempt. After he provided the keys, he also shut Lavabit down entirely.
-On 8 August 2013 Levison posted a statement. He said he had been "forced to make a difficult decision: to become complicit in crimes against the American people or walk away from nearly ten years of hard work by shutting down Lavabit." The Electronic Frontier Foundation noted that the service had apparently been used by Edward Snowden. In April 2014 the Fourth Circuit upheld the contempt finding.
+On 8 August 2013 Levison posted a statement. In it he wrote that he had been "forced to make a difficult decision: to become complicit in crimes against the American people or walk away from nearly ten years of hard work by shutting down Lavabit." The Electronic Frontier Foundation noted that the service had apparently been used by Edward Snowden. In April 2014 the Fourth Circuit upheld the contempt finding.
 === Have nothing to give: Signal, 2016 onwards ===
 Signal publishes the legal requests it has been forced to answer on a page called Government Communication. As of 4 November 2026 its list runs from a 2016 grand jury subpoena in the Eastern District of Virginia to a subpoena from the District of Columbia in November 2026.
-In the 2016 case Signal said the only information it could produce "is the date and time a user registered with Signal and the last date of a user's connectivity to the Signal service." In a 2021 case from the Central District of California it again gave only "Unix timestamps for when each account was created and the date that each account last connected to the Signal service." Signal says it has no access to users' messages, chat lists, groups, contacts, profile names or avatars.
+In the 2016 case Signal said the only information it could produce was the date and time a user registered and the last date the user connected to the service. In a 2021 case from the Central District of California it again gave only Unix timestamps for when each account was created and when each last connected. Signal says it has no access to users' messages, chat lists, groups, contacts, profile names or avatars.
 === Gag order: Calyx Internet Access, 2004 ===
-In 2004 the FBI served Nicholas Merrill, owner of the New York internet provider Calyx Internet Access, with a national security letter. The letter asked for records on one of his clients. According to the ACLU, it included a gag order that barred Calyx from telling anyone it had received the demand. With the ACLU representing him, Merrill challenged the law behind the letter under the pseudonym Doe, in the case ''Doe v. Ashcroft''.
+In 2004 the FBI served Nicholas Merrill, owner of the New York internet provider Calyx Internet Access, with a national security letter asking for records on one of his clients. According to the ACLU, the letter included a gag order that barred Calyx from telling anyone it had received the demand. Represented by the ACLU, Merrill challenged the law behind the letter under the pseudonym Doe, in the case ''Doe v. Ashcroft''.
-Merrill was allowed to identify himself in 2010. In a later suit, ''Merrill v. Lynch'', Judge Victor Marrero of the US District Court for the Southern District of New York ruled in his favour in August 2015. The ACLU reported in November 2015 that the court had lifted the gag order in its entirety. In October 2026 Logos published an interview in which Merrill recalls the letter. He says: "I could tell no person that they had asked me for this info."
+Merrill was allowed to identify himself in 2010. In a later suit, ''Merrill v. Lynch'', Judge Victor Marrero of the US District Court for the Southern District of New York ruled in his favour in August 2015. The ACLU reported in November 2015 that the court had lifted the gag order in its entirety. In October 2026 Logos published an interview in which Merrill recalls the letter: "I could tell no person that they had asked me for this info."
 == See also ==