6

It looks like that US national security letters are a prefect way of social engineering: they request confidential data from you and includes a gag order forcing you no to tell anyone about it.

There are countless of picture examples on the internet which can be used write forged one and submit it to an unsuspecting victims.

How can a company who gets one verify it really came from the government and not some criminal pretending to be the government? Given the fact they cannot tell anyone about it.

closed as off-topic by schroeder Aug 11 '18 at 14:55

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – schroeder
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 2
    "cannot tell anyone about it" except their lawyers and the agency that issued it. This is far more of a legal question than a security question, despite the soceng implications. – schroeder Aug 11 '18 at 14:56
  • 3
    @schroeder How is a question about ensuring the authenticity of a document off-topic here? Why does the involvement of legal processes rather than cryptography affect the topicality? – Gilles Aug 11 '18 at 15:10
  • 1
    Does this generalize? That is, if some company gets a search warrant, or gets served some notice of lawsuit, how does it verify either of these? It's pretty frightening to get served that you're in a lawsuit, there's a window of confusion open for social engineering. – Bruce Ediger Aug 11 '18 at 15:48
  • @gilles because of the specificity. Any answer is not going to be general or conceptual but legal in nature. – schroeder Aug 11 '18 at 16:15
  • 1
    @BruceEdiger: you can always contact the authority who seemingly popped up. If this is the police, call the police to confirm, etc. In large companies there are usually policies to deal with such cases, exactly with the aim to reduce the stress and not make mistakes (and not reinvent the wheel either) – WoJ Aug 11 '18 at 16:17
1

This doesn't contain an answer about how to verify that it's legit but this does answer other questions you probably have about it

EFF - NSL Letters

I would think that the portion containing the gag, to not tell anyone about it, doesn't include barring you from contacting the agency that issued the NSL to you, for further details. For example, if it came from the FBI, you may be able to contact the FBI for further information about it.

Not the answer you're looking for? Browse other questions tagged or ask your own question.