U.S. Court of Appeals for the Ninth Circuit S. Todd Rogers / The Recorder

SAN FRANCISCO — In a setback for internet and telecom providers, a federal appeals court on Monday ruled that provisions in the Electronic Communications Privacy Act barring companies from disclosing government surveillance requests do not violate the First Amendment.

A unanimous panel of the U.S. Court of Appeals for the Ninth Circuit rejected arguments by the Electronic Frontier Foundation, a digital civil liberties group, that it is unconstitutional for companies to be permanently barred from disclosing any information about the requests.

The group had also argued that the requests, known as “national security letters” (NSLs), must be subject to automatic court review instead of placing the burden on companies to initiate any challenge to their scope or the breadth of the nondisclosure requirements.

But the panel found that because companies need only notify federal authorities that they wish to challenge—and do not actually have to file the lawsuit themselves—their burden is “de minimis” and allowable under the seminal 1965 decision by the U.S. Supreme Court in Freedman v. Maryland, which deals with limits on censorship in the context of films.

Freedman does not require that the government provide judicial review of confidentiality provisions for the benefit of individuals who do not wish to speak,” Judge Sandra Ikuta wrote for the panel, which was rounded out by circuit judges Randy Smith and Mary Murguia.

Andrew Crocker, the EFF staff attorney who argued on behalf of mobile phone service provider Credo Mobile Inc. and cloud computing company Cloudflare in their challenge of the NSL provisions, said he was disappointed the panel agreed with the government on that point.

“That’s just not right,” Crocker said. “You’re not supposed to have to do anything special to have First Amendment rights. You just have them.”

Crocker also criticized the panel for accepting the government’s argument that permanent disclosure bans may be necessary for national security reasons, and are allowable because they are still subject to judicial review. “The First Amendment does not allow permanent gag orders,” he said. “It’s simply unconstitutional.”

Mark Abueg, a spokesman for the Department of Justice, declined to comment.

The case has a long and complicated procedural history. Credo and Cloudflare both received multiple NSLs from the FBI and challenged the scope of the information requested and the associated nondisclosure requirements. Their case went to the Ninth Circuit once before, but was sent back to district court after the relevant legal provisions were amended in 2015.

U.S. District Judge Susan Illston of the Northern District of California found those amendments, which added the challenge notice procedure, among other things, sufficiently addressed the constitutional issues raised by the EFF. The panel affirmed her ruling.

NSLs allow authorities to obtain limited records from internet or telecom service providers about their subscribers, like their name and contact information, unlike warrants for the actual contents of electronic communications issued under the Stored Communications Act.

Companies are generally barred from disclosing the fact that they have received an NSL, other than reporting a wide band of the number they have gotten. A company that received just two requests, for example, could report that it received “0 to 99″ NSLs. They must obtain permission from the FBI to disclose more information, but can challenge the FBI’s decision in court.

The 2015 amendments also added procedures requiring federal authorities to internally review restrictions on companies’ disclosure of NSL information periodically. In the opinion, Ikuta wrote that this change helped address concerns that the legal provisions are not “narrowly tailored” to achieve the government’s interest in maintaining national security.

“Under these procedures, the FBI is required to reassess the necessity of nondisclosure on two occasions: three years after an investigation is begun and upon the closing of an investigation,” the judge wrote. “This mandated reassessment reduces the likelihood that an overly long nondisclosure requirement will be imposed.”

A number of other tech companies, such as Microsoft Corp. and Twitter Inc., have similarly challenged government-imposed limits on transparency around surveillance requests in cases still ongoing in lower courts. Twitter won a round in its case ast earlier this month, in what Crocker pointed to as an encouraging sign that the fight over the issue will continue.

“I think this is a setback. I’m not going to beat around the bush,” he said. “But I still think that the trend is toward questioning of these blanket gag orders.”

Contact the reporter at bhancock@alm.com. On Twitter: @benghancock.