There's no need for this (anymore). You're already allowed to disclose (coarsely) the number of NSL you've received[1].
[1]: https://www.justice.gov/iso/opa/resources/366201412716018407...
> You can't force someone to say something in the US can you?
Unclear. The EFF believes you can't be compelled to lie, however you should consult an attorney with details of the specifics.
This always sounded fishy to me. When a NSL is served, they order you to keep silent about it, so you can't tell e.g. your own CISO. But if the CISO comes and asks, you're not ordered to lie and say you haven't received one? So if the CISO just asks you every morning, the NSL's order of keeping silent is defeated? I can't believe the courts and the executive that support NSLs in the first place would allow such a loophole.
Secondly, the FBI can serve an NSL to the CEO, a separate one to the CISO, and so on down the chain to the tech people whose job would be to fulfill the order. They can choose to serve one or some or all of these orders, and they can order some served people to cooperate and others to keep silent or lie to one another. It's not feasible to expect all of these people, some of whom are not officers of the company, to consult lawyers.
Something important to understand is that non-disclosure is not an automatic feature of the NSL, but that disclosure binds the parties to the terms in the NSL.
[1]: https://vault.fbi.gov/National%20Security%20Letters%20%28NSL...
> Secondly, the FBI can serve an NSL to the CEO, a separate one to the CISO, and so on down the chain to the tech people whose job would be to fulfill the order
Yes, they can, however that's not what happens. The general council may advise the CEO to disclose certain requirements or aspects of the NSL to the CISO or to other parties for the purposes of complying with the NSL. They will almost certainly not recommend disclosing or distributing the NSL "down the chain to the tech people".
I meant they might target the tech people directly from the start - or someone who isn't a C-level executive, anyway - if they think the CxOs would go to a lawyer and the lower level people would just comply.
The point being made upthread is that there is no black and white guidance, there is no secret NSL Guide Book for attornies.
The FBI does in fact has some guidance that your attorney will be able to locate[1]
[1]: https://vault.fbi.gov/National%20Security%20Letters%20%28NSL...
Here is how I am parsing it:
The Office of the Attorney General proposes two options:
1. Separate category reports for NSL, FISA content, and FISA non-content requests and customers affected.
2. A single report for all NSL and FISA requests, and a report for customers affected.
If you want to distinguish between the different kind of request (category 1) then you can report in blocks of 1,000, while if you don't, you can report in blocks of 250.