They might not have the contents of your messages, but they know who you’re talking to, and when
That's not to say you should use US providers! Just that NSLs aren't a good reason to pick a provider. Pick a service that doesn't have information to share about you in the first place as your high order bit.
"Owning you up" is harder (not impossible, but harder) when they can't simply send a letter and bring the force of the law to bear. NSLs are a very good reason to avoid any system that requires you to use a provider that has a presence in the US (and there are analogous concerns about e.g. AU, and obviously any country where legal and practical protections are weak enough that a strongman can just send a team of thugs round is a nonstarter). But really any specific country is beside the point; it should be table stakes for a serious cryptosystem that one can avoid depending on any single point (and make choices based on one's own trust base vs available resources) whether that's for relay servers, app maintenance, or anything else.
> Pick a service that doesn't have information to share about you in the first place as your high order bit.
True enough; obviously trusting your security to a system that requires you to use a phone number identity is laughable in the first place.
But I think it's quite valid to suggest users should carefully think about the tradeoffs between being subject to legal disclosure and being subject to compromise. Basically, do you trust the FISA courts, or do you trust the code?
The answer isn't really obvious! When it's a random anonymous startup based in, like, Panama that claims to have reinvented JavaScript-based encryption or whatever, yeah, I sorta trust the FISA courts more!
I do think this matters in a general sense, because state actors targeting individual users is a completely different threat from state actors collecting the communication graph of a major hub.
SIGINT is one half their chartered purpose. The other half is SIGSEC. And I had good reason to know directly.