CloudFlare Transparency Report on National Security Orders
blog.cloudflare.com
blog.cloudflare.com
If you've never received one, my understanding is that there's no law preventing you from saying "0", so why wouldn't you if it were true?
I'm puzzled why it's not 1-249 with 0 being a different group. So this law basically means that as long as you send less than 250 requests to a single company you're fine.
Might as well start sending 249 requests to every company they can think of.
I think you just answered your own question. The difference between 0 and 1 is pretty important.
Think of it this way: until relatively recently, Github would return either a 500 or a login page (I forget which) if a logged-out user tried to access a private repo, whereas they would return a 404 if a logged-out user tried to access a nonexistent repo.
If someone thought that you were working on a secret project and they had an idea what the project name might be, they would be able to confirm this with a simple HTTP request. They don't even need to see the contents of the repository in order to obtain what could be potentially damaging information (the mere existence of the project).
This way, one can never be sure whether a company has received any letters, which is itself a rather valuable piece of information, until they have already received a large number (and presumably for a large number of targets).
If a service was allowed to say that they had 0 requests, perhaps more users would flock to that service as a less surveilled alternative to a competitor that is in the 1-249 bracket(or higher).
As a US resident (and citizen), though, I find this very disconcerting. The difference between 0 and 249 requests is a lot.
There isn't much else a company the size of Cloudflare can be expected to do (lobbying the government requires levels of cash that I doubt Cloudflare has right now), but it makes me sad that this is even newsworthy.