On the morning of September 11, 2001, Nick Merrill was asleep in his Manhattan apartment only blocks from the World Trade Center. He never heard the planes hit the towers, and he didn’t hear them fall. When his roommate finally woke him up and told him, Merrill thought he was joking until he saw what looked like a warzone outside his window. While Merrill didn’t hear the attacks, his life would be changed forever by what transpired in their aftermath.

In the months that followed 9/11, Merrill was struck by the changes to the city: the militarization of ground zero, armed troops on the streets, ID checkpoints to get to his midtown office. “It was emotionally jarring. It reminded me of the stories my grandmother told me about the Franco regime in Spain,” he said. “She talked about soldiers wielding machine guns on every corner. This didn’t feel like America… but people were afraid.”

During the 1990s, Merrill had tried to start a nonprofit to help other nonprofit groups get online, but after some time, he decided to market to corporations, picking up clients like Snapple, Ikea, Mitsubishi, and others. He then sold his services at a discount or gave them away to the nonprofits he wanted to support—like the New York Civil Liberties Union, Democracy Now!, and others. In less than a decade, he had built his small business to over 200 clients.

In February 2004, Merrill received a strange phone call from someone claiming to be from the FBI. The caller said that an agent would be over later in the day with a letter for him. “I thought the call was a prank by one of my tech friends,” Merrill said. “We were always joking like that.” But then later that day there was a loud, “authoritative-sounding,” knock on his door. When he opened the door, an individual in a trench coat showed Merrill an FBI badge and handed him a three page “National Security Letter.”

Merrill read the letter slowly. It was asking for a ton of information. “Emails, messages, account information,” he said, “It was incredibly general… It concluded its demands by saying, ‘and any other electronic transactional records,’ which was just a way of saying, ‘just throw in everything and the kitchen sink.’ It was enough to fill the backseat of a car if all printed out.”

“It looked like a warrant,” he continued. “But when I looked for a judge’s signature, a court, a case number, anything, I saw nothing. It was just a letter addressed to me from the FBI, signed by an attorney at the FBI. I was shocked.” What shocked him even more was how the letter closed. “It said I couldn’t tell anyone, no one, no exceptions. I couldn’t even tell my business partners without risking five years in prison. I asked the agent if I could call a lawyer, and he acted like he had no authority. He was just told to bring the letter.”

Merrill was left with the letter in his hands, which requested what he considered to be constitutionally-protected information about one of his clients, but he said, “I couldn’t speak to anyone about it.” He was visibly frustrated with it as he spoke with us. “Even today, I can’t even tell you anything about the agent—even the gender—or I’ll get five years, ten if they decide it was a deliberate. So even meeting with you here is playing games with my life,” he told us. “So that kinda sucks,” he added understating the point.

After the agent left, he looked up the statute that the NSL claimed for its authority, Title 18, U.S.C., Section 2709(b)—a Patriot Act provision. “I was reading through it, and there’s all this legal jargon. It says something about records related to terrorism or clandestine intelligence activities, and my clients weren’t really in that scene, so it seemed pretty strange to me,” he said. “Finally, I just gave up and said, I don’t think this is legit. There’s no such thing as not being able to talk to a lawyer.”

He called his personal attorney and described the letter. The attorney didn’t think the letter sounded constitutional either, but had never heard of an NSL before. “This is where my nonprofit contacts came in handy,” he said. “One of my clients was the New York Civil Liberties Union, and so we called them and brought the letter down. But the attorneys there said, ‘Wow, we’ve heard of these before, but we’ve never seen one before.’”

At this point, Merrill was getting worried. Here he was speaking to the experts, and they were telling him they had never even seen a letter like this before. “It’s like going to a doctor, and he says, ‘Well, I’ve heard of cancer before, but I’ve never actually seen it before.’ It’s like this is my life!” As it turned out, between 2003 and 2006, the FBI had issued 192,499 letters, averaging about 50,000 each year, and Merrill was the first to ever challenge one. Only two others would ever join him, a group of Connecticut librarians and a California internet company.

The judge in his ruling in the case argued that the Patriot Act gag provisions would prevent anyone but “the most meddlesome and undaunted targets” from consulting a lawyer or challenging the NSL, yet Merrill doesn’t seem to fit that description. The 38 year old is quiet and reserved, a humble hero, and he doesn’t hate the government. He has no interest in meddling—he just wants his privacy.

The ACLU wasn’t even sure how to file his case since their client technically wasn’t supposed to have even spoken to them. Ultimately, they sued in April 2004 to stop the letter under the name John Doe. The court issued a gag order against Merrill. He wasn’t to speak of the case in any way. “It was surreal,” he said of the six years he was gagged. “Here I got married and had a kid, and ‘Oh by the way, here’s all this stuff you didn’t know about me. I could go to jail.’” And his family would never have known why.

“The FBI wanted the trial totally secret. I wasn’t even allowed to show up to my own hearings,” Merrill said. “The feds flipped out at the ACLU just for posting the hearings online…. The whole thing seemed a little spooky. Bush started saying that he could just put anyone in Guantanamo without a trial. I thought, ‘What if they just come and put a bag over my head because I’m pissing them off?’ I thought.” He is still nervous he told us. “My attorney at the ACLU was the same attorney who represented Anwar al Awlaki, and they just killed him. That’s just one degree of separation between me and assassination.”

In 2004, Federal District Court Judge Victor Marrero ruled in Merrill’s favor, writing that “Democracy abhors undue secrecy, in recognition that public knowledge secures freedom…. The compulsory, secret, and unreviewable production of information required by the FBI’s application of [the Patriot Act] violates the Fourth Amendment, and the non-disclosure provision violates the First Amendment.”

Unfortunately for Merrill, the decision didn’t release him from the gag order. It did prompt Congress to revisit the law, and in March 2006, allow NSLs and the gag order provisions to be challenged in court. Under these provisions, the FBI had to justify their gag order to a court, but they used evidence that Merrill and the ACLU were never permitted to challenge, and the law stated the court must treat the FBI’s statements as conclusive.

The case dragged on for six years. In that time, Merrill remained silent about his identity for fear for his freedom. In 2007, when the FBI rose to defend the amended portions of the gag orders, he anonymously submitted an article through his lawyer to The Washington Post. “I found it particularly difficult,” he wrote, “to be silent about my concerns while Congress was debating the reauthorization of the Patriot Act in 2005 and early 2006. If I hadn’t been under a gag order, I would have contacted members of Congress to discuss my experiences and to advocate changes in the law,” something he had done with Sen. Rand Paul earlier on the day we spoke with him.

The FBI eventually decided to withdraw its NSL, which gave Merrill standing only to challenge his personal gag order. Faced with the prospect of a much longer trial that would lack applicability to anyone besides himself, he settled with the FBI in August 2010. Finally, for the first time in six and a half years, he could speak openly about the case. “I’m happy I can talk about it,” he said, “but it feels weird. I’ll say something and think, ‘Oh no,’ and then remember.”

“One of the main reasons I settled was because I wanted to set up this nonprofit that would allow me to challenge some of these laws,” he explains. “There were over 200,000 NSLs in 4 years, and just one prosecution, and it wasn’t even related to terrorism, but no telecom company has ever challenged a NSL in court… And with the warrantless wiretaps, you have telecom companies making $3,500/month per tap. The FBI is paying these companies to house agents, so they don’t need to keep sending new ones each day, and why wouldn’t they take the government’s money? They have a fiduciary duty to their shareholders. They can’t just turn away that kind of money.”

Merrill’s nonprofit—the Calyx Institute—aims to change that. According to its charter, Calyx must “use all legal and technical resources available to protect the rights of its constituents and customers.” Calyx looks to launch a telecom arm of their own, which could be done on the cheap. FCC regulations permit startups to use regional monopoly lines. Merrill hopes to carve out a niche market in Verizon’s New York City, and then expand to the West Coast where there’s the most demand for privacy. “I want to show the major providers that there’s a market for privacy out there that they need to address. Even if we take just one percent of their market share, they’ll notice,” he said.

It’s more than a market gimmick for Merrill. “Some people have said, ‘Why don’t you go offshore, or overseas?’ But how could we challenge any of the U.S. statutes if we ran away? What I really want to do is change the industry.” He’s actually conflicted about how far to take his customers’ privacy. “We’ve debated complete end-to-end encryption,” he explains, “but we need something as bait, so they feds will try to use the laws against us, so we can challenge them.”

To launch Calyx, Merrill still needs several million dollars.

Techspot.com has this excellent article describing the Calyx project.