They don't need to host the data for systems they develop to be subject to a national security letter.