Microsoft Sues U.S. on Secret Requests of Customer Data

Microsoft Corp. on Thursday filed a lawsuit against the Justice Department, challenging as unconstitutional the government's authority to bar tech companies from telling customers when their data has been examined by federal agents.  The suit, filed in the federal court here, raises a fundamental question about the cloud computing era: Can the government force technology companies to remain silent about when and how federal agents search their customers' data? Individuals would know if their home or hard drive were searched by investigators, but investigators now have the ability—and are using it in thousands of cases—to keep secret their searches of data stored on the cloud.  The filing sets the stage for another high-profile confrontation between the government and a high-tech giant, after the Justice Department's February order that Apple Inc. bypass the security passcode on a terrorist's phone. The agency dropped its demand on Apple last month after it cracked the phone with help from a third party.  Microsoft says in its suit that it received 5,624 federal demands for customer information in the past 18 months, and nearly half—2,576—came with gag orders preventing the company from telling customers the government was looking at their data. Although the company "always complies with legally binding orders," it said that 1,752 of those secrecy orders had no time limit, so it might never be able to tell customers that the government obtained their digital files.  "(The) government seeks and executes warrants for electronic communications far more frequently than it sought and executed warrants for physical documents and communications—apparently because it believes it can search and seize those documents and communications under a veil of secrecy," the suit alleges.  A U.S. government representative declined an immediate comment on the Microsoft suit.  While Apple increasingly is seen as a standard-bearer for tech users' civil liberties, Microsoft too has been outspoken in its concern about government access to customer data. Brad Smith, Microsoft's president and chief legal officer, last month spoke out in support of Apple's refusal to assist the government in its quest for access to user data. In 2014, the software company challenged a secret demand for data about a business customer from the Federal Bureau of Investigation, arguing that investigators should seek the data directly from customers who use Microsoft's cloud services such as its Office 365 email product.  Courts can issue a gag order whenever they have "reason to believe" that notification could jeopardize an investigation. While Microsoft acknowledges in its suit that secrecy sometimes is necessary, it claims that this standard is too low. Because they face a low bar, the suit asserts, the government's gag order requests come too often and are granted too regularly.  Cloud computing—in which computer users store email, documents, photos and more on servers in data centers owned by Microsoft and other tech firms—compounds the problem, Mr. Smith said. Law enforcement can rifle through data without ever setting foot in the home or office of their targets and tipping them off to an investigation.  "The whole issue is arising because of the move to the cloud," Mr. Smith said in an interview.  Microsoft's filing zeroes in on a provision of the Electronic Communications Privacy Act, written in 1986. The company argues that indefinite gag orders violate the First Amendment right to inform customers about the search of their files "as soon as secrecy is no longer required." Additionally, the suit claims that the law "flouts" Fourth Amendment requirements that the government give notice to people when their property is being searched or seized.  The Justice Department, whose investigators use secret orders, has argued that if targets learn of an investigation, they might change their communications patterns, tamper with evidence or flee.  Some investigators believe that tech companies in recent years have become reluctant to help law enforcement. Officials say that technology companies are making it increasingly difficult to get information even with a search warrant approved by a judge. They warn that the trend is thwarting investigations into terrorism, murder, drug dealing and other crimes.  "Prior to 2014, a lot of the companies weren't adversaries. Then it became a business decision to be less friendly to law enforcement," said Terry Cunningham, president of the International Association of Chiefs of Police.  In its complaint, Microsoft acknowledges that the increase in demands for both online data and secrecy "undermine confidence in the privacy of the cloud and have impaired Microsoft's right to be transparent with its customers." Moreover, Microsoft's corporate customers feel "very strongly" about the issue, Mr. Smith added. He claimed that some are hesitant to move their data to the cloud over privacy concerns.  Microsoft isn't the only tech firm facing frequent gag orders in government investigations, but the company decided to file on its own to better represent its particular legal interests. Mr. Smith said he has talked with several other tech companies about the suit and anticipates "broad support across the industry." The company also plans to continue its efforts to lobby Congress to rewrite the law, and to press the Justice Department to reconsider seeking gag orders for data requests.  The outcome of those efforts may hinge on how courts interpret a legal theory, known as the third-party doctrine, in the cloud era, said Neil Richards, a professor of law at Washington University. That theory holds that people who voluntarily give information to third parties, such as banks or phone companies, have no reasonable expectation of privacy. In the Microsoft case, courts must decide whether storing emails, documents and photos in the company's data centers is tantamount to handing physical copies to a third party, or whether it is more similar to stashing that information in a customer's own filing cabinet.  Mr. Richards, who was briefed by Microsoft on its complaint and is sympathetic to its concerns, believes the 30-year-old Electronic Communications Privacy Act needs reform.  "It's really important that companies take their responsibility seriously to their customers to protect their civil liberties," Mr. Richards said.  Cases such as Microsoft's action against the Justice Department can take years to make their way through the courts, and some law-enforcement officials have urged Congress to move more quickly and update laws that govern access to data. Some lawmakers are working to pass new laws and revise old ones, but so far there appears to be little appetite in Congress to take action this year.  By Jay Greene and Devlin Barrett