When the US Department of Justice sought permission to search a Microsoft Hotmail account in 2014, a judge rejected one condition the agency asked for - an order preventing Microsoft from ever telling its customer about the search.
Microsoft was not asked to submit its views in the case, nor did it attempt to do so. On Thursday, however, the company cited the Hotmail ruling as a key precedent in a legal action filed against the government challenging indefinite gag orders when the government subpoenas information from a customer account. Microsoft sees such orders as a possible barrier to potential clients considering the purchase of cloud storage services, an increasingly important part of its business.
When a company keeps data on its own servers, the government must approach it directly with any warrant to search for data. But if the company relies on a third party for cloud storage, the government could go directly to the cloud provider, and the company might never know.
"We're hearing from our customers about it," said Brad Smith, Microsoft's president and chief legal officer. Over the past 18 months, federal courts have issued nearly 2,600 secrecy orders "silencing Microsoft from speaking about warrants", the company said in its lawsuit. Two-thirds of those were indefinite, meaning there was no end date for how long they remained in effect.
The government’s actions contravene the Fourth Amendment, which establishes the right for people and businesses to know if the government searches or seizes their property, the suit argues, and Microsoft’s First Amendment right to free speech.
Scrutiny
Using the Electronic Communications Privacy Act (ECPA), the government is increasingly directing investigations at the parties that store data in the so-called cloud, Microsoft says in the lawsuit. The 30-year-old law has long drawn scrutiny from technology companies and privacy advocates who say it was written before the rise of the commercial internet and is therefore outdated.
“People do not give up their rights when they move their private information from physical storage to the cloud,” Microsoft says in the lawsuit.
The government “has exploited the transition to cloud computing as a means of expanding its power to conduct secret investigations.” The lawsuit represents the newest front in the battle between technology companies and the US government over how much private businesses should assist government surveillance.
In the Hotmail case, US Magistrate Judge Paul Grewal ruled a limited gag order could be appropriate.
“The problem is that the government does not seek to gag Microsoft for a day, a month, a year, or some other fixed period,” Grewal wrote. “Having persuaded the court that a gag order is warranted, it wants Microsoft gagged for ... well, forever.”
Another magistrate judge in Texas came to a similar conclusion on First Amendment grounds in 2008, and Grewal followed up the Hotmail ruling with a similar one involving a Yahoo email user.
For its privacy argument, Microsoft relies partly on a Supreme Court ruling that police must announce themselves while serving a warrant.
US District Judge James Robart in Seattle will oversee the Microsoft lawsuit, according to the court docket. Robart, nominated to the court by former president George W. Bush, also presided over recent smartphone patent litigation between Microsoft and Google’s Motorola Mobility unit. Robart valued the Google patents much closer to Microsoft’s position than Google’s, a ruling upheld on appeal.
By filing the suit, Microsoft is taking a more prominent role in that battle, dominated by Apple in recent months due to the government's efforts to get the company to write software to unlock an iPhone used by one of the shooters in a massacre in San Bernardino, California.
Apple, backed by big technology companies including Microsoft, had complained that co-operating would turn businesses into arms of the state.
Last case
“Just as Apple was the company in the last case and we stood with Apple, we expect other tech companies to stand with us,” Microsoft’s chief legal officer Brad Smith said in a phone interview after the suit was filed.
In its complaint, Microsoft says over the past 18 months it has received 5,624 legal orders under the ECPA, of which 2,576 prevented Microsoft from disclosing that the government is seeking customer data through warrants, subpoenas and other requests. Most of the ECPA requests apply to individuals, not companies, and provide no fixed end date to the secrecy provision, Microsoft said.
Microsoft and other companies won the right two years ago to disclose the number of government demands for data they receive. This case goes farther, requesting that it be allowed to notify individual businesses and people that the government is seeking information about them.
