The Washington PostDemocracy Dies in Darkness

Microsoft sues over law banning tech firms from telling customers about data requests

The Microsoft logo is pictured in Issy-les-Moulineaux, outside Paris, on April 12. (Michel Euler/AP)

Microsoft wants a federal judge in Seattle to strike down a law that allows courts to prohibit a tech company from telling customers that the government has sought their data.

In a civil suit filed Thursday against the Justice Department, the tech giant revealed that, in the past 18 months alone, federal courts have issued almost 2,600 orders preventing Microsoft from alerting customers that their data has been obtained in criminal probes.

Notably, more than two-thirds — about 1,750 orders — had no fixed end date.

“This means that we are forever barred from speaking, and our customers are forever barred from hearing that the government has accessed their email or other content,” said Brad Smith, Microsoft’s president and chief legal officer. “So this matters to people and the rights that all of us are entitled to enjoy under the Constitution.”

With people storing their emails and other sensitive data on tech companies’ servers, the government is increasingly serving search warrants on companies for suspects’ data rather than on the individuals themselves. So the only way the targets know their data is being searched is if either the government or the tech company tells them.

Read: Microsoft challenges constitutionality of gag order law

More and more, Microsoft said, these warrants are accompanied by gag orders of indefinite duration. And in these cases, the firm said, the government is not required to notify the target.

The secrecy orders issued under the law in question, which is part of the Electronic Communications Privacy Act, violate customers’ Fourth Amendment right that a search be reasonable, the firm alleged. The law also violates Microsoft’s First Amendment right, the company alleged, to talk to its customers and discuss how the government conducts investigations.

The Justice Department said it is reviewing the complaint.

“Not only is Microsoft right that an indefinite gag order creates a First Amendment problem, but, of even greater concern, there is a possibility that the target may never get notice that the government is looking through his or her emails,” said Jennifer Daskal, a law professor at American University and former Justice Department official.

But, she said, the orders with a time-limited gag pose less of an issue. “So long as there is a valid basis for delay, and the customer ultimately gets notice, there does not seem to be a constitutional problem,” she said.

Jamil N. Jaffer, an adjunct law professor at George Mason University and former Justice Department official, said the company may have “an uphill battle” bringing a Fourth Amendment claim on behalf of its customers. “As a general matter, the courts have held that Fourth Amendment rights are personal rights that can’t be raised vicariously,” he said.

The lawsuit comes as the spotlight has begun to turn away from a major legal battle involving a different tech giant — Apple — over encryption and privacy. It continues a trend of tech companies publicly resisting certain government requests for data and demands for secrecy after revelations in 2013 of widespread National Security Agency surveillance by former agency contractor Edward Snowden.

In 2013, Google and four other tech firms sued the government to be able to publish more information about national security orders for customers' data, and reached a settlement that allowed some measure of greater transparency.

In 2014, Twitter took it further, suing to be able to disclose the exact number and type of national-security-related orders it received — including zero, if that were the case.

In 2015, Twitter amended its suit to challenge the gag-order provisions in another law that authorizes foreign intelligence-gathering inside the United States, saying they were unconstitutional because they were of unlimited duration.

“There is a healthy competition among the tech companies to show that they are privacy-protective and to be privacy-protective,” said Gregory Nojeim, senior counsel for the Center for Democracy & Technology, a civil liberties group.

Smith, in an interview, said the complaint was prompted by the company’s review of the data and by concerns raised by client firms that want to know when the government is investigating them.

“If people or businesses don’t know that the government is accessing their content, they can never act to defend their rights,” he said.

He added that an indefinite secrecy order would mean a suspect would not be notified even after an investigation has ended.

Congress is considering a change in the law that would impose a maximum six-month delay in notifying a customer — ending the indefinite gag order. But even if it passes, which is not expected to happen this year, “six months is still too long,” Smith said.

Microsoft also is challenging the statute’s standard for obtaining a secrecy order, which is that the court must find “there is reason to believe” that notice will jeopardize an investigation.

“I think both the very vague standard with which the government can gag a company and the indefinite duration of the gag raise serious questions under the First and Fourth amendments,” said Paul Ohm, a law professor at Georgetown University and former federal prosecutor.

But Daskal said that the problem was not the standard itself, although it might be applied too broadly in specific cases.

“The key,” she said, “is that notice should not be delayed indefinitely. At some point, the justification for delay no longer exists, and at that point either the government or company needs to let the target know that his or her data has been searched.”

Read more:

After 11 years, a curtain is lifted on a secret FBI demand for a target’s data

Tech firms reporting receipt of zero national security orders in breach of DOJ guidance