Recently, Microsoft announced that it was suing the U.S. government because almost half of the data requests are now accompanied by gag orders, restricting Microsoft from telling its customers when the government demanded to see their data, often for an indefinite period of time. As a customer of Microsoft, the American Civil Liberties Union (ACLU) filed a motion to join the same lawsuit against the U.S. government’s proliferation of secret orders.
Early in 2014, President Obama ordered the Justice Department to stop issuing National Security Letters that have no expiration date, but according to the ACLU and Microsoft, the government continues to issue these indefinite gag orders.
ACLU said that the government is abusing the Electronics Communications Privacy Act of 1986 to force companies to remain silent about when it requests data from cloud services providers such as Microsoft, Google, Amazon and others. Many of these cloud services companies have policies to inform their customers about government data requests, but they can’t do that if the government issues gag orders alongside them.
Microsoft challenges the constitutionality of gag orders because they violate the company’s free speech rights by preventing it from notifying its users. Microsoft also believes the gag orders violate the fourth amendment, which gives people the right to be notified when the government searches or seizes their property.
The ACLU seems to agree with that theory as well:
“A basic promise of our Constitution is that the government must notify you at some point when it searches or seizes your private information,” said Alex Abdo, a senior staff attorney with the ACLU Speech, Privacy, and Technology Project. “Notice serves as a crucial check on executive power, and it has been a regular and constitutionally required feature of searches and seizures since the nation’s founding. The government has managed to circumvent this critical protection in the digital realm for decades, but Microsoft’s lawsuit offers the courts an opportunity to correct course.”
The latest version of the Email Privacy Act, which is meant to reform the ECPA, introduced many welcome reforms for 21st century digital privacy. However, it also removed the right of cloud services customers to automatically be informed by the government that their data has been requested, a provision that existed in a previous version of the bill. The EPA allows companies to notify their customers about data requests, but it will be at their own discretion. The bill could still be amended to fix this issue in the Senate.
Lucian Armasu is a Contributing Writer for Tom's Hardware. You can follow him at @lucian_armasu.