Last year, Microsoft launched a lawsuit against the U.S. government because the Department of Justice (DOJ) was too often handing the company gag orders for indefinite amounts of time whenever it was making a data request.
The practice had gotten so widespread that almost two-thirds of data requests the government was making of Microsoft were accompanied by gag orders. Microsoft receives thousands of data requests from the U.S. government each year, so having so many secret orders seems at least unusual. After all, there are only so many national security investigations that can happen in a given year, and gag orders are supposed to be used primarily in national security investigations.
DOJ Limits Secret Orders
Microsoft said the DOJ has now established a new policy that restricts its agents from using secret orders for data requests, and it also puts a limit on the lifetime of the gag orders. This should free Microsoft and other companies to speak up in more cases, or participate sooner in major cases, if they so wish. Until now, the government would often require email providers such as Microsoft not to tell their customers when it got their personal emails and records.
Microsoft believes that citizens should be informed when the government requests their emails and other data, even if the data is stored on Microsoft’s premises. According to the company, there should be no difference if private documents are stored in desk drawers or in the cloud.
Microsoft also noted that it’s not alone in this belief and that a broad array of companies, academics, civil liberties groups, and even former law enforcement officials have filed amicus briefs in support of that position in its case against the U.S. government.
Microsoft To Dismiss Its Lawsuit
Microsoft believes that its concerns have largely been addressed by the new policy adopted by the DOJ, so it’s now dismissing that lawsuit. However, the company admits that there are still unsolved issues with the Electronic Communications Privacy Act (ECPA) that are also oft-abused by law enforcement.
Microsoft is encouraging Congress to act by supporting the ECPA Modernization Act of 2017, introduced in July by Sens. Mike Lee, R-Utah, and Patrick Leahy, D-Vermont. This bill includes a provision that addresses secrecy orders, which seems to be an aspect that Microsoft took into account when deciding to dismiss the lawsuit against DOJ.
Giving Up Too Soon?
We still don’t know whether or not this new law will pass, and DOJ policies can change at any time. Microsoft’s dismissal of the lawsuit may have been premature. The U.S. House has unanimously voted twice before to reform the ECPA, but the bill always ended up dying in the Senate. It’s not clear yet whether or not the situation is any better right now.
It’s also likely that the government decided to compromise on this issue is because it knew it was in the wrong, and it didn’t want Microsoft to set a precedent that would stop them from issuing certain gag orders in the future. This way, the government gets to control how it can deliver its secret orders, instead of the courts. This could change if a new law is passed that directly addresses this, but again, it remains to be seen if such a law will pass anytime soon.
Microsoft mentioned how it challenged the U.S. government in previous occasions, which is probably more than most other companies would have done. However, in almost all of these cases, Microsoft ended up settling after the government made some concessions. This is often not ideal for Microsoft’s customers, for which the company said it fought, because, largely, it allowed the government to continue its practices. Only court precedents or laws can truly put an end to bad practices from the government.
Currently, Microsoft is in another important lawsuit against the DOJ, because the government wants to have the ability to ask American companies for any of their customers’ data, even if the data is stored on servers elsewhere in the world. The Supreme Court will now decide the outcome of this case, after the government appealed a federal court’s ruling, which said that Microsoft was in the right not to give the government access to a foreign customer’s data, which was stored in Ireland.
