Microsoft v. United States (2016)

In April 2016 in Seattle,[3] Microsoft sued the U.S. Department of Justice, arguing that secrecy orders were preventing the company from disclosing warrants to customers in violation of the company's and customers' rights.[4][2] Microsoft also had the backing of companies such as Amazon, Apple, Google,[6] Dropbox and Salesforce in the lawsuit.[5] The company claimed that over the 18 months prior, federal judges had approved 2,600 secret searches of Microsoft customers' data,[2] with 68 percent of those cases involving secrecy orders with no expiration date banning Microsoft from notifying customers about the searches.[6][8] Microsoft argued that "the future of cloud computing is in jeopardy if customers can't trust that their data will remain private."[3]

The lawsuit concerned the portion of federal law that deals with delayed notice, 18 USC 2705(b) of the Stored Communications Act.[5] At issue was the 1986 Electronic Communications Privacy Act.[2][3] which predated the internet.[3][6] Although normally a person must be told by police that their homes are searched, via a warrant, the 1986 law allows police to get a special exemption to check computers without a warrant. Microsoft argued that "People do not give up their rights when they move their private information from physical storage to the cloud. The government, however, has exploited the transition to cloud computing as a means of expanding its power to conduct secret investigations."[2] Microsoft noted that those secret searches often remain undisclosed after cases were closed.[2] Microsoft alleged that it has the right to inform customers when the United States government obtains a warrant to read their emails or access their information in the cloud.[10] The company alleged that it is unconstitutional "to force the company to remain silent and not inform customers when their cloud data has been searched or inspected by authorities."[11] Microsoft contended in the case that while some cases might require secrecy, the practice of indefinite gag orders had become far too common.[3]

Microsoft argued that it was unconstitutional for the government to indefinitely ban Microsoft from informing its users that the government was requesting their emails and other documents, and that the Fourth Amendment made it so people or businesses had the right to know if the government searches or seizes their property.[4] It also argued that First Amendment was violated by not allowing Microsoft to speak to its customers.[2] CNN explained that the case "also notes the odd, modern distinction that the government makes between searching your computer -- and searching your information on a company's computer." According to the lawsuit, law enforcement took advantage of an exception to the Fourth Amendment called "third-party doctrine," where a person can't reasonably expect privacy when information is disclosed to a third party. However, up till that point, the courts had ruled that a person's Fourth Amendment rights still applied to their email, regardless of where the email was stored.[2]

The government bid for dismissal of the suit.[3] In February 2017, a federal judge in Seattle ruled in Microsoft's favor, and the case went forward with a trial date set for June 2018.[5] The judge did not rule on the merits of the case.[3] In September 2017, Microsoft announced new cloud encryption technology which "could offer an end-run around government secretive snooping by enabling customers to control access to content stored in Microsoft data centers."[3]

On October 19, 2017, Deputy Attorney General Rod Rosenstein released a three-page memo[5] directing prosecutors to keep gag orders to a year or shorter, barring "exceptional circumstances."[6][3] He also wrote that gagging clauses should only be used in search orders if there was a "real need for secrecy," for example when there is a danger a person will flee, tamper with evidence, or tip off other suspects.[9] The DoJ had "changed data request rules on alerting internet users about agencies accessing their information." The new policy mandated defined periods of time for secrecy orders from the government.[4] However, the policy wasn't extended to apply to orders issued under the Foreign Intelligence Surveillance Act or to national security letters.[9]

On October 23, 2017, Microsoft said it would drop the lawsuit as a result of a policy change by the Department of Justice (DoJ)[4] that represented "most of what Microsoft was asking for."[9] Microsoft said the changes would ensure secrecy order requests were "carefully and specifically tailored to the facts in the case."[7] No laws were changed with the shift in DOJ policy, and Microsoft did not rule out future litigation.[3] Microsoft did say it still wanted to see changes to the 1986 Electronic Communications Privacy Act (ECPA),[6][7][9] similar to those proposed in the ECPA Modernization Act.[3][9] The ECPA Modernization Act, introduced in July 2017, would require law enforcement to get "a warrant in order to access emails, location data and other sensitive information - and would force the government to notify individuals when their location and content information was requested."[9]