A Step Forward in Microsoft’s Legal Battle for Transparency about Government Data Requests – EFF

Last week, a federal court in Seattle issued a ruling in Microsofts ongoing challenge to the law that lets courts impose indefinite gag orders on Internet companies when they receive requests for information about their customers. Judge James Robarthe of recent Washington v. Trump fameallowed Microsofts claim that the gags violate the First Amendment to proceed, denying the governments motion to dismiss that claim. Its an important ruling, with implications for a range of government secrecy provisions, including national security letters (NSLs). Unfortunately, the court also dismissed Microsofts Fourth Amendment claim on behalf of its users.

When tech companies cant tell users that the government is knocking

Before looking at the substance of Judge Robarts ruling, its worth remembering why EFF thinks Microsofts lawsuit is important. In fact, wed go so far as to say that challenging gag orders imposed alongside government data requests is one of the key digital civil liberties issues of our time. Thats true for at least two reasons:

First, there has been a sea change in where we keep our sensitive personal information papers and effects protected by the Fourth Amendment and records of First Amendment-protected speech and associations. Just twenty or thirty years ago, most or all of this information would have been found in peoples homes. In order to get at your informationwhether by breaking down your door or serving you with a grand jury subpoenathe government usually couldnt help tipping you off. These days, private information is more likely to be stored in Microsoft Office 365 or with another third-party provider than a home office. In that case, you wont know the government is interested in your information unless you hear from the government or the third-party provider. But the government isnt always required to notify the targets of data requests, and it routinely gags providers from notifying their users. The long-standing defaultnotice that the government is after your informationhas in just a short time effectively flipped to no notice.

Second, gags distort the publics understanding of government surveillance and correspondingly place far more responsibility on providers. The statutory provision at issue in Microsofts lawsuit, 18 U.S.C. 2705, applies in criminal cases. This statute allows the government to gag service providers if a court finds that informing the user will result in one of several enumerated harmsdeath or injury to a particular person, destruction of evidence, witness tampering, and so on. But as Microsofts complaint explains, Section 2705 gag orders accompany at least half of the data demands the company receives, and courts often grant them without explicit findings of potential harm. In many cases, they also do so without setting a date for the gag to dissolve. The result is a de facto permanent gag order. Thats an abuse of what is intended as a limited power, granted to the government to protect specific, sensitive investigations.

Unless a provider takes extraordinary stepslike filing a facial constitutional challenge as Microsoft didits likely that the public wont be aware of this abuse. This intensifies the role that providers play as trustees of our data. Thats why EFF tracks both transparency reports and user notification as part of our annual Who Has Your Back report. We dont just rely on companies to keep our data secure, we also need them to stand up to the government on our behalf. Its a point often missed by those who dismiss companies growing commitments to privacy as empty marketing. If not Microsoft, Apple, Google, Facebook and all the others, then who?

The ruling: first party prior restraints and third-party Fourth Amendment rights

Despite the importance of these issues, the government argued that Microsofts challenge should be bounced out of court at the preliminary motion to dismiss stage. On the First Amendment claim, at least, the court disagreed. Microsofts basic argument will be familiar if youve followed EFFs NSL cases: when the government prevents you from speaking in advance, its known as a prior restraint. Under the First Amendment, prior restraints must meet exacting scrutiny and are rarely constitutional. Here, the court found that Microsoft had more than adequately alleged that Section 2705 does not meet this exacting scrutiny because it does not require courts to time-limit gags to situations where they are actually necessary based on the facts of the case.

This is nearly identical to one of the issues in EFFs NSL casesNSLs similarly allow the FBI to gag service providers indefinitely.However, NSLs are even more egregious in several ways: the FBI can issue them without any involvement by a court at all, and it need not even claim that one of the specified harms will actually result without an NSL gag. We hope the Ninth Circuit will consider our NSL clients arguments about their First Amendment rights as thoroughly as Judge Robart did here.

Finally, the court reached an unsatisfying conclusion about Microsofts attempt to raise its users Fourth Amendment rights. As EFF explained in our amicus brief earlier in the case, notice of a search is a core part of the Fourth Amendments protections. When Microsoft is precluded from notifying users, it is the only party with knowledge of the search and therefore should be able to raise its users Fourth Amendment rights. Nevertheless, the court found that Fourth Amendment rights are inherently personal and cannot be raised by a third party, leading it to dismiss Microsofts claim. We think thats wrong on the law, and we hope Microsoft will consider seeking leave to appeal. Meanwhile, well watch as the case progresses on Microsofts First Amendment claim.

Continued here:
A Step Forward in Microsoft's Legal Battle for Transparency about Government Data Requests - EFF