Should Microsoft Be Allowed To Tells Its Users When Government Searches Their Data?

If the police serve a search warrant on your home, you know, but if law enforcement searches your cloud-stored files, you’ll probably have no idea — and companies like Microsoft are currently forbidden from telling you. That’s why the tech giant is suing the Justice Department, but can Microsoft even bring this lawsuit?

That’s one of the big questions that is being argued today in a federal court in Seattle, where Microsoft is trying to stave off a DOJ motion to dismiss [PDF] the case.

To back up for a second — especially for folks not familiar with the case — this lawsuit centers on the Electronic Communications Privacy Act (ECPA) and the related Stored Communications Act (SCA) and their rules for seizure of electronic files.

The ECPA still requires that law enforcement obtain a warrant, subpoena, or court order to search remotely stored data. However, the law doesn’t require that the government notify the owner of that data about the search; it also prohibits Microsoft and other companies from telling the affected users if the government has a “reason to believe” that disclosing this request might hinder an investigation.

Microsoft claims that the government is abusing this “reason to believe” standard and applying it so generally that it violates customers’ Fourth Amendment protections against unlawful searches.

“People do not give up their rights when they move their private information from physical storage to the cloud,” wrote Microsoft in the lawsuit.

In seeking a dismissal, the DOJ contends that Microsoft doesn’t have the standing to bring the Fourth Amendment case on behalf of its users because the company is not the one who may be harmed. Additionally, the DOJ argues that it isn’t the law which bars Microsoft from sharing the information, but each individual court order.

“Microsoft’s challenge effectively asks this Court to adjudicate the lawfulness of thousands of such court orders from across the United States, without regard to the basis for, and terms of, those… orders, which necessarily vary from case to case,” the DOJ wrote in its motion for dismissal.

Last night, in advance of today’s hearing on this motion, Microsoft filed one last reply [PDF], acknowledging that the Supreme Court has held as a “general rule” that Fourth Amendment rights “may not be vicariously asserted” on behalf of another party. At the same time, SCOTUS conceded that there are “special circumstances” in which this would be allowed.

For example, in NAACP v. Alabama, the state of Alabama — as part of its efforts to shut down the NAACP in the state — obtained a court order directing the NAACP to produce a list of its members. The NAACP refused, invoking its members Fourteenth Amendment rights to due process.

In its ruling in favor of the NAACP, the Supreme Court noted that it has “generally insisted that parties rely only on constitutional rights which are personal to themselves,” but conceded that, “The principle is not disrespected where constitutional rights of persons who are not immediately before the Court could not be effectively vindicated except through an appropriate representative before the Court.”

According to Microsoft, it has to be the one bringing the Fourth Amendment case on behalf of its users, because the affected users — by law — have no idea who they are.

After all, how can you sue the government for illegally seizing your data if you don’t know it’s been stolen?

“Not knowing of the intrusion, the customer would have no practical means of protesting or challenging any infringement of her Fourth Amendment rights — especially if (as commonly occurs) the investigation does not result in the customer’s indictment,” explains Microsoft.

Adds the company, “Under settled Supreme Court authority, this case has the requisite ‘special circumstances’ because Microsoft’s customers cannot effectively protect their own Fourth Amendment rights, which the Government violates under a cloak of secrecy.”

Microsoft’s lawsuit has been supported my many big names in the tech and internet industries — including Apple, Amazon, Twitter, Google, among dozens of others — who filed briefs with the court arguing that this action is the only way for this issue to be resolved.

In the brief co-signed by Apple, company explains that in just the first half of 2016 it had received nearly 600 ECPA search requests with unlimited or indefinite gag orders preventing the company from alerting customers.

“The volume of nondisclosure orders providers receive puts them in a unique position,” argued the brief, “they are the only parties that have the information necessary to assert both their own First Amendment rights and their customers’ Fourth Amendment rights.”