Microsoft Lawsuit Against DOJ Over Gag Order Is Important but Difficult Case

"They basically have to show that, in the vast majority of cases, application of the statute would be unconstitutional and I don’t think they can make that claim," said Daskal, an expert in criminal, national security and constitutional law. "But what they can do is show that in specific cases that this is a clear violation.” For instance, she said, Microsoft can be told, "'Here’s a warrant to search for this customer’s data and we’re also issuing an order that says you can never tell the customer about the fact that there was a warrant.'" In that case, it would be appropriate for Microsoft to say, "'We’ll comply with the warrant but we want to challenge this piece of it that says we can’t ever tell our customers,'” she said.

In announcing the lawsuit Thursday, Brad Smith, the company's president-chief legal officer, wrote in a blog post that Microsoft, over the past 18 months, has received nearly 2,600 no-notice warrants from the government, of which nearly 70 percent had "no fixed end date at all." In effect, the company was "prohibited forever" from informing customers that the government had accessed their data, he said. Smith acknowledged the government can have legitimate reasons to provide no-notice warrants, such as when disclosure might impede an investigation, destroy evidence or harm an individual. But he said Microsoft doubts whether such orders "are grounded in specific facts that truly demand secrecy."

Microsoft is "pointing out an anomaly that the Justice Department is lengthening the secrecy provision here even though the administration has gone the other way for traditional criminal and national security investigations," Georgia Institute of Technology professor Peter Swire told us Monday. He said the Obama administration in 2015 "greatly reduced" the gag-rule period for National Security Letters to three years -- from 50 years -- unless the attorney general makes a specific finding that the gag order should continue. Plus, the standard history for criminal investigations is that notice is provided once the investigation is closed, he said. "And this is required for wiretaps, for instance, where the target of the wiretap learns about it whether or not they are prosecuted and that happens quite promptly," said Swire, who was unsure whether Microsoft would prevail.

Chris Calabrese, Center for Democracy and Technology vice president-policy, called the case "really important" because it is "one of the most invasive searches" of an individual. "The government's looking through your private communications in order to consider to put you in jail. So the idea that we would go to the mat to try to vindicate the rights of users to me seems both appropriate and a step forward for privacy," he told us Monday. Calabrese declined to predict whether Microsoft would be able to prevail.

Daskal said that by aggregating cases Microsoft can make a "compelling claim that there is a problem when they have indefinite secrecy orders in" more than 1,700 cases. The case will move forward and no doubt the government will file a motion to dismiss, but she said she's "not sure that Microsoft will ultimately win."

It's unclear how this lawsuit will affect ECPA legislation in the House and Senate. The House Judiciary Committee passed legislation codifying a requirement that law enforcement agencies get a criminal warrant in all cases, though the notification requirement rests on communications providers. While the House bill awaits a full floor vote, similar Senate legislation is still in committee (see 1604130036 and 1604140010). Calabrese said the House bill includes a provision that reduces the period that a gag can exist to 180 days and then it has to be renewed: "So it's possible that change in the underlying statute will affect the case," he said.

Red Branch Consulting founder Paul Rosenzweig, a former Homeland Security Department official, in an email said "that the ECPA law passed by House Judiciary authorizes an indefinite, renewable gag order -- so that reflects Congressional approval of the practice. The Senate may disagree." But, he said he didn't know whether Microsoft would win in the case. Daskal said the Senate bill has a provision that says government should notify the target when there's a warrant for data, though that default can be overridden if the government finds that doing so would jeopardize an investigation.

Microsoft said it has been planning the lawsuit "for a long time." so how much of a bearing that would have on the Senate ECPA bill is unclear, emailed Mark Jaycox, the Electronic Frontier Foundation's civil liberties legislative lead. He said "the gag provisions are ripe to change in light of this lawsuit, but there are a lot of things to fix in ECPA as a whole -- including ensuring the government obtains a warrant when it seeks a person's geolocation or cell site location."

Daskal said Microsoft's challenges to the federal government in several matters, plus challenges by other technology companies, show a larger trend. "There’s kind of an interesting interaction between … customers' increased concerns about an erosion on privacy and companies' incentives to act on their customers’ behalf, leading to this kind of rash of lawsuits bringing similar types of challenges of government investigations," she said.