Microsoft has sued the U.S. government to overturn a 1986 law that bars the company from telling its customers when federal agents have demanded their digital data, joining other tech companies defending privacy rights against intrusions by law enforcement.
According to Microsoft, the Electronic Communications Privacy Act (ECPA) should be struck down because it violates cloud customers’ right to know if the government’s searches or seizes their property and the cloud provider’s right to be transparent with its customers.
The law prevents disclosure of a search warrant or other legal process if the government has “reason to believe” disclosure would hinder its investigation.
Over the past 18 months, Microsoft said in its lawsuit, the company has received 5,624 federal demands for customer information, of which 2,576 have been accompanied by secrecy orders under the ECPA.
The government “has exploited the transition to cloud computing as a means of expanding its power to conduct secret investigations,” the complaint says. “As individuals and business have moved their most sensitive information to the cloud, the government has increasingly adopted the tactic of obtaining the private digital documents of cloud customers not from the customers themselves, but through legal process directed at online cloud providers like Microsoft.”
By filing the suit, Reuters said, Microsoft is taking a more prominent role in the high-stakes battle between tech companies and the U.S. government over how much private businesses should assist government surveillance. Apple recently fought vigorously to prevent the Justice Department from compelling it to unlock a terrorist’s iPhone.
“Just as Apple was the company in the last case and we stood with Apple, we expect other tech companies to stand with us,” Microsoft’s Chief Legal Officer Brad Smith told Reuters.
Microsoft noted that in the pre-digital age, the government could not avoid providing notice to individuals and businesses when it sought access to documents in their file cabinets or local computers. “The transition to the cloud does not alter the fundamental constitutional requirement that the government must — with few exceptions — give notice when it searches and seizes the private information or communications of individuals or businesses,” it said.