Microsoft sues DOJ over snooping citizens' emails

SAN FRANCISCO — Microsoft has sued the Justice Department in a fresh effort to prevent the government from rifling through users' personal emails or documents without their knowledge.

"We believe that with rare exceptions, consumers and businesses have a right to know when the government accesses their emails or records," Microsoft president and chief legal officer Brad Smith wrote in a blog post. "Yet it’s becoming routine for the U.S. government to issue orders that require email providers to keep these types of legal demands secret. We believe that this goes too far and we are asking the courts to address the situation."

The filing marks yet another high-profile skirmish between the government and a major technology company. Apple has pushed back against government demands that it help the FBI undermine its encryption and break into iPhones. Smith last month publicly supported Apple’s refusal to assist the government.

Microsoft has mounted a vigorous legal front over customer privacy, taking on the government for the past three years. This is the fourth lawsuit that Microsoft has filed including the company’s litigation challenging a U.S. search warrant for customer emails in Ireland.

The lawsuit filed Thursday in federal court in Seattle questions the legitimacy of the government's demand for secrecy in all cases. Justice spokeswoman Emily Pierce said federal authorities are “reviewing’’ the filing and declined further comment.

Requests from the FBI and other law enforcement agencies for access to users' personal information routinely flood tech companies that store vast amounts of people's personal data in the cloud. Massive data centers run by Microsoft, Amazon and other big tech companies allow businesses and individuals to access email, photos and other content from multiple devices, wherever they are.

Law enforcement says such requests are routine and necessary to fight crime and terrorism.

Federal investigations of major crimes from child pornography to terrorism increasingly rely on cyber world evidence, said Donald Mihalek, executive vice president of the FLEOA Foundation (Federal Law Enforcement Officers Association).

“In the cyber world, things happen in a second. One second it’s there, the next second, it’s gone,” said Mihalek, explaining why federal agents sometimes seek gag orders that bar tech and Internet companies from alerting their customers about active investigations.

“With the click of a button, you can get rid of every piece of potential evidence that exists,” added Mihalek, referring to tech company users who might learn their data is being checked by federal authorities.

"I don’t know how they could be violating anything if they follow the laws on the books" that govern approvals of search warrants and subpoenas, Mihalek said of federal agents.

CLOUD REQUESTS

Using the Electronic Communications Privacy Act, the U.S. government is increasingly targeting data stored in the cloud, according to Microsoft, which says the government has mandated secrecy in 2,576 instances over the past 18 months. People would know if the government went through their filing cabinet or their hard drive, but are unaware when their privacy in the cloud is intruded upon.

The 1986 law was written before the Web was born and long before Americans started sending, receiving and storing so much of their personal communications and documents on the Internet.

Microsoft alleges the Electronic Communications Privacy Act violates users' Fourth Amendment right that a search be reasonable and Microsoft's First Amendment right to talk to its users.

"Notably and even surprisingly, 1,752 of these secrecy orders, or 68% of the total, contained no fixed end date at all. This means that we effectively are prohibited forever from telling our customers that the government has obtained their data," Smith said.

University of Washington law professor Ryan Calo says the kind of secrecy order Microsoft is contesting  "is something that should be justified and not something that is so routine," he said.

The lawsuit underscores rising tensions over the secrecy that shrouds government requests for personal information.

Microsoft’s lawsuit was filed one day after a U.S. congressional panel voted unanimously to advance a bill that would reform the Electronics Privacy Communications Act. As a result of last-minute changes, the legislation no longer requires the government to notify a user when his or her personal communications are being pursued. Instead, the government would disclose a warrant to the service provider, which would then have the right to notify users unless a court grants a gag order.

"U.S. laws have not kept pace with the Internet revolution," said Gartner Research analyst  Avivah Litan. "It's commendable that Microsoft is challenging outdated laws and it's regrettable that Congress has not been more proactive in these matters. Cloud computing puts technology companies who store private consumer information in the cloud unfairly between the U.S. government and the public. The laws need to change and adapt to this new middleman role of the cloud provider to ensure consumer privacy and rights are protected."

Contributing: Kevin McCoy and Kevin Johnson