In Suing US Government Over Privacy, Microsoft Fights for Its Bottom Line

The lawsuit Microsoft filed against the United States government on Thursday is about privacy.

The complaint seeks to let Microsoft tell its customers if government investigators have been searching their data in the company's cloud storage. The Justice Department often issues secret orders that keep tech companies from alerting customers of government warrants and searches.

"We believe that with rare exceptions consumers and businesses have a right to know when the government accesses their emails or records," wrote Brad Smith, Microsoft's president and chief legal officer, on his blog. "Yet it's becoming routine for the US government to issue orders that require email providers to keep these types of legal demands secret."

But make no mistake: the lawsuit is also about money.

"It's really about the concerns that the average consumer or even business operator who would be procuring information technology for their company would have about using US tech products and services," explained Daniel Castro, vice president at the Information Technology and Innovation Foundation.

That's a polite way of saying that customers might not want to sign up for Microsoft's cloud services if they think government officials can snoop on their records without them knowing it.

Last year, Castro wrote a report outlining how concerns about pervasive US surveillance, such as the electronic dragnet revealed by whistleblower and former NSA contractor Edward Snowden, erodes the competitiveness of the American cloud computing industry and could cost it at least $35 billion in lost foreign business between 2013 and this year.

In 2013, tech research firm Forrester estimated that the information technology sector as a whole could lose as much as $180 billion — roughly a quarter of the industry's revenues — within the same time frame due to surveillance fears.

Under the US Constitution, the government needs to inform people if officials are searching their home or property, said Alan Butler, senior counsel at the Electronic Privacy Information Center. The government can delay disclosing the search, but sooner or later they must fess up.

But the same rules don't apply to electronic surveillance.

Under the Electronic Communications Privacy Act of 1986 (EPCA), government officials can demand information stored in servers like Microsoft's using only a subpoena — a legal order that carries less weight than a warrant, Butler noted. They can also ask a judge to issue indefinite gag orders to prevent third parties from discussing the search.

Microsoft is arguing that the EPCA violates the US Constitution. Not only is the law letting officials compromise the right of Americans to know about government searches, the lawsuit holds, but it is compromising Microsoft's free speech right to notify people about searches concerning their data.

The 30-year-old act became law when the Internet was in its infancy, Microsoft contends. It didn't anticipate the reams of data that would be available to officials today.

"The transition to the cloud does not alter people's expectations of privacy and should not alter the fundamental constitutional requirement that the government must — with few exceptions — give notice when it searches and seizes private information or communications," Smith wrote on his blog.

Microsoft's lawsuit says that it has received 5,624 orders for information in the last 18 months. The details of 2,576 of those orders must remain secret, and the gag orders on 1,752 of those cases don't expire.

"This means that we effectively are prohibited forever from telling our customers that the government has obtained their data," wrote Smith (his italics).

The Justice Department is reviewing the complaint.

By filing the lawsuit, Microsoft could be inoculating itself against claims that it is complicit in letting the government eavesdrop on people's cloud accounts.

"There is a public relations aspect to these lawsuits that they file against the government," Castro said. "It's better than any marketing than they could do on their own that says, 'We care about your privacy.'"

Butler doesn't know how Microsoft executives balanced their business and privacy concerns when they filed their lawsuit. But he doesn't really care.

"Regardless of what they think in their hearts of hearts, the points they are making are very valid ones," he said, pointing out that Microsoft's lawsuit is an important contribution to an ongoing conversation in the US about electronic privacy since the Snowden scandal.

The lawsuit, for example, has brought attention to EPCA at a time when Congress is now considering amendments to bring the law up to date. Pressure from a big corporation that might be afraid of losing money due to a bad law is a good way to influence lawmakers.

"If people know how many searches were going on, there would be a lot more interest," said Butler. "You are not going to use a cloud service if you do not have these privacy protections. That is going to affect the bottom line."

Follow John Dyer on Twitter: @johnjdyerjr

Photo via Pixabay