Why We're Supporting Microsoft's Challenge to Secret Surveillance

A few weeks ago, Microsoft filed a landmark lawsuit challenging the excessive secrecy surrounding the government’s demands for the emails and other electronic communications of the company’s customers. Today, the ACLU has moved to intervene in Microsoft’s lawsuit—as one of Microsoft’s customers—to stand alongside the company in its fight.

The lawsuit has the potential to restore critical privacy protections that the government has managed to circumvent in the digital world. That’s why we’re thrilled that Microsoft has filed the suit and why we’re excited to support them—you can read our proposed complaint here.

It’s worth taking a step back to understand why Microsoft’s case is so significant.

Before people started storing the intimate details of their lives in the “cloud,” they usually kept their private effects at home—or in their purses and wallets, or in some other place that they physically controlled. And when the government would get a warrant to search those places, it was (and still is) required to leave a copy of the warrant with the individual searched as well as an inventory of anything taken. In this way, the individual would get “notice” of the search.

Giving “notice” has always been the government’s legal duty when it searches your property. Historically, fulfilling that duty has also been nearly unavoidable. If the government wanted to search your property, it was hard to do so without your finding out about it. You would probably discover any significant items missing, windows shattered, or doorframes broken. That practical reality, reinforced by the legal requirement of notice, has served as a crucial check on the government’s use of its surveillance authority. It has ensured that courts, and not executive whim, decide the contours of our constitutional right to privacy.

One of the main problems with secret searches—that is, searches without notice—is that those searched have no way of challenging the legality of the government’s surveillance. Those prosecuted often learn of the surveillance against them in court, but many people who are monitored never get prosecuted, and so the only way they can hope to learn of the invasion of their privacy is through the constitutional requirement of notice. Of course, the government will often be able to justify delaying notice until after it completes any given investigation, but the government cannot delay it forever.

Unfortunately, with the advent of electronic communication and (quick on its heels) electronic surveillance, the practical reality of notice changed. The government could wiretap your conversations without leaving any trace that you could detect, making it all but impossible to learn of or challenge the surveillance. And the government took advantage of that fact for many years. In fact, it took a Supreme Court decision in 1967 to stop the practice. In Berger v. New York, the Supreme Court struck down New York’s eavesdropping statute. The Supreme Court found the statute unconstitutional for many reasons, but among them was the statute’s failure to provide for “notice.”

In response to the Supreme Court’s decision, Congress passed what The Wire would later introduce to a wide audience: an all-purpose wiretapping statute usually referred to as “Title III.” Title III allows federal and state law-enforcement agents to wiretap criminal suspects in certain circumstances. One of its core features is “notice.” The government can get approval to delay notice under Title III, for renewable 90-day periods, but it must notify those targeted at some point.

That was the state of “notice” and electronic surveillance until the rise of the internet.

With the internet came electronic-communication services (e.g., email) and remote-computing services (e.g., cloud storage), and once again, quick to follow were government surveillance requests. Congress ultimately passed a law in 1986 called the Electronic Communications Privacy Act (ECPA) to regulate government access to communications stored online. But this time, the statute Congress enacted did not include a strong notice requirement. Under ECPA, there are some circumstances in which the government must notify customers and subscribers that it has acquired their electronic communications. But nowadays, the government relies primarily on a provision of ECPA that allows it to obtain our emails or cloud-stored data without providing notice.

As a result, the government’s now-routine practice is to search and seize the electronic communications of thousands of individuals every year, without ever giving them notice of that fact.

To their credit, under the ECPA regime, Microsoft and other major online providers have generally stepped in to notify their customers when not prohibited from doing so. But, as we learned from Microsoft’s lawsuit, the companies frequently are prohibited from notifying their customers of surveillance requests. And the majority of the “gag orders” imposing that silence come without any set time limit.

That is where Microsoft’s lawsuit comes in. Microsoft has sued the federal government, arguing that the combination of the government’s failure to provide notice and its overreaching use of gag orders has effectively deprived many of Microsoft’s customers of the notice to which they are entitled when the government seizes their sensitive communications.

We could not agree more. And in fact, we think there’s another problem with what the government is doing. Not only must providers like Microsoft be permitted to notify their customers of surveillance demands at some point, but the government itself must provide notice. No matter what ECPA allows, the Fourth Amendment requires notice as a critical limitation on any invasion of privacy. While some large providers, like Microsoft, have committed to providing notice when permitted, not all companies make the same promise (or have the resources to live up to it). Individuals shouldn’t have to rely on their email providers to pick up the government’s slack. And the Fourth Amendment places the duty to provide notice on the government so that they won’t have to.

The government appears to believe that the fact that individuals store their private communications online somehow deprives them of the right of notice. But the right to notice travels with the right to privacy. In other words, we have a right to notice when the government seizes our private communications because we have a right to privacy in those communications protected by the Fourth Amendment.

This is the argument that we will advance alongside Microsoft if our motion to intervene is granted, and it is one of the reasons that Microsoft’s lawsuit is critical to privacy in the digital realm. The internet may have changed much about the ways in which we communicate, but it has not eliminated the government’s constitutional obligation to notify those whose privacy it invades. Microsoft’s lawsuit provides an opportunity to reaffirm this obligation.

Read our filings:
Motion to Intervene
Proposed Complaint