ACLU Seeks to Join Microsoft in ECPA Challenge

Yesterday, the ACLU filed a motion to join Microsoft’s ongoing challenge to the constitutionality of § 2705(b) of the Electronic Communications Privacy Act (ECPA), which permits the government to obtain gag orders that prohibit technology companies like Microsoft from disclosing to anyone that the government has obtained customer data. The case began last month when Microsoft filed a complaint in the District Court for the Western District of Washington.

The ACLU’s motion to intervene is premised on its interest in the case as an organization that “rel[ies] on Microsoft Corporation’s email and cloud-computing services to store and transmit sensitive records and communications.” In its motion, the ACLU argues that § 2705(b) violates its constitutional right to notice when the government “searches and seizes” the ACLU’s electronic communications pursuant to ECPA.

ECPA empowers the government to obtain warrants that require technology companies to disclose the contents of their customers’ “electronic communication[s]” if relevant to an ongoing criminal investigation. Section 2705(b) further permits the government to obtain a court order prohibiting the technology company from disclosing the existence of the warrant if the court has “reason to believe” that disclosure would have adverse consequences, including “seriously jeopardizing an investigation or unduly delaying a trial.” These orders can be issued “for such period as the court deems appropriate.”

In the original complaint, Microsoft notes that individuals and business now increasingly store sensitive information on “the cloud,” remote servers maintained and operated by third parties. In response, the government has adopted the tactic of obtaining this information not from the customers themselves, but from third-party cloud providers like Microsoft. According to the complaint, Microsoft has received 5,624 government warrants demanding customer data in the past 18 months. Of those, around half (2,576) were accompanied by a gag order. Furthermore, 1,752 of those gag orders did not contain a time limit.

Microsoft’s challenge to § 2705(b) argues that it is invalid under both the First and Fourth Amendments. From the complaint:

[T]win developments—the increase in government demands for online data and the simultaneous increase in secrecy—have combined to undermine confidence in the privacy of the cloud and have impaired Microsoft’s right to be transparent with its customers, a right guaranteed by the First Amendment.

There may be exceptional circumstances when the government’s interest in investigating criminal conduct justifies an order temporarily barring a provider from notifying a customer that the government has obtained the customer’s private communications and data. But Section 2705(b) sweeps too broadly. That antiquated law (passed decades before cloud computing existed) allows courts to impose prior restraints on speech about government conduct—the very core of expressive activity the First Amendment is intended to protect— even if other approaches could achieve the government’s objectives without burdening the right to speak freely. The statute sets no limits on the duration of secrecy orders, and it permits prior restraints any time a court has “reason to believe” adverse consequences would occur if the government were not allowed to operate in secret. Under the statute, the assessment of adverse consequences need not be based on the specific facts of the investigation, and the assessment is made only at the time the government applies for the secrecy order, with no obligation on the government to later justify continued restraints on speech even if circumstances change because, for instance, the investigation is closed or the subject learns of it by other means. It also permits those restraints based on the application of purely subjective criteria, such as a finding that notice would “jeopardiz[e] an investigation” in unspecified ways or “unduly delay a trial.” Section 2705(b) is therefore facially overbroad under the First Amendment, since it does not require the government to establish that the continuing restraint on speech is narrowly tailored to promote a compelling interest.

The statute also violates the Constitution’s protection against unreasonable searches and seizures. The Fourth Amendment’s requirement that government engage only in “reasonable” searches necessarily includes a right for people to know when the government searches or seizes their property. See Wilson v. Arkansas, 514 U.S. 927, 934 (1995). For example, if the government comes into a person’s home to seize her letters from a desk drawer or computer hard drive, that person in almost all circumstances has the right to notice of the government’s intrusion. The same is true when the government executes a search of a business to seize emails from the business’s on-site server. But Section 2705(b) subjects Microsoft’s cloud customers to a different standard merely because of how they store their communications and data: the statute provides a mechanism for the government to search and seize customers’ private information without notice to the customer, based upon a constitutionally insufficient showing. In so doing, Section 2705(b) falls short of the intended reach of Fourth Amendment protections, which do not depend on the technological medium in which private “papers and effects” are stored.

The ACLU’s motion and proposed complaint underscore Microsoft’s Fourth Amendment arguments, stating that § 2705(b) violates the ACLU’s right to notice whenever the government compels Microsoft to disclose the contents of the ACLU’s data and communications.

Specifically, the ACLU’s motion to intervene points out a “chicken-and-egg” problem with suits such as this:

It bears emphasis at the outset . . . that this lawsuit may be the only opportunity for Movants to vindicate their constitutional entitlement to notice from the government. This is true because of the chicken-and-egg relationship between injury and relief in this context: customers deprived of notice are, by definition, unaware of the government’s secret searches of their communications, but once customers learn of a search, they no longer need the notice that the government failed to provide. In fact, all of Microsoft’s customers are in this paradoxical position, highlighting both the importance of Microsoft’s suit and of Movants’ intervention.