Microsoft says it receives thousands of secret data requests each year from US government

The company claims many of these lack legal justification and are either rejected outright or challenged through litigation

Microsoft has received up to 3,500 secret government subpoenas for its users' data each year for the last five years, the company revealed at a Judiciary Committee this week.

The comments emerged during a hearing held on Wednesday, created to establish whether the US government should award the same legal protections to user data held on cloud company servers as it does to physical files.

Chairman Nadler of the US House Committee on the Judiciary stated that legislators are investigating whether technology has vastly outpaced the law when it comes to the government demanding personal data from a third-party provider, and whether gag orders accompanying those demands have become standard practice in cases where timely notice would make more sense.

Tom Burt, vice president for Customer Security & Trust at Microsoft and representative for the company at the hearing, said that between 2,400 and 3,500 requests had been made each year over the past five years. He also added that Microsoft, the only tech company to be represented at the hearing, is just one of a number of cloud firms in the industry and that others may have also received subpoenas.

“Multiply those numbers by every technology company that holds or processes data, and you may get a sense of the scope of the government’s overuse of secret surveillance,” he said.

Burt added that the clandestine surveillance of so many Americans represents a “sea-change” from historical norms. He pointed out that if law enforcement wants to search someone’s physical office, it must prove to a judge with specific facts that a secret warrant is necessary and Congress places a strict 30-day limit on the length of time that secrecy may last.

“However, if they want to search your virtual office, they just serve a simple warrant on your cloud provider and obtain secrecy through a boilerplate process,” he said.

Burt also revealed that Microsoft “does not simply comply with such demands without question”. He said Microsoft reviews them to protect customers’ interests, pointing out that some of the demands were “legally deficient” so the company did not comply. In other cases, Microsoft challenged the orders through negotiation or litigation.

Examples of this include a secrecy order for data belonging to an account where the account holder was the victim in the case. There were also examples of requests for data related to large companies and their leadership teams, even though the investigation covered just one email account belonging to the company and did not involve any allegations of wrongdoing.

Related Resource

The secure cloud configuration imperative

The central role of cloud security posture management

The secure cloud configuration imperativeWatch now

Burt said that often law enforcement will realise its secrecy demand “lacks justification” and will agree to let Microsoft provide advance notice to the owner of the target account.

“Sometimes law enforcement authorities even concede they came to us because it was simply ‘easier.’ Of course, ‘easier,’ is not, and should never be, the basis for a secrecy order,” he added.

The hearing came after the news that former president Donald Trump’s US Department of Justice (DOJ) reportedly targeted reporters and Democrats who were focused on investigating Russia’s interference in the 2016 election, as reported by the New York Times.

Other cases mentioned by chairman Nadler include president Bush’s Justice Department, which went after reporters who helped expose the NSA’s expansive warrantless surveillance programmes, and president Obama’s Justice Department, which went so far as to charge a reporter as a co-conspirator in violation of the Espionage Act.

Featured Resources

The ultimate law enforcement agency guide to going mobile

Best practices for implementing a mobile device program

Free download

The business value of Red Hat OpenShift

Platform cost savings, ROI, and the challenges and opportunities of Red Hat OpenShift

Free download

Managing security and risk across the IT supply chain: A practical approach

Best practices for IT supply chain security

Free download

Digital remote monitoring and dispatch services’ impact on edge computing and data centres

Seven trends redefining remote monitoring and field service dispatch service requirements

Free download

Most Popular

Best Linux distros 2021
operating systems

Best Linux distros 2021

11 Oct 2021
HPE wins networking contract with Birmingham 2022 Commonwealth Games
Network & Internet

HPE wins networking contract with Birmingham 2022 Commonwealth Games

15 Oct 2021
Veritas Backup Exec 21.3 review: Covers every angle
backup software

Veritas Backup Exec 21.3 review: Covers every angle

14 Oct 2021