IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

Microsoft says it receives thousands of secret data requests each year from US government

The company claims many of these lack legal justification and are either rejected outright or challenged through litigation

Microsoft has received up to 3,500 secret government subpoenas for its users' data each year for the last five years, the company revealed at a Judiciary Committee this week.

The comments emerged during a hearing held on Wednesday, created to establish whether the US government should award the same legal protections to user data held on cloud company servers as it does to physical files.

Chairman Nadler of the US House Committee on the Judiciary stated that legislators are investigating whether technology has vastly outpaced the law when it comes to the government demanding personal data from a third-party provider, and whether gag orders accompanying those demands have become standard practice in cases where timely notice would make more sense.

Tom Burt, vice president for Customer Security & Trust at Microsoft and representative for the company at the hearing, said that between 2,400 and 3,500 requests had been made each year over the past five years. He also added that Microsoft, the only tech company to be represented at the hearing, is just one of a number of cloud firms in the industry and that others may have also received subpoenas.

“Multiply those numbers by every technology company that holds or processes data, and you may get a sense of the scope of the government’s overuse of secret surveillance,” he said.

Burt added that the clandestine surveillance of so many Americans represents a “sea-change” from historical norms. He pointed out that if law enforcement wants to search someone’s physical office, it must prove to a judge with specific facts that a secret warrant is necessary and Congress places a strict 30-day limit on the length of time that secrecy may last.

“However, if they want to search your virtual office, they just serve a simple warrant on your cloud provider and obtain secrecy through a boilerplate process,” he said.

Burt also revealed that Microsoft “does not simply comply with such demands without question”. He said Microsoft reviews them to protect customers’ interests, pointing out that some of the demands were “legally deficient” so the company did not comply. In other cases, Microsoft challenged the orders through negotiation or litigation.

Examples of this include a secrecy order for data belonging to an account where the account holder was the victim in the case. There were also examples of requests for data related to large companies and their leadership teams, even though the investigation covered just one email account belonging to the company and did not involve any allegations of wrongdoing.

Related Resource

The secure cloud configuration imperative

The central role of cloud security posture management

The secure cloud configuration imperativeFree download

Burt said that often law enforcement will realise its secrecy demand “lacks justification” and will agree to let Microsoft provide advance notice to the owner of the target account.

“Sometimes law enforcement authorities even concede they came to us because it was simply ‘easier.’ Of course, ‘easier,’ is not, and should never be, the basis for a secrecy order,” he added.

The hearing came after the news that former president Donald Trump’s US Department of Justice (DOJ) reportedly targeted reporters and Democrats who were focused on investigating Russia’s interference in the 2016 election, as reported by the New York Times.

Other cases mentioned by chairman Nadler include president Bush’s Justice Department, which went after reporters who helped expose the NSA’s expansive warrantless surveillance programmes, and president Obama’s Justice Department, which went so far as to charge a reporter as a co-conspirator in violation of the Espionage Act.

Featured Resources

Accelerating AI modernisation with data infrastructure

Generate business value from your AI initiatives

Free Download

Recommendations for managing AI risks

Integrate your external AI tool findings into your broader security programs

Free Download

Modernise your legacy databases in the cloud

An introduction to cloud databases

Free Download

Powering through to innovation

IT agility drive digital transformation

Free Download

Most Popular

Former Uber security chief to face fraud charges over hack coverup
data breaches

Former Uber security chief to face fraud charges over hack coverup

29 Jun 2022
Macmillan Publishers hit by apparent cyber attack as systems are forced offline
Security

Macmillan Publishers hit by apparent cyber attack as systems are forced offline

30 Jun 2022
FCC commissioner urges Apple and Google to remove TikTok from app stores
data protection

FCC commissioner urges Apple and Google to remove TikTok from app stores

29 Jun 2022