The Justice Department has issued new guidelines aimed at providing more transparency around prosecutors’ secret demands for customer data stored on tech firms’ servers.
The binding guidance, approved last week by Deputy Attorney General Rod Rosenstein, ends routine imposition of gag orders barring companies from telling customers their email or other records have been turned over in response to legal demands.
It also bans – in most cases – indefinite gag orders that forbid a company from ever telling users their data have been searched.
The move comes a year and a half after Microsoft sued the department, asking a federal judge in Seattle to strike down portions of a major privacy law that govern the secrecy orders. The tech giant argued that the Electronic Communications Privacy Act violated customers’ Fourth Amendment right that a search be reasonable because it did not require the government to notify them when their records were obtained. The company also argued that the law’s gag order provision violated the company’s First Amendment right to talk to its customers.
The new guidance requires prosecutors to tailor their applications for secrecy orders to ensure that they are necessary, and explain why. For instance, a prosecutor might fear that the target will destroy data if he or she learns of the probe. Or the target might try to flee. The assessment must be “individualized and meaningful.”
And now there is a time limit: “Barring exceptional circumstances,” a gag order may be sought for “one year or less.”
The change is a recognition that privacy laws passed in the 1980s have not kept up with the advent of cloud computing in which people, at the press of a button, create and store data in servers that they do not control.
“This update further ensures that the department can protect the rights of citizens we serve, while allowing companies to maintain relationships with their customers by notifying those suspected of crimes, or believed to have information relevant to a crime, in a timely manner that information was obtained relating to their user accounts,” Department of Justice spokeswoman Lauren Ehrsam said in a statement.
“This is an important step for both privacy and free expression,” Microsoft President and Chief Legal Officer Brad Smith said in a blog post. “It is an unequivocal win for our customers, and we’re pleased the DOJ has taken these steps to protect the constitutional rights of all Americans.”
As a result, Microsoft announced it plans to drop its lawsuit. But it wants Congress to pass legislation to put a 90-day limit on non-disclosure orders unless the government asks for them to be renewed.
When Microsoft filed its case in April 2016, it noted that in the prior 18 months, it had received 5,600 federal demands for data, and almost 2,600 were accompanied by obligations of secrecy. And more than two-thirds of those – about 1,750 orders – had no fixed end date.
“In short, we were prevented from ever telling a large number of customers that the government had sought to access their data,” Smith said.
The policy does not apply to orders under the Foreign Intelligence Surveillance Act or to “national security letters,” a type of administrative subpoena used in national security cases.
Chris Calabrese, vice president of policy at the Center for Democracy and Technology, a privacy organization, applauded the move. But, he said, “it is no substitute for statutory reform.”
The move matters for Americans whose data is secretly obtained in criminal probes that never lead to a prosecution, but who never find out because of indefinite gag orders. This has become much more of a problem as people store their emails and other sensitive data in the cloud. “They’re not expecting that it’s an all-you-can-eat buffet for the government,” said John McKay, a former U.S. attorney in Seattle who is now a partner at Davis, Wright, Tremaine.
(c) 2017, The Washington Post · Ellen Nakashima
{Matzav.com}
