7

FAQ: The rules that require tech companies to turn customer data over to investi...

 3 years ago
source link: https://www.washingtonpost.com/technology/2021/06/15/faq-data-subpoena-investigation/
Go to the source link to view the article. You can view the picture content, updated content and better typesetting reading experience. If the link is broken, please click the button below to view the snapshot at that time.
neoserver,ios ssh client

Tech giants have to hand over your data when federal investigators ask. Here’s why.

Apple, Microsoft and Google receive tens of thousands of requests each year to provide data about their customers, and often the companies are barred from notifying them

Image without a caption
The Trump administration's Justice Department subpoenaed Apple and Microsoft for data from the accounts of lawmakers, their families and aides. (Kevin Dietsch/Getty Images)
June 15, 2021 at 10:00 a.m. UTC

SEATTLE — When the Trump administration’s Justice Department sought to ferret out leakers, it turned to the tech giants where so much of our digital life is stashed.

Apple and Microsoft disclosed last week that the agency secretly subpoenaed account data from members of Congress and aides to crack down on leaks during the Trump administration. That followed recent disclosures to media organizations including The Washington Post and the New York Times that the Trump Justice Department had secretly sought reporters’ phone and email records in an effort to identify the sources of leaks.

That information — which email addresses and phone numbers we use and when we use them — can be crucial to piecing together a leak in a probe.

And there is little the tech giants can do but comply. Because these subpoenas can come with a gag order, the companies were precluded from notifying customers that information was turned over. The data gathering became public only after those orders expired.

Advertisement

Here’s what you need to know.

Frequently Asked Questions

  • How many subpoenas were issued, and who issued them?
  • What kind of information was gathered?
  • Why did the government use a subpoena to get the information?
  • Why did it take so long for tech companies to tell customers their data was turned over?
  • Are there ever good reasons for gag orders?
  • Why are investigators issuing subpoenas to tech companies rather than the targets of their investigations?

How many subpoenas were issued, and who issued them?

It’s not entirely clear. Apple received a subpoena on Feb. 6, 2018, that sought customer or subscriber account information for 73 phone numbers and 36 email addresses, spokesman Fred Sainz said in an emailed statement Friday. Sainz noted that “the nature of the inquiry” led Apple to believe that similar requests were sent to other technology companies.

On Friday, Microsoft disclosed that it, too, received a subpoena in 2017, also apparently related to the leak investigation. Google, another company with a huge base of customers that use its email service and mobile devices, often receives government requests for data. But it did not say if federal investigators subpoenaed it in their probe of leaks related to the House Intelligence Committee.

What kind of information was gathered?

The companies were vague, but generally said the information was metadata. That includes subscriber information, including the customers’ name and address, and access logs, which indicate when someone has signed into their account. That information can help investigators pinpoint a leak.

Advertisement

If a leaker uses a personal iCloud account to send classified material to a reporter, for example, and investigators are able to determine the account from which the information was sent, knowing the name of the account owner could crack the case.

Both Apple and Microsoft said no content, such as email or pictures, was shared with investigators.

Why did the government use a subpoena to get the information?

Investigators have a handful of tools to compel the disclosure of electronic data, and a subpoena is the easiest to obtain because the government is not required to provide cause for obtaining the information. Subpoenas don’t require a judge to issue them.

In Apple’s case, the company received a subpoena from a federal grand jury that was signed by an assistant U.S. attorney. The only time a judge got involved was when investigators sought a gag order, which the company said was signed by a federal magistrate. Apple did not have the opportunity to argue against that order. Even if the company wanted to challenge the order, the subpoena “provided no information on the nature of the investigation and it would have been virtually impossible for Apple to understand the intent of the desired information without digging through users’ accounts,” Sainz said.

Advertisement

Still, the type of information allowed under a subpoena is limited to basic subscriber data.

The government could also have sought a so-called 2703(d) court order or a search warrant, which would have compelled more detailed information such as the email addresses to which messages were sent, or even emails themselves. But the legal threshold for investigators to use either of those tools is much higher. At the very least, they would have needed to show that the data they are after is relevant and material to their investigation.

Why did it take so long for tech companies to tell customers their data was turned over?

The companies didn’t immediately tell customers of the subpoenas or the fact that data was turned over because judges barred them from doing so. Apple’s Sainz said the subpoena included a nondisclosure order signed by a federal magistrate judge. That order was extended three times, each time for a year. When the Justice Department did not extend the order a fourth time, Apple notified customers on May 5 that investigators had sought data.

Advertisement

Microsoft, too, said it was prevented from notifying the customer targeted by the Justice Department investigation for more than two years because of a gag order. When that order lifted, Microsoft told the customer, who in turn acknowledged to the company being a congressional staffer.

Microsoft President Brad Smith blasted the effort to shield the investigation from its customers with gag orders in a Washington Post opinion piece Monday.

“Democracy rests on a fundamental principle of government transparency,” Smith wrote. “Secrecy should be the rare exception — not the rule.”

There are no legal requirements for companies to tell customers anything, said Orin Kerr, a law professor at the University of California at Berkeley. But generally, companies lay out their guidelines for disclosure in their privacy policies. Apple, Microsoft and Google also publicly provide information about how often they receive legal demands for customer data.

Are there ever good reasons for gag orders?

Yes. Investigators might subpoena data as part of an ongoing criminal investigation into, say, a drug ring. In that case, tipping off suspects about an investigation could lead them to destroy evidence and evade arrest.

Advertisement

But an investigation into government leaks can lead to charges that the government’s legal apparatus is doing the bidding of the political leaders, Kerr said.

“There are cases where it makes sense [to obtain gag orders], but the language of nondisclosure orders is written very broadly,” Kerr said.

Why are investigators issuing subpoenas to tech companies rather than the targets of their investigations?

Because those tech companies are the keepers of the information, and because obtaining data from them, when coupled with gag orders, means targets have no idea they are being probed. What’s more, tech giants hold exactly the kind of information investigators typically want — where people go, to whom they speak and more.

“What people don’t understand about our digital toys is that our communications data can easily be obtained by investigators,” said Andrew Guthrie Ferguson, a professor at American University Washington College of Law. “Someday we will realize there are no secrets on the Internet. We might not be seen, but our devices are being monitored, and that means we are only a government request from being exposed.”


About Joyk


Aggregate valuable and interesting links.
Joyk means Joy of geeK