On Monday, August 31, the U.S. House passed the bipartisan NDO Fairness Act by a unanimous vote. If enacted, this legislation will help protect the fundamental privacy rights of technology users.
The NDO Fairness Act addresses the overuse of non-disclosure orders (NDOs), also known as secrecy orders, that prevent technology companies from informing users when law enforcement wants to access their personal information stored in the cloud, such as emails, texts, photos, and other files.
Under NDOs, cloud computing companies cannot notify their customers that they are the subject of a government search.
What was an exception has now become the norm, with judges frequently approving boilerplate NDO requests from federal investigators. The practice of seeking secrecy orders is not unique to any administration or political party.
The Problem: Overreaching Secrecy Orders
Cloud computing providers, including Microsoft, receive thousands of non-disclosure orders (NDOs) from law enforcement every year—requiring companies to secretly provide data such as emails, texts, and other files associated with targets of investigations. Under NDOs, cloud computing companies cannot notify their customers that they are the subject of a government search. These demands have even targeted journalists and lawmakers.
What was an exception has now become the norm, with judges frequently approving boilerplate NDO requests from federal investigators. But providing notice of a search is a fundamental tool for protection against government overreach.
The misuse of NDOs for data searches represents a significant disparity between search rules in the physical vs. the digital world. For secret physical searches, law enforcement must meet strict standards, which are not being applied for secret searches of consumer data stored by cloud companies.
Microsoft frequently receives boilerplate secrecy orders from law enforcement that have not received meaningful judicial review. These orders are obtained under the 40-year old Electronic Communications Privacy Act (ECPA), which became law before cloud computing was invented. The practice of seeking secrecy orders is not unique to any administration or political party.
The NDO Fairness Act Provides Commonsense Solutions
The bipartisan NDO Fairness Act would strengthen the standards prosecutors must meet to obtain an NDO. It will also limit the use of indefinite secrecy orders. Courts will be required to carefully review and provide a written determination when approving an NDO.
The NDO Fairness Act will still allow the justified use of NDOs. There is still a place for temporary secrecy orders when it comes to terrorism, nation-state cyberattacks, violent crimes, and offenses involving child sexual materials. Prosecutors will also be able to obtain NDOs when investigation targets are flight risks or may intimidate witnesses.
Technology companies can continue to be strong partners to law enforcement, but must also be able to defend their customers’ rights against surveillance. The bipartisan NDO Fairness Act aims to reform the process, and if passed, would:
- End boilerplate secrecy orders by requiring judges to consider the full facts and circumstances of each order.
- Strengthen the standards prosecutors must meet to obtain an NDO.
- Limit the use of indefinite secrecy orders.
There is still a place for secrecy when it comes to national security issues or offenses involving child sexual materials, but there must be more rigorous requirements for secrecy requests.
In our democracy, secret government surveillance operations should not replace reasonable and accountable criminal investigations. The U.S. Senate must now pass this legislation to send it to the President’s desk to be signed into law.
You can learn more about this legislation in this Microsoft on the Issues blog by Microsoft Vice Chair and President Brad Smith.
