An Analysis of Service Provider Transparency Reports On
Total Page:16
File Type:pdf, Size:1020Kb
comparison between the U.S. and other countries’ national A Hogan Lovells White Paper security access to data is made difficult by the even more secretive and opaque framework for access in other countries.3 Service providers subject to such requests for An Analysis of Service data by the NSA are pushing for the ability to report with transparency on the nature and number of national security Provider Transparency requests for information.4 Reports on Government Certain online service providers publish “transparency reports” that disclose principally law enforcement Requests for Data authorities’ requests for information held by the providers. The figures for government information requests in these reports do not include U.S. national security-related requests, given the current legal restrictions on providers’ Law enforcement requests in the U.S. disclosure of precise numbers related to such requests. compared with reported requests of other Thus, the reports concern official government requests for information during the course of law enforcement governments do not reveal great disparity investigations.5 by Given the focus on government access to data held by third * parties, it is timely to compare the available statistics as Christopher Wolf, Washington, DC revealed in the transparency reports. 27 August 2013 Introduction 3 For example, unlike requirements under the U.S. FISA The United States is portrayed by some as unique in the Amendments Act of 2008, the Communications Security world in its government’s desire for and access to personal Establishment of Canada is not required to obtain judicial approval data held by service providers.1 In particular, the scope and before intercepting communications related to foreign intelligence, see Jane Bailey, Systematic government access to private-sector scale of national security access to personal data continues data in Canada, 2 INT’L DATA PRIVACY L. 207, 213 (2012); to be a topic of international discussion in the wake of the France’s 1991 law enacted to provide institutional safeguards Snowden revelations. 2 The declassification of certain related to interceptions of national security communication National Security Agency (“NSA”) reports and opinions of nonetheless provides leeway for the government to conduct broad, untargeted, random monitoring of radio traffic for “defense of the Foreign Intelligence Surveillance Court in the United national interests” without authorization, see Article L 241-2, States is shedding some light on the quantity and types of Internal Security Code; and the United Kingdom’s Regulation of records requested for national security purposes. A Investigatory Powers Act 2000 enables the Foreign Secretary to issue interception warrants relating to foreign intelligence without allowing courts a role in the authorization or review of these * Christopher Wolf is Director of the Privacy and Information interceptions, see Ian Brown, Systematic government access to Management practice at Hogan Lovells US LLP. The author private-sector data in the United Kingdom, 2 INT’L DATA PRIVACY extends special thanks to colleagues Sachiko Jepson and Bret L. 230, 235 (2012). Cohen for their assistance with the preparation of this White Paper. 4 See, e.g., Google Motion for Declaratory Judgment, Jun. 18, 1 See, e.g., Georgina Prodhan & Claire Davenport, US Surveillance 2013, available at Revelations Deepen European Fear,REUTERS, June 7, 2013, http://assets.nationaljournal.com/img/MOTION.pdf (seeking available at http://reuters.com/article/2013/06/07/europe- declaratory judgment from the Foreign Intelligence Surveillance surveillance-prism-idUSL5N0EJ31S20130607, Viviane Reding, Court of its right to publish aggregate information about FISA Protecting Europe’s Privacy, N.Y. TIMES, June 17, 2013, orders). available at 5 In the United States, companies generally require a subpoena for http://nytimes.com/2013/06/18/opinion/global/viviane-reding- non-content information requests, like IP address and other basic protecting-europes-privacy.html. subscriber information, and a warrant or order for content 2 An earlier Hogan Lovells White Paper compares national security information, like the substance of e-mail messages. See, e.g., access to data in the cloud from the perspective of procedural Microsoft 2012 Law Enforcement Requests Report FAQs, protections that would enable analysis of the degree of government https://microsoft.com/about/corporatecitizenship/en- access. See Winston Maxwell & Christopher Wolf, A Sober Look us/reporting/transparency/#FAQs1 [hereinafter Microsoft FAQs], at National Security Access to Data in the Cloud: Analyzing the Google Transparency Report, Legal Process, Extravagant Claims about U.S. Access That Ignore Access by http://google.com/transparencyreport/userdatarequests/legalprocess Foreign Jurisdictions (2013), available at [hereinafter Google Legal Process], Twitter Transparency Report, http://hldataprotection.com/2013/05/articles/international-eu- United States Information Requests, privacy/white-paper-cloud-national-security. https://transparency.twitter.com/information-requests/2012/jul- dec/us [hereinafter Twitter Transparency Report]. 1 When the data contained in the reports are adjusted for reports that provide data on government information population sizes of and the number of Internet users in each requests across multiple countries. respective country, they reveal that the U.S. government requests information from these providers at a rate While some companies recently have obtained U.S. comparable to – and sometimes lower than – that of several permission to disclose the aggregated number of national other countries, including many European Union member security and law-enforcement-related information requests states. they receive, they are authorized to release these numbers only in ranges of thousands of requests.13 Further, released In fact, in 2012 it was reported that the rate at which reports do not include comparable figures for non-U.S. European governments seek access to private data is at an national security requests. Therefore, as these data do not “all-time high,”6 having increased more than the rate of enable meaningful statistical comparison across countries, U.S. government requests during the same period. they are outside the scope of this White Paper. Thus, as the national security access debate continues, the To maximize the timeframe represented in our calculations, issue of whether the U.S. is an outlier when it comes to law we examined all such data available from each company: enforcement access to data held by others can be resolved. three years of data available from Google (2010 to 2012),14 In that regard, U.S. requests to service providers are not one-and-a-half years of data available from Twitter (2012 fundamentally different in quantity than requests by law to June 2013)15 and LinkedIn (July 2011 to 2012), and one enforcement authorities in other countries.7 year of data available from Microsoft and Skype (2012). Methodology Rather than simply compare the raw numbers of requests for information by governments, this White Paper analyzes This White Paper analyzes government requests for the total number of reported local and national government information across several countries for at least a full year. data requests per capita and per Internet user in each in- We have used data from the transparency reports of Google scope country. 16 This is because countries with larger Inc., 8 Microsoft Corporation, 9 Skype Communications S.A.10 (acquired by Microsoft in 2011), Twitter, Inc.,11 and LinkedIn Corporation 12 because they are the only such n%20government%20data%20request%20statistics [hereinafter LinkedIn Transparency Report]. 13 See Ted Ullyot, Facebook Releases Data Including All National 6 See Privacy International, Google Transparency Report for Security Requests, Facebook Newsroom, June 14, 2013, available Second Half of 2012 Shows European Government Attempts to at https://newsroom.fb.com/News/636/Facebook-Releases-Data- Access Private Data at an All-Time High, Including-All-National-Security-Requests, John Frank, Microsoft’s https://privacyinternational.org/press-releases/google- U.S. Law Enforcement and National Security Requests for Last transparency-report-for-second-half-of-2012-shows-european- Half of 2012, Microsoft on the Issues, June 14, 2013, available at government-attempts (Jan. 24, 2013) [hereinafter Privacy http://blogs.technet.com/b/microsoft_on_the_issues/archive/2013/0 International, European Government Access to Private Data]. 6/14/microsoft-s-u-s-law-enforcement-and-national-security- 7 A comparison of the numbers of requests of course does not requests-for-last-half-of-2012.aspx, Apple’s Commitment to address the types of requests, whether through a subpoena, warrant Customer Privacy, Apple.com, June 16, 2013, or merely an “informal” request (not permitted in the United http://apple.com/apples-commitment-to-customer-privacy States, but practiced in other jurisdictions). See Winston Maxwell [hereinafter Apple’s Commitment to Customer Privacy], Vindu & Christopher Wolf, A Global Reality: Government Access to Goel, Government, Led by U.S., Seek More Data About Twitter Data in the Cloud (2012), available at Users, N.Y. TIMES, July 31, 2013, available at http://hldataprotection.com/2012/05/articles/international-eu- http://bits.blogs.nytimes.com/2013/07/31/governments-led-by-u-s- privacy/hogan-lovells-white-paper-on-governmental-access-to- seek-more-data-about-twitter-users.