Microsoft said federal courts barred it from disclosing 2,576 government demands for customer data during the past 18 months, including 1,752 secrecy orders with no expiration date, as the company filed a constitutional challenge Thursday against the Justice Department.

The lawsuit asks a federal court in Seattle to invalidate the routine use of nondisclosure orders under Section 2705(b) of the Electronic Communications Privacy Act. Microsoft argues that indefinite secrecy violates its First Amendment right to speak with customers and its customers’ Fourth Amendment interest in receiving notice when the government searches or seizes their private information.

The company is not seeking to eliminate secrecy when disclosure could endanger a person, prompt a suspect to flee, destroy evidence or compromise an investigation. It contends that a power intended for exceptional circumstances has become standard, particularly as email and documents move from personal computers and office filing cabinets onto corporate cloud servers.

Microsoft’s complaint for declaratory judgment names the Justice Department and Attorney General Loretta Lynch. It says people should not lose notice that their property has been searched merely because they entrusted it to a remote service provider.

Nearly half of demands carried gag orders

Between September 2014 and March 2016, Microsoft received 5,624 federal demands for customer information or data, according to the suit. Of those, 2,576 were accompanied by orders preventing disclosure. About two-thirds of the secrecy orders—1,752—contained no fixed end date, effectively requiring permanent silence unless the company later persuaded a court to lift them.

The scale is central to Microsoft’s claim. A temporary order tied to a specific investigative risk may be justified, the company says. Thousands of orders, many indefinite and issued through a statute that does not require a narrowly limited duration, transform an exception into a system.

Microsoft’s archive of the litigation says secrecy should be the exception rather than the rule. Company President and Chief Legal Officer Brad Smith has framed the dispute as one of notice, not immunity: investigators may obtain lawful warrants and orders, but customers ordinarily should learn about searches once disclosure no longer threatens the case.

The Justice Department said it was reviewing the complaint. Prosecutors are likely to argue that delayed notice is indispensable in investigations where disclosure would reveal surveillance, alert targets or expose cooperating witnesses. The legal question is whether Section 2705(b) contains enough safeguards to prevent that delay from becoming unnecessarily broad or permanent.

A 1986 law meets cloud computing

Congress enacted the Electronic Communications Privacy Act when email was often downloaded to a user’s own computer and remote storage was limited. Thirty years later, individuals and companies routinely keep years of correspondence, photographs and business records on servers operated by Microsoft, Google, Apple and other providers.

That shift changes who receives a warrant. A search of a home or office usually becomes known to the owner when agents arrive or leave an inventory. A search directed at a cloud provider can occur without the customer’s knowledge, and a secrecy order can prevent the provider from supplying the notice that physical circumstances would otherwise make unavoidable.

The Guardian’s account of the filing described the suit as an effort to prevent digital storage from creating fewer practical protections than a desk drawer. The company argues that the Constitution’s basic requirements do not depend on whether information sits on a local hard drive or in a data center.

Section 2705(b) allows a court to prohibit notice when there is reason to believe disclosure will lead to an adverse result, including flight, evidence destruction, witness intimidation, danger to life or serious jeopardy to an investigation. Microsoft’s complaint says those categories are broad, the standard is insufficiently demanding and the statute does not require courts to set an end date.

A same-day legal report noted that Microsoft is asking for a declaration that the provision violates both free-speech and search protections. The challenge therefore concerns not only what the government may obtain, but what it may force a third party not to say.

First Amendment speech meets Fourth Amendment notice

Microsoft’s First Amendment theory is direct: a court order stops the company from telling a customer truthful information about the government’s access to that customer’s account. To survive constitutional review, such a restraint ordinarily must be justified by a strong interest and tailored to the circumstances.

The Fourth Amendment claim is more unusual because the privacy right belongs principally to the customer, not the provider. Microsoft says it has standing to protect customers who cannot challenge secret searches they do not know occurred and to avoid becoming the mechanism through which notice disappears.

ABC News summarized the complaint as a challenge to both constitutional injuries: individuals and businesses may be deprived of notice, while Microsoft is prevented from communicating for the government’s purposes. The case could force courts to examine whether traditions of notice apply differently when evidence is held by a third party.

Prosecutors will emphasize that notice has never been absolute. Search warrants can be sealed, wiretaps operate secretly and grand-jury proceedings are confidential. Microsoft answers that those practices generally contain procedures, time limits or later notice, whereas many Section 2705(b) orders may never expire.

Technology companies test surveillance boundaries

The lawsuit is the latest confrontation between large technology companies and federal investigators. Apple recently resisted an order to create software that would help the FBI unlock an iPhone used by one of the San Bernardino attackers. The government withdrew that case after a third party accessed the phone, leaving the legal issue unresolved.

Microsoft’s dispute differs technically. It often can supply cloud data in response to lawful process; the question is whether it may tell the account holder. But both cases arise from the same structural change: private companies now design and operate systems that contain extraordinary volumes of personal information, placing them between government authority and users’ expectations of privacy.

A Wired examination of the case emphasized that nearly half of the government’s demands carried secrecy orders. Cloud customers may include businesses, journalists, nonprofit groups and public agencies whose operations depend on confidence that providers will protect their information and disclose legal access when permitted.

Microsoft also is contesting a federal warrant demanding emails stored in an Irish data center. That case concerns geographic reach; Thursday’s case concerns secrecy. Together they ask whether rules written for an earlier communications system can govern global cloud infrastructure without new legislative boundaries.

GeekWire reported from Seattle that the suit targets the specific nondisclosure provision rather than the government’s general authority to investigate crimes. That narrower strategy may give the court a path to require expiration dates or more particular findings without dismantling lawful access to evidence.

The remedy may belong to Congress

Courts can decide whether the present statute crosses constitutional lines, but a durable framework may require Congress. Lawmakers could impose presumptive time limits, demand individualized explanations, require periodic review and guarantee notice after investigative risks pass.

A Bloomberg report on the filing placed the case within a broader industry campaign for transparency. Companies have won limited authority to publish aggregate numbers about surveillance demands, but aggregates do not tell an individual customer that a particular account was searched.

The government has legitimate reasons to prevent targets from learning about active investigations. Microsoft’s numbers suggest the dispute is no longer about whether such secrecy is ever necessary. It is about duration, frequency and who must prove that silence remains justified.

Cloud computing makes invisible searches easier to execute and harder for affected people to challenge. Microsoft is asking a court to restore a principle familiar from the physical world: secrecy may delay notice, but it should not erase notice forever without a compelling and specific reason.