Facebook and Microsoft have struck agreements with the US government to release limited information about the number of surveillance requests they receive, a modest victory for the companies as they struggle with the fallout from disclosures about a secret US government data collection program.
The companies remain barred from revealing whether they have actually received Foreign Intelligence Surveillance Act (FISA) requests and can only say that any they have received are included in the total reported figures. Microsoft released similar numbers for the same period, but downplayed how much they revealed.
Facebook on Friday became the first to release aggregate numbers of requests, saying in a blog post that it received between 9,000 and 10,000 US requests for user data in the second half of last year, covering 18,000 to 19,000 of its users’ accounts. Facebook has more than 1.1 billion users worldwide.
Microsoft said it had received requests of all types for information on about 31,000 consumer accounts in the second half of last year. In a “transparency report” Microsoft published earlier this year, it said it had received criminal requests involving 24,565 accounts for all of last year.
If half of those requests came in the second part of the year, the intelligence requests constitute the bulk of government inquiries. Microsoft did not dispute that conclusion.
Google said late on Friday that it was negotiating and that the sticking point was whether it could only publish a combined figure for all requests. It said that would be “a step back for users,” because it already breaks out criminal requests and National Security Letters, another type of intelligence inquiry.
Facebook, Google and Microsoft had all publicly urged the US authorities to allow them to reveal the scope of the surveillance requests after documents leaked to the Washington Post and the Guardian suggested they had given the government “direct access” to their computers as part of a National Security Agency program called PRISM.
Google, Facebook and Microsoft contradicted the reports and both papers have since backtracked.
The initial reports about PRISM included an internal NSA slide listing the dates that nine companies began allowing data collection, starting with Microsoft in 2007.
Only one company, Yahoo, is known to have taken the highly unusual step of appealing an order from the US Foreign Intelligence Surveillance Court argued in 2008 that the order violated the US Constitution’s Fourth Amendment against unreasonable searches and seizures.
However, US District Judge Bruce Selya, who headed the FISA court’s Court of Review, ruled the data collection program did not run afoul of the Bill of Rights.
According to the slides, two days after that, Google joined PRISM.
“When Yahoo lost that case, it dissuaded everyone else from going to court,” a source told reporters.