Microsoft Reports: What ïthe LawÍ Is Asking of Internet Companies

Authors

• 

  Dunstan Allison-Hope

  Senior Advisor, BSR

  

  ---

  

  Dunstan Allison-Hope

  Senior Advisor, BSR

  

  San Francisco

  ---

  Dunstan leads BSR’s work at the intersection of technology and human rights.

  Previously, Dunstan led BSR’s information and communications technology, heavy manufacturing, and human rights teams.

  He brings significant experience working on a diverse range of engagements and issues, including human rights due diligence, privacy and freedom of expression, sustainability reporting and strategy, and stakeholder engagement.

  Dunstan facilitated the multistakeholder process of developing global principles on freedom of expression and privacy, which led to the launch of the Global Network Initiative in October 2008. He also helped create the Electronic Industry Citizenship Coalition, a collaborative initiative of more than 100 ICT companies improving conditions in their supply chains. Dunstan participated in the process of creating the Global Reporting Initiative G3 guidelines, and he is a regular commentator on issues of corporate accountability, reporting, and human rights. He also co-authored the 2010 book Big Business, Big Responsibilities.

  Prior to joining BSR in 2004, Dunstan was part of British Telecommunications' corporate responsibility team.

  Dunstan has an M.Prof. in Sustainable Development from Forum for the Future.

  Close

Dunstan Allison Hope, Managing Director, Advisory Services, BSR

Yesterday, Microsoft published its first Law Enforcement Requests Report, disclosing the number and nature of requests law-enforcement agencies globally have asked Microsoft regarding its online and cloud services—and how the company responded to those requests.

The relationship between companies and law-enforcement agencies is a complex one, especially since the activities of law-enforcement agencies can both protect human rights (such as by clamping down on human trafficking) or violate them (such as by using personal data to suppress political speech).

It can be tricky for business to navigate this relationship, so I warmly welcome Microsoft’s transparency as a powerful tool in helping society better understand how the company makes decisions about when to reveal information and which information to share.

The Microsoft report follows similar previous reports from Google and Twitter, and it adds a new layer of detail: By distinguishing between requests for “content data” (such as the body of an email) and “non-content data” (such as an email or billing address), the report sheds even more light on what law-enforcement agencies actually do and do not gain access to.

Now that this level of transparency around law-enforcement requests is more commonplace, this begs the question, what will happen next?

I would like to see four things:

1. We should create common reporting protocols for how to collect, record, and disclose this data. This would allow readers to compare reports published by different companies and covering different countries.
2. Other companies in the internet industry should take the opportunity to increase their transparency on this subject, to establish transparency as the industry norm.
3. Companies in other industries—such as telecommunications, financial services, retail, and health care—should experiment with similar reports. Many companies outside the internet business hold our personal information and are subject to requests from law-enforcement agencies.
4. The Global Reporting Initiative should use the lessons learned from this increased reporting and transparency to incorporate law-enforcement relationship data into its sustainability reporting guidelines. It is quite extraordinary how little coverage privacy issues receive in the guidelines, given that we live in the digital age.

Most importantly (and this will be easier now that more companies are revealing this data), we as a society should engage in an informed debate about the proper relationship between law enforcement, private companies, and privacy.

I’m a huge supporter of strong personal privacy protections, but it concerns me when these discussions start with the implicit idea that all law-enforcement activities and requests for personal data are bad. Law enforcement should be there to protect us all, and Microsoft’s report illuminates some of the contexts when it makes sense for the company to reveal information—there are all sorts of crimes (think drug crime, human trafficking, racial hatred) for which I, for one, am glad companies collaborate with law enforcement. It’s time we discussed how companies can assist law enforcement responsibly, and how law-enforcement agencies can earn our trust that personal data won’t be misused.