Accusations force tech companies to come forward with data to defend themselves

The tech policy community has been begging Facebook for years to reveal the number of times that law enforcement and government agencies turn to it for information about its users. Reports varied wildly: In 2009, Newsweek said the site got 10 to 20 requests from police every day. In 2011, Reuters did a painstaking trawl through years of public court records trying to figure out how many times the po-po did Facebook searches and came up with only two dozen warrants. Facebook historically refused to hand over official numbers, but that changed on Friday. NSA leaker Edward Snowden got Facebook to do in two weeks what Facebook resisted doing for years: giving official stats on how often the government pokes around in its database.

In the last 6 months of 2012, the U.S. gov wanted data over 8,000 times for over 18,000 Facebook users. Facebook wasn’t the only company to come forward with numbers for the first time as a result of the NSA leaks. On Monday, Apple revealed that from Dec. 2012 to May 2013, it received more than 4,000 requests for info about more than 9,000 Macheads. Sharing these relatively tiny numbers was the companies’ attempts to stave off claims that they are handing over massive amounts of intel to the NSA as part of the PRISM program. The government alerted tech companies Friday that they could hand over — for the first time — information about secret national security requests as long as they provided it in aggregated form along with all of the other government data requests that come in (such as the local police station trying to get information in a missing child case). Facebook, Apple, and Microsoft issued those reports, but Google objected, saying it wants to be able to list Foreign Intelligence Surveillance Act requests on their own, rather than in a bundle. Still, even in a bundle, the numbers to come to light are illuminating in the case of Microsoft because of the ability to compare the new report with a previous report the company issued about 2012 data requests. See the chart below which includes the recent reports from Apple, Facebook and Microsoft, as well as the reports issued regularly by Google, Twitter, and, again, Microsoft:

Microsoft previously said that for all of 2012, it had 11,073 data requests for 24,565 accounts, and that its VoIP company Skype received 1,154 requests for 4,814 accounts.  Microsoft general counsel John Frank writes that all Microsoft consumer products had to be combined into one report for the national security disclosure, so I’ve bundled Skype and Microsoft data above (over 12,000 requests for over 29,000 accounts). Now Microsoft reports that in the last half of 2012 alone, it received more than 6,000 requests for data for over 31,000 accounts.

Including national security data requests for just a half year increases the number of Microsoft users affected to more than the company previously reported affected for an entire year. At the very least, we know the government got information on over 2,000 Microsoft users/accounts (31K vs 29K) as part of secret national security requests. That’s a relatively dramatic spike in the number of people using Hotmail, Outlook, Bing and other Microsoft products who were caught up in national security investigations. We don’t know exactly what the government asked Microsoft to hand over on those people, but we can assume it was metadata about their browsing behavior, their email, their searches, etc.

It’s not a great comparison, though, because we’re looking at a year’s worth of data in comparison to a half year, so let’s do some more back-of-the-envelope math. Assuming that the government made approximately the same number of requests in the first half of the year as the second half of the year, we’ll divide Microsoft’s national-security-free report in half and assume they got approximately 6,000 requests for over 14,000 accounts in the latter half of 2012. That would mean that the handful — could be 5 or a dozen or a few hundred — of national security requests that Microsoft got in the latter half of 2012 affected about 17,000 Microsoft accounts/users (31K vs. 14K). If we then double that number for the entirety of 2012, we could assume that national security investigations may have secretly targeted the accounts of up to 34,000 people. That’s a lot of potential terrorists.

We’re left to assume because the government doesn’t want exact numbers handed out.