Microsoft reveals first FBI National Security Letter in transparency report, says US foreign intelligence surveillance requests doubled from H2 2015 to H1 2016
Microsoft published its biannual transparency report on Thursday, revealing its first National Security Letter from the FBI.
Context & Ripple Effects
Microsoft's first published National Security Letter lands in a disclosure wave that Yahoo started when it published three FBI letters previously under gag order in mid-2016, and that Cloudflare joined in January by disclosing a 2013 letter and joining CREDO and EFF's constitutional challenge to the NSL regime. A 2015 court ruling had already exposed how much the FBI collects through these warrantless demands — browsing, shopping, and location history — giving companies both precedent and motive to publish.
The timing matters because Microsoft simultaneously reports US foreign intelligence surveillance requests doubled from H2 2015 to H1 2016, meaning the company is disclosing more about a demand stream that is itself growing. The report converts an abstract legal fight into a concrete count of what one major cloud provider receives.
First-order effects
- Microsoft joins Yahoo and Cloudflare as one of the few companies able to name an FBI National Security Letter at all, shifting its transparency reporting from aggregate request counts to specific order disclosures.
- Customers of Microsoft's cloud now have visibility into a doubling of foreign intelligence surveillance requests hitting the company across two half-year periods.
Second-order effects
- The FBI's own numbers show the pressure working: it issued 12,150 national security letters in 2016, down 5% year over year just weeks after Microsoft's report, as legal challenges from tech companies mount.
- Rival cloud providers face customer expectations set by Microsoft's disclosure level, making non-disclosure of eligible NSLs harder to defend commercially.
Third-order effects
- Secrecy clauses outlast individual disclosures: four years later Microsoft's security chief told Congress that as many as one-third of all US government data demands still carry secrecy clauses, suggesting transparency reports narrow but do not eliminate the gag-order norm.
- If the pattern holds, periodic NSL publication becomes a standing feature of cloud-industry compliance, with the volume of disclosed letters serving as a public proxy for the scale of warrantless surveillance.
The trend: Cloud providers are normalizing the publication of once-secret national security letters even as government secrecy clauses persist, turning transparency reports into the primary public record of warrantless surveillance.