REDMOND, Wash., Jan. 24, 2006 – Last fall, Microsoft received subpoenas from both the Department of Justice ("DOJ") and the American Civil Liberties Union ("ACLU") in the lawsuit (ACLU v. Gonzales, C.A. #98-5591 (E.D. Pa.)) filed by the ACLU which challenges the constitutionality of the Child Online Protection Act, 47 U.S.C. §231 ("COPA"). Microsoft is not a party to the lawsuit, although several years ago we did intervene in support of challenges to the constitutionality of various aspects of COPA.
COPA would make it illegal to post, for "commercial purposes," World Wide Web content that is "harmful to minors" (essentially, sexual material, although the vagueness of the term was the basis for one of the constitutional challenges to COPA) unless an access control mechanism such as credit-card verification is used. The Supreme Court upheld a 3rd Circuit ruling finding COPA unconstitutional because there were "less restrictive means" of achieving the government’s objectives, citing studies showing that end-user filtering software was both less restrictive and effective. The government is now seeking to defend the constitutionality of the law by showing that such filtering is in fact ineffective – and has subpoenaed search engine providers for evidence in support of that claim.
The DOJ subpoena compelled Microsoft to produce (1) "all URL’s that are available to be located through a query on your company’s engine as of July 31, 2005" and (2) "all queries that have been entered on your company’s search engine between June 1, 2005, and July 31, 2005." (Another subpoena from the DOJ, and one from the ACLU, requested information regarding web filter and parental control product development; we provided some information in response to these subpoenas as well).
As did several other recipients of the subpoenas, including Google, Microsoft initially objected to the DOJ subpoena (and to the other subpoenas). Microsoft negotiated with the DOJ to limit the scope of the subpoena to reduce its burden on the company and to be certain that personal search records or other personally identifiable information would not need to be produced. Microsoft then responded to the DOJ subpoena and, under a protective order, produced to both the DOJ and ACLU information in two categories: first, a random sample of URL pages from its index, and second, aggregated anonymous query logs that listed, for a limited time period, search queries and how often they occurred. At no time was any personally identifiable information requested, nor was any supplied. With the information that Microsoft produced, one can see the frequency that query terms occurred, but not what any specific user queried. In fact, the information that Microsoft produced is very similar to a one-week look at the "most popular searches" information that almost all major search engines promote.
Microsoft regards the protection of personal identifiable information as a vital foundation of trust, and it regards customer trust as critical to the success of its business. Our privacy notices are prominent, transparent and clearly explain our policies.