Cloud Computing Law: Balancing Privacy and Investigation

more+
less-

Megaupload Ltd. is alleged to have disseminated copyright protected movies and music and US prosecutors now have the task of gaining access to the company’s servers in a bid to prove their case. In the fascinating Megaupload saga, a Canadian court has been asked to decide what to do with 32 servers belonging to Megaupload which are located in Canada. The servers are packed with information - “100 laptops” worth of data according to the judgement - and the court was asked by the US government to deliver that data to American prosecutors who are pursuing charges against Megaupload for criminal infringement of copyright, conspiracy to infringe copyright, money laundering and racketeering.

In last week’s decision, Canada (United States of America) v. Equinix Inc., 2013 ONSC 193, the court denied this request, indicating that the massive volume of data meant that the scope of the investigation should be narrowed to just that information that is the target of the search, rather than the entire contents of the data trove. However, the judge did not deny that the evidence should be delivered. Evidence to implicate Megaupload likely is contained within those servers, and it is only a matter of time and negotiation to determine the scope of the search, rather than an absolute denial of the request. “Given the undisputed conclusion” the judge wrote, ”…that there were reasonable grounds to believe that evidence of the offences would be located on the servers in my view the appropriate balance of the state interest in gathering evidence and privacy interests in information can be struck by an order that the servers be brought before the court …so that the court can make an order refining what is to be sent.”

From a cloud computing law perspective, this case raises several important points:

  • Canadian courts will order seizure and search of cloud-computing servers - just like they will with any piece of evidence in Canada - pursuant to a request from US authorities in the course of a criminal investigation;
  • Privacy interests will be balanced by the court, since the law is developing a sense of when individuals have an expectation of privacy in the contents of computers or servers;
  • However, that privacy right is not absolute, but it will be balanced with the interests of governments to conduct investigations.

We can expect another decision to be released before long, where the contents of the servers are indeed delivered to US prosecutors, with some conditions or limitations as to the scope of the search.