For months, the technology and business communities have been waiting anxiously for a Federal appeals court ruling on whether American companies can be forced to turn over customer information to U.S. law enforcement when that information is stored on servers abroad. It’s the result of a legal appeal filed last year by Microsoft Corporation that was argued before the U.S. Court of Appeals for the Second Circuit more than seven months ago.
But any day now, the Second Circuit is expected to issue its decision. Here’s why it’s so important:
First, a refresher on the facts. In December 2013, a U.S. magistrate issued a seemingly routine warrant in a narcotics investigation, demanding that Microsoft turn over messages from a customer’s email account. Law enforcement requests like this are made all the time and Internet service providers typically comply. But this was different. The warrant sought email not stored on servers in the U.S. but at a Microsoft data center in Dublin, Ireland. Microsoft refused to comply, citing concerns about customer privacy, and the legal fight was on. An added twist – the email account in question didn’t belong to a U.S. citizen.
The law. The warrant was issued under a 1986 law called the Stored Communications Act or SCA. In plain English, the SCA says that law enforcement can require companies like Microsoft to turn over electronically stored information – including its contents – “using the procedures described in the Federal Rules of Criminal Procedure. Now, that’s the important part since those rules say that U.S. courts can only issue warrants for searches and seizures within the U.S. The email communications U.S. law enforcement want sit on a server in Ireland, more than 4,500 miles from the company’s Redmond, Wash. headquarters.
The court battle: Microsoft opening shot was to vacate the warrant. But in April 2014, a U.S. magistrate refused and said that a warrant issued under the SCA “is a hybrid: part search warrant and part subpoena,” and as such, didn’t require the government to barge into Microsoft’s corporate headquarters and conduct a physical search but only use sophisticated technology to access the Dublin server from its corporate headquarters. Microsoft appealed, but in July 2014, a Federal district judge in Manhattan affirmed the magistrate’s ruling and held that the key issue was Microsoft’s ability to control its customer’s information and not the information’s physical location.
The Second Circuit: In September 2015, a three-judge panel of the Second Circuit heard oral argument. Three broad themes emerged: First, how will the SCA be interpreted? Does it act more like a search warrant and require extraterritorial application, meaning that it would force a U.S. company to produce material stored in another country; or does it function more like a subpoena, meaning that Microsoft would be required to turn over materials within its possession, custody or control. In the latter case, the physical location of the data wouldn’t really matter. Second, would it affect foreign policy? Microsoft argued that if US law enforcement were permitted to serve warrants on technology companies here, it would open the proverbial floodgates for other countries to do the same and serve warrants on technology firms for the private communications of Americans stored in US data centers owned by foreign companies. Finally, is the SCA so anachronistic that is should go the way of the Betamax? Toward the end of the argument, Judge Gerald Lynch, one of the three jurists who heard the argument, made a full-throated appeal to Washington, saying it “would be helpful if Congress would engage in that kind of nuanced regulation, and we’ll all be holding our breaths for when they do.”
How is the court likely to rule? It’s anyone’s guess at this point, as is the timing of the ruling. During the oral argument, Judge Lynch noted several times that the ruling would have broad implications so it’s not altogether surprising that we’re still waiting for the opinion.
Why is the outcome so important? As more and digital information is stockpiled around the globe, it is critical for organizations and individuals to understand the “rules of the road” and when, and under what circumstances, governments in the U.S. and abroad can lawfully access customer data, wherever collected and stored.
Is the Second Circuit only a pit stop to the Supreme Court? Perhaps. With several legislative proposals pending in Washington, it’s possible that Congress could step in and address the issue but that’s unlikely to happen any time soon. More likely, the party that draws the short end at the Second Circuit will be headed to the Supreme Court.
