The rules defining privacy rights in the digital ether just became more complicated – and many didn’t believe that was possible.
In a decision issued late Friday by a federal magistrate in Philadelphia, Google Inc. was ordered to hand over to the FBI customer emails stored on servers outside the United States. The magistrate’s decision runs headfirst into a similar case decided by the U.S. Court of Appeals for the Second Circuit in favor of Microsoft Corp. seven months ago.
The ruling also raises difficult questions about the legal implications of emerging – and varying – technologies used to move vast troves of electronic files across the globe based on the different ways cloud providers store and organize electronic data.
The Philadelphia case involves search warrants issued under the Stored Communications Act (SCA), a 1986 law that created Fourth Amendment-type protections for electronically stored data including a requirement that the government secure a warrant before seizing electronic information. The warrants in the Philadelphia case sought the contents of email communication in connection with two separate criminal investigations – both of which involved account holders who were U.S. citizens.
Google responded to the warrants by producing the content of emails stored on its servers in the U.S. but refused to turn over emails stored outside of the country, citing the Second Circuit’s ruling seven months ago that said Microsoft was not be required to disclose emails stored on a server outside of the U.S. The communications sought by law enforcement in the Microsoft case resided on a server in Dublin, Ireland. Like the Philadelphia case, Microsoft also involved an SCA warrant. Last month, a sharply divided Second Circuit refused to revisit its ruling in the Microsoft case.
The Philadelphia magistrate, Thomas J. Rueter, concluded that, since all relevant conduct will occur in the U.S. – even though the data was stored abroad – “the invasions of privacy will occur in the United States … when the FBI reviews the copies of the requested data in Pennsylvania.” He reasoned that ordering Google to retrieve data from foreign servers did not amount to a seizure under the Fourth Amendment: “Electronically transferring data from a server in a foreign country to Google’s data center in California does not amount to a ‘seizure’ because there is no meaningful interference with the account holder’s possessory interest in the user data.”
The magistrate also said that his decision was driven by Google’s own technology and the need to avoid “absurd results” including making Google immune from legal process because of the way its network is configured and operates. Google uses a “dynamic” data storage technology that literally breaks up its customers’ electronic data and distributes it to multiple data centers around the world. The data is automatically moved from location to location on Google’s network to optimize performance and other efficiencies. And as the magistrate noted, “[i]t is possible that the network will change the location of data between the time when the legal process is sought and when it is served.”
This means that the electronic data was a moving target. Or as the government argued, “stored one day in a data center in Finland or Singapore; and automatically moved the next day to a new data center in Chile, or Belgium.”
Magistrate Reuter’s opinion won’t be the last word in this case. In a statement, Google has already said it plans to appeal the decision. “We will continue to push back on overbroad warrants.”
And as always, we’ll continue to report on the case as it makes its way through the appellate process.
The cases are In re: Search Warrant No. 16-960-M-01 to Google and In re: Search Warrant No. 16-1061-M to Google, U.S. District Court, Eastern District of Pennsylvania, Nos. 16-mj-00960, 16-mj-01061.
