2nd Circuit Hands Microsoft Win Against Government Seeking Customer Data Overseas
Microsoft scored a victory Thursday against the government when the 2nd U.S. Circuit Court of Appeals ruled 3-0 that DOJ couldn't force the company to provide customers' electronic communications stored outside the U.S. The "Stored Communications Act does not authorize courts to issue and enforce against U.S.-based service providers warrants for the seizure of customer e-mail content that is stored exclusively on foreign servers," said the decision. Microsoft and privacy supporters hailed the ruling, while DOJ said it's mulling next steps.
Sign up for a free preview to unlock the rest of this article
Communications Daily is required reading for senior executives at top telecom corporations, law firms, lobbying organizations, associations and government agencies (including the FCC). Join them today!
“We are disappointed with the court’s decision and are considering our options," emailed a DOJ spokesman. "Lawfully accessing information stored by American providers outside the United States quickly enough to act on evolving criminal or national security threats that impact public safety is crucial to fulfilling our mission to protect citizens and obtain justice for victims of crime.”
Microsoft President-Chief Legal Officer Brad Smith said the decision is important. "It ensures that people’s privacy rights are protected by the laws of their own countries; it helps ensure that the legal protections of the physical world apply in the digital domain; and it paves the way for better solutions to address both privacy and law enforcement needs," he said in a blog post. The ruling makes clear that Congress didn't give the government power "to use search warrants unilaterally to reach beyond U.S. borders" and people should be confident their personal data will be protected by their own country's laws, he said.
Microsoft complied partially with a magistrate judge's warrant to provide noncontent information, which was stored in the U.S., to the government about a customer involved in a drug trafficking case, said the 2nd Circuit ruling. But the company declined to get data stored in Ireland, the New York court said. The company sought to quash the warrant, but the U.S. District Court for the Southern District of New York denied Microsoft's motion and held the company in civil contempt, so the company appealed to the 2nd Circuit Court, the ruling said.
Judge Susan Carney wrote in the decision that the aim of the Stored Communications Act -- part of the larger Electronic Communications Privacy Act -- was to protect a person's privacy "in the context of new technology that required a user's interaction with a service provider." The statute doesn't "explicitly nor implicitly ... envision the application of its warrant provisions overseas," she wrote.
"The application of the Act that the government proposes -- interpreting 'warrant' to require a service provider to retrieve material from beyond the borders of the United States -- would require us to disregard the presumption against extraterritoriality that the Supreme Court re-stated and emphasized" in two cases, wrote Carney. "We are not at liberty to do so." Carney was joined by District Judge Victor Bolden for the District of Connecticut, sitting by designation.
Circuit Judge Gerard Lynch concurred in a separate opinion, saying congressional action is needed "to revise a badly outdated statute." While the correct decision was reached, he said any revision should focus on strengthening the law’s privacy protections, modernizing provisions giving law enforcement access to stored content and clarifying the international reach. He wrote that he “fully” expected DOJ will seek to overrule the decision through legislation and, in that case, Congress should “thoughtfully and dispassionately” address the law’s provisions to serve current needs.
In his post, Microsoft's Smith said the company received backing from 28 technology and media companies, 23 trade associations and advocacy groups, 35 leading computer scientists and the government of Ireland. Several privacy and technology groups praised the decision. “This ruling is a major affirmation that the rights we enjoy in the physical world continue to apply in the digital world," said Greg Nojeim, Center for Democracy and Technology director-Freedom, Security and Technology project, in a statement. A win for DOJ, he said, would have spurred other countries to try to gain access to data stored in the U.S. based on their laws: "It would have been like the Wild West and disaster for privacy.”
Information Technology and Innovation Foundation Vice President Daniel Castro said in a statement that it's not a question of whether the government can get lawful access to the data, but the process that it should use: the mutual legal assistance treaty (MLATs) rather than a search warrant. He said the U.S. has MLATs with more than 50 countries, including Ireland.
“As Congress considers reforming the Electronic Communications Privacy Act and Stored Communications Act, this ruling demonstrates the importance of clear statutory language that anticipates and facilitates cloud privacy and security," said Computer & Communications Industry Association CEO Ed Black in a statement. He said the decision shows "the government’s position does not reflect the statutory status quo or Constitutional bounds, but also suggests that the status quo does not adequately reflect the function of modern online platforms."