[{"innerBlocks":[],"postId":348,"name":"core\/freeform","blockType":{"name":"core\/freeform","keywords":[],"attributes":{"content":{"type":"string","source":"raw"},"lock":{"type":"object"},"metadata":{"type":"object"}},"providesContext":[],"usesContext":[],"selectors":[],"supports":{"className":false,"customClassName":false,"reusable":false},"styles":[],"variations":[],"blockHooks":[],"apiVersion":3,"title":"Classic","description":"Use the classic WordPress editor.","category":"text"},"originalContent":" $\"\"$ The U.S. Supreme Court recently heard oral arguments in U.S. v. Microsoft<\/em>, tackling the question of whether an organization can refuse to disclose foreign-stored data sought by the U.S. government through domestic warrants. Currently, the Second Circuit says yes while other circuits tend to say no.\n\nWhile several district courts have concluded that it is not an extraterritorial seizure to enforce warrants that require organizations to produce U.S. users\u2019 account data stored in foreign servers, these decisions conflict with precedent from the Second Circuit Court of Appeals. The Second Circuit held that Microsoft could not be compelled to comply with a warrant if it meant producing foreign-stored data for use in a domestic case. Elsewhere in the United States, judges have rejected the Second Circuit\u2019s decision, ordering the production of foreign-stored data pursuant to domestic warrants. These decisions follow the reasoning that a court can order the production of anything that can be accessed and delivered within the United States. Accordingly, no relevant extraterritoriality concerns are implicated despite the storage of data in a foreign location. Outside of the Second Circuit, it is clear that courts are focusing on where the access to and disclosure of the stored data occurs (domestically) rather than the location of the data (internationally). Conversely, the Second Circuit\u2019s Microsoft decision focuses on the seizure of the data from a foreign location, which is where it locates the privacy violations and applies its extraterritoriality analysis.\n\nLegislation could fix the differing interpretations, but despite near universal agreement that the Electronic Communications Privacy Act of 1986 needs to be updated and the repeated introduction of new legislation, Congress has been slow to act. Thus, both parties urged the Supreme Court to clarify the law during oral arguments in U.S. v. Microsoft<\/em>, which focused on whether the search, retrieval, and disclosure of foreign-stored data constituted an extraterritorial act, and if so, how the law should apply.\n\nThe Second Circuit and Microsoft<\/strong>\n\nThe Second Circuit\u2019s decision<\/a> in July 2016 held that Microsoft could not be forced to turn over emails stored on a server in Dublin, Ireland, for use in a domestic case.\u00a0 This decision in In the Matter of a Warrant to Search a Certain E-mail Account Controlled and Maintained by Microsoft Corporation<\/em> (\u201cMicrosoft Decision\u201d) reversed an April 2014 Southern District of New York ruling<\/a> denying Microsoft\u2019s motion to quash a warrant issued under the Stored Communications Act<\/a> (\u201cSCA\u201d) directing Microsoft to disclose records within its control pertaining to a specific email account.\u00a0 That court had determined that \u201can entity lawfully obligated to produce information\u201d in its control \u201cmust do so regardless of the location of that information.\u201d The Second Circuit disagreed and concluded that the relevant focus of the SCA warrant provisions is on maintaining the privacy of users\u2019 stored communications, meaning that foreign-stored communications should not be disclosed, because \u201cthe invasion of the customer\u2019s privacy takes place\u201d where the protected data is stored. In the Second Circuit\u2019s opinion, this means that Microsoft would be forced to perform a foreign seizure of the communications in question while \u201cacting as an agent of the government.\u201d\n\nThe concurring opinion<\/a> highlighted the potential slippery slope underpinning the logic of the dissenter\u2019s position concerning the location of the disclosure as dispositive.\u00a0 Specifically, Judge Lynch expressed concern that, under the dissenter\u2019s logic, the door could be open for an SCA warrant to obtain content stored in Ireland in an account established in Ireland by an Irish citizen in violation of Irish law merely because the service provider has a branch office in the United States with access to the account.\n\nAlthough Judge Lynch disagreed with the \u201cmajority\u2019s determination that the locus of the invasion of privacy is where the private content is stored,\u201d calling that determination \u201csuspect when the content consists of emails stored in the \u2018cloud,\u2019\u201d he indicated that it was \u201cat least equally persuasive that the invasion of privacy occurs where the person whose privacy is invaded customarily resides.\u201d\u00a0 Despite this distinction, Judge Lynch concluded that the panel majority had reached the correct result because he felt that Congress had not \u201cdemonstrated a clear intention to reach situations of this kind in enacting\u201d the SCA, especially \u201cin the case (which could well be this one) of records stored at the behest of a foreign national on servers in his own country.\u201d\n\nIn January 2017, the Second Circuit denied rehearing of the Microsoft case<\/a> in an evenly divided decision (\u201cMicrosoft II\u201d).\u00a0 Three judges recused themselves and four judges<\/a> separately dissented from the rehearing denial.\u00a0 Notably, the dissenting judges believed that the conduct that is the subject of the warrant was the provider\u2019s disclosure of emails and not their access to customer data, and the disclosure<\/a> to the DOJ would necessarily take place in the United States. \u00a0Further, the dissenting judges argued<\/a> that \u201cno extraterritorial reach is needed to require delivery in the United States of the information sought,\u201d because the warrant asked for data \u201calready within the grasps of a domestic entity.\u201d\u00a0 The dissent<\/a> also acknowledged a theme that was present in the Second Circuit\u2019s 2016 opinion: the difficulty of applying a statute passed in 1986 to present technology.\n\nThe Rest of the United States<\/strong>\n\nIn analogous cases throughout the country\u2014including the Eastern District of Pennsylvania, the Eastern District of Wisconsin, the Middle District of Florida, the Northern District of California, and the D.C. District Court\u2014magistrate judges have rejected the Second Circuit\u2019s decision in Microsoft and ordered organizations to produce foreign-stored data pursuant to SCA warrants.\u00a0 These decisions adhere to the principle that a court can order any organization that is subject to the court\u2019s jurisdiction to disclose anything it can access and deliver within the United States. Following this reasoning, no relevant extraterritoriality concerns are implicated by the foreign storage of user data.\n\nIn February 2017, U.S. Magistrate Judge Thomas Rueter in Philadelphia ordered<\/a> Google Inc. (\u201cGoogle\u201d) to comply with search warrants and transfer email from a foreign server to be reviewed locally, because there was \u201cno meaningful interference\u201d with the account holder\u2019s \u201cpossessor interest\u201d in the data sought.\u00a0 Judge Reuter reasoned that for the purposes of the warrant, the seizure of the information occurs where the search is conducted, and the \u201cactual infringement of privacy occurs at the time of disclosure\u201d; both in the United States.\u00a0 U.S. District Judge Juan S\u00e1nchez upheld Judge Reuter\u2019s ruling in August 2017.\u00a0 In his analysis, \u201cthe location of the provider and where it will disclose the data [is what] matter[s] in the extraterritoriality analysis.\u201d\u00a0 Citing one of the dissents from Microsoft II, S\u00e1nchez distinguished \u201c[t]he nature of electronic documents. Unlike paper documents, which have a tangible physical existence and location,\u201d electronic documents are \u201cliterally intangible\u201d making their location on a foreign server \u201cmerely virtual.\u201d\u00a0 This virtual presence is particularly relevant in regard to Google because, for network efficiency purposes, the company splits digital data into shards and relocates these pieces according to an algorithm between servers located around the globe in contrast to Microsoft, which stores data in fixed locations according to user proximity.\n\nAlso in February 2017, Magistrate Judge William E. Duffin in the Eastern District of Wisconsin ordered<\/a> Yahoo! Inc. (\u201cYahoo\u201d) and Google to comply with search warrants.\u00a0 Citing the \u201cpersuasive\u201d \u201canalysis of the four judges dissenting\u201d from Microsoft II, Judge Duffin determined that the service provider\u2019s chosen storage location for customer data \u201cis immaterial,\u201d and that \u201cwhat matters is the location of the service provider\u201d in the U.S., because that is where the data is accessed and turned over to the government.\n\nIn April 2017, Magistrate Judge Thomas B. Smith in the Middle District of Florida held that the SCA could be used to compel Yahoo to produce foreign-stored information.\u00a0 Disagreeing with the Microsoft Decision, the judge said that the focus of the SCA is not on the privacy interests in stored communications but rather on the compelled disclosure. Because the compelled disclosure takes place in the United States, Yahoo must produce information pursuant to the SCA warrant even if that information is stored on a foreign server.\n\nAlso in April 2017, Magistrate Judge Laurel Beeler in the Northern District of California ordered<\/a> Google to comply with a search warrant issued pursuant to the SCA for data \u201cregardless of the data\u2019s actual location.\u201d\u00a0 In her opinion, Judge Beeler accepted that SCA warrant provisions do not apply extraterritorially but concluded that warrants in this case should be viewed as \u201ca domestic application of the SCA\u201d rather than an extraterritorial one.\u00a0 In August 2017, her opinion was reviewed de novo<\/em> and affirmed, with U.S. District Court Judge Richard Seeborg ordering Google to produce \u201call content responsive to the search warrant that is accessible, searchable, and retrievable from the United States<\/em> pursuant to the terms of the warrant\u201d (emphasis added).\u00a0 Currently, Google is refusing to produce materials stored abroad, despite federal prosecutors\u2019 calls for sanctions<\/a>, and is seeking an appeal, pending the Supreme Court\u2019s decision in Microsoft<\/em>.\n\nIn June 2017, Magistrate Judge G. Michael Harvey in the District of Columbia directed<\/a> Google to comply with a warrant issued under the SCA for contents of a particular Google account.\u00a0 Based on an interpretation of the SCA that emphasizes disclosure over privacy and access over seizure, and considering the contents of Google\u2019s user agreement, the court held that Google is not seizing data. Rather, it already has access.\u00a0 Google users have no capacity to control the storage location of their data, because they agree to allow Google to access and transfer their data at will when registering for an account.\u00a0 That is, the data sought by the SCA warrant is already in Google\u2019s possession, custody, and control, and Google can access it without further authorization.\u00a0 U.S. District Court Judge Beryl A. Howell affirmed this ruling in July 2017.\n\nRecently Proposed Legislative Solutions<\/strong>\n\nAt the end of May 2017, law enforcement access to data stored abroad was the subject of a Senate Judiciary Committee, Subcommittee on Crime and Terrorism hearing<\/a>, which was in part another reconsideration of how to update the Electronic Communications Privacy Act of 1986 (ECPA), which created the SCA.\u00a0 While it is acknowledged by members of Congress on both sides of the aisle that ECPA is seriously out of date, proposals to update it have generally failed.\u00a0 In July 2017, S. 1671<\/a>, the International Communications Privacy Act, was referred to the Senate Judiciary Committee. It aimed to clarify the SCA\u2019s warrant requirement as it pertains to \u201cglobal electronic communications while respecting the data privacy laws of other countries\u201d and had broad support from technology companies<\/a> and industry groups<\/a>. The House of Representatives held a corresponding hearing<\/a> on the lawful access to and privacy protection of data stored abroad in June 2017, during which the Department of Justice in light of Microsoft II urged Congress reform the law.\n\nMore recently, Congress introduced the bipartisan Clarifying Lawful Overseas Use of Data (CLOUD<\/a>) Act of 2018, which would make the argument at issue in Microsoft<\/em> moot. In part, the CLOUD Act makes all data in the \u201cpossession, custody, or control\u201d of the provider attainable under the SCA, regardless of where the data is physically stored. \u201cPossession, custody, or control\u201d of course has its own Circuit Court variances<\/a> in definition, which could still create issues in applying the law uniformly. Several tech companies, including Apple, Facebook, Google, and Microsoft, authored a letter<\/a> to the Senators who sponsored the CLOUD Act, stating that \u201cif enacted, the CLOUD Act would be notable progress to protect consumers\u2019 rights and would reduce conflicts of law.\u201d The letter further comments that the CLOUD Act is a \u201clogical solution for governing cross-border access to data.\u201d Privacy groups disagree, seeing the legislation as a \u201cdangerous expansion\u201d<\/a> of \u201claw enforcement\u2019s ability to target and access people\u2019s data across international borders\u201d and saying it does not adequately protect<\/a> the privacy of cloud storage.\n\nParsing the Current Landscape <\/strong>\n\nInitially, the factual distinction between Microsoft\u2019s and Google\u2019s cloud storage solutions seemed to account for the differing outcomes in the Microsoft Decision and the subsequent Eastern District of Pennsylvania case involving Google.\u00a0 Google breaks up emails, and freely and regularly transfers user data from one data center around the globe to another without the customer\u2019s knowledge.\u00a0 Not only do such transfers not interfere with the customer\u2019s access or possessory interest in the user data, but this also means that data does not reside primarily in a single, identifiable foreign location.\u00a0 Microsoft, on the other hand, does not freely transfer its data, but allocates its storage based on proximity to a location selected by the user during account registration, meaning that the Second Circuit could more easily determine that specific data resided primarily in a fixed jurisdictional location.\u00a0 If Google\u2019s data lacks an alternate, identifiable jurisdictional location, no other foreign discovery options are readily available.\n\nHowever, the subsequent opinions make it clear that the courts are focusing on the locations of the access to and disclosure of the stored data, which occur in the United States, rather than the location of the data itself.\u00a0 Conversely, the Microsoft Decision focused on the seizure of the data from a foreign location, which is where it locates the privacy violations and applies its extraterritoriality analysis.\n\nClearly, all of these cases are criminal ones.\u00a0 Civil litigants, however, may note the passing references in some opinions to possession, custody, or control, which seem to be the key to understanding how a court may analyze similar civil cases. For example, in the initial court order granting the warrants overturned in the Microsoft Decision, Magistrate Judge James C. Francis IV, determined that the SCA\u2019s warrant provisions were substantially similar to \u201cthose associated with a subpoena to produce information in [an organization\u2019s] possession, custody, or control regardless of the location of that information.\u201d The Second Circuit interprets possession, custody, or control broadly, requiring parties in civil litigation to preserve, collect, search, and produce all documents a party has the practical ability to obtain.\n\nProducing foreign-stored documents whether compelled by a subpoena or a warrant may implicate the privacy laws of other countries, which can have their own consequences.\u00a0 For example, under the European Union\u2019s General Data Protection Regulation (GDPR), which comes into effect in May 2018, simply complying with a U.S. search warrant may be unlawful without additional steps. Brad Smith, Chief Legal Officer of Microsoft, testified<\/a> that \u201cU.S. law enforcement will be significantly restricted in its ability to obtain digital information covered by the GDPR unless it issues demands through international processes, instead of using unilateral, U.S.-based warrants.\u201d\n\nDevelopments at the Supreme Court Level<\/strong>\n\nOn June 23, 2017, the Department of Justice filed a petition for a writ of certiorari<\/a>, asking the United States Supreme Court to overturn the Microsoft II decision blocking the warrant.\u00a0 In its petition, the Department of Justice argues that the SCA\u2019s requirement to disclose information is a domestic application, not an extraterritorial one, and that the Second Circuit\u2019s decision conflicts with \u201cunanimous holdings of courts that a domestic recipient of a subpoena is required to produce specified materials within the recipient\u2019s control, even if the recipient stores the materials abroad.\u201d\u00a0 Microsoft argues in opposition<\/a> that the focus of the SCA is properly on \u201ccommunications in storage\u201d and that it \u201capplies where the communications are stored.\u201d Because the statute does not apply abroad, a point both parties agree on, \u201cthe SCA reaches only communications stored in the United States.\u201d The Supreme Court granted the petition on October 16, 2017.\u00a0 This high-profile case has garnered attention from many interested parties, resulting in the filing of over 30 amicus briefs by organizations ranging from The New Zealand Privacy Commissioner<\/a> and the European Commission on Behalf of the European Union<\/a> to Members of Congress<\/a> and IBM<\/a>.\n\nThe Supreme Court heard argument<\/a> on February 27, 2018, bringing us one step closer to a ruling that could give cloud storage providers and domestic users of their services much anticipated guidance as to how far the U.S. government can reach into their digital private lives. As the Second Circuit acknowledged, the Supreme Court is grappling with the application of \u201cdecades-old law to modern technology.\u201d<\/a> The oral argument focused on the disclosure (which would happen in the United States) and search (of data currently stored in Ireland) aspects of the SCA. Justices Ginsberg and Gorsuch honed in on the physical characteristics of data storage abroad, which means that some act has to take place in a foreign location for the data to be retrieved. Microsoft argued that retrieving and disclosing the data constitutes an \u201cextraterritorial act,\u201d even if a human being is not involved: \u201cif you sent a robot into a foreign land to seize evidence, it would certainly implicate foreign interests.\u201d In opposition, the government stated that such a disclosure would be analogous to a federal court requiring a defendant to access foreign assets to pay a fine. Justice Roberts seemed skeptical of Microsoft\u2019s claims, stating that it is \u201cnot the government\u2019s fault that [the data is] located overseas\u201d and suggesting that storing data overseas could be a way for providers to attract customers interested in keeping their data out of the government\u2019s grasp. Justice Alito seemed to share Justice Roberts\u2019 concerns. Conversely, Justice Sotomayor noted the potential to create \u201cinternational problems\u201d by expanding the SCA\u2019s extraterritorial reach. The government countered that \u201cthere is not an international problem here. This is largely a mirage that Microsoft is seeking to create.\u201d Justice Breyer attempted to find a compromise, suggesting that when faced with a government warrant, companies could ask a judge whether the warrant was enforceable in light of competing foreign law concerns. Other Justices inquired as to the government\u2019s ability to obtain said data outside of the SCA, for example through multi-lateral treaties (MLATs); concerns about foreign sovereignty; and whether they should wait for the CLOUD Act to be enacted. Justices Ginsburg and Sotomayor both appeared to believe that legislation rather than the Supreme Court should resolve the issue. Both parties asked the Supreme Court to decide upon the law as it currently stands without waiting for Congress to act. The Supreme Court\u2019s decision is anticipated before the end of June 2018, assuming Congress does not pass legislation to resolve the issue in the meantime.","saveContent":" $\"\"$ The U.S. Supreme Court recently heard oral arguments in U.S. v. Microsoft<\/em>, tackling the question of whether an organization can refuse to disclose foreign-stored data sought by the U.S. government through domestic warrants. Currently, the Second Circuit says yes while other circuits tend to say no.\n\nWhile several district courts have concluded that it is not an extraterritorial seizure to enforce warrants that require organizations to produce U.S. users\u2019 account data stored in foreign servers, these decisions conflict with precedent from the Second Circuit Court of Appeals. The Second Circuit held that Microsoft could not be compelled to comply with a warrant if it meant producing foreign-stored data for use in a domestic case. Elsewhere in the United States, judges have rejected the Second Circuit\u2019s decision, ordering the production of foreign-stored data pursuant to domestic warrants. These decisions follow the reasoning that a court can order the production of anything that can be accessed and delivered within the United States. Accordingly, no relevant extraterritoriality concerns are implicated despite the storage of data in a foreign location. Outside of the Second Circuit, it is clear that courts are focusing on where the access to and disclosure of the stored data occurs (domestically) rather than the location of the data (internationally). Conversely, the Second Circuit\u2019s Microsoft decision focuses on the seizure of the data from a foreign location, which is where it locates the privacy violations and applies its extraterritoriality analysis.\n\nLegislation could fix the differing interpretations, but despite near universal agreement that the Electronic Communications Privacy Act of 1986 needs to be updated and the repeated introduction of new legislation, Congress has been slow to act. Thus, both parties urged the Supreme Court to clarify the law during oral arguments in U.S. v. Microsoft<\/em>, which focused on whether the search, retrieval, and disclosure of foreign-stored data constituted an extraterritorial act, and if so, how the law should apply.\n\nThe Second Circuit and Microsoft<\/strong>\n\nThe Second Circuit\u2019s decision<\/a> in July 2016 held that Microsoft could not be forced to turn over emails stored on a server in Dublin, Ireland, for use in a domestic case.\u00a0 This decision in In the Matter of a Warrant to Search a Certain E-mail Account Controlled and Maintained by Microsoft Corporation<\/em> (\u201cMicrosoft Decision\u201d) reversed an April 2014 Southern District of New York ruling<\/a> denying Microsoft\u2019s motion to quash a warrant issued under the Stored Communications Act<\/a> (\u201cSCA\u201d) directing Microsoft to disclose records within its control pertaining to a specific email account.\u00a0 That court had determined that \u201can entity lawfully obligated to produce information\u201d in its control \u201cmust do so regardless of the location of that information.\u201d The Second Circuit disagreed and concluded that the relevant focus of the SCA warrant provisions is on maintaining the privacy of users\u2019 stored communications, meaning that foreign-stored communications should not be disclosed, because \u201cthe invasion of the customer\u2019s privacy takes place\u201d where the protected data is stored. In the Second Circuit\u2019s opinion, this means that Microsoft would be forced to perform a foreign seizure of the communications in question while \u201cacting as an agent of the government.\u201d\n\nThe concurring opinion<\/a> highlighted the potential slippery slope underpinning the logic of the dissenter\u2019s position concerning the location of the disclosure as dispositive.\u00a0 Specifically, Judge Lynch expressed concern that, under the dissenter\u2019s logic, the door could be open for an SCA warrant to obtain content stored in Ireland in an account established in Ireland by an Irish citizen in violation of Irish law merely because the service provider has a branch office in the United States with access to the account.\n\nAlthough Judge Lynch disagreed with the \u201cmajority\u2019s determination that the locus of the invasion of privacy is where the private content is stored,\u201d calling that determination \u201csuspect when the content consists of emails stored in the \u2018cloud,\u2019\u201d he indicated that it was \u201cat least equally persuasive that the invasion of privacy occurs where the person whose privacy is invaded customarily resides.\u201d\u00a0 Despite this distinction, Judge Lynch concluded that the panel majority had reached the correct result because he felt that Congress had not \u201cdemonstrated a clear intention to reach situations of this kind in enacting\u201d the SCA, especially \u201cin the case (which could well be this one) of records stored at the behest of a foreign national on servers in his own country.\u201d\n\nIn January 2017, the Second Circuit denied rehearing of the Microsoft case<\/a> in an evenly divided decision (\u201cMicrosoft II\u201d).\u00a0 Three judges recused themselves and four judges<\/a> separately dissented from the rehearing denial.\u00a0 Notably, the dissenting judges believed that the conduct that is the subject of the warrant was the provider\u2019s disclosure of emails and not their access to customer data, and the disclosure<\/a> to the DOJ would necessarily take place in the United States. \u00a0Further, the dissenting judges argued<\/a> that \u201cno extraterritorial reach is needed to require delivery in the United States of the information sought,\u201d because the warrant asked for data \u201calready within the grasps of a domestic entity.\u201d\u00a0 The dissent<\/a> also acknowledged a theme that was present in the Second Circuit\u2019s 2016 opinion: the difficulty of applying a statute passed in 1986 to present technology.\n\nThe Rest of the United States<\/strong>\n\nIn analogous cases throughout the country\u2014including the Eastern District of Pennsylvania, the Eastern District of Wisconsin, the Middle District of Florida, the Northern District of California, and the D.C. District Court\u2014magistrate judges have rejected the Second Circuit\u2019s decision in Microsoft and ordered organizations to produce foreign-stored data pursuant to SCA warrants.\u00a0 These decisions adhere to the principle that a court can order any organization that is subject to the court\u2019s jurisdiction to disclose anything it can access and deliver within the United States. Following this reasoning, no relevant extraterritoriality concerns are implicated by the foreign storage of user data.\n\nIn February 2017, U.S. Magistrate Judge Thomas Rueter in Philadelphia ordered<\/a> Google Inc. (\u201cGoogle\u201d) to comply with search warrants and transfer email from a foreign server to be reviewed locally, because there was \u201cno meaningful interference\u201d with the account holder\u2019s \u201cpossessor interest\u201d in the data sought.\u00a0 Judge Reuter reasoned that for the purposes of the warrant, the seizure of the information occurs where the search is conducted, and the \u201cactual infringement of privacy occurs at the time of disclosure\u201d; both in the United States.\u00a0 U.S. District Judge Juan S\u00e1nchez upheld Judge Reuter\u2019s ruling in August 2017.\u00a0 In his analysis, \u201cthe location of the provider and where it will disclose the data [is what] matter[s] in the extraterritoriality analysis.\u201d\u00a0 Citing one of the dissents from Microsoft II, S\u00e1nchez distinguished \u201c[t]he nature of electronic documents. Unlike paper documents, which have a tangible physical existence and location,\u201d electronic documents are \u201cliterally intangible\u201d making their location on a foreign server \u201cmerely virtual.\u201d\u00a0 This virtual presence is particularly relevant in regard to Google because, for network efficiency purposes, the company splits digital data into shards and relocates these pieces according to an algorithm between servers located around the globe in contrast to Microsoft, which stores data in fixed locations according to user proximity.\n\nAlso in February 2017, Magistrate Judge William E. Duffin in the Eastern District of Wisconsin ordered<\/a> Yahoo! Inc. (\u201cYahoo\u201d) and Google to comply with search warrants.\u00a0 Citing the \u201cpersuasive\u201d \u201canalysis of the four judges dissenting\u201d from Microsoft II, Judge Duffin determined that the service provider\u2019s chosen storage location for customer data \u201cis immaterial,\u201d and that \u201cwhat matters is the location of the service provider\u201d in the U.S., because that is where the data is accessed and turned over to the government.\n\nIn April 2017, Magistrate Judge Thomas B. Smith in the Middle District of Florida held that the SCA could be used to compel Yahoo to produce foreign-stored information.\u00a0 Disagreeing with the Microsoft Decision, the judge said that the focus of the SCA is not on the privacy interests in stored communications but rather on the compelled disclosure. Because the compelled disclosure takes place in the United States, Yahoo must produce information pursuant to the SCA warrant even if that information is stored on a foreign server.\n\nAlso in April 2017, Magistrate Judge Laurel Beeler in the Northern District of California ordered<\/a> Google to comply with a search warrant issued pursuant to the SCA for data \u201cregardless of the data\u2019s actual location.\u201d\u00a0 In her opinion, Judge Beeler accepted that SCA warrant provisions do not apply extraterritorially but concluded that warrants in this case should be viewed as \u201ca domestic application of the SCA\u201d rather than an extraterritorial one.\u00a0 In August 2017, her opinion was reviewed de novo<\/em> and affirmed, with U.S. District Court Judge Richard Seeborg ordering Google to produce \u201call content responsive to the search warrant that is accessible, searchable, and retrievable from the United States<\/em> pursuant to the terms of the warrant\u201d (emphasis added).\u00a0 Currently, Google is refusing to produce materials stored abroad, despite federal prosecutors\u2019 calls for sanctions<\/a>, and is seeking an appeal, pending the Supreme Court\u2019s decision in Microsoft<\/em>.\n\nIn June 2017, Magistrate Judge G. Michael Harvey in the District of Columbia directed<\/a> Google to comply with a warrant issued under the SCA for contents of a particular Google account.\u00a0 Based on an interpretation of the SCA that emphasizes disclosure over privacy and access over seizure, and considering the contents of Google\u2019s user agreement, the court held that Google is not seizing data. Rather, it already has access.\u00a0 Google users have no capacity to control the storage location of their data, because they agree to allow Google to access and transfer their data at will when registering for an account.\u00a0 That is, the data sought by the SCA warrant is already in Google\u2019s possession, custody, and control, and Google can access it without further authorization.\u00a0 U.S. District Court Judge Beryl A. Howell affirmed this ruling in July 2017.\n\nRecently Proposed Legislative Solutions<\/strong>\n\nAt the end of May 2017, law enforcement access to data stored abroad was the subject of a Senate Judiciary Committee, Subcommittee on Crime and Terrorism hearing<\/a>, which was in part another reconsideration of how to update the Electronic Communications Privacy Act of 1986 (ECPA), which created the SCA.\u00a0 While it is acknowledged by members of Congress on both sides of the aisle that ECPA is seriously out of date, proposals to update it have generally failed.\u00a0 In July 2017, S. 1671<\/a>, the International Communications Privacy Act, was referred to the Senate Judiciary Committee. It aimed to clarify the SCA\u2019s warrant requirement as it pertains to \u201cglobal electronic communications while respecting the data privacy laws of other countries\u201d and had broad support from technology companies<\/a> and industry groups<\/a>. The House of Representatives held a corresponding hearing<\/a> on the lawful access to and privacy protection of data stored abroad in June 2017, during which the Department of Justice in light of Microsoft II urged Congress reform the law.\n\nMore recently, Congress introduced the bipartisan Clarifying Lawful Overseas Use of Data (CLOUD<\/a>) Act of 2018, which would make the argument at issue in Microsoft<\/em> moot. In part, the CLOUD Act makes all data in the \u201cpossession, custody, or control\u201d of the provider attainable under the SCA, regardless of where the data is physically stored. \u201cPossession, custody, or control\u201d of course has its own Circuit Court variances<\/a> in definition, which could still create issues in applying the law uniformly. Several tech companies, including Apple, Facebook, Google, and Microsoft, authored a letter<\/a> to the Senators who sponsored the CLOUD Act, stating that \u201cif enacted, the CLOUD Act would be notable progress to protect consumers\u2019 rights and would reduce conflicts of law.\u201d The letter further comments that the CLOUD Act is a \u201clogical solution for governing cross-border access to data.\u201d Privacy groups disagree, seeing the legislation as a \u201cdangerous expansion\u201d<\/a> of \u201claw enforcement\u2019s ability to target and access people\u2019s data across international borders\u201d and saying it does not adequately protect<\/a> the privacy of cloud storage.\n\nParsing the Current Landscape <\/strong>\n\nInitially, the factual distinction between Microsoft\u2019s and Google\u2019s cloud storage solutions seemed to account for the differing outcomes in the Microsoft Decision and the subsequent Eastern District of Pennsylvania case involving Google.\u00a0 Google breaks up emails, and freely and regularly transfers user data from one data center around the globe to another without the customer\u2019s knowledge.\u00a0 Not only do such transfers not interfere with the customer\u2019s access or possessory interest in the user data, but this also means that data does not reside primarily in a single, identifiable foreign location.\u00a0 Microsoft, on the other hand, does not freely transfer its data, but allocates its storage based on proximity to a location selected by the user during account registration, meaning that the Second Circuit could more easily determine that specific data resided primarily in a fixed jurisdictional location.\u00a0 If Google\u2019s data lacks an alternate, identifiable jurisdictional location, no other foreign discovery options are readily available.\n\nHowever, the subsequent opinions make it clear that the courts are focusing on the locations of the access to and disclosure of the stored data, which occur in the United States, rather than the location of the data itself.\u00a0 Conversely, the Microsoft Decision focused on the seizure of the data from a foreign location, which is where it locates the privacy violations and applies its extraterritoriality analysis.\n\nClearly, all of these cases are criminal ones.\u00a0 Civil litigants, however, may note the passing references in some opinions to possession, custody, or control, which seem to be the key to understanding how a court may analyze similar civil cases. For example, in the initial court order granting the warrants overturned in the Microsoft Decision, Magistrate Judge James C. Francis IV, determined that the SCA\u2019s warrant provisions were substantially similar to \u201cthose associated with a subpoena to produce information in [an organization\u2019s] possession, custody, or control regardless of the location of that information.\u201d The Second Circuit interprets possession, custody, or control broadly, requiring parties in civil litigation to preserve, collect, search, and produce all documents a party has the practical ability to obtain.\n\nProducing foreign-stored documents whether compelled by a subpoena or a warrant may implicate the privacy laws of other countries, which can have their own consequences.\u00a0 For example, under the European Union\u2019s General Data Protection Regulation (GDPR), which comes into effect in May 2018, simply complying with a U.S. search warrant may be unlawful without additional steps. Brad Smith, Chief Legal Officer of Microsoft, testified<\/a> that \u201cU.S. law enforcement will be significantly restricted in its ability to obtain digital information covered by the GDPR unless it issues demands through international processes, instead of using unilateral, U.S.-based warrants.\u201d\n\nDevelopments at the Supreme Court Level<\/strong>\n\nOn June 23, 2017, the Department of Justice filed a petition for a writ of certiorari<\/a>, asking the United States Supreme Court to overturn the Microsoft II decision blocking the warrant.\u00a0 In its petition, the Department of Justice argues that the SCA\u2019s requirement to disclose information is a domestic application, not an extraterritorial one, and that the Second Circuit\u2019s decision conflicts with \u201cunanimous holdings of courts that a domestic recipient of a subpoena is required to produce specified materials within the recipient\u2019s control, even if the recipient stores the materials abroad.\u201d\u00a0 Microsoft argues in opposition<\/a> that the focus of the SCA is properly on \u201ccommunications in storage\u201d and that it \u201capplies where the communications are stored.\u201d Because the statute does not apply abroad, a point both parties agree on, \u201cthe SCA reaches only communications stored in the United States.\u201d The Supreme Court granted the petition on October 16, 2017.\u00a0 This high-profile case has garnered attention from many interested parties, resulting in the filing of over 30 amicus briefs by organizations ranging from The New Zealand Privacy Commissioner<\/a> and the European Commission on Behalf of the European Union<\/a> to Members of Congress<\/a> and IBM<\/a>.\n\nThe Supreme Court heard argument<\/a> on February 27, 2018, bringing us one step closer to a ruling that could give cloud storage providers and domestic users of their services much anticipated guidance as to how far the U.S. government can reach into their digital private lives. As the Second Circuit acknowledged, the Supreme Court is grappling with the application of \u201cdecades-old law to modern technology.\u201d<\/a> The oral argument focused on the disclosure (which would happen in the United States) and search (of data currently stored in Ireland) aspects of the SCA. Justices Ginsberg and Gorsuch honed in on the physical characteristics of data storage abroad, which means that some act has to take place in a foreign location for the data to be retrieved. Microsoft argued that retrieving and disclosing the data constitutes an \u201cextraterritorial act,\u201d even if a human being is not involved: \u201cif you sent a robot into a foreign land to seize evidence, it would certainly implicate foreign interests.\u201d In opposition, the government stated that such a disclosure would be analogous to a federal court requiring a defendant to access foreign assets to pay a fine. Justice Roberts seemed skeptical of Microsoft\u2019s claims, stating that it is \u201cnot the government\u2019s fault that [the data is] located overseas\u201d and suggesting that storing data overseas could be a way for providers to attract customers interested in keeping their data out of the government\u2019s grasp. Justice Alito seemed to share Justice Roberts\u2019 concerns. Conversely, Justice Sotomayor noted the potential to create \u201cinternational problems\u201d by expanding the SCA\u2019s extraterritorial reach. The government countered that \u201cthere is not an international problem here. This is largely a mirage that Microsoft is seeking to create.\u201d Justice Breyer attempted to find a compromise, suggesting that when faced with a government warrant, companies could ask a judge whether the warrant was enforceable in light of competing foreign law concerns. Other Justices inquired as to the government\u2019s ability to obtain said data outside of the SCA, for example through multi-lateral treaties (MLATs); concerns about foreign sovereignty; and whether they should wait for the CLOUD Act to be enacted. Justices Ginsburg and Sotomayor both appeared to believe that legislation rather than the Supreme Court should resolve the issue. Both parties asked the Supreme Court to decide upon the law as it currently stands without waiting for Congress to act. The Supreme Court\u2019s decision is anticipated before the end of June 2018, assuming Congress does not pass legislation to resolve the issue in the meantime.","order":0,"get_parent":{},"attributes":[],"attributesType":{"content":{"type":"string","source":"raw"},"lock":{"type":"object"},"metadata":{"type":"object"}},"dynamicContent":null}]

What Controls: The Location of the Data or the Location of the Searches for the Data?