Nationality in the cloud: US clashes with Microsoft over seizing data from abroad

Does cloud computing have a nationality? That’s the question posed by Microsoft’s lawyers and the counsel in a closely watched case whose oral arguments begin in Manhattan on next Wednesday. The case scrutinizes the ability of the US government to seize information outside its own borders.

Microsoft and the US government are facing off in the second circuit court of appeals over the tech giant’s continuing refusal to hand over emails related to a narcotics case from a Hotmail account hosted in Ireland in 2013.

Microsoft argues that its data should be protected by the laws of the land where its servers are located – a decision that will have major ramifications for cloud computing no matter which way it goes.

The case has made for strange bedfellows: Apple filed an amicus brief with Microsoft, as did the Electronic Frontier Foundation and Verizon, NPR and Fox News, the Irish government, the ACLU, eBay and the Guardian.

In court documents, Microsoft argued: “The power to embark on unilateral law enforcement incursions into a foreign sovereign country – directly or indirectly – has profound foreign policy consequences. Worse still, it threatens the privacy of US citizens.”

Thus far, the courts have been unsympathetic: last year judge James Francis IV, the southern district of New York magistrate who originally issued the warrant, found that he had indeed made the right decision and told Microsoft to hand over the emails.

At issue is the Stored Communications Act of 1986, which Microsoft says couldn’t possibly have anticipated cloud storage, in which data is meted out across servers all over the globe to reduce costs and increase speed.

Microsoft doesn’t contend that Francis’s ruling is contradicted by the SCA, but that it constitutes wild judicial speculation so far outside the act’s bounds that there is no way to apply it. The SCA covers serving a warrant in the US and searching a premises in the US – the middle portion, it said in a brief, interprets the act of executing a warrant as compelling Microsoft to retrieve documents from foreign servers.

“No one describes air travel as ground transportation just because it involves taxiing to and from the runway,” the company said in a brief with attorney Bradford L Smith as lead author.

Public officials are looking to reform the law, as well: Senators Orrin Hatch of Utah, Chris Coons of Delaware and Dean Heller of Nevada have co-sponsored the Law Enforcement Access to Data Stored Abroad (Leads) Act, a bill that would address circumstances similar to the one being litigated.

The government argues that because Microsoft is an American corporation, all data controlled in its facilities anywhere on earth can be subpoenaed lawfully because the tech giant is headquartered in Redmond, Washington. Because of that, US government lawyers say, officials have the right to repatriate records and the search warrant acts as a subpoena.

In a recent study, underwritten by Microsoft, European thinktank the Center for European Policy Studies wrote: “Microsoft has contested the decision on the grounds that the records are stored in a data centre in foreign country, not owned by Microsoft but rather by the email user, and that the order entails a conflict of laws and the impermissible exercise of extraterritorial authority.”

Microsoft declined to comment on the record, citing active legislation, but last year Brad Smith, Microsoft’s top lawyer, told the Guardian tech companies would be forced to encrypt more of their data, defeating government efforts, if the company loses. “It will force companies to look for more ways to encrypt data and not retain the keys. Partner with non-US companies so that non-US companies have the servers. None of which will be helpful to the US,” he said.

“Part of what we’re seeing here is the desire to go unilateral,” said Lee Tien, senior staff attorney for the Electronic Frontier Foundation. “We have formal mechanisms for this. They are cumbersome, and we fully support expediting them and appropriating more money to make that thing work, but at the end of the day it’s like saying: ‘Gee, we shouldn’t have to get a search warrant because it’s a pain in the ass.’”

This warrant relates to a single narcotics trafficking case, but Tien said the current litigation recalls breaches of privacy on a much grander scale.

“When the Snowden stuff started coming out, a lot of folks were kind of upset to discover that the US government was taking advantage of the fact that a lot of communications run through the United States and were stored in data centers that were run by US companies,” Tien said. “That made people who were not US citizens wonder: ‘Gee, is my data being protected the way it should be?’”

Tien also judged the warrant to be overly broad, covering every email ever sent from the account in a case that might not cover the entire life of a person’s private email account. Tien said that the way judges understand these cases is changing, though: “We’re seeing magistrates realize that that it’s too broad to suck out five years of someone’s Gmail if it involves two months of someone’s life and, generously, a dozen people. None of that gives any reason to read anybody’s emails to their mom from five years ago.”