Data Stored on Foreign Servers Remains Safe From U.S. Warrants -- for Now
In July, the Second Circuit ruled that the federal government was not authorized to seize information stored on overseas servers under the Stored Communications Act. That law's warrant provisions, the three-judge panel held, don't apply extraterritorially, allowing Microsoft to quash a warrant for a customer's email data stored on its servers in Ireland.
It was a landmark decision, one that earned praise from privacy advocates and industry alike. And it will stand for now, after the Second Circuit split 4-4 on Tuesday on whether to rehear the case en banc. The deadlock means no rehearing and the case remains good law -- though the government could appeal to the Supreme Court.
The Second Circuit's Landmark Ruling
The dispute arose after the government suspected one Microsoft email user of trafficking in illegal narcotics. The feds served Microsoft with a warrant pursuant to the Stored Communications Act, for emails on the company's "electronic communications services" -- information that was on servers in Dublin.
Microsoft challenged the warrant, becoming the first company to do so. The SCA's warrant provisions, Microsoft argued, don't reach beyond U.S. borders. The Second Circuit agreed, finding no congressional intent that the law should apply extraterritorially:
The focus of those provisions is protection of a user's privacy interests. Accordingly, the SCA does not authorize a US court to issue and enforce an SCA warrant against a United States-based service provider for the contents of a customer's electronic communications stored on servers located outside the United States.
Microsoft had warned that allowing the warrant to stand could lead to an international "free-for-all," leading foreign law enforcement officers to seek to seize data in the United States.
No En Banc Hearing, but Supreme Court Review?
The Department of Justice sought a rehearing en banc, leading to Tuesday's evenly-split vote. Without a majority in favor of review, the panel's opinion stands.
The denial of rehearing led to four dissents -- one from each judge who had voted for the rehearing. The panel ruling, Judge Jose A. Cabranes said in his dissent, "indisputably and severely" constrained criminal investigators, without serving "any serious, legitimate, or substantial privacy interest."
Judge Christopher F. Droney noted the difficulty of "attempting to apply a statute enacted decades ago to present technology." The issues raised when doing so deserve further review, he argued.
The DOJ is still reviewing the decision, according to department spokesman Peter Carr. If the department does appeal to the Supreme Court, the strength and number of those dissents could tip the scales toward Supreme Court review.
Related Resources:
- Microsoft Prevails Again in Dispute With Justice Department Over Customer Data in Ireland (GeekWire)
- Microsoft Doesn't Have to Turn Over Emails on Foreign Servers (FindLaw's U.S. Second Circuit Blog)
- Microserf Proposes Solving Tech Problems With Medieval Law (FindLaw's Technologist)
- Say Goodbye to Microsoft OneDrive's Unlimited Cloud Storage (FindLaw's Technologist)