Policy —

Does US have right to data on overseas servers? We’re about to find out

Supreme Court case has ramifications for tech sector, foreign relations, and privacy.

Microsoft in Dublin, Ireland.
Enlarge / Microsoft in Dublin, Ireland.

The Justice Department on Friday petitioned the US Supreme Court to step into an international legal thicket, one that asks whether US search warrants extend to data stored on foreign servers. The US government says it has the legal right, with a valid court warrant, to reach into the world's servers with the assistance of the tech sector, no matter where the data is stored.

The request for Supreme Court intervention concerns a 4-year-old legal battle between Microsoft and the US government over data stored on Dublin, Ireland servers. The US government has a valid warrant for the e-mail as part of a drug investigation. Microsoft balked at the warrant, and convinced a federal appeals court that US law does not apply to foreign data.

The government on Friday told the justices that US law allows it to get overseas data, and national security was at risk.

"This Court should grant review to restore the government’s ability to require providers to disclose electronic communications—which are, in this day and age, often the only or the most critical evidence of terrorism and crime," the government wrote. (PDF)

The outcome has huge privacy ramifications for consumers and for the tech sector, which is caught between a rock and a hard place. The sector is being asked by the US government to comply with court orders that sometimes conflict with the laws of where the data is stored.

To remedy that, Congress is trying to hash out legislation that would allow the US government to enter into reciprocity agreements with other countries so that each side has the right to access data on foreign servers—with a valid warrant.

The paradox

"I look forward to getting out some legislation before the end of the year," Sen. Chuck Grassley, an Iowa Republican, said at a Senate Judiciary Committee hearing on the topic last month. "It's very important for our national security."

Sen. Orrin Hatch, a Utah Republican and member of the Judiciary Committee, asked: "What are providers supposed to do? Who's law do they violate?"

Adding to the quagmire, lawmakers noted that the search-and-seizure laws of some nations, like China, are not on par with the US government, which would make it difficult to negotiate reciprocity deals with those countries.

Brad Smith, Microsoft's president and chief legal officer, told the committee he hopes the US can strike deals with foreign nations. He told lawmakers that Microsoft first challenged whether the US had the right to overseas data in 2013. Simply complying with US warrants for overseas data, he said, "undermines foreign confidence in American technology companies."

"These concerns led to our lawsuit," he said.

In a statement late Friday, Smith added:

Today the U.S. Justice Department asked the Supreme Court to reconsider a legal decision, in a case brought by Microsoft, which found that U.S. warrants cannot be unilaterally applied to email in other countries. It seems backward to keep arguing in court when there is positive momentum in Congress toward better law for everyone. The DOJ’s position would put businesses in impossible conflict-of-law situations and hurt the security, jobs, and personal rights of Americans.

The government balked at the assertion. In its petition, the Justice Department said that Microsoft's "arguments ring hallow."

Economic concerns cannot override the text of the statute or the interests in public safety and national security that are at stake in this case—particularly when the claimed economic benefit is derived directly from a provider’s ability to market itself as capable of shielding subscribers' activity, including their criminal activity, from discovery by the authorities.

Following Microsoft's lead, there are more than 100 active cases in the US in which the tech sector is challenging whether the US government, even with valid warrants, can reach into their foreign servers.

"The numbers continue to rise," Deputy Assistant Attorney General Brad Wiegmann told the Judiciary Committee. Many of those challenges are under seal and not a part of public court dockets. Some cases not under seal were brought by Google and Yahoo.

Invalid warrants

In a nutshell, the US government claims it should not matter where the data is stored. What matters is whether the company can access that data in the US.

The Microsoft case is the only one to have been litigated far enough to have reached the Supreme Court.

When the Microsoft case was in the lower courts, dozens of organizations and companies submitted briefs on behalf of Microsoft. They include the US Chamber of Commerce, Amazon, Apple, Cisco, CNN, Fox News Network, Gannett, and Verizon.

If the justices grant the government's appeal, a hearing is not expected until the court's next term in the fall.

Channel Ars Technica