With the proliferation of electronically stored information ("ESI") and the rising expense of storing the massive amounts of content generated, internet service providers ("ISPs"), such as Microsoft, have frequently turned to overseas storage options or the cloud for more economical content storage. Content may also be stored abroad if the account registrant or address provided upon registration are located in closer proximity to an overseas server. This has created a challenge for obtaining ESI, both in civil litigations and criminal investigations, when the content is determined to reside outside the United States and its retrieval could trigger overseas data privacy laws or other extraterritorial considerations.
One such challenge is currently pending before Southern District of New York Chief Judge Loretta A. Preska. In a case of first impression, Chief Judge Preska will have to determine whether the government may properly obtain email content stored abroad by serving a search warrant issued pursuant to the Stored Communications Act, 18 U.S.C. §§ 2701-2712 (the "SCA"), on an ISP based in the United States. The action - In the Matter of a Warrant to Search a Certain E-mail Account Controlled and Maintained by Microsoft Corporation - involves Microsoft's appeal from Magistrate Judge James C. Francis's decision denying its motion to quash a warrant that calls for the production of email content stored on servers in Dublin (the "Initial Decision"). The case involves novel and complicated questions about the extraterritorial reach of search warrants and by implication the efficacy of foreign data protection laws that could have broad ramifications for the ISP community. Not surprisingly then, Apple, AT&T, and Verizon have sought to file amici briefs on Microsoft's behalf.
Microsoft's Motion to Quash
The search warrant issued by Judge Francis - well known for penning groundbreaking e-discovery decisions - called for Microsoft to produce, among other things, the content of all emails stored in the targeted account and records or other identifying information for the targeted account, including the full name of the account holder, physical address, telephone numbers, and other identifiers. 2014 WL 1661004, at *2 (S.D.N.Y. Apr. 25, 2014). Microsoft produced the non-content information stored on its servers in the United States but moved to quash the warrant with respect to the content information, which was stored on servers in Ireland. Judge Francis denied the motion to quash, requiring the production of the ESI located on the overseas servers.
In doing so, Judge Francis rejected Microsoft's argument that the warrant for the production of ESI stored on overseas servers violated United States laws against extraterritorial searches and seizures. The Initial Decision held that warrants issued under the SCA (an "SCA Warrant") are not traditional search warrants, which typically involve the government entering premises and imaging hard-drives or servers. Instead, Judge Francis found that SCA Warrants are a "hybrid" - akin to both a warrant and a subpoena - because the ISPs receive the demand for disclosure and search for and produce the requested ESI themselves. Noting that it has "long been the law that a subpoena requires the recipient to produce information in its possession, custody or control regardless of the location of that information," id. at *5, Judge Francis was not persuaded that the overseas location of the content should have any bearing on or bar Microsoft's production, because the subpoena-like feature of SCA Warrant placed "obligations only on the service provider to act within the United States." Id. at *9.
The Initial Decision also rejected Microsoft's argument that the warrant should have been handled through a Mutual Legal Assistance Treaty ("MLAT") once the content was identified as residing on overseas servers. Judge Francis observed that the MLAT process was too "slow and cumbersome" an alternative, given the need for speedy law enforcement investigation. He also expressed concern about the certainty and availability of the MLAT process, as foreign agencies or governments carrying out the warrant pursuant to the MLAT "generally retain the discretion to decline a request for assistance," id. at *8, and not all countries have MLATs with the United States. Finally, he noted that some ISPs are exploring the option of moving away from storing their ESI on land-based servers altogether, specifically citing Google's publicly announced initiative to establish "true 'offshore' servers: server farms located at sea beyond the territorial jurisdiction of any nation." Id. at 9 (internal citation omitted). Such advancements in storage capacity and location would, Judge Francis reasoned, render certain data held by ISPs completely unavailable to law enforcement under Microsoft's reading of the SCA.
Finding the relevant language of the SCA "ambiguous," id. at *4, Judge Francis also analyzed the legislative history of the SCA, id. at **5-8. Because the legislative history was "scant," he looked to the data retrieval framework and policy concerns underlying the Patriot Act, which authorizes nationwide service of search warrants for electronic evidence. Id. at *6. He reasoned that the legislative history of the Patriot Act makes clear that Congress equates "where" the electronic data is located with the location of the ISP, not the location of any server. Id. at *7. Based on that legislative history, Judge Francis concluded that, in passing the SCA, Congress appeared to have anticipated that an ISP located in the United States would be obligated to respond to a warrant by producing information within its control, regardless of where that information was stored. Id. at **3, 8.
Implications for Foreign Data Privacy and Protection
Although Judge Francis did not address foreign data privacy and protection laws that could be implicated were Microsoft to comply with the warrant, that is an issue observers are watching closely. For example, in the days following Judge Francis's decision, the European Commission Spokeswoman for Justice, Fundamental Rights and Citizenship, Mina Andreeva, announced, "The commission's position is that this data should not be directly accessed by or transferred to US law enforcement authorities outside formal channels of co-operation, such as the mutual legal assistance agreements or sectional EU-US agreements authorizing such transfers." Microsoft 'must release' data held on Dublin server, BBC.COM, 29 April 2014, http://www.bbc.com/news/technology-27191500. Ms. Andreeva went on to explain that "the European Parliament [has] reinforced the principle that companies operating on the European market need to respect the European data protection rules - even if they are located in the US." Id. Similarly, Verizon's petition to file an amicus brief argued that if a U.S. search warrant could be used to obtain customer data or communications stored abroad, it would create a "dramatic conflict with foreign data protection law."
It remains to be seen whether Chief Judge Preska will address the foreign privacy and protection issues implicated by the Microsoft appeal. Briefing in the case is ongoing and oral argument is scheduled for July 31, 2014.
Over the past few years, companies have had to grapple with how to comply with civil discovery demands that call for ESI stored overseas and potentially subject to data privacy laws or blocking statutes. Moreover, ISPs have crafted detailed and cautious policies for responding to domestic civil subpoenas that might implicate the SCA and the privacy protections afforded to user ESI under the statute.
If Judge Preska adopts Judge Francis's ruling, ISPs may have to mediate the production requirements of SCA Warrants where content is stored overseas with foreign data privacy laws and blocking statutes. With the rising costs of ESI storage, innovative initiatives like the at-sea server farms and the anticipated amendments to the European data privacy regime, these issues are only bound to get more complicated in the future.