Does a US Warrant Extend to Data Held Abroad?

When the government wants a company in the United States to turn over private data stored in another country, which country’s laws apply? The Supreme Court is set to consider that question in a case that raises a novel legal question about warrants, borders, and the Fourth Amendment.

The case involves a dispute between Microsoft and the U.S. Department of Justice, which served the company with a warrant demanding it turn over emails that are stored at its data center in Ireland. Microsoft balked, arguing — so far successfully — that the warrant is effective only inside the country, and therefore cannot not compel disclosure of information stored abroad. The Justice Department has argued that the warrant is valid because the actions required for Microsoft to retrieve the data in question would take place in the U.S., and therefore do not entail a search or seizure outside U.S. borders, which can only take place with explicit authorization from Congress.

Last week, the ACLU, along with the Brennan Center for Justice, the Electronic Frontier Foundation, Restore the Fourth, and The R Street Institute, filed a brief arguing that the government’s insistence that it can seize data held abroad with a regular warrant is based on an erroneous interpretation of the Fourth Amendment.

In July 2016, a panel of the Second Circuit Court of Appeals ruled in favor of Microsoft. It held that the warrant would be executed in Ireland, and not in the U.S., where the Microsoft employees gathering the data are located. In the absence of authorization from Congress, the court ruled the warrant had no effect outside the U.S. and Microsoft did not have to comply. The Justice Department appealed to the Supreme Court, which will hear the case on February 27.

The “Microsoft Ireland” case raises complicated issues about privacy, government access to data stored in other nations, and technological design. Our amicus brief strives to sensitize the Supreme Court to dangerous arguments the government has made that, if adopted, could adversely impact Fourth Amendment rights.

The government urges the court to rule that it is not a search when the government or its agents copy or transfer a user’s emails, but only when the company discloses the information to the government or a government agent reviews the emails’ content. According to that argument, the Fourth Amendment would only kick into gear when the government takes possession of emails. That’s a dangerous position. A company acting as a government agent is conducting a Fourth Amendment “search and seizure” when accessing, copying, or moving a user’s data, regardless of when, where, or even whether investigators later search it.

While a warrant issued in this case, the government also implies that a subpoena — which is not issued by a judge and does not require a probable cause showing — would have been sufficient to search and seize the Microsoft emails. That’s dangerous, too. A subpoena cannot compel a company to disclose a customer’s email or other private communications. Since we have a reasonable expectation of privacy in those personal messages, the Constitution requires a search warrant approved by a judge. A lower standard would empower law enforcement to conduct searches without judicial oversight, creating serious consequences for privacy rights. We urged the court to make clear that a mere subpoena cannot authorize law enforcement to search and seize American emails from a service provider.

The government’s position could also increase the risk that investigators from other countries will interfere with the privacy and property interests of people in the United States. If the Supreme Court rules that the U.S. government can force access to foreign data under U.S. law, then foreign governments are more likely to reciprocate by seeking Americans’ data through foreign law, which tends to be far less protective of privacy. Mutual legal assistance treaties — agreements between countries that establish mechanisms for requesting and obtaining evidence for criminal investigations and prosecutions — already define the proper process for cross-border data demands. These agreements ensure that where a law enforcement demand implicates both countries’ legal protections, both countries’ laws are satisfied.

The Microsoft Ireland case raises complicated issues, but it certainly shouldn’t be decided in a manner that erodes constitutional privacy rights.

Add a comment (10)
Read the Terms of Use

Anonymous

Personal information is your "personal property" and nobody should be able to trespass on your property without a judicial warrant from a real Article III court.

Triangular eye

What is “personal information”? Is people are in their back yard naked having sex with their spouse protected information as performed on personal property? Like, you live on 10 acres and you’re having sex with your husband and someone films it with a zoom lens then complains to the law. Is that personal. What if it was only one acre full of family homes? Just want to know what’s personal.

Dr. Timothy Leary

Why is Microsoft employing people in Ireland, and storing American data there? The slogan "Be American, Buy American" extends to utilizing, that is, buying American employees. It's no wonder that disadvantaged Americans like the Fergusonites don't have jobs.

Anonymous

The 1st amendment allows you to say things that are neither witty, nor insightful, and of little relevance to the subject at hand. That doesn't make you right and it doesn't mean your argument is strong, That, my good sir, is where one's critical reasoning abilities come into play.

Dr. Timothy Leary

Well Mr. Anonymous, I can tell that by the logic and astuteness of your response that you are not a Fergusonite.

Anonymous

I think the other anonymous is saying you should troll better, Dr Leary.

Dr. Timothy Leary

I am not a troll. I am a provocateur.

Anonymous

If you win this the people Meuller is investigating may be able to cite your case, in their defense, in court. Did you think about that? If the government can't get access to emails stored overseas then, surely, it would be the same for banking and financial information. Seems like the same argument would apply. Obviously it doesn't, currently, and I'm not sure where to find the laws on that but if the Supreme Court rules that a law doing an action is unConstitutional then closely related laws are in jeopardy of being ruled unConstitutional, too. After all, if the argument is that the US warrant doesn't apply then it doesn't apply to anything.

Anonymous

I'd love to see the Mueller investigation find something and successfully prosecute it just as much as anyone. But we shouldn't sacrifice Due Process for the sake of making one particular prosecution easier. Most of that evidence was obtained under FISA, which is totally separate (and FISA courts are pretty terrible too)

Anonymous

No.
If you argue YES, you should be prepared to handover data on all handing over data on American citizens/residents/visitors to other governments.

Stay Informed