Microsoft: Privacy case could spur email 'Wild West'

WASHINGTON - If the government prevails in its legal battle to compel Microsoft to turn over emails held on a server in Ireland, an "international firestorm" could result, an attorney for the tech giant told a federal court in New York on Wednesday.

In a case with significant global business and privacy implications, Joshua Rosenkranz, a Microsoft attorney, argued that U.S. law does allow the federal government to issue a warrant for emails the company is storing in a data center overseas.

To uphold that warrant, he said, would launch "a global free-for-all" in which "any country with jurisdiction over a provider can reach into any other country and plunder our emails."

The issue before a three-judge panel of the U.S. Court of Appeals for the 2nd Circuit was whether the 1986 Stored Communications Act allows a U.S. law enforcement agency to obtain stored emails with a warrant from a U.S. provider if those emails are stored abroad.

It is a novel case, one that arises out of the evolution of cloud computing, in which large global email providers such as Microsoft are increasingly storing customers' content all over the world. The firms say they do this because users can pull up their emails more quickly if they are stored closer to them.

"This case matters tremendously to American communications and cloud service providers, since a ruling in favor of the government will make foreign customers fear that the U.S. government will have easy access to their private information regardless of whatever protection their own local law provides," said Michael A. Vatis, a partner at Steptoe & Johnson who co-authored a friend-of-the-court brief for Verizon in the case. "And they will bring their business to foreign providers instead."

The government agreed with Microsoft that the law does not apply overseas. But Assistant U.S. Attorney Justin Anderson argued that the law's focus was on disclosure _ not storage or the location of the stored content. Given that Microsoft can access customers' emails from within the United States data no matter where the data is stored, he said, "this [warrant] is not an extraterritorial application of anything."

The government, he said, "is indifferent to where Microsoft might have to go to gather these materials ... The warrant doesn't care where the records are."

Judge Susan Carney asked Anderson whether a German court could require disclosure of an email provider in Germany, regardless of where the servers were and even if the disclosure would affect U.S. customers' privacy.

"The fact is that under international law, this is the norm," he said. "The norm is that sovereigns, having jurisdiction over entity and people before them, can compel those entities and individuals to produce materials."

The legal battle began in December 2013, when a magistrate judge in New York issued a search warrant in a drug-trafficking investigation. Microsoft challenged the warrant, arguing it was not justified by law or the Constitution. In August 2014, a federal judge in New York upheld the magistrate judge's opinion. The company appealed.

"The case will set a precedent that will have a worldwide impact,'' said Gregory Nojeim, senior counsel for the Center for Democracy and Technology, which also has filed a legal brief in support of Microsoft. "If U.S. warrants compel U.S. providers to disclose communications stored outside the country, foreign governments will argue that their legal orders work in the United States, including countries that have lousy surveillance laws, or that don't follow the laws they do have. Welcome to the Wild West."

The Irish government has submitted a brief arguing that a legal process exists to obtain the email _ a mutual legal-assistance treaty between Dublin and Washington that assists the governments in obtaining information to enforce their laws.

What Ireland is objecting to, Rosenkranz said, is a "law enforcement seizure on their land" by the United States.

"We would go crazy if China did it to us," Rosenkranz said. "Why? Because this case is about sovereignty."

The panel's presiding judge, Gerard Lynch, observed that at least on one point, the two sides could agree _ that technology had outpaced the law.

"Both sides," he said, "are in agreement that there may not be as much protection of the privacy of one's electronic communications as the electronic communicator might like based on this statute."