Ireland: An End To The Microsoft Saga? Appeals Court Rules In Microsoft's Favour

A US appeals court recently handed down a ground-breaking privacy decision, bringing the three-year Microsoft warrant saga to an apparent end. On 14 July 2016, the US Court of Appeals for the Second Circuit sided in favour of Microsoft, deciding that Microsoft has no obligation to disclose email content stored on its Dublin servers to US authorities.

One of the key factors that swayed the court was the traditional meaning of the term 'warrant'. The court held that the use of the term 'warrant' implies that its application is confined solely to matters within the bounds of the United States. The decision has been celebrated by many in the technology industry as a victory for personal privacy but it has also raised a number of additional issues.

Background

In short, the case concerned the nature and reach of a 'warrant' issued under the US Stored Communications Act ("SCA") – a law which was developed in 1986 to extend the privacy protection of electronic records.

The case began in late 2013 when a federal Magistrate in New York granted a search warrant under the SCA for data held by Microsoft. The warrant was issued as part of an on-going investigation into narcotics trafficking.

Microsoft unsuccessfully challenged the warrant in front of the issuing Magistrate. It then appealed this decision to the District Court but the Magistrate's ruling was confirmed by the District Court. Subsequently, Microsoft brought a further appeal before the Court of Appeals. This appeal provides the context of the current decision.

Warrants: the Extraterritorial?

The decision of the court can ultimately be attributed to the determination of two questions: (1) whether the wording of the SCA contemplates a warrant's application outside US borders; and (2) if not, whether the US government's application of the SCA warrant is actually extraterritorial and beyond the intention of the law.

In the US, there is a legal presumption that US laws only apply domestically, a point that was particularly highlighted by the US Supreme Court in Morrision (2010). According to the court in the current case, this is a "strong and binding" presumption. The court could not find any indication of Congress' positive intent that the SCA was meant to reach beyond the bounds of the US.

On the first question, the court held that the SCA does not apply to territories outside of the United States.

Warrants, Subpoenas and Hybrids

On the second question, the court noted that the US government had conceded an oral argument that the warrant provisions of the SCA do not contemplate overseas application. Still, the court sought to consider the meaning of the rules.

Congress' use of the term 'warrant' in the SCA, the court highlighted, underlined the domestic boundaries of the Act. A warrant is a term of art and, according to the court, a term "endowed with a legal lineage that is centuries old". Focusing again on the intention of Congress, the court considered that the use of the term was intended to invoke its "traditional, domestic connotations".

One of the core arguments made by the US government was that the warrant in question should be viewed as a " hybrid" of a traditional warrant and a subpoena. This arose from the fact that a subpoena – a binding request for the production of documents – can require the collection and production of information located overseas. Nevertheless, the court fundamentally rejected this view, explaining that warrants and subpoenas "have long been distinct legal instruments" and that the terms are not used interchangeably within the SCA. To highlight this point, the court emphasised the cascading nature of the SCA's protections, with the term 'warrant' denoting a greater level of protection to stored content while the term 'subpoena' indicated a lesser degree of protection.

Differing views

Moreover, the court's views diverged from those of the US government on a number of additional fronts:

• First, the court disagreed with the application of the 1983 Marc Rich case, in which the disclosure of foreign-located records was ordered. In particular, the court found that Marc Rich did not provide any basis for applying law developed in the context of subpoenas to SCA-based warrants.
• Furthermore, the US government sought to rely upon a number of past US cases involving banks and the disclosure of their overseas records. However, the court found that such instances were not comparable to Microsoft's case, particularly given the fact that – according to the US Supreme Court – bank depositors have no protectable privacy interests in bank documents.

Implications of the Court's Decision

In light of its findings, the court concluded that the SCA warrant may not be lawfully used to compel Microsoft to produce email content stored in its Dublin datacentre.

The court's verdict was celebrated as a victory for personal privacy with Brad Smith – Microsoft President and Chief Legal Officer – stating that "it tells people they can indeed trust technology as they move their information to the cloud".

However, with the resolution of one problem, another emerges. With so much data today being stored using cloud services, there remains the open questions as to when, why, and how such information should be made available to investigating law enforcement. The traditional search and seizure powers of the state, developed over many years, do not sit well in an era of cloud computing. The parties to the case are in agreement that the 1986 rules are outdated and a review of these laws is badly needed to address the discrepancy.

Microsoft itself, in a statement released after the court's decision, called on all stakeholders to support legislative action in this area, including a new International Communications Privacy Act which has been put before Congress and has the potential to solve the current impasse. In addition, it is worth noting that the court did not come to its conclusion based on a new theory of privacy practices in the cloud – instead, the case turned on technical questions of statutory interpretation.

Perhaps the current situation is best summated by Circuit Judge Gerard Lynch – one of the judges behind the ruling – who stated, "I concur in the result, but without any illusion that the result should even be regarded as a rational policy outcome, let alone celebrated as a milestone in protecting privacy".

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.