When the Drug Enforcement Administration wanted certain emails as evidence in a drug trafficking case, it got a warrant directing Microsoft to turn them over. That warrant was authorized by a 1986 law called the Stored Communications Act. That law is not up to date. It was written long before cloud communications could even be imagined. Unfortunately, there appears to be no more recent law the government could use.
It’s unfortunate because the emails the DEA wants are stored on servers in Ireland. Microsoft contends that warrants authorized by the Stored Communications Act cannot be enforced outside the borders of the United States. Without a valid warrant, the company says it cannot turn over the emails.
In 2016, the 2nd Circuit Court of Appeals in Manhattan sided with Microsoft, ruling that these domestic warrants simply don’t apply in other countries. The DEA appealed to the Supreme Court.
During oral arguments this week, both the parties and the justices recognized that the out-of-date statute poses real problems. Ideally, Congress would bring the statute up to date. Indeed, a bill called the Cloud Act has been introduced. However, there is no guarantee of its timely passage, and some decision may have to be made in the meantime.
Arguing for the DEA’s position, the Justice Department contended that the warrant doesn’t need to be valid in Ireland but in Microsoft’s home state of Washington. There, a computer operator can simply retrieve the emails from Ireland and turn them over. The mere fact that the storage servers are physically located in Ireland is irrelevant; they are accessible from the United States.
Moreover, the government says, Microsoft itself chose to locate the emails in Ireland. It has full authority to move them back to the U.S. Furthermore, the DEA wasn’t just making a demand — it had gone to the trouble of getting a warrant. The warrant process, the government argues, provides sufficient protection for the defendant.
Microsoft’s lawyers say it’s not irrelevant that the emails are stored in Ireland. It’s a question of that country’s sovereignty. Although a computer operator in Washington can access the emails, they would have to travel along hard wires located in Ireland and then across the Atlantic. And, it’s not random that the emails are stored in Ireland. The defendant told Microsoft when he signed up that he was based in Ireland.
The company, supported by other email and cloud storage providers, claims that its clients will go elsewhere if U.S. warrants can reach their servers in any country. Microsoft has 100 data centers located in 40 countries.
Should U.S. warrants apply anywhere in the world where a U.S. company has access to them?