On February 3, 2017 a federal magistrate judge ordered Google to comply with a search warrant to produce foreign-stored emails (In re Search Warrant No. 16-960-M-01 to Google). The magistrate judge disagrees with the U.S. Court of Appeals for the Second Circuit’s Microsoft Ireland Warrant Case, which was recently denied rehearing by an evenly divided court. This decision shows that the Justice Department is asking judges outside the Second Circuit to reject the Second Circuit’s ruling — and that at least one judge has agreed.
At issue are two routine Stored Communications Act (SCA) warrants served on Google for the contents of emails. Google responded with the emails that it knows were stored inside the United States, but it refused to turn over emails that could be outside the United States. Because Google breaks up its emails and the network might distribute them anywhere in the world, Google can’t know where many emails are located and declined to produce them under the Second Circuit’s Microsoft case.
The government moved to compel Google to produce all of the emails within the scope of the warrant. Magistrate Judge Thomas J. Rueter ruled that Google has to comply with the warrant in full because “the conduct relevant to the SCA’s focus will occur in the United States” even for the data that is retrieved from outside the United States. According to the judge:
“…[T]he invasions of privacy will occur in the United States; the searches of the electronic data disclosed by Google pursuant to the warrants will occur in the United States when the FBI reviews the copies of the requested data in Pennsylvania. These cases, therefore, involve a permissible domestic application of the SCA, even if other conduct (the electronic transfer of data) occurs abroad.”
The court reasoned that when a network provider is ordered to retrieve information from abroad, that copying of information abroad and sending back to the United States does not count as a Fourth Amendment “search” or “seizure” outside the United States, stating “Electronically transferring data from a server in a foreign country to Google’s data center in California does not amount to a “seizure” because there is no meaningful interference with the account holder’s possessory interest in the user data.”
Further, the court saw no search abroad: “When Google produces the electronic data in accordance with the search warrants and the Government views it, the actual invasion of the account holders’ privacy- the searches – will occur in the United States.” Because the search and seizure occurred in the United States, not abroad, the relevant privacy invasion was domestic and a domestic warrant could order it.
Bob Dibert is a Member at the Frost Brown Todd, LLC Louisville office practicing business litigation and electronic data discovery, privacy & security law. Referencing the warrants to Google and Microsoft, Dibert states, “These cases show how courts can focus on factual details in reaching different results when the law is uncertain.”
“In Microsoft, the data was located in a different country – the Republic of Ireland – and the account (perhaps including the account holder) was in or proximate to Ireland. In Google, the most that could be said about the data was that at least some of it was located somewhere outside the U.S., at least some of the time.”
It’s not clear what the reactions will be, if any, of other nations where US companies store data. While data privacy laws in European Union countries have tightly restricted access to their citizen’s data, particularly by outside nations, treaties and legal agreements include provisions for transferring data for criminal matters.
Dibert elaborates, stating, “Although neither decision discusses the context specifically, the Republic of Ireland has both legislation and treaties to provide assistance to foreign prosecutors and courts in criminal matters. And, it was a challenge in Ireland that ultimately declared U.S. laws to provide inadequate privacy protections for citizens and data located in the European Union (including Ireland). The specific case, Schrems v. Data Protection Commissioner, No. C-362/14 (Court of Justice of the European Union, Oct. 6, 2015), involved transfer of a European user’s Facebook data from Ireland to U.S. servers. So Google did not involve territory where it might have been prudent for Microsoft to tread lightly.”
Where do we go from here?
Many law experts believe that the actions ordered by the judge would still be considered seizure, citing Orin S. Kerr, Fourth Amendment Seizures of Computer Data, 119 Yale L.J. 700, 700 (2010), which argues that copying Fourth Amendment-protected files seizes them under the Fourth Amendment when copying occurs without human observation and interrupts the stream of possession or transmission.
Because of the ambiguity of the location of the data that results from the methods Google uses to store data, some data service providers may re-think whether to pursue this hybrid model as opposed to the more “cut-and-dry” methods. Will Google completely overhaul the way they store data? Probably not. But by appealing the decision, they will force the issue with the courts to address the Fourth Amendment ambiguities. Stay tuned.
Dr. Cobb currently serves as Partner at One Source Discovery, a local, full
service eDiscovery firm. He developed the strict procedures used during
forensic collections and analysis to ensure accuracy, verifiability and
repeatability. Dr. Cobb is the creator of BlackBox, the patented remote
forensic collection software tool. Prior to his position at One Source
Discovery, he was the founder and President/CEO of AC Forensics and
Assistant Professor at the University of Louisville. Dr. Cobb has served as
a consultant on hundreds of Electronic Discovery matters, provided expert
testimony on various Computer Forensics matters in Federal and State
Courts, given several talks and CLE’s related to electronic discovery, and
published numerous technology journal articles.