The Law and Business of Social Media
May 03, 2017 - Privacy, Stored Communications Act, Litigation

Court Orders Google to Turn Over Foreign-Stored Data

Court Orders Google to Turn Over Foreign-Stored Data

The U.S. Department of Justice (DOJ) recently secured a notable victory against Google in a dispute over the enforceability of a U.S. search warrant seeking access to foreign-stored account data.

The April 19 ruling—from Magistrate Judge Beeler in the U.S. District Court for the Northern District of California—is the latest sign that DOJ is continuing to rely on the Stored Communication Act (SCA) to seek overseas account data even after the Department’s high profile defeat in the Second Circuit’s ruling in the Microsoft case.

And the opinion suggests that DOJ’s litigation strategy may be working.

The dispute arose after DOJ obtained a search warrant last year under the SCA directing Google to provide information related to specified Google user accounts. Google withheld some of the requested information and challenged the request. Google explained that it relies on algorithms to move user data around the world automatically to aid in network efficiency. Invoking the Second Circuit’s Microsoft ruling, which rejected DOJ’s efforts to obtain content stored on Microsoft servers in Ireland, Google argued that some of the requested data was stored exclusively overseas and therefore beyond the purview of an SCA warrant.

In her 9-page opinion, Judge Beeler declined to apply the reasoning of Microsoft and ordered Google to comply with the warrant “regardless of the data’s actual location.” Accepting that the SCA warrant provisions do not apply extraterritorially, the opinion concluded that the warrant at issue should be viewed as “a domestic application of the SCA” rather than an extraterritorial one.

The opinion briefly noted a potential distinction between the Microsoft and Google cases—specifically, that Microsoft had been storing data in accordance with the user’s self-reported location in Ireland, whereas Google was moving data around the world based on efficiency-driven algorithms. Yet, the ruling appeared animated by the court’s decision to “follow[] as persuasive” the reasoning of the dissenters from the denial of rehearing en banc in the Microsoft case: Judge Beeler concluded that it does not matter where Google chooses to store the data as long as Google “is in the district and is subject to the court’s jurisdiction; [and] the warrant is directed to the only place where it can access and deliver the information that the government seeks.” Additionally, the opinion noted that “[o]ther courts [outside the Second Circuit] have reached similar conclusions after a similar analysis of the Microsoft decision.”

U.S. companies have now received multiple warnings not to store user communications abroad if they hope to avoid U.S. law enforcement requests despite the Second Circuit’s Microsoft decision. U.S. courts remain willing to pierce the veil of global cloud storage practices in aid of a criminal investigation. The ruling suggests that DOJ will continue pressing arguments to distinguish (or otherwise reject) the Second Circuit’s Microsoft decision in future litigation. The development further compounds the legal complexity of cross-border data transfers, as U.S.-based cloud service providers may have a difficult time representing whether data based in the European Union would be exposed to U.S. government access.

This decision also comes at a time of renewed public scrutiny of the SCA as a whole: a challenge by Microsoft to SCA warrant secrecy rules is currently working its way through the courts, and a pending bill in Congress could limit government access to communications older than 180 days without a warrant.

Finally, the growing number of courts outside the Second Circuit that have broken with the ruling in Microsoft raises the chances that these issues may ultimately be headed to the U.S. Supreme Court. The Solicitor General’s Office could still ask the Supreme Court to review the Second Circuit’s Microsoft decision, having sought and received an extension of the time to petition for certiorari in that case until May 24.

In addition, companies with a stake in these issues should watch for further litigation from Google over this order, as well as a forthcoming ruling from Judge Juan Sanchez of the U.S. District Court for the Eastern District of Pennsylvania. On April 18, Judge Sanchez heard oral arguments regarding Google’s ongoing challenge to Magistrate Judge Thomas Rueter’s order compelling the company to comply with an SCA warrant in a case raising similar issues.

*             *             *

For other Socially Aware posts addressing the U.S. government’s efforts to obtain user data directly from social media networks and cloud storage providers, please see the following: Google Ordered to Comply with Warrant for Foreign-Stored User Data; Second Circuit: Email Stored Outside the U.S. Might Be Beyond Government’s Reach; and We’ve Come for Your Tweets: Twitter to Appeal Denial of Its Motion To Quash District Attorney’s Subpoena.