Federal Judge Upholds Magistrate's Ruling, Says Google Must Hand Over Data From Overseas Servers
from the worldwide-service,-domestic-delivery dept
Earlier this year, a Pennsylvania magistrate judge decided Google needed to turn over data to US law enforcement despite it being housed (possibly temporarily) in overseas servers. The overseas housing was simply part of Google's data flow, which routes communications around the world for efficiency, rather than to keep them out of local governments' hands.
This contradicted an earlier decision by the 2nd Circuit Appeals Court, which ruled Microsoft did not have to turn over data held in overseas servers in response to a US search warrant. The fact that Google does not explicitly hold certain data in certain servers was key to this decision. The conclusion the magistrate reached was no seizure of the data took place until Google stopped the data flow and gathered it up locally. That decision seemed to rewrite the definition of the word "seizure," as the warrant compelled Google to grab the data and compile it domestically. Stopping the flow of data traffic to grab stuff certainly sounds like Google is "seizing" it -- and it's only doing so because the government has ordered it to.
Google asked for a judicial review of the magistrate's decision. Unfortunately, the Pennsylvania federal judge one step up from the magistrate has upheld the magistrate's order. (h/t Brad Heath) From the memorandum [PDF]:
Although Google and each of the account holders in question are based in the United States, Google contends it is the physical location of the data to be retrieved—which Google, not the account holder, controls, and which Google can change at any time for its own business purposes—that determines whether the statute is being applied extraterritorially. Because this Court agrees with the government that it is the location of the provider and where it will disclose the data that matter in the extraterritoriality analysis, and because Google can retrieve and produce the outstanding data only in the United States, the Court agrees with the Magistrate Judge’s conclusion that fully enforcing the warrants as to the accounts in question constitutes a permissible domestic application of the SCA. The Order granting the government’s motions to compel will therefore be affirmed.
The memorandum runs several pages, but basically reiterates the magistrate's findings. The warrant is lawful under the Stored Communications Act and provides for the seizure of the data requested. That the data is located extraterritorially would normally pose a problem, but Google's overseas data stores are only filled for Google's convenience, rather than being a place where any of the sought data resides permanently. This decision basically lays it all out for US service providers, stating that because warrants are served to their domestic offices, data located anywhere in the world is within reach of a US search warrant.
The court gets around the contradictory nature of its conclusion by quoting heavily from the dissenting judges in the 2nd Circuit Appeals Court decision.
Although the panel decision in the Microsoft case was unanimous, the decision drew vigorous opposition from other judges of the Second Circuit when the case came before the full court on the government’s petition for rehearing en banc. The petition was denied by an equally divided court, but the denial generated four separate dissents by judges who agreed that enforcing an SCA warrant to require a domestic service provider to disclose information in the provider’s possession, which the provider can access within the United States, constitutes a domestic application of the statute’s warrant provision, regardless of where the provider has elected to store the information. See Microsoft Reh’g, 855 F.3d at 61-62 (Jacobs, J., dissenting); id. at 66-68 (Cabranes, J., dissenting); id. at 70-73 (Raggi, J., dissenting); id. at 75-76 (Droney, J., dissenting). The Microsoft court’s analysis has also been rejected by every magistrate judge and district court that has considered the issue to date, including the Magistrate Judge in this case.
However, there's nothing in the memorandum that even hints at the dangerous precedent the court is helping set. The Pennsylvania court views the Second Circuit decision as an anomaly and will afford it zero respect when discussing challenged warrants. Presumably, ignoring an outlier will continue through any suppression hearing once this case moves forward. Google will certainly appeal this decision, but the absence of favorable rulings from within this circuit (Third Circuit) likely make this non-starter. As it stands now, one circuit in the nation holds the government to the letter of the law when issuing SCA warrants. For everyone else, it's still up in the air, with more courts likely to side with the 2nd Circuit dissent, which will result in more US law enforcement demanding data from overseas simply because they have a US entity to hand the warrant to.
Thank you for reading this Techdirt post. With so many things competing for everyone’s attention these days, we really appreciate you giving us your time. We work hard every day to put quality content out there for our community.
Techdirt is one of the few remaining truly independent media outlets. We do not have a giant corporation behind us, and we rely heavily on our community to support us, in an age when advertisers are increasingly uninterested in sponsoring small, independent sites — especially a site like ours that is unwilling to pull punches in its reporting and analysis.
While other websites have resorted to paywalls, registration requirements, and increasingly annoying/intrusive advertising, we have always kept Techdirt open and available to anyone. But in order to continue doing so, we need your support. We offer a variety of ways for our readers to support us, from direct donations to special subscriptions and cool merchandise — and every little bit helps. Thank you.
–The Techdirt Team
Reader Comments
Subscribe: RSS
View by: Time | Thread
I'd guess Google will appeal, and if 3rd Circuit upholds the decision they'll appeal to the Supreme Court because there's a circuit split. They can make a convincing argument that this case and the Microsoft decision can't be distinguished, as Microsoft also could have moved the data back to domestic servers where it would fall under the warrant. After all, the judge in the Google case isn't ordering Google to just wait to see if the data comes back to the US naturally, he's ordering them to make the data come back to the US.
[ link to this | view in chronology ]
All your data are belong to us
[ link to this | view in chronology ]
[ link to this | view in chronology ]
Re:
[ link to this | view in chronology ]
Re: Re:
Implying Google is not a multinational corporation
[ link to this | view in chronology ]
is always presumed to be at the point in America where it
was incorporated or has it's offices. You can't evade the
IRS by moving American tax information out of the country
because it is, by law, always held in U.S. jurisdiction.
[ link to this | view in chronology ]
Court is trying to walk the tightrope
This is a bad thing because it means doing business in Canada is now under US laws.
[ link to this | view in chronology ]
Re: Court is trying to walk the tightrope
[ link to this | view in chronology ]
Re: Re: Court is trying to walk the tightrope
/s
[ link to this | view in chronology ]
[ link to this | view in chronology ]
Re:
Otherwise, it would fail to meet the standards of the judgement. A Chinese person using Google in the US directly would already being making a step to avoid his government, and the action would clearly be his choice and not that of Google.
[ link to this | view in chronology ]
[ link to this | view in chronology ]
Decision Makes Sense
Google and the client are in the US. The data is sourced in the US and will only normally be used in the US. Storing it offshore appears to be nothing more than an attempt to create a barrier between law enforcement and the data, in a wholesale way.
My guess is that Google has been hoping that the courts would rule in their favor so they can crow about keeping consumer data private. Being tricky and trying to slide around the law is never a good thing.
[ link to this | view in chronology ]
Re: Decision Makes Sense
[ link to this | view in chronology ]
Re: Decision Makes Sense
Google should only be forced to produce data when it is currently on US based servers for US government agents. Just like Microsoft only produced data that was in the US not Ireland. Now one difference is that the data for google is in flux based on need. So it's possible that sooner or later that the data is placed on a US based server. At which point in time the warrant would be valid.
[ link to this | view in chronology ]
Court orders and gag orders
After all, the foreign court does not care much about US national security -- especially if you sued in Russia -- and all court orders must be obeyed, according to US and Canadian courts, even if they violate the sovereignty of a foreign nation.
[ link to this | view in chronology ]
[ link to this | view in chronology ]
So many bad consequences to come...
Keep in mind 2 things: 1) The government can demand data for a whole host of legal reasons, none of which require a conviction. So, we are talking about the data of people who are still presumed innocent. Don't be fooled into thinking the targets will only be "bad" people who have committed what most of us might consider a serious crime. Like every other overly broad legal tool, this will eventually be used by some cop to check if his girlfriend is cheating on him or to see what secret files some celebrity is keeping. 2) If our government can do it, so can the governments of Russia, Iran, China, etc. Will they hesitate to demand the data that any company (not just Google) has on someone they want to target? E.g. a business competitor, a suspected undercover/counter-terrorism operative, etc? Of course they won't.
Keep in mind that it seems like the only relevant standard the court is really enforcing here is that there is someone in the U.S. to whom law enforcement can hand a court order and that said someone can get access the data from here, whether or not the data itself is currently here. That's basically any data stored by a company that has a U.S. office.
At the end of the day, this encourages companies to off-shore not just some of their data for efficiency purposes, but also their headquarters and any offices so that this can't happen. Odd-sounding notions like businesses incorporated on floating private island nations that aren't subject to traditional national jurisdiction are typically met with lots of outrage by people who disdain all things corporate. But, here is potentially a good civil rights reason for such places.
[ link to this | view in chronology ]