DOJ Asks The Supreme Court To Give It Permission To Search Data Centers Anywhere In The World

from the world-is-[potentially]-yours dept

Having been told "no" twice by the Second Circuit Court of Appeals, the DOJ is asking the Supreme Court to overturn the decision finding Microsoft did not need to hand over communications stored in foreign data centers in response to a US warrant.

The Appeals Court told the DOJ that statutory language simply didn't agree with the premise pushed by the government: that US-issued warrants should allow the law enforcement to dig through "file cabinets" not actually located at the premises (United States) searched. The court noted jurisdictional limitations have always been part of the warrant process (although recent Rule 41 changes somewhat undercut this). That the information sought is digital rather than physical doesn't change this. The court suggested the DOJ take it up with Congress if it doesn't like the status quo. The DOJ has proposed legislation but likely feels a Supreme Court decision in its favor would be a swifter resolution.

The DOJ's 207-page petition [PDF] actually only contains about 30 pages of arguments. The bulk of the petition is made up of previous court decisions and oral argument transcripts covering the DOJ's losses at the lower level. The Table of Contents gets right to the point, utilizing the section header "The panel's decision is wrong" to set the tone for its rehashed arguments.

The DOJ quotes the dissenting judges from the Appeals Court's decision, one of which makes the ever-popular "appeal to 9/11" argument:

Judge Raggi also emphasized the exceptional importance of this case and the “immediate and serious adverse consequences” of the panel’s ruling. “On the panel’s reasoning,” she explained, if the government had been able to show in early September 2001 probable cause to believe that the 9/11 perpetrators “were communicating electronically about an imminent, devastating attack on the United States, and that Microsoft possessed those emails,” a federal court would not have been able to issue a Section 2703 warrant if Microsoft had stored the emails outside the United States, “even though [Microsoft’s] employees would not have had to leave their desks in Redmond, Washington, to retrieve them.”

All well and good, if you like that sort of thing, but the facts of the case are far less dire:

In December 2013, the government applied for a warrant requiring Microsoft to disclose email information for a particular user’s email account. See App., infra, 2a, 8a-10a. The government’s application established probable cause to believe that the account was being used to conduct criminal drug activity.

This is how most arguments for expansions of law enforcement reach and grasp go: talk about how it will be used to stop terrorists; actually use it to hunt down normal criminals.

The petition admits Congress meant for domestic laws to only be applied domestically before arguing certain "applications" of US law should be seen as permissible inversions of Congressional intent. The DOJ argues Microsoft's United States offices should permit worldwide searches of its data centers. Once again, the government's arguments that stored communications are no different than paper files in a file cabinet (made when it wants broadly-written electronic storage searches to be seen as no more intrusive than a residence search) works against it. This interpretation of the Stored Communications Act means any service provider anywhere could be made to hand over documents stored overseas as long as they have a US office where a warrant can be served. This would be the case even if the service provider has no US storage locations and nothing more than a US-based "storefront" for convenience.

Microsoft has already responded with a lengthy blog post. It points out the better way forward is not to have the Supreme Court reinterpret a 30-year-old law, but rather to work with US service providers and Congress to build a better law that addresses the world as it is now.

The litigation path DOJ is now trying to extend in parallel to legislative progress seeks to require the Supreme Court to decide how a law written three decades ago applies to today’s global internet. The previous decision was soundly in our favor, and we’re confident our arguments will be persuasive with the Supreme Court. However, we’d prefer to keep working alongside the DOJ and before Congress on enacting new law, as Judge Lynch suggested, that works for everyone rather than arguing about an outdated law. We think the legislative path is better for the country too.

The post also points out cooperation with foreign law enforcement is a much faster process than has been portrayed by the DOJ, which insists it takes "weeks" to see results of these cooperative efforts. Following the Charlie Hebdo attack, Microsoft was able to turn over US-stored communications to French law enforcement in under an hour.

What the DOJ doesn't seem to understand (or genuinely just doesn't care about) is a decision granting it the power to seize communications from anywhere in the world would result in foreign governments expecting the same treatment when requesting communications stored in the US.

Should people be governed by the laws of their own country? If the decision in our case were reversed, it would subject every person in the world to every other country’s legal process. The email of a person who lives and works in Dublin would be subject to an American warrant issued by a U.S. court just as an American would be subject to an Irish warrant. Our customers tell us they want to be governed by the laws of their own government, and they deserve the certainty of knowing what laws govern their data.

If the Supreme Court decides to grant the DOJ's petition, this won't be argued until the next session, leaving the DOJ plenty of time to work on its legislative proposals. Hopefully, it's actually working with US service providers on this, rather than thinking it's the only stakeholder of importance in the legislative process.

Filed Under: data, doj, ecpa, jurisdiction, sca, stored data, subpoenas, supreme court
Companies: microsoft

Canadian Supreme Court Says It's Fine To Censor The Global Internet; Authoritarians & Hollywood Cheer...

from the d'oh-canada dept

For the past few years, we've been covering the worrisome Google v. Equustek Solutions case in Canada. The case started out as a trademark case, in which Equustek claimed that another company was infringing on its trademarks online. That's fine. The problem was that the lower court issued an injunction against Google (a non-party in the case) that said it had to block entire sites worldwide. Blocking sites already raises some concerns, but the worldwide part is the real problem. In 2015, an appeals court upheld that decision, and earlier today the Canadian Supreme Court agreed with both lower courts in a 7-2 decision.

The court is dismissive of any concerns about how an order from one country to block things on the internet globally might be abused -- calling the concerns "theoretical" and unproven. That may not last very long. First, let's look at the decision itself, and then the horrific possible consequences for free speech and innovation.

Google’s argument that a global injunction violates international comity because it is possible that the order could not have been obtained in a foreign jurisdiction, or that to comply with it would result in Google violating the laws of that jurisdiction, is theoretical. If Google has evidence that complying with such an injunction would require it to violate the laws of another jurisdiction, including interfering with freedom of expression, it is always free to apply to the British Columbia courts to vary the interlocutory order accordingly. To date, Google has made no such application. In the absence of an evidentiary foundation, and given Google’s right to seek a rectifying order, it is not equitable to deny E the extraterritorial scope it needs to make the remedy effective, or even to put the onus on it to demonstrate, country by country, where such an order is legally permissible.

This is a nifty trick: because you can't show that this order might offend freedom of expression laws somewhere else in the world, let's just assume it's fair to apply absolutely everywhere. But... that's not the issue. It's not for a Canadian court to determine if its rulings obey the laws in other countries. A Canadian court has jurisdiction over Canada. And that's it. This is not about balancing theoretical harm v. real harm, this is about jurisdiction.

The court tries to get around the jurisdictional question by saying because Google is available in Canada, somehow that makes it okay to censor globally, and further, notes that the lack of borders on the internet require such a result (ignoring how this will almost certainly create massive problems down the road):

The problem in this case is occurring online and globally. The Internet has no borders — its natural habitat is global. The only way to ensure that the interlocutory injunction attained its objective was to have it apply where Google operates — globally. As Fenlon J. found, the majority of Datalink’s sales take place outside Canada. If the injunction were restricted to Canada alone or to google.ca, as Google suggests it should have been, the remedy would be deprived of its intended ability to prevent irreparable harm. Purchasers outside Canada could easily continue purchasing from Datalink’s websites, and Canadian purchasers could easily find Datalink’s websites even if those websites were deindexed on google.ca. Google would still be facilitating Datalink’s breach of the court’s order which had prohibited it from carrying on business on the Internet. There is no equity in ordering an interlocutory injunction which has no realistic prospect of preventing irreparable harm.

This sounds nice, but makes no sense. First, again, a Canadian court only has jurisdiction over Canada. If the irreperable harm is happening elsewhere, then that's not the Canadian court's jurisdction and it has no say in the matter. The fact that purchasers outside Canada can find Datalink's website isn't a matter for Canadian courts. This may sound unfair -- as the court seemed to think -- but take two seconds to flip the script and think about how this would work with a ruling in China about stories concerning Tiananmen Square, or in Saudi Arabia about LGBTQ rights -- saying that Google had to de-index such sites in Canada, because they violated local law.

The second scary part about the ruling is that it's not just saying that Google needs to de-index sites shown to involve infringement, but that it needs to de-index an entire site because other pages on that site might, at some future point, infringe. Really. The two dissenting judges pointed out how problematic this aspect is in the ruling, and how it actually gives Equustek even more than it was seeking.

The December 2012 Order gives Equustek more than the injunctive relief it sought in its originating claim. Rather than simply ordering the modification of Datalink websites, the December 2012 Order requires the ceasing of website business altogether.

And that creates an additional problem. Since Equustek is getting more than it wanted, and because the defendant in the original case has ignored the court process, it's likely that this "temporary" injunction will effectively become a permanent one:

In our view, little incentive remains for Equustek to return to court to seek a lesser injunctive remedy. This is evidenced by Equustek’s choice to not seek default judgment during the roughly five years which have passed since it was given leave to do so.

Thus, the dissent notes, this is, in effect, a permanent injunction. And, it doesn't come close to the standards necessary for such a permanent injunction -- specifically in dragging a third party (i.e., Google) into the remedy:

As we will outline below, the Google Order enjoins a nonparty, yet Google has not aided or abetted Datalink’s wrongdoing; it holds no assets of Equustek’s, and has no information relevant to the underlying proceedings. The Google Order is mandatory and requires court supervision. It has not been shown to be effective, and Equustek has alternative remedies.

And, it fears that Google will be forced to continue to monitor and de-index any new website set up by Datalink:

The Google Order requires ongoing modification and supervision because Datalink is launching new websites to replace delisted ones. In fact, the Google Order has been amended at least seven times to capture Datalink’s new sites (orders dated November 27, 2014; April 22, 2015; June 4, 2015; July 3, 2015; September 15, 2015; January 12, 2016 and March 30, 2016). In our view, courts should avoid granting injunctions that require such cumbersome courtsupervised updating.

Finally, the dissent points out that it appears Datalink has assets in France, and Equustek could easily go after them there, and that would be a remedy that leaves Google out of the process.

Unfortunately, the dissent does not really delve into the problematic nature of a Canadian court claiming it can force a website to de-list sites globally. I already provided the Chinese/Saudi Arabian examples above, but Canadian law professor Michael Geist goes much deeper:

Google will obviously abide the ruling, but as I noted last year, what happens if a Chinese court orders it to remove Taiwanese sites from the index? Or if an Iranian court orders it to remove gay and lesbian sites from the index? Since local content laws differ from country to country, there is a great likelihood of conflicts. That leaves two possible problematic outcomes: local courts deciding what others can access online or companies such as Google selectively deciding which rules they wish to follow. The Supreme Court of Canada did not address the broader implications of the decision, content to limit its reasoning to the need to address the harm being sustained by a Canadian company, the limited harm or burden to Google, and the ease with which potential conflicts could be addressed by adjusting the global takedown order. In doing so, it invites more global takedowns without requiring those seeking takedowns to identify potential conflicts or assess the implications in other countries.

Geist also notes that this is part of the "drip drip drip" nature of mutliple rulings chipping away at free expression online:

This last paragraph noting that Google already removes links to certain content (hate speech, child pornography, and copyright takedowns) highlights the cumulative effect of court decisions and regulations that individually may seem reasonable but which quickly move toward takedowns of all kinds. In fact, the majority cites the international support for Internet injunctions with global effect as a justification for its own order. The net result is the expectation of all countries and courts that they may issue global takedown orders regardless of the impact on Internet users outside the jurisdiction or on Internet intermediaries.

Furthermore, Geist highlights where the court went wrong in saying that because it's "easy" for Google to de-index a site worldwide, there's no burden. But the technical burden is not the issue. The legal burden is:

Of course, the inconvenience does not come from the technical side of removing search results, which is indeed trivial. The real inconvenience comes from conflict of laws and the potential for global takedown orders coming from across the planet, thereby opening the door to other countries choosing what Canadians might be able to find in search results. Those issues – along with the need to identify the laws in other countries in order to avoid conflicts – do involve significant inconvenience and expense.

Indeed, a ruling like this likely will give Google more power over others, because Google has a large legal team that can handle this. Most other sites do not. Smaller sites cannot scour the globe to find out where such global takedown orders are legal and where they are not.

Another Canadian lawyer, Howard Knopf, is even more forward in pointing out how this will be abused by Hollywood:

I can just see the RIAA and MPAA salivating that the thought of getting global injunctions against Google at an interlocutory hearing from a trial judge in British Columbia. Will the mere fact that copyright subsists in BC - as it does virtually everywhere - be sufficient to get the injunction? One can imagine that few if any defendants would appear in such proceedings.

And, worse, he points out that even if Canadian trial judges see through that ploy, the RIAA & MPAA can just go jurisdiction shopping for other locations where courts will cite this case as a reason they can issue preliminary global injunctions. Canada just handed anyone who wants it a tool for global censorship. Anyone from authoritarian regimes to Hollywood may now begin to use it.

I recognize that some Google haters are cheering on this ruling because they will cheer on anything that makes Google look bad -- and the RIAA/MPAA types are celebrating this new power over Google. But this is extremely short sighted. Enabling countries to reach across borders to censor the internet does not end well. You are giving veto power over speech to the most repressive regimes, just because you dislike a company. If that's your view, you should perhaps check your priorities more carefully. And this goes doubly for the RIAA and MPAA. Those two organizations both used to fight for free speech. They both used to fight for the ability of musicians and filmmakers to express themselves. This tool that they helped create (they were involved in this case, pushing the view that the court eventually sided with), will be turned around and used to censor music and movies worldwide -- and the legacy recording and film industries will have no one to blame but themselves.

Filed Under: canada, censorship, global, hollywood, injunction, jurisdiction, right to be forgotten, trademark
Companies: datalink, equustek solutions, google

Charter Tries To Tap Dance Out Of Lawsuit Over Substandard Broadband

from the we-don't-have-to-care----we're-the-cable-company dept

Last month, we noted how New York Attorney General Eric Schneiderman sued Charter Communications for knowingly providing broadband service well below advertised speeds. After an initial first read I didn't think much of the lawsuit (pdf), but upon closer inspection it provides some pretty damning evidence that Charter not only knowingly failed to provide decent service (and just didn't care, since this is the uncompetitive broadband industry), but in some instances actively made connections worse for its own competitive advantage.

The AG's suit highlights how Charter manipulated data for a program run by the FCC to monitor consumer connection speeds. This program, co-operated by a UK outfit dubbed SamKnows, gives volunteers custom-firmware embedded routers to monitor connection quality and speed. The FCC was then using this data to name and shame ISPs that failed to deliver advertised speeds. The lawsuit highlights how Charter executives worked to intentionally deliver faster speeds to just these customers in order to trick the FCC into believing its network was performing better than it actually was.

The suit also seemed to confirm something that content and transit operators have been complaining about for a few years -- namely that large incumbent ISPs were intentionally letting interconnection points get saturated to extract additional fees from backbone and content providers like Netflix. This behavior quickly ended thanks in large part to the FCC's new net neutrality rules, which currently protect such interconnection relationships from abuse by incumbent telecom mono/duopolies. With these rules possibly dying this year, it's a problem you can be sure will re-emerge.

Not too surprisingly, Charter is trying to have this case thrown out. Recent court filings (pdf) indicate that the company successfully had the case moved from state to federal court, with Charter lawyers arguing that the Communications Act completely preempted claims under state law. Charter lawyers even went so far as to justify this position using the exact same 2015 FCC net neutrality rules ISPs lobbied, repeatedly, to destroy:

"Charter even went so far as quoting language from the FCC's 2015 Open Internet Order (aka the net neutrality regulations) to support the proposition that states are precluded from imposing obligations inconsistent with the FCC's regulatory regime.

According to defendants' court papers providing notice of removal, "Given the State’s distortion of the speed tests approved by the FCC and its reliance on other tests that the FCC does not require or endorse, if the 'state court vindicate[s] [the State’s claim], the relief granted would necessarily force [Defendants] to do more than required by the FCC.' The State is, in effect, 'trying to invalidate' disclosures made pursuant to the FCC’s reporting regime; its claim thus is necessarily federal."

With the new Trump FCC making it very clear that incumbent ISPs are going to get a free pass on the consumer protection front, the states (with an even more inconsistent track record on consumer protection than the federal government) may wind up being the only thing standing between you and the dubious ethics of companies like AT&T, Charter and Comcast:

"On Monday, the NY AG's office filed a motion to remand the case back to state court. The forthcoming decision could be an important one if other top legal officials in states across the nation attempt to fill the void of whatever the FCC is not doing....Schneiderman's attorneys argue that the lawsuit is "rooted entirely in the kind of consumer deception that is within the traditional purview of state law and is historically subject to enforcement in state court."

Charter's in a somewhat unique position due to conditions attached to the company's recent acquisition of Time Warner Cable and Bright House Networks. Those conditions banned the company from not only imposing usage caps, but also require it to continue to adhere to the FCC's net neutrality rules (including the interconnection provisions) for seven years -- even if they're dismantled by ISPs and loyal politicians this year. Other ISPs face no such restrictions, and depending on Charter's success here, incumbent ISPs may soon find themselves in a new golden era for anti-competitive behavior.

Filed Under: broadband, eric schneiderman, false advertising, fcc, jurisdiction, net neutrality, new york, speed tests

Court Tells Melania Trump She Can't Sue The Daily Mail In Maryland, So She Refiles In New York

from the because-of-course-not dept

Disclaimer: As you probably already know, the lawyer in this story, Charles Harder, is the lawyer in the ongoing lawsuit against us.

Back in September of last year, we wrote about how our now First Lady Melania Trump, represented by Charles Harder, had sued the Daily Mail and some blogger in Maryland. As we noted at the time, the choice of Maryland for the venue was odd -- since the Daily Mail is a UK publication and Trump (at the time) lived in NY. We speculated that the blogger -- Webster Griffin Tarpley, who was not widely known -- may have been included solely to try to get the case into a Maryland court. As we noted at the time, Maryland's anti-SLAPP law is notoriously weak. In a profile on Harder last year, the Hollywood Reporter noted that he's well aware of the differences in state laws:

In his offices, Harder keeps charts mapping the differences in libel and privacy laws throughout the country. He also has become a pro on where to strategically file cases.

A couple weeks ago, the court let the case against Tarpley go forward, but late last week dismissed the case against the Daily Mail, saying that the venue was improper. As the ruling rightly notes:

In this case the Article was researched, written for and published in a United Kingdom newspaper and published on a general news website that did not focus on Maryland. The Article was uploaded by MailOne staff in London and MailOne staff in New York posted the Article to the U.S. homepage of MailOnline. No reporter or editor traveled to Maryland in the course of reporting, editing, or publishing the Article.... There are no advertising or business acts conducted by MMI that were purposefully directed to Maryland. Further there is nothing about the parties that connects the case against MMI to Maryland -- MMI does not have an office in Maryland, Plaintiff does not live in Maryland, and the witnesses are not located in Maryland. It would be unreasonable as a matter of constitutional due process for this Court to exert jurisdiction over MMI or MailOnline in the State of Maryland.

Much of the rest of the ruling goes through the arguments brought forth for why Maryland was the proper venue -- including things like having targeted advertising for visitors in Maryland, and having other stories that were local to Maryland -- and disposes of them one by one. None of it stuck.

Of course, on Monday, Harder filed a brand new lawsuit on behalf of Melania Trump against the Daily Mail... in NY state court. The complaint here is much more fleshed out than the original complaint in the Maryland case. The press has mainly pounced on one specific claim in the new lawsuit, about how the original article by the Daily Mail could have harmed Trump's ability to cash in on a "once-in-a-lifetime" opportunity. From the lawsuit:

As a result of Defendant's publication of defamatory statements about Plaintiff, Plaintiff's brand has lost significant value, and major business opportunities that were otherwise available to her have been lost and/or substantially impacted. The economic damage to Plaintiff's brand, and licensing, marketing and endorsement opportunities caused by the publication of Mail Online's defamatory article, is multiple millions of dollars. Plaintiff had the unique, once-in-a-lifetime opportunity, as an extremely famous and well-known person, as well as a former professional model and brand spokesperson, and successful businesswoman, to launch a broad-based commercial brand in multiple product categories, each of which could have garnered mutli-million dollar business relationships for a multi-year term during which Plaintiff is one of the most photographed women in the world. These product categories would have included, among other things, apparel, accessories, shoes, jewelry, cosmetics, hair care, skin care and fragrance.

That's definitely a lot more fleshed out and specific than what was in the original complaint in Maryland (which was filed before the election):

Plaintiff is involved in many business ventures involving the licensing of her name and likeness, and relying upon her valuable reputation, and the defamatory publication foreseeably caused substantial damage to her business, career, reputation and her actual and prosepctive economic relationships. As a result of the conduct of Daily Mail, Plaintiff has been damaged in an amount to be proven at trial.

Of course, what changed between the first complaint and the second complaint was Melania's husband becoming President of the United States. Thus, the clear implication -- that many in the media are making -- is that the "once in a lifetime" opportunity is to somehow cash in on the Presidency. Of course, I do wonder how much damage to her brand could really be attributed to those articles, which have since been deleted, seeing as her reputation -- and the fact that she will now be "one of the most photographed women in the world" -- certainly seems to have massively boosted her reputation and massively increased her areas of opportunity if she does choose to cash in (i.e., it seems that she might have had a stronger case if she had not become First Lady). Separately, in an era where people like Kim Kardashian and Paris Hilton have become massive licensing juggernauts, I'm curious how much damage the Daily Mail reports could actually do to potential brand/licensing deals.

Either way, Harder and Trump will continue pushing forward in their lawsuit against the Daily Mail, just in New York, rather than Maryland. And, yes, if you were wondering, New York has an unfortunately weak anti-SLAPP law.

Filed Under: anti-slapp, charles harder, defamation, first lady, jurisdiction, maryland, melania trump, new york, webster tarpley
Companies: daily mail

Senators Not Impressed By DOJ's Answers On Rule 41 Changes

from the answer-the-damn-question dept

The DOJ has finally responded to questions posed by several senators about its interpretation of the proposed Rule 41 changes, due to go into effect on December 1st. Arriving shortly before the deadline -- and during the Thanksgiving holiday Black Friday news rush -- the DOJ's letter [PDF] contains a few explanations of its jurisdiction limitation-stripping and roving botnet warrants.

Unfortunately, not much is clarified other than that the DOJ still feels its proposal is nothing more than Rule 41 64-bit -- an update of existing law more in line with today's connected reality. (The DOJ offers no insight on its reluctance to update other outdated laws like the CFAA…) It also appears to believe the Fourth Amendment impact of its "one warrant, thousands of searches" proposal will be minimal and that it will maintain the same level of respect it has shown for privacy protections (also minimal) under the updated rule.

Needless to say, Sen. Wyden and co. aren't impressed by the DOJ's response.

Wyden and Coons were among 11 senators and 12 House members who queried DOJ about the hacking powers expansion last month. The department’s reply, which arrived today, should be “a big blinking warning sign about whether the government can be trusted to carry out these hacks without harming the security and privacy of innocent Americans’ phones, computers and other devices,” Wyden wrote.

The DOJ is still dodging a few questions. One question in particular was completely unaddressed in the DOJ's response. Wyden and his co-signers asked what the DOJ was going to do to prevent forum shopping for compliant judges -- something that would become far more common with jurisdictional limits removed.

The letter does not recount any specific department policies or training that would prevent forum shopping. It does stress police will only be able to seek warrants in districts where activity related to a crime has occurred and that the revised rule uses the same language as existing out-of-district warrant authorities for terrorism cases.

The DOJ either can't answer this or won't answer this. In either case, the lack of response indicates the DOJ isn't interested in preventing law enforcement agencies (like the FBI) from shopping for judges. If there's nothing in place now, it's highly unlikely any guidance will be in place by December 1st. If there is something in place, it's apparently nothing more than a suggestion that law enforcement seek warrants in their own jurisdictions. If the DOJ was truly interested in shutting down forum shopping, it would have begun putting policies in place at any point over the last couple of years while it pursued this "update" of Rule 41.

The letter does say law enforcement agencies won't be able to peek at private files while mucking about the insides of citizens' computers to shut down botnets. But the letter (and the Constitution) both say a lot of things that are great in theory, but less so in practice. Fourth Amendment violations can only be cured by visits to courtrooms, but it's something that's prohibitively expensive and subject to a large number of "GET OUT OF VIOLATION" cards (good faith, plain view, close-but-no-suppression, etc.) issued by presiding judges.

The redux of the changes is still this: if anonymization efforts are made by anyone targeted in a criminal investigation, the FBI, etc. can go find the most compliant judge available to sign off on a single warrant that can be used to search thousands of computers worldwide. It can also do this under the pretext of fighting botnets, performing the same sort of limited search for identifying info, even when all the hundreds or thousands of targets are not suspected of any wrongdoing.

Pretty much the only thing standing between the DOJ's proposal and the December 1st implementation is Congressional members' decision to "opt in" to a shutdown fight -- something the DOJ is clearly hoping won't happen. Wyden's recently-introduced bill would push the adoption back until the middle of next year, but it still requires representatives to express some sort of opinion (yes/no) on rule changes that could easily coast into existence while everyone in Congress is distracted by upcoming holidays and annual budget battles.

Filed Under: chris coons, doj, fbi, hacking, jurisdiction, malware, nit, ron wyden, rule 41

Government Seeks Do-Over On Win For Microsoft And Its Overseas Data

from the please-please-please-let-me-get-what-I-want dept

The DOJ wants the Second Circuit Court of Appeals to revisit the decision it handed down in July -- the one that's preventing it from forcing Microsoft to hand over data stored on its servers in Ireland. The DOJ hoped the court would read the Stored Communications Act as applying to the location of the company served with the data request, rather than the actual location of the data. The Appeals Court disagreed with the lower court's finding -- one that dragged in the Patriot Act for some reason -- pointing out that the purpose of the SCA was to protect the privacy of communications, not to facilitate the government in obtaining them.

The government has filed a petition [PDF] for a rehearing of the case, obviously in hopes of a reversal. Jennifer Daskal of Just Security has posted several reasons why the DOJ's desired interpretation of the Stored Communications Act is dangerous, along with other problems arising from this decision.

To begin with, the decision raises new logistical issues, both for the government and the private companies served with these warrants.

According to the government, companies like Google and Yahoo! now need to ascertain the location of sought-after data “at the moment the warrant is served.” If the content is stored abroad, it is now “beyond the reach of a Section 2703 warrant, even when the account owner resides in the United States and the crime under investigation is entirely domestic.”

The court's interpretation of the SCA theoretically means Google will never again have to turn over requested emails to law enforcement.

Moreover, in the case of Google, this data is also outside the reach of a MLA request “because only Google’s US-based employees can access customer email accounts, regardless of where they are stored.” (p.6) In other words, US law enforcement cannot access the data because it is outside the reach of the US warrant authority. And foreign governments cannot because they lack jurisdiction over the US-based employees that control the data. No law enforcement official can access it anywhere.

That being said, Daskal points out that the government also feels that just because it has a warrant, it should be able to demand the production of communications wherever, whenever. This flat assertion that warrants trump privacy in every case is every bit as one-sided as the DOJ's theory that Google now has the option to rebuff warrants at its sole discretion.

The DOJ's fears aren't entirely unfeasible. Companies that sell their communications tools with privacy-heavy sales pitches could simply offshore their data storage to put it out of reach of SCA-citing warrants, turning the 2nd Circuit's ruling into a middle finger to US law enforcement.

If this is going to be fixed in any sort of way that doesn't turn this into a one-sided victory for service providers or the government, it's probably going to need to be through legislation. The court's revisitation of the issue (courts have generally been favorable to rehearing requests from the US government) may come to that very conclusion.

Indeed, the DOJ has already begun pushing for a legislative solution, albeit one that heavily favors the government. The DOJ wants existing Mutual Legal Assistance Treaties (MLATs) modified so the FBI, etc. can continue to compel the production of communications stored overseas without tripping over reluctant US service providers or statutory limitations built into the SCA.

As Daskal notes, Congress is better off addressing this issue sooner rather than later. Should the court reverse its decision and allow the FBI to demand communications from foreign data centers using nothing more than a warrant issued by a local magistrate, other countries far less concerned about US privacy protections will be sure to utilize the same tactics.

Yet I continue to have concerns about the result of a governmental win: the government gets free rein to compel any US-based provider to disclose any user’s data, without any constraint based on things like the location or nationality of the target. This is a rule that will be watched, and likely mimicked, by others.

Consider the broader implications: The United States would (or at least should) be concerned if foreign governments unilaterally demanded the unilateral production of US citizens and residents data. And in fact current US law prohibits US-based providers from responding to those demands—requiring that the foreign governments instead employ the MLA process and ultimately obtain a US warrant based on the US standard of probable cause. Foreign government also have an interest in controlling access to their residents data. Those interests ought to be taken into account.

Unfortunately, Congress doesn't really have a great track record when it comes to legislative fixes for tech issues. We have a more technologically-adept set of legislators than we've ever had previously, but there are still many who won't see the forest of implications for the law enforcement trees. But the situation may become much, much worse if left unattended.

Filed Under: doj, electronic surveillance, ireland, jurisdiction, stored communications, warrant
Companies: microsoft

Appeals Court Says It's Perfectly Fine For The DOJ To Steal Kim Dotcom's Money Before Any Trial

from the this-is-pretty-fucked-up dept

Last year, there was a series of very troubling rulings by a district court in a case related to the criminal prosecution of Kim Dotcom. This wasn't, technically, part of the actual criminal case against him, but rather a separate effort by the government to steal his money. We've been covering the ridiculous process of civil asset forfeiture for a while, and it's really problematic in general. In Dotcom's case, it's something of a farce. Remember, civil asset forfeiture is the situation where the US government effectively files a civil (not criminal) lawsuit against inanimate objects, rather than people. In this case, it basically filed a lawsuit against all of Kim Dotcom's money, arguing that it was the proceeds of a crime and therefore, the government should just get it all. Again, this is entirely separate from the actual criminal trial of Kim Dotcom, which has been put on hold while the extradition battle plays out in New Zealand (determining if Dotcom can be forcibly sent to the US to stand trial).

Just the whole process of civil asset forfeiture is troublesome enough. As we've detailed over and over again, it's basically a system whereby law enforcement gets to steal money and other stuff (cars are popular) from people, simply by claiming that they were used in a criminal endeavor. Since the lawsuit is against the stuff, if people want it back, they have to go and make a claim on it, and it's a fairly convoluted process. In this case, things were even more ridiculous, because the government argued that because Dotcom was resisting extradition from New Zealand, he could be declared "a fugitive" and the judge overseeing the case (the same one overseeing his criminal case, Judge Liam O'Grady) agreed. That effectively meant that Dotcom had no legal right to protest the government simply taking and keeping all of his assets -- and they moved forward and did exactly that.

It is difficult to see how this can be legitimately described as anything but theft by the US government. It got someone locked up in New Zealand, based on questionable legal theories, and while he was (quite reasonably) fighting extradition to the US (a place he's never visited and where he has no business ties), it initiated a separate legal process to keep all his money, no matter what happens in his extradition fight and criminal trial. On top of that, it effectively barred him from making an official claim on that money by having him declared a fugitive for exercising his legal due process rights to fight extradition. So while he exercises his legal due process rights in New Zealand, he's blocked from doing so in the US. And all of his money goes to the US government.

As we said after O'Grady's ruling came out, even if you think that Dotcom is guilty of a criminal copyright conspiracy, and even if you think he should be extradited, tried and locked up this should concern you. Let him go through the full legal process, with all that due process entails, and then determine what should happen to his assets. To take them before that's happened, through this questionable side process is immensely problematic.

And that's why Dotcom appealed, and many others -- including a bunch of criminal defense lawyers -- stepped in to argue this was crazy. Unfortunately, earlier today, the 4th Circuit Appeals Court upheld O'Grady's ruling and rubber stamped the DOJ's legalized theft of Dotcom's assets. You should read the 61 page opinion (which was a 2 to 1 decision, with an interesting dissent), but we'll hit on some of the low points here.

There were a number of different arguments raised -- with a big one not just being the basic due process question, but a jurisdiction question. Dotcom's assets are not in the US. His work was not in the US. So why does the US get to seize the money. The majority opinion basically says "because that's what Congress wanted -- it created this law to let the US government seize overseas assets." The opinion admits that there's a bit of a circuit split on this, but goes for it anyway.

When the amendments were introduced in the Money Laundering Improvements Act, Senator D’Amato included an explanatory statement indicating that subsection (b) was intended to provide the federal district courts with jurisdiction over foreign property:

Subsection (b)(2) addresses a problem that arises whenever property subject to forfeiture under the laws of the United States is located in a foreign country. As mentioned, under current law, it is probably no longer necessary to base in rem jurisdiction on the location of the property if there have been sufficient contacts with the district in which the suit is filed. See United States v. $10,000 in U.S. Currency[, 860 F.2d 1511 (9th Cir. 1988)]. No statute, however, says this, and the issue has to be repeatedly litigated whenever a foreign government is willing to give effect to a forfeiture order issued by a United States court and turn over seized property to the United States if only the United States is able to obtain such an order.

Subsection (b)(2) resolves this problem by providing for jurisdiction over such property in the United States District Court for the District of Columbia, in the district court for the district in which any of the acts giving rise to the forfeiture occurred, or in any other district where venue would be appropriate under a venue-for-forfeiture statute.

This is the point that the dissent disagrees on, and argues that the forfeiture should be blocked on jurisdictional questions alone. The key, according to Judge Henry Floyd, is that court decisions must be binding on parties, and not advisory. But that doesn't work when you're talking about an opinion concerning assets overseas, which will still then depend on the local government where those assets live to abide by the ruling.

The majority side-steps this concern by cabining it to the separation of powers context. One of the basic tenets of what constitutes a “case or controversy” cannot be elided so. The defendant in this action--the res--is outside of the United States and beyond the control of the district court. Absent control, no order of the district court can be binding on the res because the fate of the res is ultimately not in the hands of the district court. Instead, the res in this case is subject to the control of the courts of New Zealand and Hong Kong. The district court’s forfeiture order therefore merely advises the courts of a foreign sovereign that (in the district court’s view under the laws of the United States) the United States should have title to the res. Those courts, of course, with control of the res and with the authority vested in them by their own sovereigns, remain free to revise, overturn, or refuse recognition to the judgment of the district court.

As Judge Floyd notes, this makes the opinion nothing more than an advisory opinion, which is prohibited by Article III of the Constitution (concerning the powers of the judiciary).

Back to the majority opinion, the court rejects the argument that this process to steal Dotcom's money without letting him defend himself violates the Due Process Clause of the Fifth Amendment. First, the court says that because some of Megaupload's servers were based in Virginia, the jurisdiction is fine. Then, the court accepts the lower court's decision that Dotcom can be called a "fugitive" even as he's both in contact with the court and going through a perfectly legal process around extradition in New Zealand. Somewhat incredibly, the court decides that because he's resisting extradition, that's the same thing as being a fugitive hiding out. That... should be troubling for a whole variety of reasons. Basically, the court says that due process means that Dotcom has the right to be heard protesting the forfeiture, but that the only way to do that is to stop fighting extradition. It gets down in the weeds parsing the law in determining what the right standard is for determining if fighting extradition counts as being a fugitive, and decides that this was Congress' intent with the law -- that so long as the person is avoiding court, even if for reasons relating to the legality of extradition, they can still be declared a fugitive.

The claimants’ argument that they have legitimate reasons to remain where they are, such as jobs, businesses, and families does not disprove that avoiding prosecution is the reason they refuse to come to the United States.

I imagine that Dotcom's lawyers will now try to fight this as well -- seeking either an en banc rehearing or petition the Supreme Court to hear the case. Both are pretty risky, with a fairly high probability of being rejected. And, of course, as the dissent pointed out, there's still one other hurdle for the DOJ: the assets are held in Hong Kong and New Zealand, and they now need to convince authorities in those two places to hand over the money. And, as of right now, it's not clear if they'll actually let it happen.

Again, no matter what you think of Dotcom's actual criminal case, this result should be concerning to you. The use and abuse of civil asset forfeiture is the real issue here -- not the copyright questions. The ability of the US government to simply take millions of dollars based on accusations and without a guilty verdict in a trial should be tremendously worrying. If a full trial happened and he was found guilty, then there's a reasonable argument that, as a result of that, the money can be forfeited. But it's extremely problematic that the money can be forfeited in these circumstances, before the rest of the legal process has occurred. Under this ruling, even if Dotcom came to the US and was found not guilty, the US government would still keep all his stuff. Can anyone explain how that would be a fair and just result?

Filed Under: 4th circuit, article iii, asset forfeiture, civil asset forfeiture, copyright, doj, due process, hong kong, jurisdiction, kim dotcom, new zealand
Companies: megaupload

DOJ Pushes Out Legislation Proposal To Undercut Microsoft Case Decision About Overseas Searches

from the please-please-please-let-us-get-what-we-want dept

No sooner had the ink dried on the Second Circuit Appeals Court decision regarding Microsoft and its overseas servers than new legislation designed to undercut the court's finding has been printed up by the DOJ and presented to the administration.

Microsoft successfully argued that the US government couldn't force it to unlock a server in Dublin, Ireland, so it could rummage around for evidence. Nor could the DOJ force the company to act on its behalf, performing a search of its overseas servers for documents the US government couldn't access otherwise.

Since that decision obviously just won't do, the DOJ has presented proposed legislation [PDF] that would alter existing Mutual Legal Assistance Treaties (MLATs) so the agency can do the very thing a court just said it couldn't do.

The details are discussed in, um, detail over at the Lawfare blog by none other than a former DOJ lawyer (David Kris). Needless to say, the post skews towards "supportive," but the analysis is thorough and offers some excellent insight on what the DOJ hopes to open up -- and what it's willing to concede in return for this new power.

The law would limit searches to communications from non-US citizens located abroad and only for criminal investigations. This would prevent the altered MLATs from being used by US agencies to gather intelligence, restricting them only to gathering evidence of criminal activity. That being said, for every concession made, there's a DOJ land grab.

The heart of the proposed legislation is section 4, which allows for executive agreements between the U.S. and foreign governments. Where a satisfactory agreement is in place, the barriers to access in the Wiretap Act, Stored Communications Act, and criminal Pen Register statute are removed (by section 3).

Of all the places to remove existing limits, the DOJ has chosen three of its most-abused laws/statutes. The Wiretap Act has been rendered toothless by the DEA's collusion with a judicial rubber stamp in California and used by the DOJ to push American telcos into doing its spying for it. The Stored Communications Act was just another (failed) angle of attack for the DOJ in its fight against Microsoft. And the Pen Register Act has been used as a cover for Stingray deployments by multiple law enforcement agencies, all with the tacit approval of the FBI, which still acts as a middleman in every IMSI catcher purchase by local PDs.

From there, the DOJ offers a melange of legal authorities to govern its searches of foreign servers.

The foreign orders authorized by the agreement must meet several specific requirements. First, they must pertain to the “prevention, detection, investigation, or prosecution of serious crime, including terrorism.” This means that affirmative foreign intelligence gathering is out of bounds. Conceptually, the idea here seems similar to the split in FISA’s two definitions of “foreign intelligence information,” 50 U.S.C. 1801(e)(1)-(2).

[...]

Second, the foreign orders must use a “specific” identifier such as a name or account as the “object of the order.” This comes from the USA Freedom Act’s amendments to FISA, designed to prevent bulk collection, 50 U.S.C. 1841, 1861.

[...]

Third, the orders must be “based on requirements for a reasonable justification based on articulable and credible facts, particularity, legality, and severity regarding the conduct under investigation,” and must be subject to “review or oversight” by a judge or other “independent authority.” These elements seem to be derived in part from several U.S. constitutional requirements—e.g., those governing a stop and frisk (Terry v. Ohio, 392 U.S. 1 (1967)), the definition of probable cause (Illinois v. Gates, 462 U.S. 213 (1983)), the requirements for a search warrant (including particularity and a neutral and detached magistrate, see Maryland v. Garrison, 480 U.S. 79 (1987)), and a proportionality requirement.

At first blush, these would seem to subject DOJ requests to multiple forms of oversight. But it most likely won't. The self-written loopholes allow for plenty of "search first, ask permission later" action.

Of course, the requirements are not exactly the same as those the Fourth Amendment would compel—for example, the reference to “review or oversight” by a judge or other “independent authority” would seem to permit after-the-fact review by a Parliamentary body rather than advance review of orders by a judge.

On top of that, the folding in of FISA language allows the FBI, et al to interpret "criminal investigation" very loosely.

Note, however, that counter-intelligence, expressly including counter-terrorism but also probably including counter-espionage, is included, because the language refers not only to “investigation” and “prosecution,” but also to “prevention” and “detection” of crime.

So, despite saying the MLAT alterations would be limited to investigatory work, rather than intelligence gathering, the new agreements could be read as permitting both. And, despite restricting agencies from using foreign government to obtain data or communications they otherwise wouldn't be able to access, the proposal does allow these entities to provide US agencies with data and communications involving US persons. Sure, there are minimization procedures, but they're apparently tied to restrictions built into foreign governments' laws rather than our own, and auditing for abuses of this access is limited to a review every half-decade -- hardly the sort of thing that stops abuse in its tracks.

And the minimization procedures deployed by foreign governments when handing over info on US persons are tied to a bunch of exceptions -- the usual parade of horrors agencies use to justify intrusive surveillance.

[A] foreign government “may not disseminate the content of a communication of a U.S. person to U.S. authorities unless it is relevant to the “prevention, detection, investigation, or prosecution of serious crime, including terrorism, or necessary to protect against a threat of death or serious bodily harm to any person,” and also “relates to significant harm, or the threat thereof, to the United States or U.S. persons, including but not limited to crimes involving national security such as terrorism, significant violent crime, child exploitation, transnational organized crime, or significant financial fraud.”

So, it can't be used for anything not included on the "serious crimes" list, which doesn't leave much. There's not a whole lot of criminal activity that can't be squeezed into this laundry list. Moving violations? Jaywalking? Lord knows anything drug-related will still be considered "dangerous," even if most of the threat is composed of overreacting drug warriors lobbing flash bangs into cribs at 5 am.

Obviously, the DOJ wasn't just going to stand by and let the Second Circuit determine how it's going to operate. This bill may have been a long time in the works, but its public debut is impeccably timed.

Filed Under: doj, ireland, jurisdiction, legislation, subpoena, warrant
Companies: microsoft

Australian Company Files Bogus Defamation/Trademark Infringement Lawsuit Over A Nine-Year-Old Blog Post

from the as-substance-free-as-a-bag-of-imported-air dept

We've seen plenty of bogus DMCA takedowns and legal threats issued in order to silence critics. Paul Alan Levy has gotten ahold of a weird, long-delayed lawsuit [PDF] filed by an Australian financier against an unknown blogger who wrote a single critical post about him nine years ago.

There is somebody on the other side of the Pacific Ocean who has a strongly negative perspective on Nicholas Assef, the head honcho at an Australian financial services firm called Lincoln Crowne – or at least, somebody held such views nine years ago.   We know at least that much because, in 2007, an anonymous individual created a small Google blog, using the URL lincolncrowne.blogspot.com, and posted a “warning” urging people who were considering doing business with Assef and his company to do their due diligence first. And even though the blog is buried deep in the Google search results for someone entering a search using lincoln crowne as the search string (currently, it is on the tenth page of results), Assef is plainly rankled by this criticism.

How Assef came across this single post, floating in the internet backwater, is a mystery. But there it is. Before suing the Doe behind the single-post "blog," Lincoln Crowne tried suing Google for defamation in Australia, presumably to use local laws to route around Section 230 protections. It didn't work. Google briefly took down the blog post before restoring it.

Having failed in this attempt, Lincoln Crowne is now trying to sue the anonymous blogger, using a poorly-constructed lawsuit with more than a few deficiencies. It not only claims the content is defamatory, but that the defendant's URL is a violation of its trademark. It's a mess, which is somewhat surprising because the firm is being represented by lawyers who seem otherwise competent.

Levy provides more insight into the suit's multiple flaws.

The trademark claim is based on the proposition that use of the company name in the third-level domain for the blog constitutes infringement. The complaint asks the court to exercise supplemental jurisdiction over the defamation claim, which is based on the allegation that everything written in the blog is a lie (does that include “and” and “the”?). The defamation claim is a bit odd because the statute of limitations for defamation is only one year, and the suit was filed eight years after publication. And the trademark claim is even worse – the blog is simple criticism, without selling any rival products. and there is a Ninth Circuit decision on point: Bosley Medical v. Kremer (a case that I handled), saying that non-commercial gripe sites are outside the scope of the Lanham Act. And even if the site had some commercial aspect, what likelihood of confusion about source could be caused by a blog that is headlined BEWARE LINCOLN CROWNE & COMPANY and then “Warning Warning Warning - Nick Assef"?.

Those aren't the only problems. In addition to these spurious claims, the complaint also shifts targets in midstream. The defendants listed on the first page of the suit only include "Does 1-10." Out of nowhere, the lawsuit suddenly starts targeting Google.

Also odd is the fact that the default judgment order is sought against Google, which is not a party to the lawsuit and is not in default and which, in any event, could not have been sued for defamation. It is unclear whether plaintiffs have alerted Google to the fact that they are seeking an order from the judge directed at Google rather than at the anonymous blogger.

As Levy points out, this sort of thing is common in the Ninth Circuit, where many tech companies are located. Sneaky plaintiffs file against one party and then pepper their complaints with requests for default judgment against better-heeled corporations.

Not only that, but the Ninth Circuit seems to enjoy circling this particular bogus lawsuit drain -- much more so than Levy does.

I find it tiresome to have to keep going back to courts in the Ninth Circuit to make these arguments: once we win in a circuit, I prefer to preserve Public Citizen's scarce resources by moving on to other jurisdictions. But if nobody speaks up, the win becomes a dead letter and future lawyers then start citing the lower court decision in self-justification.

A bogus lawsuit -- running unopposed (as it were) -- can do just as much damage as a legitimate one. And this one is pure frivolity. Even if the long-expired statute of limitations on defamation claims is ignored, the trademark allegations are nothing for Lincoln Crowne's representation to be proud of. In order to demonstrate the "harm" a personal blog showing up 10 pages into a Google search is doing to its business, the company actually had to use "lincoln crowne blogspot" as its search terms to get anything incriminating to show up on the first page. As Levy notes, the likelihood of the average consumer adding the word "blogspot" to their search for Lincoln Crowne hovers at a steady 0%.

It wasn't until seven years after the offending post appeared that Lincoln Crowne showed any motivation to secure its own Blogspot-hosted blogs in an attempt to combat the single negative post it had come across, so it's not as if the company has faced an uphill battle against a determined blogger for nine years straight.

Either way, the likelihood of confusion is nil and the post itself -- even if considered defamatory -- isn't Google's problem (although the plaintiff would really like it to be) and dates back further than the statute of limitations can be stretched.

It's clear from the lawsuit that Lincoln Crowne is just hoping to stick Google with something by injecting wording that asks for the company to be held responsible should the actual Doe defendant fail to appear. That's not proper litigation. That's opportunism.

Filed Under: 9th circuit, australia, california, censorship, defamation, jurisdiction, nicholas assef, slapp, statute of limitations, trademark
Companies: lincoln crowne

Huge Win: Court Says Microsoft Does Not Need To Respond To US Warrant For Overseas Data

from the big-news dept

We've been following an important case for the past few years about whether or not the US can issue a warrant to an American company for data stored overseas. In this case, Microsoft refused to comply with the warrant for some information hosted in Ireland -- and two years ago a district court ruled against Microsoft and in favor of the US government. Thankfully, the 2nd Circuit appeals court today reversed that ruling and properly noted that US government warrants do not apply to overseas data. This is a hugely important case concerning the privacy and security of our data.

The key issue here is that the US government was basically on a fishing expedition for information hosted on Microsoft Outlook.com email servers. And there are a few really key issues, concerning jurisdiction, privacy and the all important difference between a subpoena and a warrant (something that many people seem to think are the same thing). Microsoft's own response to the lawsuit did a really good job explaining the issues and how the government wanted to pretend a warrant was a subpoena, and what that meant for the 4th Amendment:

The Government cannot seek and a court cannot issue a warrant allowing federal agents to break down the doors of Microsoft's Dublin facility. Likewise, the Government cannot conscript Microsoft to do what it has no authority itself to do -- i.e., execute a warranted search abroad. To end-run these points. the Government argues, and the Magistrate Judge held, that the warrant required by ECPA is not a "warrant" at all. They assert that Congress did not mean "warrant" when using that term, but instead meant some previously unheard of "hybrid" between a warrant and subpoena duces tecum. The Government takes the extraordinary position that by merely serving such a warrant on any U.S.-based email provider, it has the right to obtain the private emails of any subscriber, no matter where in the world the data may be located. and without the knowledge or consent of the subscriber or the relevant foreign government where the data is stored.

This interpretation not only blatantly rewrites the statute, it reads out of the Fourth Amendment the bedrock requirement that the Government must specify the place to be searched with particularity, effectively amending the Constitution for searches of communications held digitally. It would also authorize the Government (including state and local governments) to violate the territorial integrity of sovereign nations and circumvent the commitments made by the United States in mutual legal assistance treaties expressly designed to facilitate cross-border criminal investigations. If this is what Congress intended, it would have made its intent clear in the statute. But the language and the logic of the statute, as well as its legislative history, show that Congress used the word "warrant" in ECPA to mean "warrant," and not some super-powerful "hybrid subpoena." And Congress used the term "warrant" expecting that the Government would be bound by all the inherent limitations of warrants, including the limitation that warrants may not be issued to obtain evidence located in the territory of another sovereign nation.

The Government's interpretation ignores the profound and well established differences between a warrant and a subpoena. A warrant gives the Government the power to seize evidence without notice or affording an opportunity to challenge the seizure in advance. But it requires a specific description (supported by probable cause) of the thing to be seized and the place to be searched and that place must be in the United States. A subpoena duces tecum, on the other hand, does not authorize a search and seizure of the private communications of a third party. Rather. it gives the Government the power to require a person to collect items within her possession, custody, or control, regardless of location, and bring them to court at an appointed time. It also affords the recipient an opportunity to move in advance to quash. Here, the Government wants to exploit the power of a warrant and the sweeping geographic scope of a subpoena, without having to comply with fundamental protections provided by either. There is not a shred of support in the statute or its legislative history for the proposition that Congress intended to allow the Government to mix and match like this. In fact, Congress recognized the basic distinction between a warrant and a subpoena in ECPA when it authorized the Government to obtain certain types of data with a subpoena or a "court order," but required a warrant to obtain a person's most sensitive and constitutionally protected information -- the contents of emails less than 6 months old.

It was unfortunate that two judges at the district court level basically ignored this argument, so it's good to see the appeals court shoot it down completely.

For the reasons that follow, we think that Microsoft has the better of the argument. When, in 1986, Congress passed the Stored Communications Act as part of the broader Electronic Communications Privacy Act, its aim was to protect user privacy in the context of new technology that required a user’s interaction with a service provider. Neither explicitly nor implicitly does the statute envision the application of its warrant provisions overseas. Three decades ago, international boundaries were not so routinely crossed as they are today, when service providers rely on worldwide networks of hardware to satisfy users’ 21st–century demands for access and speed and their related, evolving expectations of privacy.

Rather, in keeping with the pressing needs of the day, Congress focused on providing basic safeguards for the privacy of domestic users. Accordingly, we think it employed the term “warrant” in the Act to require pre‐disclosure scrutiny of the requested search and seizure by a neutral third party, and thereby to afford heightened privacy protection in the United States. It did not abandon the instrument’s territorial limitations and other constitutional requirements. The application of the Act that the government proposes ― interpreting “warrant” to require a service provider to retrieve material from beyond the borders of the United States ―would require us to disregard the presumption against extraterritoriality that the Supreme Court re‐stated and emphasized in Morrison v. National Australian Bank Ltd., 561 U.S. 247 (2010) and, just recently, in RJR Nabisco, Inc. v. European Cmty., 579 U.S. __, 2016 WL 3369423 (June 20, 2016). We are not at liberty to do so.

In the full discussion, the court points out where the lower court went wrong, thinking that thanks to the PATRIOT Act, a warrant could apply to the location of the service provider rather than the location of the server. But the court says that's clearly wrong, and the Congressional record makes it pretty clear that it was looking to apply the law just to the United States. As for the idea that the warrant was really a subpoena in disguise, the court says that's not how it works:

Warrants and subpoenas are, and have long been, distinct legal instruments. Section 2703 of the SCA recognizes this distinction and, unsurprisingly, uses the “warrant” requirement to signal (and to provide) a greater level of protection to priority stored communications, and “subpoenas” to signal (and provide) a lesser level. 18 U.S.C. § 2703(a), (b)(1)(A). Section 2703 does not use the terms interchangeably. Id. Nor does it use the word “hybrid” to describe an SCA warrant. Indeed, § 2703 places priority stored communications entirely outside the reach of an SCA subpoena, absent compliance with the notice provisions. Id. The term “subpoena,” therefore, stands separately in the statute, as in ordinary usage, from the term “warrant.” We see no reasonable basis in the statute from which to infer that Congress used “warrant” to mean “subpoena.”

[....] We see no reason to believe that Congress intended to jettison the centuries of law requiring the issuance and performance of warrants in specified, domestic locations, or to replace the traditional warrant with a novel instrument of international application.

There is, of course, the further issue of Microsoft being a US company, but the court says that doesn't magically make its overseas data subject to these kinds of warrants, because the intent of the law is to protect the privacy of users' communications, not to make it easier for the government to snoop.

The reader will recall the SCA’s provisions regarding the production of electronic communication content: In sum, for priority stored communications, “a governmental entity may require the disclosure . . . of the contents of a wire or electronic communication . . . only pursuant to a warrant issued using the rules described in the Federal Rules of Criminal Procedure,” except (in certain cases) if notice is given to the user....

In our view, the most natural reading of this language in the context of the Act suggests a legislative focus on the privacy of stored communications. Warrants under § 2703 must issue under the Federal Rules of Criminal Procedure, whose Rule 41 is undergirded by the Constitution’s protections of citizens’ privacy against unlawful searches and seizures. And more generally, § 2703’s warrant language appears in a statute entitled the Electronic Communications Privacy Act, suggesting privacy as a key concern.

The overall effect is the embodiment of an expectation of privacy in those communications, notwithstanding the role of service providers in their transmission and storage, and the imposition of procedural restrictions on the government’s (and other third party) access to priority stored communications. The circumstances in which the communications have been stored serve as a proxy for the intensity of the user’s privacy interests, dictating the stringency of the procedural protection they receive—in particular whether the Act’s warrant provisions, subpoena provisions, or its § 2703(d) court order provisions govern a disclosure desired by the government. Accordingly, we think it fair to conclude based on the plain meaning of the text that the privacy of the stored communications is the “object[] of the statute’s solicitude,” and the focus of its provisions.

The court goes on at length arguing that the Stored Communications Act's default is that communication privacy must be protected, and the exceptions are narrow.

All three judges on the panel agreed, but one -- Judge Gerard Lynch -- wrote a concurrence that tries to undercut the strong 4th Amendment/privacy arguments in the overall opinion, basically noting that he believes the decision doesn't come down to 4th Amendment issues or privacy protection, but merely how Congress drew up the law in the Stored Communications Act -- and basically argues that if Congress doesn't like this result, it can just rewrite the law.

It's also important to note that Rule 41 is the underpinning of much of this case, and that's the rule that the courts recently agreed to change to allow the DOJ more power to simply hack overseas servers. That shouldn't directly impact this particular case or similar situations, but does show how the DOJ is looking for ways to create endruns around limitations on domestic laws to try to get international data.

Still, for now, this ruling is a surprisingly good one, reinforcing privacy protections in overseas data. Kudos to Microsoft for going to court over this when it would have been quite easy for it to just give in and hand over the data. I assume that the US government will seek to get this ruling overturned, either via an en banc hearing on the 2nd Circuit or going to the Supreme Court, so the case isn't over yet. But, as for right now, it's in a good position.

Filed Under: 2nd circuit, 4th amendment, communications, doj, ecpa, email, ireland, jurisdiction, privacy, sca, subpoena, warrant
Companies: microsoft