Last week, in In re Search Warrants Nos. 16-960-M-01and 16-1061-M to Google, a federal magistrate judge in the Eastern District of Pennsylvania ordered Google to comply with three search warrants to turn over users’ electronic data stored outside the United States. In reaching that holding, the court concluded on Feb. 3 that compelling Google to produce the data does not constitute an unlawful extraterritorial application of the Stored Communications Act (SCA). Relevant to the magistrate judge’s analysis was the dynamic means by which Google stored user data in data centers across multiple countries.
Enacted in 1986, the SCA imposes non-disclosure obligations on providers of electronic communications services (ECS) and remote computing services (RCS), with certain exceptions. One of those exceptions was 18 U.S.C. § 2703, which establishes the condition under which the government may access stored communications. The government may obtain access to basic subscriber and transaction information through an administrative subpoena. See 18 U.S.C. § 2703(c)(2). It may also obtain other non-content records through a court order upon a showing that the “content or records…are relevant and material to an ongoing criminal investigation.” 18 U.S.C. § 2703(c)(2), (d). The only way that the government may access the contents of recent electronic communications, such as email, stored by an ECS, is through a warrant. See 18 U.S.C. § 2703(a). For older electronic communications and electronic communications stored by an RCS, the government needs a warrant as well, unless it is willing to provide notice to the subscriber or customer. See 18 U.S.C. § 2703(b)(1)(A).
Google stores user data for its Gmail and other services both inside and outside of the United States. Some user files may be broken into component parts and different parts of a single file could be stored in different locations (including in different countries). Google automatically moves data from one location to another on its network to optimize the network’s performance, reliability and other efficiencies. Thus, email in a Gmail user’s account may be stored in data multiple centers across the globe at different times.
In August 2016, the government obtained three search warrants for the contents of Gmail accounts under section 2703(a) of the SCA for two separate criminal investigations. The subjects of the investigation were believed to reside in the United States, and the crimes under investigation were allegedly committed entirely within the United States. Google partially complied with the warrants and produced only data responsive to the warrants that Google could confirm was stored in the United States. Google did not produce email contents that were stored in its data centers outside of the country.
The government filed a motion to compel Google to comply with the warrants. Citing Matter of Warrant to Search a Certain E-mail Account Controlled and Maintained by Microsoft Corp. (the “Microsoft decision”), 829 F.3d 197, 222 (2d Cir. 2016), Google argued that it was not required to produce electronic data stored outside the United States because a warrant issued under SCA “lawfully reaches only data stored within the United States.”
Thomas J. Rueter, a magistrate judge in the U.S. District Court for the Eastern District of Pennsylvania, rejected Google’s arguments, granting the government’s motion to compel. As an initial matter, the court analyzed the Microsoft decision which applied the two-step inquiry articulated by the Supreme Court in Morrison v. National Australian Bank Ltd., 561 U.S. 247 (2010) to determine whether the presumption against extraterritoriality applied to a warrant served on Microsoft for electronic data stored overseas. Finding that the SCA warrant provisions did not apply extraterritorially, the U.S Court of Appeals for the Second Circuit in the Microsoft decision concluded that “the SCA focuses on user privacy and determined that enforcing the warrant by directing Microsoft to seize the contents of its customer communications stored in Ireland would be an unlawful extraterritorial application of the SCA.” Microsoft, at 220-21.
The magistrate judge agreed with the first step of the Morrison inquiry, and neither party disputed that Congress did not intend for the SCA’s warrant provisions to apply extraterritorially. Google, slip op. at 16. However, the court took issue with the second step, finding that “the disclosure by Google of the electronic data relevant to the warrants at issue constitutes neither a ‘seizure’ nor a ‘search’ of the targets’ data in a foreign country.” Id. at 18. The court held that “[e]lectronically transferring data from a server in a foreign country to Google’s data center in California does not amount to a ‘seizure’ because there is no meaningful interference with the account holder’s possessory interest in the user data” and “[e]ven if the transfer interferes with the account owner’s control over his information, this interference is de minimus and temporary.” Id. at 20. Moreover, the court held that a search occurs “when the government violates a subjective expectation of privacy,” and”[e]ven though the retrieval of the electronic data by Google from its multiple data centers abroad has the potential for an invasion of privacy, the actual infringement of privacy occurs at the time of disclosure in the United States…when the FBI review the copies of the requested data in Pennsylvania.” Id. at 23-24.
Finally, the magistrate judge found that compelling Google to comply with the search warrants would not violate principles of international comity as “[n]o foreign nation’s sovereignty will be interfered with in any ascertainable way at the time the…warrants at issue are executed because the searches will be conducted in the United States.” Second, unlike in Microsoft, where the user’s data had been stored in a data center in Ireland for a lengthy period of time, the Google users’ data was constantly moving across different jurisdictions. Due to the constantly migratory nature of Google’s electronic data made, the magistrate judge found it would be “impossible for the government to obtain the sought-after user data through existing MLAT channels.” Id. at 26, 28-29.
Although this decision is a single decision by a single magistrate judge, it represents the first known decision by a federal court outside of the Second Circuit addressing the issue of whether a SCA warrant can compel the production of electronic data stored overseas by an American company. The Magistrate Court justified its decision in part on the fact that the electronic data that was the subject of the warrants was constantly moving from one location to another and the government could not ascertain the location of the data with adequate certainty to enable it to obtain the data through the MLAT process. Other federal courts may distinguish this decision and reach a different conclusion if the electronic data that is sought by a search warrant is static and stored only in one location. Companies should pay close attention to whether Google will appeal this decision and how other federal courts outside of the Second Circuit will decide the issue of whether the use of an SCA warrant to compel the production of electronic data stored overseas constitutes an extraterritorial, and hence unlawful, application of the SCA to determine whether this decision is simply an outlier, or the beginning of a trend.