Skip to main content

EFF to Supreme Court: Protect the Privacy of Cross-Border Data

January 18, 2018

EFF to Supreme Court: Protect the Privacy of Cross-Border Data

The Electronic Frontier Foundation urged the Supreme Court today to hold that Microsoft cannot be forced by the U.S. government to disclose the contents of users’ emails stored on the company’s computers in Dublin, Ireland.

The stakes for user privacy in the court’s decision are extremely high. Governments around the world may feel empowered to snoop on the countless emails, chats, and other online communications that cross international boundaries if the court sides with the government.

At the center of the case, the U.S. government is attempting to overturn a Second Circuit decision holding that police cannot use U.S. warrants to compel U.S. Internet companies to disclose users’ email and digital content stored outside the United States. The appellate court reasoned that this extraterritorial application of a U.S. warrant would exceed the process Congress created — the Electronic Communications Privacy Act (ECPA) — to protect people’s privacy while allowing law enforcement access to emails. The case is titled United States v. Microsoft, and is often called “the Microsoft Ireland case.” EFF joined the ACLU, Brennan Center, Restore the Fourth, and R Street Institute to file the amicus brief with the Supreme Court.

The U.S. government’s unilateral approach to obtaining Microsoft users’ emails would bypass the international procedures that it has previously agreed to. Specifically, the U.S. has signed treaties with 65 individual countries and the European Union, called Mutual Legal Assistance Treaties (MLATs), that enable the U.S. to apply to foreign governments where evidence of a crime is located, and ask that country to assist in collecting the evidence under its own privacy laws. The countries the United States has partnered with can similarly request that the U.S. Department of Justice help them collect evidence stored in the United States. Under MLATs, foreign countries must follow the privacy rules established by U.S. law, including the requirement under the Fourth Amendment that law enforcement obtain a warrant to search and seize content. These MLATs recognize the importance of other countries’ privacy and human rights laws. Ireland has advised the U.S. Supreme Court that it believes the MLAT process is the most appropriate means for the U.S. government to obtain the emails that Microsoft stores in Ireland.

To evade using MLATs, and get around the fact that U.S. warrants typically do not have international reach, the U.S. government is arguing that a Fourth Amendment search and seizure only occurs when Microsoft, within the United States, delivers emails to officers of the U.S. government. That is simply not the case. Rather, if Microsoft copies or moves data from Ireland to the United States on demand from the U.S. government, that is a search and seizure, and it occurs abroad. As our amicus brief states:

Furthermore, the Government’s argument that such collection and copying does not “expand[ ] [Microsoft’s] authority over those emails” (id.) ignores that it does expand the government’s authority over them. A government-directed exercise of dominion over an individual’s private communications, by itself, is a Fourth Amendment seizure.

EFF has long worked to ensure the greatest privacy protection for cross-border data. In the Microsoft Ireland case, we filed amicus briefs before the district court and the appellate court. We are also fighting for privacy protections at the international level in the Council of Europe, where a  new treaty  could allow direct foreign law enforcement access to data stored in other countries’ territories.  And EFF is advocating against overbroad DOJ legislative proposals to access online content stored abroad.

We urge the Supreme Court to hold the government accountable for following the rules set by Congress, and by international treaty, when law enforcement agencies seek access to our private conversations stored outside the United States. The court is expected to decide this case during the spring 2018 term.

We thank our counsel Brett J. Williamson, Nathaniel Asher, David K. Lukmire, and Cara Gagliano of O’Melveny & Myers.

JavaScript license information