The US Wants Access to Anyone's Email on Earth, and Microsoft Is Fighting Back

Microsoft and the US Government met in a Manhattan courtroom on Wednesday for a new round in their years-old fight over the emails of an unnamed person involved in a drug investigation.

It wasn't just the data belonging to that unnamed person that was at stake, but the privacy rights of millions of people who rely on email providers that store their information in the so-called "cloud."

In this case, the US government served Microsoft with a warrant in December of 2013, requesting the company provide information including the content of emails of an Outlook.com user. Microsoft refused to comply, arguing that the data in question is stored only on servers in Ireland, and that the US government should go through Irish authorities, before going to Microsoft, to get it.

We already live in a future where all our secrets, such as our love letters or our exchanges with lawyers or colleagues, are conveniently just one click away wherever we are—not just for us, but also for the internet giants that guard them. That also means, in a way, that those emails could be a click away for the government too, provided it has the right legal authority to force the internet giant to disclose them. That's the key of this legal fight.

In the courtroom of the Second Circuit Court of Appeals in Manhattan, Microsoft's lawyer argued that given that the relevant data is in Ireland, outside of American jurisdiction, the US government is arguing its laws can reach across borders. Thus, if the US government wins the case, it will open up the possibility for other governments to argue the same thing, and "get their hands on our emails sitting in the United States."

"If that is the rule, that is a rule for global chaos," said Joshua Rosenkranz, a partner with the law firm Orrick, Herrington & Sutcliffe, who was representing Microsoft. "Because other countries can do that to us."

"We would go crazy if China did that to us," he added.

The US government, on the other hand, argued that US law, specifically the Stored Communications Act, which is part of the oft-maligned Electronic Communications Privacy Act (ECPA) passed in 1986, compels American companies to disclose data under their control, regardless of where the data is actually stored.

Assistant US Attorney Justin Anderson said that companies like Microsoft, as a business decision, "choose to be able to access data from the United States, wherever that might be stored," and that compels them to provide the data to law enforcement agencies in America if they need that data, and can get a warrant. It doesn't matter that the data comes from Ireland, because the "disclosure is here," Anderson said.

Microsoft also argues that in the end, this is not a decision that should rest with the judges of the appeals court, but that Congress should revise what Rosenkranz called an "anachronistic" law passed in a "pre-CompuServe, pre-AOL world," and clearly define when the physical borders of the real world legally prevent the US government from reaching into seemingly borderless clouds.

As it happens, a bill that would cover this case is currently on the table. The Law Enforcement Access to Data Stored Abroad (LEADS) Act, says that the US government can't compel companies to disclose data stored abroad, unless that data belongs to a US citizen. The act reiterates that if the authorities need data belonging to a foreigner, they should use the existing international cooperation mechanisms known as MLATs (mutual legal assistance treaties).

Interestingly, MLATs were barely mentioned on Wednesday, even though the US government could've used the MLAT process in this case.

"The dirty secret is that [the MLAT process] would work here," Michael Price, a counsel for the Brennan Center for Justice at New York University School of Law, told Motherboard after the hearing. "It may not be perfect, and it may not be as fast, but it works."

This is the first time that this particular issue has been argued in court, and the case has gotten the attention of many people not directly involved in it, including the government of Ireland and members of the European Parliament.

Several companies, such as Verizon, AT&T, and even Microsoft's historical rival Apple have filed briefs in support of Microsoft's arguments. Privacy and digital rights groups, including the Brennan Center for Justice, have sided with Microsoft. And even media organizations such as The Guardian, CNN, and Washington Post, oppose the government, arguing that this case would be a dangerous precedent that would inspire governments in other countries to request reporters' emails stored in the United States.

"If the US government wins this case, we expect that other countries will argue that their legal process reaches content that providers store in the US, including countries that have lousy surveillance laws, or that don't follow the laws they do have," Greg Nojeim, a senior counsel at the digital rights advocacy group Center for Democracy and Technology, said in a statement. "Welcome to 'Wild West.'"

A decision in the case is expected in the next few months, and Microsoft has already said it will appeal to the Supreme Court if necessary.