Should governments be able to look at your data when it is abroad?

By L.S.

SUPPOSE FBI agents were to break into the postbox of an American company in Dublin to seize letters which might help them convict an international drug dealer. There would be general uproar, if not a transatlantic crisis. But that is essentially what the FBI wants to happen, albeit in the virtual realm: it has asked a court to order Microsoft, in its capacity as a big e-mail provider, to hand over messages from a suspect in a drugs case which are stored in a data centre in Ireland. On September 9th an appeals court in New York will hear oral arguments on whether Microsoft has to comply.

The case has many wrinkles, mainly due to the fact that the relevant American laws were written before the internet took off. In a sense, the court has to guess what lawmakers would have written into legislation if the global network had already been around. But at the core of the case is one of the most knotty legal questions in the age of cloud computing: how to give law-enforcement agencies access to evidence when laws remain national, but data are often stored abroad and sometimes even at multiple places at once?

The American government argues that it is irrelevant where the data are located. What matters is the nationality of the company holding the data. And since Microsoft is American it has to hand it over. The firm argues that this would amount to “unilateral law-enforcement incursions into a foreign sovereign country”. The proper way to go about this would be to use the path of “mutual legal assistance” : ask the Irish authorities to issue an Irish warrant.

Some have argued that Microsoft is only pushing back against the warrant to signal loudly that it is willing to defend its customers abroad, even against its snoop-happy government. But the case is about more than marketing. Microsoft—and other American tech giants, for that matter—have invested billions in data centres abroad, particularly in Europe. If American law-enforcement bodies (and, perhaps, the country’s intelligence agencies) can access these directly, European firms will be even more reluctant to trust American firms with their data.

Another big worry is that the case will encourage other governments, in particular unsavoury ones, also to require Microsoft and other cloud-computing providers to hand over data stored abroad. If such extraterritorial warrants become the norm, firms could find themselves caught often between conflicting laws: one country requires access while the laws of the country where the data are stored do not permit it.

In a lower court, a judge has already ruled twice against Microsoft. The firm has since put together an unusual coalition to support its position: its arch-rival, Apple, has filed an amicus brief, as did the Electronic Frontier Foundation and the American Civil Liberties Union, two lobby groups, several media and tech companies (the Guardian, NPR, Fox News, eBay, Verizon) and even the Irish government.

A decision is expected later this year, but the case will probably go to the Supreme Court, and thus last at least two more years. Whatever the outcome, Microsoft and its allies hope that the case will push Congress to update the relevant laws to limit the damage. One proposal, called the Law Enforcement Access to Data Stored Abroad Act, or LEADS, would limit extraterritorial search warrants to American citizens and severe crimes.

Although such a reform would help American tech companies, it would not solve another problem: whereas the FBI may be able to directly seize data stored abroad, other countries’ law-enforcement agencies do not have that privilege. Since American tech giants are so dominant globally, most data are stored in American data centres. But the country’s privacy laws do not allow its firms to hand over the content of communications directly to foreign law-enforcement bodies. And mutual legal assistance procedures take on average ten months.

One solution would be to allow courts in other countries also to request data directly. A better option, from a civil-liberties point of view, would be for governments to get together and negotiate a system of mutual legal assistance worthy of its name. A good point to start would be to go with the times and develop an electronic system for managing requests for such assistance. Today these are often still sent around on paper, in diplomatic pouches.