Yeah…I’m writing about this…again. This topic is that important.
For several years now the tech industry has watched closely as Microsoft fought to disclose information contained on a server in Ireland from an FBI warrant. The government’s position has been and remains that simply having access to the information is enough to be able to compel the release of the desired information via a warrant.
I think that the government is wrong, simply because if the US makes a legal precedent that physical location of data is meaningless because of remote connectivity it is giving itself worldwide jurisdiction over any and all data accessible by corporations with a US presence. I can’t think of a faster way to cause corporations to minimize their US footprint than that, separating out business divisions to the EU or India or anywhere else that has better privacy laws than the US. It would be a no brainer for them in order to maintain business relationships with other governments and corporations.
Secondly, if the US takes on the role of, “all the worlds data that is accessible from inside the US is subject to US warrants” then there is no way to complain when China takes the exact same stance, “all the worlds data that is accessible from inside China is subject to Chinese warrants.” And legally, there would be nothing we could do about it except start fining those corporations with a US presence for turning over data on US citizens to the Chinese government.
Now international diplomacy is not an easy game, but the role of how citizens interact and the rights that they have are the reason that Kim Dot Com is still fighting extradition from New Zealand and not been snatched in the middle of the night by a SEAL team. Like it or not, Kim broke no laws in New Zealand, and so the United States clearly recognizes that it must use a lengthy legal process to convince New Zealand that it has a compelling right to prosecute Kim for actions that he took outside of US jurisdiction by showing harm to US citizens through Kim’s actions. These warrants for account information seek to bypass that process, and in doing so violate the sovereignty of foreign nation states which often have vastly different privacy laws (since Ireland is a member of the EU with their extensive EU level privacy laws, those apply as well).
Congress has been kicking about the “Law Enforcement Access to Data Stored Abroad” legislation for several years no, with no clear progress on getting it passed into law which would force the DOJ to use the warrant system only to retrieve the data on US citizens. http://thehill.com/blogs/congress-blog/judicial/337681-when-can-law-enforcement-access-data-stored-abroad-only-congress
Still, the Microsoft case regarding Ireland was won by Microsoft at the appellate level, leaving the DOJ to appeal to the US Supreme Court (which they have: https://www.theregister.co.uk/2017/06/26/supremes_microsoft_warrant_case/ ) If the USSC declines to take the case, then the 2nd judicial circuit ruling will stand, but only in the appellate jurisdiction which allows the DOJ to pursue the warrants in other jurisdictions like they are doing against Google in the 9th district: https://arstechnica.com/tech-policy/2017/09/justice-department-goes-nuclear-on-google-in-search-warrant-fight/
Another option is that the USSC decides to take the Microsoft Case, and affirm the 2nd District ruling, making it the case law of the land. The last option is the USSC takes the case, and overturns the 2nd district ruling, making it case law of the land for the DOJ to demand data from US corporations no matter where the data is stored and damn the consequences.
Generally the USSC has not taken cases where Congress has pending legislation going to fix the problem, such as the “Law Enforcement Access to Stored Data” bill that would answer the question, however this is one of the more important issues of our time and Congress has shown no sign of actually passing that legislation. So the safest course of action is to deny review, but that would continue the current ambiguous state of affairs where at least two appellate courts have divergent rulings on the same subject which has historically triggered USSC review at some point.
So either Congress needs to act, or the USSC needs to act, and hopefully whichever acts first will get it right.