by Anupam Chander, Martin Luther King, Jr. Professor of Law and Director of the California International Law Center at UC Davis. Recipient of a Google Research Award supporting related research
In 2013, Microsoft was staring at an order that risked its foreign business. The trust of its foreign users was at stake. A federal magistrate judge in New York had ordered Microsoft to produce emails from someone implicated in a narcotics case that were stored on Microsoft’s computers in Dublin, Ireland. While the identity of the target remains secret to this day, many observers assume that the person is foreign because of Microsoft’s policy to locate the records of a user close to that person’s residence. The court warrant thus meant that even if an Irish person used Microsoft’s computers in Europe, a U.S. court could demand that information when it wanted. The order effectively enlisted U.S. companies as the eyes and ears of U.S. courts worldwide.
Microsoft appealed, drawing the support of Apple, Amazon and numerous other major technology companies (though not all of them). Even the Irish government, in a relatively rare move, filed a brief in the U.S. case, observing that it had a mutual legal assistance treaty with the United States that provided an official process to enable U.S. courts to obtain information in Ireland. Ireland noted what it saw as “potential infringements by other states of its sovereign rights with respect to its jurisdiction over its territory.” It noted that it would be “pleased to consider, as expeditiously as possible, a request under the treaty…”
This month, the Second Circuit Court of Appeals ruled in Microsoft’s favor, holding that Microsoft’s Irish computers lay beyond the reach of the search warrants issued under the Stored Communications Act, a 1986 federal law. Civil liberties advocates, not just U.S. internet companies and the Republic of Ireland, should breathe a sigh of relief.
Some have worried that this decision will lead countries to insist on data localization—the requirement that data about the citizens of a country mostly stay within the country. Elsewhere I have criticized data localization as a measure that erodes free expression, enhances authoritarian control, undermines local enterprise, and reduces trade. The critics of the Second Circuit decision are indeed right that the decision makes the siting of a computer server more important.