Federal Judge Upholds Magistrate's Ruling, Says Google Must Hand Over Data From Overseas Servers
from the worldwide-service,-domestic-delivery dept
Earlier this year, a Pennsylvania magistrate judge decided Google needed to turn over data to US law enforcement despite it being housed (possibly temporarily) in overseas servers. The overseas housing was simply part of Google’s data flow, which routes communications around the world for efficiency, rather than to keep them out of local governments’ hands.
This contradicted an earlier decision by the 2nd Circuit Appeals Court, which ruled Microsoft did not have to turn over data held in overseas servers in response to a US search warrant. The fact that Google does not explicitly hold certain data in certain servers was key to this decision. The conclusion the magistrate reached was no seizure of the data took place until Google stopped the data flow and gathered it up locally. That decision seemed to rewrite the definition of the word “seizure,” as the warrant compelled Google to grab the data and compile it domestically. Stopping the flow of data traffic to grab stuff certainly sounds like Google is “seizing” it — and it’s only doing so because the government has ordered it to.
Google asked for a judicial review of the magistrate’s decision. Unfortunately, the Pennsylvania federal judge one step up from the magistrate has upheld the magistrate’s order. (h/t Brad Heath) From the memorandum [PDF]:
Although Google and each of the account holders in question are based in the United States, Google contends it is the physical location of the data to be retrieved—which Google, not the account holder, controls, and which Google can change at any time for its own business purposes—that determines whether the statute is being applied extraterritorially. Because this Court agrees with the government that it is the location of the provider and where it will disclose the data that matter in the extraterritoriality analysis, and because Google can retrieve and produce the outstanding data only in the United States, the Court agrees with the Magistrate Judge’s conclusion that fully enforcing the warrants as to the accounts in question constitutes a permissible domestic application of the SCA. The Order granting the government’s motions to compel will therefore be affirmed.
The memorandum runs several pages, but basically reiterates the magistrate’s findings. The warrant is lawful under the Stored Communications Act and provides for the seizure of the data requested. That the data is located extraterritorially would normally pose a problem, but Google’s overseas data stores are only filled for Google’s convenience, rather than being a place where any of the sought data resides permanently. This decision basically lays it all out for US service providers, stating that because warrants are served to their domestic offices, data located anywhere in the world is within reach of a US search warrant.
The court gets around the contradictory nature of its conclusion by quoting heavily from the dissenting judges in the 2nd Circuit Appeals Court decision.
Although the panel decision in the Microsoft case was unanimous, the decision drew vigorous opposition from other judges of the Second Circuit when the case came before the full court on the government’s petition for rehearing en banc. The petition was denied by an equally divided court, but the denial generated four separate dissents by judges who agreed that enforcing an SCA warrant to require a domestic service provider to disclose information in the provider’s possession, which the provider can access within the United States, constitutes a domestic application of the statute’s warrant provision, regardless of where the provider has elected to store the information. See Microsoft Reh’g, 855 F.3d at 61-62 (Jacobs, J., dissenting); id. at 66-68 (Cabranes, J., dissenting); id. at 70-73 (Raggi, J., dissenting); id. at 75-76 (Droney, J., dissenting). The Microsoft court’s analysis has also been rejected by every magistrate judge and district court that has considered the issue to date, including the Magistrate Judge in this case.
However, there’s nothing in the memorandum that even hints at the dangerous precedent the court is helping set. The Pennsylvania court views the Second Circuit decision as an anomaly and will afford it zero respect when discussing challenged warrants. Presumably, ignoring an outlier will continue through any suppression hearing once this case moves forward. Google will certainly appeal this decision, but the absence of favorable rulings from within this circuit (Third Circuit) likely make this non-starter. As it stands now, one circuit in the nation holds the government to the letter of the law when issuing SCA warrants. For everyone else, it’s still up in the air, with more courts likely to side with the 2nd Circuit dissent, which will result in more US law enforcement demanding data from overseas simply because they have a US entity to hand the warrant to.
Comments on “Federal Judge Upholds Magistrate's Ruling, Says Google Must Hand Over Data From Overseas Servers”
I’d guess Google will appeal, and if 3rd Circuit upholds the decision they’ll appeal to the Supreme Court because there’s a circuit split. They can make a convincing argument that this case and the Microsoft decision can’t be distinguished, as Microsoft also could have moved the data back to domestic servers where it would fall under the warrant. After all, the judge in the Google case isn’t ordering Google to just wait to see if the data comes back to the US naturally, he’s ordering them to make the data come back to the US.
All your data are belong to us
As is always the case…
This could make for some interesting goings on when it comes to Tax information being sought by the IRS on these multinational companies.
Re: Re:
Re: Re: Re:
Implying Google is not a multinational corporation
Re:
Tax information for American corporations and subsidiaries
is always presumed to be at the point in America where it
was incorporated or has it’s offices. You can’t evade the
IRS by moving American tax information out of the country
because it is, by law, always held in U.S. jurisdiction.
Court is trying to walk the tightrope
If you look at their decision its basically coming down to “The person who gave you the Data is in the US, his access is in the US. You cant hide the data in Canada if all activity is happening in the US”.
This is a bad thing because it means doing business in Canada is now under US laws.
Re: Court is trying to walk the tightrope
And turnabout is fair play. The US will set the standard for when those other countries make similar demands.
Re: Re: Court is trying to walk the tightrope
Not at all, the will use the data being on their soil as an excuse for the person to extradited to the US to accept a plea bargain.
/s
Next up: China will demand Google extraterritorial information on Chinese dissidents (Possibly in the US). That is if they haven’t already been doing so.
Re: Re:
Well, if the person is (a) in CHina, and (b) using Google services in China, and (c) they are dealing with Google China offices, then perhaps.
Otherwise, it would fail to meet the standards of the judgement. A Chinese person using Google in the US directly would already being making a step to avoid his government, and the action would clearly be his choice and not that of Google.
I guess they don’t call it the “long arm of the law” for nothing.
Decision Makes Sense
The decision makes sense, for very simple reasons.
Google and the client are in the US. The data is sourced in the US and will only normally be used in the US. Storing it offshore appears to be nothing more than an attempt to create a barrier between law enforcement and the data, in a wholesale way.
My guess is that Google has been hoping that the courts would rule in their favor so they can crow about keeping consumer data private. Being tricky and trying to slide around the law is never a good thing.
Re: Decision Makes Sense
Exactly!
Re: Decision Makes Sense
No I don’t believe it was an intentional barrier. Google houses data wherever it will produce faster results at that point in time.
Google should only be forced to produce data when it is currently on US based servers for US government agents. Just like Microsoft only produced data that was in the US not Ireland. Now one difference is that the data for google is in flux based on need. So it’s possible that sooner or later that the data is placed on a US based server. At which point in time the warrant would be valid.
Court orders and gag orders
It occurs to me that with the court position that court orders are global, then you could sue Google or another multinational business in a foreign court, and compel them to reveal information sealed by a gag order attached to a NSL or warrant.
After all, the foreign court does not care much about US national security — especially if you sued in Russia — and all court orders must be obeyed, according to US and Canadian courts, even if they violate the sovereignty of a foreign nation.
Yet another reason to be reluctant to do any business in the US…
So many bad consequences to come...
Keep in mind 2 things: 1) The government can demand data for a whole host of legal reasons, none of which require a conviction. So, we are talking about the data of people who are still presumed innocent. Don’t be fooled into thinking the targets will only be "bad" people who have committed what most of us might consider a serious crime. Like every other overly broad legal tool, this will eventually be used by some cop to check if his girlfriend is cheating on him or to see what secret files some celebrity is keeping. 2) If our government can do it, so can the governments of Russia, Iran, China, etc. Will they hesitate to demand the data that any company (not just Google) has on someone they want to target? E.g. a business competitor, a suspected undercover/counter-terrorism operative, etc? Of course they won’t.
Keep in mind that it seems like the only relevant standard the court is really enforcing here is that there is someone in the U.S. to whom law enforcement can hand a court order and that said someone can get access the data from here, whether or not the data itself is currently here. That’s basically any data stored by a company that has a U.S. office.
At the end of the day, this encourages companies to off-shore not just some of their data for efficiency purposes, but also their headquarters and any offices so that this can’t happen. Odd-sounding notions like businesses incorporated on floating private island nations that aren’t subject to traditional national jurisdiction are typically met with lots of outrage by people who disdain all things corporate. But, here is potentially a good civil rights reason for such places.