One of the big attractions at Relativity Fest in London was a panel discussion about the right of US authorities to access data held abroad. The specific context was the case originally known as “Microsoft Dublin”, “the Dublin Warrant” or Microsoft v US.
The panel included the Honorable James Francis IV, Distinguished Lecturer at the City University of New York School of Law, and retired U.S. Magistrate Judge (S.D.N.Y.), who made the original Dublin Warrant decision. With him was Rachi Messing of Microsoft. David Horrigan of Relativity moderated. You can watch a recording of the panel here.
After the panel, I asked Judge Francis if he would distil into five minutes the really interesting discussion which had earlier taken an hour. Master of précis that he is, he did just that.
Judge Francis said that in addressing the primary issue as to US law enforcement’s right to access email outside the US, he determined that the email was within the possession, custody and control of Microsoft in Redmond Washington. No activity was needed by the FBI in Ireland nor by any Microsoft person in Dublin. A Microsoft person could simply sit at a terminal in Redmond and comply with the demand. This was not, he found, an extra-territorial application of the Stored Communications Act.
After various appeals, the case reached the US Supreme Court where, after oral argument, the case was dismissed as moot after the Clarifying Lawful Overseas Uses of Data (CLOUD) Act was passed. Much of what the government had sought in the Microsoft case had become law not through the court but through Congress.
Is there more to the CLOUD Act than this, I asked – a wider context perhaps?
Judge Francis said that ISPs like Microsoft can challenge any particular warrant on various grounds – the relevant individual must be a US person, the ISP must be in jeopardy of violating foreign law and must weigh a series of comity factors to show that compliance was appropriate.
The comity factors are not quite the same as those in the Aérospatiale case; it would be interesting, Judge Francis said, to see how that plays out.
Foreign governments have standing to object to a demand made under the CLOUD Act – the ISP can notify foreign governments who can intervene if they qualify to do so through an agreement with the US. The UK is in the process of negotiating an agreement which will qualify under the CLOUD Act.
There is a reciprocal right for foreign governments to get information from ISPs. They must show the US Attorney General and the Secretary of State that they have adequate protections in place in relation to the privacy of the account holder, including protections for freedom of speech.