Amicus BR ND Cal As Filed

-
1 ORRICK, HERRINGTON & SUTCLIFFE LLP

BRIAN P. GOLDMAN (SBN 279435)
2 brian.goldman@orrick.com
EVAN ROSE (SBN 296559)
3 erose@orrick.com
405 Howard Street, San Francisco, CA 94105
4 Tel: 415-773-5700 / Fax: 415-773-5759
E. JOSHUA ROSENKRANZ (pro hac vice)
5 jrosenkranz@orrick.com
51 West 52nd Street, New York, NY 10019
6 Tel: 212-506-5000 / Fax: 212-506-5151
ROBERT M. LOEB (pro hac vice)
7 rloeb@orrick.com
HANNAH GARDEN-MONHEIT (pro hac vice )
8 hgarden-monheit@orrick.com
1152 15th Street NW, Washington, DC 20005
9 Tel: 202-339-8400 / Fax: 202-339-8500
10 Attorneys for Amici Curiae
MICROSOFT CORPORATION, CISCO SYSTEMS, INC.,
11 AND APPLE INC.
COVINGTON & BURLING LLP
12 DEVON MOBLEY-RITTER (SBN 309439)
dmobleyritter@cov.com
13 333 Twin Dolphin Drive, Suite 700
Redwood Shores, CA 94065
14 Tel: 650-632-4700 / Fax: 650-632-4800
JAMES M. GARLAND (pro hac vice)
15 jgarland@cov.com
ALEXANDER A. BERENGAUT (pro hac vice)
16 aberengaut@cov.com
KATHARINE GOODLOE (pro hac vice)
17 kgoodloe@cov.com
One CityCenter
18 850 10th Street, NW
Washington, DC 20001
19 Tel: 202-662-6000 / Fax: 202-778-5505
20 Attorneys for Amici Curiae
MICROSOFT CORPORATION AND AMAZON.COM, INC.
21
UNITED STATES DISTRICT COURT
22
NORTHERN DISTRICT OF CALIFORNIA SAN FRANCISCO DIVISION
23 In the Matter of the Search of Content Stored Case No. 3:16-mc-80263-RS
at Premises Controlled by Google Inc. and
24 BRIEF FOR AMICI CURIAE
Further Described in Attachment A MICROSOFT CORPORATION,
25 AMAZON.COM, INC., CISCO
SYSTEMS, INC., AND APPLE INC. IN
26 SUPPORT OF GOOGLE INC.
Hearing Date: June 22, 2017
27 Hearing Time: 8:00 AM
Judge: Hon. Richard Seeborg
28
Case No. 3:16-mc-80263-RS
BRIEF FOR AMICI CURIAE MICROSOFT CORPORATION, AMAZON.COM, INC., CISCO SYSTEMS, INC., AND
APPLE INC. IN SUPPORT OF GOOGLE INC.
-
1 TABLE OF CONTENTS
2 Page
3 INTERESTS OF AMICI CURIAE .................................................................................................. 1

4 INTRODUCTION .......................................................................................................................... 2
ARGUMENT .................................................................................................................................. 4
5
I. The Stored Communications Act Does Not Authorize Warrants For Seizure
6 Of Private Emails Stored In A Foreign Country. .................................................... 4
A. The conduct relevant to the SCAs focus is intrusion on the privacy
7 of stored communications. .......................................................................... 4
8 B. Executing a warrant seeking email content from a data center in a
foreign country would effect a law enforcement search and seizure
9 on foreign soil. ............................................................................................ 7
II. Only Congress Can Decide Whether And How To Update The SCA.................. 12
10
CONCLUSION ............................................................................................................................. 15
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
-i- Case No. 3:16-mc-80263-RS
BRIEF FOR AMICI CURIAE MICROSOFT CORPORATION, AMAZON.COM, CISCO SYSTEMS, INC., AND
-
1 TABLE OF AUTHORITIES
2 Page(s)
3 Cases
4
Berger v. New York,
5 388 U.S. 41 (1967) ......................................................................................................................9
6 EEOC v. Arabian Am. Oil. Co.,

499 U.S. 244 (1991) ....................................................................................................................2
7
F. Hoffmann-La Roche Ltd. v. Empagran S.A.,
8 542 U.S. 155 (2004) ..................................................................................................................12
9 In re Info. associated with one Yahoo email address that is stored at premises
10 controlled by Yahoo,
Nos. 17-M-1234 and 17-M-1235, 2017 WL 706307 (E.D. Wis. Feb. 21, 2017) .......................5
11
In re [redacted]@yahoo.com, stored at premises owned, maintained, controlled,
12 or operated by Yahoo, Inc.,
No. 6:17-mj-1238 (M.D. Fla. Mar. 21, 2017) .............................................................................5
13
Katz v. United States,
14
389 U.S. 347 (1967) ....................................................................................................................9
15
Konop v. Hawaiian Airlines, Inc.,
16 302 F.3d 868 (9th Cir. 2002).......................................................................................................6
17 Kyllo v. United States,

533 U.S. 27 (2001) ....................................................................................................................10
18
Loretto v. Teleprompter Manhattan CATV Corp.,
19 458 U.S. 419 (1982) ....................................................................................................................9
20
Morrison v. Natl Austl. Bank Ltd.,
21 561 U.S. 247 (2010) ................................................................................................2, 4, 8, 11, 13
22 RJR Nabisco, Inc. v. European Cmty.,

136 S. Ct. 2090 (2016) ................................................................................................................4
23
Theofel v. Farey-Jones,
24 359 F.3d 1066 (9th Cir. 2004).....................................................................................................6
25 United States v. Bach,
26 310 F.3d 1063 (8th Cir. 2002)...................................................................................................10
27 United States v. Comprehensive Drug Testing, Inc.,

621 F.3d 1162 (9th Cir. 2010)...................................................................................................10
28
- ii - Case No. 3:16-mc-80263-RS
-
1 United States v. Jacobsen,

466 U.S. 109 (1984) ....................................................................................................................9
2
United States v. Verdugo-Urquidez,
3
494 U.S. 259 (1990) ....................................................................................................................8
4
United States v. Warshak,
5 631 F.3d 266 (6th Cir. 2010).............................................................................................7, 9, 10
6 Matter of Warrant to Search a Certain E-Mail Account Controlled & Maintained

by Microsoft Corp. (Microsoft I),
7 829 F.3d 197 (2d Cir. 2016) ......................................................................3, 5, 6, 7, 9, 10, 12, 13
8 Matter of Warrant to Search a Certain E-Mail Account Controlled & Maintained
9 by Microsoft Corp. (Microsoft II),
855 F.3d 53 (2d Cir. 2017) ....................................................................................6, 9, 11, 12, 15
10
In re Warrant to Search a Target Computer at Premises Unknown,
11 958 F. Supp. 2d 753 (S.D. Tex. 2013) ........................................................................................9
12 Constitutional Provisions
13 Fourth Amendment .....................................................................................................................8, 10
14
Statutes
15
Stored Communications Act, 18 U.S.C. 2701, et seq.
16 18 U.S.C. 2701 .....................................................................................................................2, 5
18 U.S.C. 2701(a) ....................................................................................................................5
17 18 U.S.C. 2702 .....................................................................................................................5, 6
18 U.S.C. 2702(a) ....................................................................................................................5
18 18 U.S.C. 2703 .........................................................................................................................5
19 18 U.S.C. 2703(a) ....................................................................................................................5
18 U.S.C. 2703(g) ....................................................................................................................9
20 18 U.S.C. 2707 .........................................................................................................................6
21 Other Authorities
22 Brief of Amicus Curiae Jan Philipp Albrecht, Member of the European Parliament,
Microsoft I, No. 14-2985, Dkt. 148 (2d Cir. Dec. 19, 2014) ......................................................8
23
Council of Europe Convention on Cybercrime, Nov. 23, 2001, S. Treaty Doc. 108-
24
11, 2296 U.N.T.S. 167 ........................................................................................................14, 15
25 Art. 18 .................................................................................................................................15
Art. 19 .................................................................................................................................15
26 Art. 31 .................................................................................................................................15
Art. 32 ...........................................................................................................................14, 15
27
28
- iii - Case No. 3:16-mc-80263-RS
-
1 Letter from Mythili Raman, Acting Assistant Atty Gen., Criminal Div., U.S.
Dept of Justice, to Reena Raggi, Chair, Advisory Comm. on the Criminal
2 Rules (Sept. 18, 2013), https://perma.cc/MC3X-RPYH .............................................................8
3
Restatement of Foreign Relations 432 cmt. b ................................................................................8
4
U.S. Dept of Justice, Office of Legal Education, Executive Office for United
5 States Attorneys, Searching and Seizing Computers and Obtaining Electronic
Evidence in Criminal Investigations (2009), https://perma.cc/CK8H-R2RY ...........................10
6
7
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
- iv - Case No. 3:16-mc-80263-RS
-
1 INTERESTS OF AMICI CURIAE

2 Amici Microsoft Corporation, Amazon.com, Inc., Apple Inc., and Cisco Systems, Inc. are
3
leading technology companies that provide communications and cloud-based computing services
4
and software to more than one billion customers in more than 90 countries around the world.
5
Customers entrust Amici to securely store their private emails and the contents of other
6
7 communications in data centers. Certain Amici store some of those communications in data
8 centers in foreign countries. Microsoft, for example, stores European customers
9 communications in a European data center in order to reduce network delays and allow customers
10
faster access to their private correspondence. The U.S. Governmentas well as state and local
11
governmentsfrequently serves some Amici with warrants issued under the Stored
12
Communications Act (SCA). When the data sought is stored in a U.S. data center, Amici
13
regularly comply with such warrants. The Government, however, has attempted to use such
14
15 warrants to force some Amici to seize private emails stored in a foreign country, without the
16 consent of that country, and turn them over to the Government. But the SCA does not authorize
17 warrants that reach into other countries, and forcing Amici to execute such searches on the
18
Governments behalf would place Amici in the position of being compelled to risk violating
19
foreign data privacy laws.
20
When Microsoft was faced with such a warrant seeking private emails stored in Ireland, it
21
22 challenged the lawfulness of the warranta challenge supported by 28 technology and media
23 companies, 23 trade associations and advocacy groups, 35 of the nations leading computer
24 scientists, and the Republic of Ireland. The Second Circuit agreed with Microsoft that the SCA
25 does not authorize warrants seeking data stored on servers in foreign countries. That court
26
recognized, as do Amici, that the SCAa statute enacted when the internet was still in its
27
infancyneeds to be updated to both strengthen its protections of individual privacy in light of
28
-1- Case No. 3:16-mc-80263-RS
-
1 advances in technology and likewise ensure that those advances do not prevent law enforcement
2 from being able to do their jobs. But the court also correctly understood that any such
3
modernization must come from Congress, not the courts. Amici submit that this Court should
4
embrace the Second Circuits ruling and reject the magistrate judges contrary and flawed
5
approach.1
6
7 INTRODUCTION
8 This case addresses the reach of the Stored Communications Act, 18 U.S.C. 2701 et
9 seq., which Congress enacted as part of the Electronic Communications Privacy Act of 1986.
10
Technology has changed dramatically since the SCA became law. The Congress that drafted the
11
SCA could barely have imagined the notion of storing emails halfway across the globe. That is
12
why companies, commentators, and privacy advocates alike have long called for the SCA to be
13
updated in light of the realities of 21st century technology.
14
15 The question here, however, is the scope of the SCA as it now stands, not as Congress
16 might eventually revise it. As written today, the SCA does not contain a clear indication of an
17 extraterritorial application, and so, under the established presumption against extraterritoriality,
18
it has none. Morrison v. Natl Austl. Bank Ltd., 561 U.S. 247, 248 (2010).2 That presumption
19
ensures that courts do not apply statutes in ways that potentially risk unintended clashes between
20
our laws and those of other nations, EEOC v. Arabian Am. Oil. Co., 499 U.S. 244, 248 (1991).
21
22 Yet, notwithstanding its agreement that the SCA does not extend outside the United States, the
23 Government here seeks to use SCA warrants to do just that: reach into other countries to seize
24 private email content stored there. The magistrate judge, apparently believing that granting the
25
26 1
Amici are filing this brief with the consent of both parties. More information about individual
27 Amici is included in the motion for leave to file this brief.
2
The parties here agree that the SCA do[es] not contemplate or permit extraterritorial
28 application. Magistrate Judges Opinion (Op.) 6.
-2- Case No. 3:16-mc-80263-RS
-
1 Government such power is sound policy, embraced the Governments flawed argument that a
2 warrant requiring a provider to seize and copy communications stored overseas at the behest of
3
the Government is a domestic act so long as the disclosure of the communications to law
4
enforcement agents happens in the United States. By focusing solely on where the emails are
5
retrieved remotely and then disclosed, the magistrate judge ignored the serious incursion on
6
7 foreign sovereignty that occurs when a service provider is compelled by the Government to
8 access, copy, and import into the United States private emails stored on computers in foreign data
9 centers.
10
The Second Circuit properly rejected the argument that the statutory focus of the SCA is
11
disclosure, rather than protecting the privacy of communications in electronic storage. In Matter
12
of Warrant to Search a Certain E-Mail Account Controlled & Maintained by Microsoft Corp.
13
(Microsoft I), 829 F.3d 197 (2d Cir. 2016), the court held that the Government cannot use an SCA
14
15 warrant to retrieve email content stored in Ireland. As the court recognized, the SCAs text,
16 framework, and history demonstrate that the relevant provisions focus on protecting the
17 privacy of the content of a users stored electronic communications, so the statute is applied
18
wherever those electronic communications are stored. Id. at 217. That means that the statutes
19
provisions apply to only domestically stored communications. Moreover, the Second Circuit
20
properly rejected the fiction that a search and seizure of foreign-stored communications is a
21
22 domestic act just because the search and seizure can be effected from inside the United States. Id.
23 at 220. Rather, when a warrant seeks email content from a foreign data center, the invasion of
24 privacy occurs overseasin the place where the customers private communications are stored,
25 and where they are accessed, copied, and imported into the United States for the benefit of law
26
enforcement.
27
Worse still, the magistrate judges ruling invites foreign nations to reciprocate by invading
28
-3- Case No. 3:16-mc-80263-RS
-
1 Americans privacyby demanding, for example, that foreign offices of U.S. technology
2 companies turn over U.S. citizens private communications stored on U.S. soil. It also places
3
technology companies that store customer data abroad in the untenable position of being
4
compelled to risk violating foreign data privacy laws to comply with warrants issued by U.S.
5
courts. Only Congress can craft a comprehensive framework that takes account of both law
6
7 enforcements legitimate interests and foreign countries equally legitimate concerns. But
8 Congress has never addressed these fundamental questions of sovereigntynot in 1986, when it
9 enacted the SCA, nor at any point since, including in the 2006 Cybercrime Convention, which
10
expressly reserves such questions. Congress should promptly update the SCA to reflect todays
11
technological landscape. Until it does, however, courts may not extend the SCA to reach data
12
stored in another sovereign country.
13
ARGUMENT
14
15 I. The Stored Communications Act Does Not Authorize Warrants For Seizure Of
Private Emails Stored In A Foreign Country.
16
A. The conduct relevant to the SCAs focus is intrusion on the privacy of stored
17 communications.
18
It is a basic premise of our legal system, RJR Nabisco, Inc. v. European Cmty., 136
19
S. Ct. 2090, 2100 (2016), that [w]hen a statute gives no clear indication of an extraterritorial
20
application, it has none. Morrison, 561 U.S. at 248. The Government agrees that the SCA gives
21
22 no such indication, and so it does not extend extraterritorially. Simply put, nothing in the SCA
23 purports to regulate or protect in any way private communications stored overseas.
24 The question here, then, is whether forcing a provider to execute a warrant in another
25 country constitutes an impermissible extraterritorial application of the SCA. The answer to that
26
question turns on identifying the conduct relevant to the statutes focus or the objects of the
27
statutes solicitude. RJR Nabisco, 136 S. Ct. at 2101; Morrison, 561 U.S. at 267. At this second
28
-4- Case No. 3:16-mc-80263-RS
-
1 step of the extraterritoriality analysis, courts examine whether that conduct occurs abroad. As the
2 Second Circuit correctly held, the relevant location is where emails are stored, because the focus
3
of the SCAs warrant provisions is on protecting users privacy interests in stored
4
communications. Microsoft I, 829 F.3d at 220.
5
The magistrate judge erred in this case by adopting the view of the dissenters from denial
6
7 of rehearing in Microsoft I that the only relevant conduct is the disclosure of information from
8 [the service providers] headquarters in the United States. Op. 7.3 This focus on the place of
9 disclosure, as opposed to the location of the electronic storage from which a provider would be
10
ordered to access and retrieve customers private communications, is, given the current structure
11
of the law, wrong for several reasons.
12
First, the SCAs plain text makes clear that its focus is protecting against the accessing
13
and removal of private communication[s] in electronic storage. 18 U.S.C. 2702(a),
14
15 2703(a). The SCA begins with 2701, which makes it a violation to access[] without
16 authorization a service providers servers and thereby obtain[] an electronic communication

17 while it is in electronic storage, irrespective of whether the communication is ever disclosed. Id.
18
2701(a). Section 2702 then prohibits providers from voluntarily disclosing private
19
communication[s] in electronic storage. And 2703 carves out certain exceptions from
20
2702 for when communication[s] in electronic storage can be revealed to law enforcement.
21
22 The thread that ties the statute together is the protection of private stored electronic
23
24 3
The Government argues (Br. 3-4) that three other magistrate judges have rejected the Second
Circuits analysis. All three decisions are subject to pending motions to vacate. Moreover, the
25 M.D. Fla. and E.D. Wis. decisions were issued ex parte and constitute improper advisory
opinions that address the extraterritoriality question even though neither case involved data stored
26 outside the United States. See In re [redacted]@yahoo.com, stored at premises owned,
maintained, controlled, or operated by Yahoo, Inc., No. 6:17-mj-1238 (M.D. Fla. Mar. 21, 2017)
27 (attached to Governments brief as exhibit B); In re Info. associated with one Yahoo email
address that is stored at premises controlled by Yahoo, Nos. 17-M-1234 and 17-M-1235, 2017
28 WL 706307 (E.D. Wis. Feb. 21, 2017).
-5- Case No. 3:16-mc-80263-RS
-
1 communications.
2 Thus, as the Ninth Circuit has recognized, the SCA reflects Congresss judgment that
3
users have a legitimate interest in the confidentiality of communications in electronic storage at a
4
communications facility. Just as trespass protects those who rent space from a commercial
5
storage facility to hold sensitive documents, the [SCA] protects users whose electronic
6
7 communications are in electronic storage with an ISP. Theofel v. Farey-Jones, 359 F.3d 1066,
8 1072-73 (9th Cir. 2004) (citation omitted); see also Konop v. Hawaiian Airlines, Inc., 302 F.3d
9 868, 874 (9th Cir. 2002) ([T]he [SCA] was designed to address[ ] access to stored wire and
10
electronic communications and transactional records. (emphasis added)). Accordingly, [t]he
11
better approach, which is more in keeping with the Morrison analysis and the SCAs emphasis
12
on data storage, is one that looks to the step taken before disclosureaccessin determining
13
privacys territorial locus. Matter of Warrant to Search a Certain E-Mail Account Controlled &
14
15 Maintained by Microsoft Corp. (Microsoft II), 855 F.3d 53, 60 (2d Cir. 2017) (Carney, J.,
16 concurring in the denial of rehearing en banc).

17 Second, if the relevant conduct were disclosure, as the magistrate judge here held, the
18
SCA provision that prohibits providers from voluntarily disclosing customers communications
19
( 2702) would offer no protection against a U.S. service provider who copied a U.S. customers
20
U.S.-stored emails and willfully disclosed them to a foreign tabloid newspaper. Under the
21
22 magistrate judges view, so long as the disclosure occurred overseas, the customer would have no
23 recourse under 2702 and 2707 (the SCAs private right of action). That cannot be right. The
24 one thing Congress certainly sought to protect when it enacted the SCA in 1986 was the privacy
25 of U.S. customers electronic communications stored within the United States. The statutes
26
focus is on the protected stored communications, not on disclosure, because [t]he primary
27
obligations created by the SCA protect the electronic communications. Microsoft I, 829 F.3d at
28
-6- Case No. 3:16-mc-80263-RS
-
1 218. Indeed, [d]isclosure is permitted only as an exception to those primary obligations[.] Id.
2 Third, the Government is wrong to suggest (Br. 22) that a customers protected interest in
3
stored emails is not infringed where a provider retrieves the email content from storage and
4
copies it at the Governments behest and without the customers permission. Such access violates
5
the customers reasonable expectation of privacy in a way that the provider moving the
6
7 customers data in order to ensure fast, uninterrupted service does not. See United States v.
8 Warshak, 631 F.3d 266, 286-87 (6th Cir. 2010) (holding that a service providers right to access
9 email for business purposes did not diminish the reasonableness of [the customers] trust in the
10
privacy of his emails). It also is in tension with foreign data protection and privacy laws, which
11
protect the customers privacy interests in email stored abroad. Thus, as the Second Circuit held,
12
the infringement is not limited to the disclosure, but rather occurs when the service provider is
13
required to collect [private email content] from servers located overseas and import [it] into
14
15 the United States. Microsoft I, 829 F.3d at 221.
16 Fourth, there is no merit to the Governments contention (Br. 10) that because the statute
17 confers in personam jurisdiction over service providers, the place where a provider can retrieve
18
and disclose emails is the relevant location. Jurisdiction has nothing to do with what conduct is
19
relevant to assessing extraterritoriality under Morrison. There is no question that this Court has
20
jurisdiction over many technology companies in the United States, but the question is what the
21
22 SCA authorizes the Government and the court to do with providers under its jurisdictioncompel
23 them to execute search warrants for private communications stored overseas, or only
24 domestically.
25 B. Executing a warrant seeking email content from a data center in a foreign
26 country would effect a law enforcement search and seizure on foreign soil.
27 As explained further below, the international outrage the Governments actions have
28 provoked in similar cases only confirms that the relevant conduct for extraterritoriality purposes
-7- Case No. 3:16-mc-80263-RS
-
1 is the compelled seizure and importation of emails stored abroad. The Governments assertions
2 that stored email content lacks any location (Br. 8), does not withstand scrutiny. Of course, data
3
is stored on physical servers, and other sovereigns quite reasonably view orders directing the
4
copying and importing into the United States of data from servers located within their territory as
5
U.S. law enforcement activity on their shores. See, e.g., Brief of Amicus Curiae Jan Philipp
6
7 Albrecht, Member of the European Parliament, Microsoft I, No. 14 2985, Dkt. 148 (2d Cir. Dec.
8 19, 2014). Indeed, they view it as an affront to their sovereignty in much the same way that
9 physically conducting law enforcement activity on foreign soil would violate their sovereignty
10
and territorial integrity. See Restatement of Foreign Relations 432 cmt. b; see also Morrison,
11
561 U.S. at 269 (The probability of incompatibility with the applicable laws of other countries
12
is a strong signal that Congress did not intend such a foreign application). With good reason:
13
Where a service provider is compelled to access, copy, and import the data into the United States,
14
15 it is in essence effectuating a search and seizure on foreign soil on the Governments behalf.4
16 Law enforcement agencies may not execute search warrants for property in foreign
17 countries at all: Any warrant issued by a judicial officer in this country would be a dead letter
18
outside the United States. United States v. Verdugo-Urquidez, 494 U.S. 259, 274 (1990).5 Thus,
19
a warrant issued under the SCA plainly would not authorize FBI officials to enter a foreign data
20
21
4
22 This is not to suggest that the extraterritoriality inquiry is coextensive with the Fourth
Amendment. The question for purposes of the extraterritoriality analysis is not whether the
23 invasion of privacy has been justified by issuance of a warrant upon a finding of probable cause.
The question is where the relevant conducthere, the interference with the privacy of stored
24 communicationsoccurs. A search or seizure undoubtedly interferes with those
communications privacy, regardless of whether that interference is justified under the Fourth
25 Amendment.
5
For that reason, the U.S. Department of Justice has recognized that a U.S. search warrant
26 cannot authorize law enforcement agents to remotely access electronic storage media located in
another country because to do so would be an extraterritorial application of U.S. law. See Letter
27 from Mythili Raman, Acting Assistant Atty Gen., Criminal Div., U.S. Dept of Justice, to Reena
Raggi, Chair, Advisory Comm. on the Criminal Rules 1, 4-5 (Sept. 18, 2013),
28 https://perma.cc/MC3X-RPYH.
-8- Case No. 3:16-mc-80263-RS
-
1 center themselves and seize customers emails. The flaw with the magistrate judges ruling is
2 that it treats the SCA as a tool for forcing technology companies to do on the Governments
3
behalf that which warrants do notand cannotempower Government agents to do themselves.
4
Contrary to the Governments suggestion that a warrant issued under the SCA merely
5
functions like a subpoena for business records (Br. 6, 16), the SCA describes the companys role
6
7 in complying with the Governments demand as execut[ing the] search warrant. 2703(g). In
8 so doing, the service providercompelled to locate, seize, and copy the private emails of its
9 customerseffects a law enforcement search and seizure. See United States v. Jacobsen, 466
10
U.S. 109, 113 (1984) (explaining that search or seizure conducted by a private individual is
11
treated as governmental action where that individual is acting as an agent of the government).
12
And when the customers private information is stored outside the United States, executing the
13
warrant requires the technology company to conduct, at the Governments behest, a search and
14
15 seizure in foreign territory. See In re Warrant to Search a Target Computer at Premises
16 Unknown, 958 F. Supp. 2d 753, 755 (S.D. Tex. 2013) (rejecting argument that computer software
17 that compiles data from a target computer and transmits it to agents in a particular district effects
18
a search only in that district). Similarly, the intrusion upon customer privacy that the warrant
19
authorizes occurs where the provider, acting under orders from the Government, gathers up and
20
copies their communications from electronic storage. See Warshak, 631 F.3d at 288. That is the
21
22 point where the warrant interferes with the customers right to exclude and limit access to her
23 emails. See Loretto v. Teleprompter Manhattan CATV Corp., 458 U.S. 419 (1982).
24 The Governments (and the Microsoft dissenters) attempt to avoid this conclusion by
25 characterizing emails as ephemeral, intangible property is unpersuasive. See, e.g., Microsoft II,
26
855 F.3d at 61 (Jacobs, J., dissenting from denial of rehearing en banc). As the Second Circuit
27
correctly explained, data in fact has a physical location in a data center. Microsoft I, 829 F.3d
28
-9- Case No. 3:16-mc-80263-RS
-
1 at 220 n.28. That is common sense, and demonstrably true. And of course the Supreme Court
2 has recognized that intangible property can be seized even absent interference with any right of
3
access to that property. See Katz v. United States, 389 U.S. 347, 354 (1967) (listening to and
4
recording telephone booth conversations constituted both a search and a seizure); Berger v. New
5
York, 388 U.S. 41, 59 (1967) (electronic audio recording device seized communications,
6
7 conversations, or discussions when they were recorded). And the Ninth Circuit has held that
8 copying electronic data effects a seizure of that data. United States v. Comprehensive Drug
9 Testing, Inc., 621 F.3d 1162, 1169 (9th Cir. 2010) (en banc). Three other circuits agree, and none
10
has held otherwise.6 Indeed, the Government has acknowledged that, where law enforcement
11
agents themselves execute a warrant for private electronic data, a search occurs even before they
12
review that data.7 The result is no different when a service provider is compelled to access and
13
copy data on a server located abroad on the Governments behalf. The act is a search and seizure
14
15 on foreign soil, irrespective of where the retrieval is initiated or where the disclosure later occurs.
16 It is no answer to say, as the magistrate judge did (Op. 7-8), that the only place to access
17 the data is from a terminal in the United States. Remote access does not change where the data is
18
located, copied, and imported into the United Statesthe acts that intrude on foreign sovereignty.
19
To analogize to a Fourth Amendment question, when an agent points a thermal imaging sensor at
20
a house from the passenger seat of [his] vehicle across the street, the search is in the house, not
21
22 in the car or the exterior wall. Kyllo v. United States, 533 U.S. 27, 30, 35 & n.2 (2001).
23
6
24 See Microsoft I, 829 F.3d at 220; Warshak, 631 F.3d at 284 (emails were seized when provider
acceded to the Governments request that the provider make copies); United States v. Bach, 310
25 F.3d 1063, 1065, 1067 (8th Cir. 2002) (search and seizure occurred when technicians copied
contents of email accounts from Yahoo! servers in order to turn data over to law enforcement
26 authorities).
7
U.S. Dept of Justice, Office of Legal Education, Executive Office for United States Attorneys,
27 Searching and Seizing Computers and Obtaining Electronic Evidence in Criminal Investigations
113 (2009), https://perma.cc/CK8H-R2RY (Where the service provider lacks the ability or will
28 to comply with [SCA warrant] agents must search the providers computers themselves.).
- 10 - Case No. 3:16-mc-80263-RS
-
1 The same intrusion on privacy occurs when the Government forces a service provider to
2 access its overseas servers, seize and copy private customer email content, and import it into the
3
United States to be turned over to a law enforcement agencywhether or not the service provider
4
can accomplish this task from a terminal based in the United States. [C]alling such an
5
application domestic because the command to retrieve the data is issued from within the
6
7 United States or the data is turned over within the United States runs roughshod over the
8 concerns that undergird the Supreme Courts strong presumption against extraterritoriality.
9 Microsoft II, 855 F.3d at 58 (Carney, J., concurring); see Morrison, 561 U.S. at 266 (the mere
10
presence of some domestic activity does not render a particular application of the statute
11
domestic).
12
The magistrate judge also suggested that the nature of the intrusion might depend on the
13
specifics of the email providers network architecture. See Op. 8. The question whether the SCA
14
15 can be used to reach into foreign countries, however, is a question of statutory interpretation that
16 must be decided independent of any consideration of the data architecture of a particular provider.
17 In Morrison, the Court overruled decades of Court of Appeals cases that engaged in case-by-case
18
comity balancing, holding instead that the presumption against applying U.S. law in foreign
19
countries applies regardless of whether there is a risk of conflict between the American statute
20
and a foreign law in the particular case. 561 U.S. at 255. Under Morrison, the relevant question
21
22 is whether Congress actually intended the statute to apply in foreign countries, not whether
23 Congress would have wanted the statute to apply abroad in some or all scenarios had it thought
24 of them. Id. Because there is no such congressional intent here, the statute simply does not apply
25 to data stored in other countries.
26
Although the magistrate judges practical concerns about Googles distributed cloud
27
storage highlight the need for legislative action, they are not a reason to disregard Morrisons
28
- 11 - Case No. 3:16-mc-80263-RS
-
1 requirement of clear intent before reading the SCA to extend into other countries. If the concern
2 is simply that a provider might employ a process of distributing information [that] is automatic,
3
via an algorithm, which means that the datas location can change while a warrant remains
4
outstanding, Op. 3, 9, then it might be that the data cannot be said to be stored overseas for the
5
entire period the warrant was outstanding, in which case the question of extraterritorial
6
7 application of the SCA would not even be raised. Amici take no position as to where Googles
8 data is located. When data is in fact stored overseas, the SCA does not apply.
9 II. Only Congress Can Decide Whether And How To Update The SCA.
10
The Microsoft dissenters viewadopted by the magistrate judge herethat only the
11
place of disclosure is relevant, was largely animated by their concerns for the practical needs of
12
law enforcement in todays era of global communications. See, e.g., Microsoft II, 855 F.3d at 63-
13
65 (Cabranes, J., dissenting from denial of rehearing en banc). But the Supreme Court
14
15 established the presumption against extraterritoriality precisely to defer to Congresss sole
16 prerogative to decide when it becomes necessary or proper for its statutes to be extended
17 overseas. Courts, unlike Congress, are inherently limited by the information provided by
18
litigants in a particular case, Microsoft I, 829 F.3d at 232 (Lynch, J., concurring), and are
19
therefore ill-equipped to address countervailing concerns of foreign sovereignty and international
20
comity. The presumption against extraterritoriality therefore cautions courts to assume that
21
22 legislators take account of the legitimate sovereign interests of other nations when they write
23 American laws. It thereby helps the potentially conflicting laws of different nations work
24 together in harmonya harmony particularly needed in todays highly interdependent

25 commercial world. F. Hoffmann-La Roche Ltd. v. Empagran S.A., 542 U.S. 155, 164-65 (2004).
26
How those foreign relations concerns should be balanced against the needs of law enforcement to
27
obtain data stored in other countries is a policy question that only Congress can address.
28
- 12 - Case No. 3:16-mc-80263-RS
-
1 Amici fully agree with Judge Lynch, concurring in Microsoft I, that the statute should be
2 revised, with a view to maintaining and strengthening [its] privacy protections, rationalizing and
3
modernizing the provisions permitting law enforcement access to stored electronic
4
communications and other data where compelling interests warrant it, and clarifying the
5
international reach of those provisions after carefully balancing the needs of law enforcement
6
7 against the interests of other sovereign nations. 829 F.3d at 233. Congress has any number of
8 possible revisions it might want to consider. In the meantime, settled doctrine makes this Courts
9 job simple: reading the SCA to apply only to electronic communications stored here, just as other
10
countries laws regulate electronic communications stored therenot to try to discern whether
11
Congress would have wanted the statute to apply abroad had it foreseen that global electronic
12
communications would present these challenges. Morrison, 561 U.S. at 255 (emphasis added).
13
By permitting U.S. law enforcement agencies to force service providers to retrieve and
14
15 turn over data stored in foreign countries, without the consent of the foreign country, the
16 magistrate judges decision raises the very concerns identified in Morrison. So bold a projection
17 of U.S. law enforcement power into foreign countries would show disdain for those countries
18
sovereignty and threaten to disrupt the harmony existing between the United States and other
19
nations. It also disregards the carefully calibrated, comity-protective framework established
20
through mutual legal assistance treaties and other bilateral agreements. And it might put service
21
22 providers in the untenable position of being forced to violate foreign privacy law in order to
23 comply with warrants issued by U.S. courts.
24 Authorizing such wide-ranging international warrants would also invite foreign nations to
25 reciprocate, demanding unilateral access to communications stored in the United States without
26
regard for U.S. law. The United States would have little ground to object if Russia or China or
27
Saudi Arabia instructed a service provider operating within its territory to turn over private
28
- 13 - Case No. 3:16-mc-80263-RS
-
1 electronic communications stored within the United States, without the permission of the United
2 States and without any warrant issued by a domestic court. After all, under the magistrate judges
3
reasoning, that would be a purely domestic act by that foreign nation. These potentially
4
disruptive outcomes underscore why only Congress has the authority and competence to balance
5
law enforcement needs against the United States relations with foreign nations, the privacy of its
6
7 citizens, and the competitiveness of its technology industry.
8 The Government nevertheless contends (Br. 24-28) that Congress already did strike a new
9 balance when the United States ratified the Council of Europes Convention on Cybercrime, Nov.
10
23, 2001, S. Treaty Doc. 108-11, 2296 U.N.T.S. 167. That argument is unavailing for two
11
reasons. First, the fact that the Senate ratified the Convention in 2006 on the understanding that
12
unspecified domestic laws fulfilled U.S. obligations under the Convention says nothing about the
13
meaning of the SCA. The Senate cannot unicamerally amend the law.
14
15 Second, the Convention expressly declines to compel service providers to execute cross-
16 border searches and seizures of private email content, such as the search compelled by the
17 warrant here. The drafters of the Convention discussed at length the question of transborder
18
accessthat is, the issue of when a Party is permitted to unilaterally access computer data
19
stored in another Party without seeking mutual assistance. Explanatory Report 293.8 The
20
drafters ultimately decided to only set forth in Article 32 two situations where such access
21
22 was permitted, and agreed not to regulate other situations. Id. 293-94. Article 32 authorizes
23 transborder access only where the data being accessed is publicly available, and second, whether
24 the Party has accessed or received data located outside of its territory, and it has obtained the
25 lawful and voluntary consent of the person authorized to disclose the data. Id. 294 (emphasis
26
8
27 The Convention and related ratification materials are attached to the Governments brief as
Exhibit C.
28
- 14 - Case No. 3:16-mc-80263-RS
-
1 added); see also Cybercrime Convention Art. 32.9 Otherwise, the Convention requires bilateral
2 action. In short, under the Convention, parties must have the capability to search and seize data
3
located within their own borders (Art. 19), and they must use the MLAT process to assist one
4
another where data is located extraterritorially (Art. 31). Explanatory Report 292 (Each Party
5
must have the ability to, for the benefit of another Party, search or similarly access, seize or
6
7 similarly secure, and disclose data stored by means of a computer system location within its
8 territory just as under Article 19 (Search and seizure of stored computer data) it must have the
9 ability to do so for domestic purposes.); see also id. 193 (The computer system or part of it
10
[searched or seized under Article 19] must also be in its territory.). Thus, Congress has not,
11
to date, authorized state and federal law enforcement to unilaterally compel a service provider to
12
import private emails stored overseas.
13
By design[ing the statute] afresh, Congress could address todays data realities while
14
15 remaining cognizant of the mobility of data and the varying privacy regimes of concerned
16 sovereigns, as well as the potentially conflicting obligations placed on global service providers.
17 Microsoft II, 855 F.3d at 60 (Carney, J., concurring). Until Congress does so, however,
18
compelling service providers to search and seize communications stored on servers located in
19
foreign countries remains an impermissible extraterritorial application of U.S. law.
20
CONCLUSION
21
22 For the foregoing reasons, the magistrate judges order should be vacated.
23
24 9
Moreover, Article 18, on which the Government relies, applies only to the production of
subscriber information by service providers. Art. 18.1.b (requiring a service provider offering
25 its services in the territory of the Party to submit subscriber information); Art. 18.3 (defining
subscriber information as data relating to subscribers other than content data
26 (emphasis added)). And the Article applicable to stored content data includes express territorial
limits. See Art. 19(1)-(2) (governing search and seizure of stored computer data that is in [the
27 Partys] territory); Explanatory Report 195 ([A]rticle 19 does not address transborder search
and seizure, whereby States could search and seize data in the territory of other States without
28 having to go through the usual channels of mutual legal assistance.).
- 15 - Case No. 3:16-mc-80263-RS
-
1 Dated: June 6, 2017 Respectfully submitted,
3 By: /s/ Robert M. Loeb

Robert M. Loeb (pro hac vice)
4
Counsel for Amici Curiae Microsoft
5 Corporation, Apple Inc., and Cisco
Systems, Inc.
6
COVINGTON & BURLING LLP
7
By: /s/ Devon Mobley-Ritter
8 Devon Mobley-Ritter
9 Counsel for Amici Curiae Microsoft
Corporation and Amazon.com, Inc.
10
11 The filer of this document attests that concurrence in the filing has been obtained from the
12
other signatories, Robert M. Loeb of Orrick, Herrington, & Sutcliffe LLP and Devon Mobley-
13
Ritter of Covington & Burling LLP.
14
15
16 By: /s/ Brian P. Goldman

Brian P. Goldman
Attorney for Amici Curiae Microsoft Corp.,
18 Cisco Systems, Inc., and Apple Inc.
19
20
21
22
23
24
25
26
27
28
- 16 - Case No. 3:16-mc-80263-RS

Amicus BR ND Cal As Filed

Загружено:

Сведения о документе

Оригинальное название

Авторское право

Доступные форматы

Поделиться этим документом

Поделиться или встроить документ

Параметры публикации

Этот документ был вам полезен?

Это неприемлемый материал?

Авторское право:

Доступные форматы

Amicus BR ND Cal As Filed

Загружено:

Авторское право:

Доступные форматы

-

1 ORRICK, HERRINGTON & SUTCLIFFE LLP

3 INTERESTS OF AMICI CURIAE .................................................................................................. 1

6 EEOC v. Arabian Am. Oil. Co.,

17 Kyllo v. United States,

22 RJR Nabisco, Inc. v. European Cmty.,

27 United States v. Comprehensive Drug Testing, Inc.,

1 United States v. Jacobsen,

6 Matter of Warrant to Search a Certain E-Mail Account Controlled & Maintained

1 INTERESTS OF AMICI CURIAE

8 centers in foreign countries. Microsoft, for example, stores European customers

23 purports to regulate or protect in any way private communications stored overseas.

16 authorization a service providers servers and thereby obtain[] an electronic communication

16 concurring in the denial of rehearing en banc).

24 together in harmonya harmony particularly needed in todays highly interdependent

23 comply with warrants issued by U.S. courts.

1 Dated: June 6, 2017 Respectfully submitted,

2 ORRICK, HERRINGTON & SUTCLIFFE LLP

3 By: /s/ Robert M. Loeb

16 By: /s/ Brian P. Goldman

Вам также может понравиться