A potentially major blow for privacy advocates occurred on Friday when a US magistrate ruled against Google and ordered it to cooperate with FBI search warrants demanding access to user emails that are stored on servers outside of the United States. The case is certain to spark a fight, because an appeals court ruled in favour of Microsoft in a similar case recently.
According to Reuters:
US Magistrate Judge Thomas Rueter in Philadelphia ruled on Friday that transferring emails from a foreign server so FBI agents could review them locally as part of a domestic fraud probe did not qualify as a seizure.
The judge said this was because there was "no meaningful interference" with the account holder's "possessory interest" in the data sought.
"Though the retrieval of the electronic data by Google from its multiple data centres abroad has the potential for an invasion of privacy, the actual infringement of privacy occurs at the time of disclosure in the United States," Rueter wrote.
Google was betting on a January 24 ruling by the Second Circuit Court of Appeals that it would not rehear the Justice Department's arguments for why it needed access to user data from Microsoft's servers located in Ireland. Many believed that decision might create some legal guidance for cases like this one in which the laws on the books are considered outdated and insufficient.
The legal language of "possessory interest", for example, is often used to define temporary ownership over real estate. Attempting to determine ownership over abstract property in the form of data isn't easy with the current legal system.
In the ruling against Google, Judge Rueter is arguing that even though "the retrieval of the electronic data by Google from its multiple data centres abroad has the potential for an invasion of privacy, the actual infringement of privacy occurs at the time of disclosure in the United States." It's unclear if that decision means that evidence from a foreign server would be a violation of privacy if disclosed in a US court of law.
Clarity is what tech companies and privacy advocates have been pushing for over the years. Both the Microsoft and Google cases relied on warrants issued under the Stored Communications Act from 1986. A lot has changed about the flow of information since then and in a globalized world, tech giants have to work with competing international privacy laws. If Judge Rueter's opinion stands, it could put the US in violation of international treaties.
In the Microsoft case, Judge Susan L. Carney even wrote that this is an issue that needs to be taken care of by Congress, writing:
"We recognise at the same time that in many ways the [Stored Communications Act] has been left behind by technology. It is overdue for a congressional revision that would continue to protect privacy but would more effectively balance concerns of international comity with law enforcement needs and service provider obligations in the global context in which this case arose."
Google argued that because it stores pieces of emails on different servers in order to streamline its network performance, it might not even know where the information that's being requested is actually stored. The search giant released a statement today saying, "The magistrate in this case departed from precedent, and we plan to appeal the decision. We will continue to push back on overbroad warrants."
These types of cases will either have to make their way to the Supreme Court or Congress will have to act. With the chaotic state of the US government at the moment, it's impossible to say how either of those options might work out.