On Tuesday morning, the nine justices of the Supreme Court put a legal theory from Microsoft to the test—that the company should not be forced to hand over data held abroad to the American government, even when served with a valid court order.

During oral arguments, the Department of Justice, by contrast, urged the court to compel Microsoft to hand over the data. The DOJ said that allowing Microsoft to refuse the order is tantamount to encouraging companies to keep particularly sensitive data overseas as a way to evade authorities.

Two liberal justices, Sonia Sotomayor and Ruth Bader Ginsburg, who have recently ruled on the side of privacy in the past, questioned whether the court should be stepping in. They said that the onus should be on Congress to regulate appropriately.

“Wouldn’t it be wiser to say, ‘Let’s leave things as they are. If Congress wants to regulate this “brave new world,” let them do it’?” Justice Ginsburg said.

The case, which has drawn attention from both law enforcement and major Silicon Valley firms, involves an Outlook.com email account somehow connected to a drug trafficking investigation. As part of its standard business practice, Microsoft typically holds user’s data geographically closer to where the account was created—in this case, Ireland.

More than four years ago, investigators obtained a warrant under the 1986 Stored Communications Act and served it on Microsoft, which resisted the order. On appeal, the 2nd Circuit Court of Appeals ruled in July 2016 that the law did not apply outside the United States. The DOJ then appealed the case to the Supreme Court.

It is not publicly known what the government hopes would be revealed by acquiring the email, which was sought as part of a drug investigation. The authorities have also not revealed whether the email account owner is American or if that person has been charged with a crime.

Cloud cover

Right out of the gate, Michael Dreeben—a veteran of the Office of the Solicitor General who has appeared dozens of times before the Supreme Court—was questioned by Sotomayor. She noted that this case was unusual as there was not a “circuit split,” or a disagreement between lower appellate courts.

Dreeben said that the 2nd Circuit’s ruling had “caused grave and immediate harm to the government’s ability to enforce federal criminal law,” as there was a live issue that needed to be resolved. Plus, he urged the justices, the interests of law enforcement could not wait for Congress to pass a piece of legislation that likely would resolve the issue (that bill was only introduced in the Senate earlier this month).

When Microsoft’s turn came, its lawyer, E. Joshua Rosenkranz, underscored how a 1980s-era law that never contemplated data being stored abroad was now clashing with modern technological realities.

“This is a very new phenomenon, this whole notion of cloud storage in another country,” he said. “We didn’t start doing it until 2010. So the fact that we analyzed what our legal obligations were and realized, ‘Wait a minute, this is actually an extraterritorial act that is unauthorized by the US Government.’ The fact that we were sober-minded about it shouldn’t be held against us.”

In other words, he argued, American law can’t possibly have the power to reach into another country and access material there.

But then, Justice Anthony Kennedy—who is most often dubbed the court’s swing vote between its conservative and liberal wings—explored a notion that the case can’t possibly solely turn on the physical location of the data.

“Why should we have a binary choice between a focus on the location of the data and the location of the disclosure?” he said. “Aren’t there some other factors, where the owner of the email lives or where the service provider has its headquarters?”

Viewed through that lens, assuming that the account owner is believed to be American—and Microsoft is obviously an American company—that should favor disclosure.

The government raised the argument that if Microsoft’s point of view wins the day, then it would open the door for it to keep users’ data abroad, where the American government can’t get at it.

But Rosenkranz said that while this is a theoretical possibility, it is practically unlikely, as people value low latency—the time it takes to move data from one place to another. Plus, as he noted: “If people want to break the law and put their emails outside the reach of the US Government, they simply wouldn’t use Microsoft.”

But then Justice Samuel Alito confirmed that the record does not show the nationality of the email account’s owner—it is unknown whether she or he is Irish, American, or something else.

“Well, if this person is not Irish, and Ireland played no part in your decision to store the information there, and there’s nothing that Ireland could do about it if you chose tomorrow to move it someplace else, it is a little difficult for me to see what Ireland’s interest is in this,” Justice Alito continued.

“Your Honor, Ireland’s interests are the same interest of any sovereign who protects information stored where—within their domain,” Rosenkranz responded. “We protect information stored within the United States, and we don’t actually care whose information it is because we have laws that guard the information for everyone.”

A decision is expected within the coming months.

https://arstechnica.com/?p=1266679