By coincidence, as conspirators halfway around the world carried out this coup attempt, the United States Court of Appeals for the Second Circuit in New York ruled on a court case with direct impact on the future of Internet communications more broadly. The case, which concerned a December 2013 warrant directing Microsoft to turn over email data related to a user assigned to their Ireland data center, is the latest chapter in a broader debate on how the U.S., and other countries around the globe, will treat information that traverses and lives in an increasingly borderless cyber world.
Whose law applies?
The case illustrates a dilemma for both the U.S. government and data service providers. Today, evidence or information relevant to a law enforcement investigation is often in electronic form and, because of breakthroughs in cloud computing, this data could be stored in any number of locations around the globe. In such cases, the question is: Whose law applies when U.S. law enforcement requires access to digital evidence stored outside the United States? The U.S. government argued that Microsoft did provide the non-content user information that was stored in the U.S., it argued that the U.S. government would need to utilize the Mutual Legal Assistance Treaty process instead of an extraterritorial warrant in order to access information stored outside of the U.S.
Despite the Court's ruling in Microsoft's favor, the government's argument in this case remains a threat to a trusted and open Internet. A successful appeal to the Supreme Court, or the adoption of legislation codifying this argument, would accelerate a breakdown of trust between nations and increase the risk of internet "balkanization."
If the courts or Congress ultimately adopt this argument, U.S. companies will be in a difficult position, potentially forcing them to decide between their obligations under U.S. law and the laws of the foreign jurisdictions in which they operate. In many cases, companies may be faced with the impossible choice of disobeying U.S. law by failing to turn over data or disobeying a foreign country's law by turning over legally-protected customer data to the U.S. government. More distressingly, the adoption of extraterritorial data disclosure requirements in the U.S. are likely to be used to justify similar efforts in other countries. How can the U.S. reasonably object to a Chinese-issued warrant ordering a U.S. company to turn over the email of a U.S. citizen if our own law allows for the equivalent?
Taken further, this logic creates a strong incentive for countries to enact data localization requirements that force companies to store the data of, for example, Brazilian citizens in Brazil in order to thwart the efforts of foreign governments to gain access to data on its citizens. Such requirements may be designed to protect the privacy of a country's citizens, but would also have the effect of fracturing trust, diminishing the value of the Internet, and interfering with our core beliefs of freedom of speech and pursuit of free enterprise.
Economics require we act now
So where does this leave us? The government is considering an appeal while one member of the Appeals Court pled for Congress to resolve the disconnect between the modern Internet and the outdated laws governing it. Congress has considered a variety of bills that would address at least some of these issues, including the "International Communications Privacy Act" (ICPA), but has yet to act.
It should, and soon. Every day consumer technologies, global commerce and technological innovators rely upon a global network that facilitates the flow of information across international borders. Global economic activity relies upon the network's ability to quickly transfer data and connect employees around the globe, allowing for international financial transactions, effective supply chains and employee collaboration across borders. Technological innovation, much of it centered in the U.S., relies upon the global network to support emerging technologies, foster innovation and connect disparate consumers and investors to unique ideas and technologies. In short, American economic activity is rooted in our ability to leverage the global network.
Despite Microsoft's success before the Appeals Court, the global network remains under threat. Were the government's argument to prevail, either on appeal or through Congressional action, the U.S. would face significant economic disruption as a result of Internet balkanization. Congress has the opportunity to pursue a different path, one that balances the need to respect the laws of foreign countries with law enforcement's legitimate need to access data for investigatory purposes. It must act now and not leave these important policy issues for the courts to decide.