The Battle for Your Data: The United States vs. Microsoft

The Stakes

Two factions — one public, one private — are waging a battle over one of the world's most valuable resources: data. More specifically, the right to data privacy.

In one corner, we have the U.S. Department of Justice (DOJ). In the other, Microsoft, the third biggest tech company in the world. They're duking it out in the highest court of the United States.

Though the DOJ is fighting for access to the emails of a single Microsoft customer, the outcome of this battle will affect every American who's ever sent an email, liked a Facebook post, or clicked an internet link.

"The stakes are really high," Gregory Nojeim, senior counsel and director of the Freedom, Security, and Technology Project at the Center for Democracy & Technology, told CNN. "It's going to set the tone for cross-border data demands on a global scale."

The Case

In 2013, the DOJ obtained a search warrant for the emails of a suspect in a drug-trafficking investigation. However, because the emails are stored in a Microsoft server located in Dublin, Ireland, the company does not think it is legally required to turn them over.

Microsoft argues that domestic warrants don't cover data stored outside that nation's borders and that the DOJ should go through Ireland if it wants the emails. According to NPR, Ireland agrees, maintaining that an international treaty is the right way to obtain the emails.

However, the DOJ thinks the current approach of using mutual legal assistance treaties (MLATs) to obtain data stored on foreign soil but owned by American companies is unnecessarily time-consuming and problematic. And the agency wants Microsoft to turn over the emails right now (or, more specifically, five years ago).

Essentially, the DOJ thinks it has a right to any data collected by an American company. As long as the agency has a search warrant, it can access your data regardless of where it's stored.

If you're a law-abiding citizen, that's not such a big deal. But armed with a warrant, the DOJ can access your digital footprint to not only look for evidence to convict you of a crime it's investigating, but perhaps of others in your more distant past as well.

So far, you don't have to be too worried — DOJ hasn't won any of the court cases leading up to this battle royal. In 2016, the New York-based 2nd U.S. Circuit Court of Appeals sided with Microsoft, stating that the emails were beyond the reach of a domestic search warrant.

 

At the center of this case is the Electronic Communications Privacy Act (ECPA), a law designed to strike a balance between the privacy rights of American citizens and the needs of law enforcement officials. But the law passed in 1986, before the internet had made it far outside scientific institutions, making the ECPA woefully ill-equipped to address the current conflict between the DOJ and Microsoft. Congress is already considering legislation that would bring the EPCA into the 21st century.

Here's how either outcome could affect you.

If the Court Finds in Favor of Microsoft:

Any data stored on foreign servers will remain out of reach of U.S. law enforcement unless the foreign nation that houses those servers agrees to turn it over (in other words, business as usual).

However, yours isn't the only data that stays safe overseas — lots of criminals' data will be out of authorities' hands, too.

Let's jump right to the worst case scenario: Your loved one is the victim of human trafficking. Law enforcement officials have reason to believe the criminal sent an email confessing to the crime and sharing details that would help them find your missing loved one. They've even obtained a court warrant for access to the email.

The only problem is the email is stored on a server in a foreign nation, one currently not entirely on friendly terms with the U.S. Thanks to the ruling in favor of Microsoft, the DOJ has to go through that nation to obtain the email. The time that takes could be the difference between saving your loved one's life, or being perpetually one step behind the bad guys.

Criminals might also start specifically seeking out companies that store data overseas to slow down the process that leads to legal repercussions. These companies could even include overseas storage as a specific service or marketing their ability to "protect" data from the U.S. government.

And Microsoft's win could someday be rendered irrelevant if Congress passes new legislation, such as a law requiring U.S. companies to keep on data on servers located in the U.S. If one were to pass, it would ensure that a case like this one would never happen again.

If the Court Finds in Favor of the DOJ:

On the one hand, U.S. law enforcement agencies would have a better chance of staying ahead of criminals. Criminals might be careful with theirs, but you'd be hard-pressed to find criminals that doesn't produce a trail of digital breadcrumbs.With the right access, law enforcement officials could put them behind bars more quickly. That hypothetical human trafficker would probably have a tougher time eluding capture if all of his or her emails, phone calls, text messages were just a search warrant away.

However, if the Supreme Court forces Microsoft to turn over this one suspect's emails, it sets a precedent for future criminal cases involving all other forms of data. Ultimately, the decision could give us one more way for the government to monitor our activities, while also escalate tensions between the U.S. and other nations.

"Unilateral actions like this will undermine privacy protections of customers everywhere, and are a recipe for international tensions, conflict, and chaos," wrote Microsoft president Brad Smith in a blog post published on the day of the hearing.

How would Ireland's government react if the Supreme Court rules against Microsoft? How would other nations react in the same situation?

And, then again, would other nations expect free access to data stored within U.S. borders? Will the U.S. be all right with foreign nations snatching up any data they say could help with their criminal investigations without going through the U.S. government first?

On February 27, the Supreme Court agreed heard the first arguments in the case; the justices have until June to make a decision.