Can the government get access to your email to see if you are committing a crime? That depends on your service provider. If the company stores your email content in a foreign country, it does not have to give it to the government. On July 14, 2016, a federal appeals court in New York ruled in Microsoft Corporation v. United States that the law could not force Microsoft to turn over its customer’s email content because the content was stored on a server in Ireland.
This is good news for folks who want to keep their email private. But it leaves the decision whether to protect our privacy completely in the control of our email service provider. Let me explain.
The Electronic Communications Privacy Act (ECPA)
Congress passed the ECPA in 1986, before email was commonly used by ordinary folks—and before the world wide web even had a name. The ECPA includes the Stored Communications Act (18 U.S.C. §§2701–2712), which requires the government to get a warrant before it accesses your electronically stored communications. In order to get a warrant, the federal government must follow the procedures set out in the Federal Rules of Criminal Procedure. Those rules require the government to get a warrant, a court order and show that evidence of a crime will probably be found there. (If you’ve ever studied U.S. constitutional law, you know that the 4th Amendment requires search warrants to be based upon probable cause).
The details of the ruling are rather technical, so I won’t dwell on them. The court spends a lot of time explaining how warrants are different from subpoenas. For our purposes, the important part is that subpoenas can require people to turn over everything (relevant) in their control, no matter where it’s located. Warrants are court orders that traditionally do not operate outside the jurisdiction of the court.
The court rejected the government’s argument that the warrant should be treated like a subpoena. The court ruled that it didn’t matter that Microsoft could reach the content in Ireland without physically going there.
Who Protects Our Email Privacy?
The bad news is that the customer’s right to privacy depended on Microsoft’s decision to store its customers’ emails in Ireland. It didn’t have to do that. Microsoft could just as easily have stored email content on the server closest to the customer. And if it had done so, the law would have required Microsoft to turn over the content.
Many tech and media companies filed amicus, or friend of the court, briefs supporting Microsoft. Here is a list of the organizations and people who filed amicus briefs. But not every major tech company participated. For example, Google is not on the list. If internet privacy is important to you, think about asking your email provider where it stores your email content.
Image via Pixabay.
