Email Privacy Challenge

Status: US Supreme Court; Appeal beginning soon.

ORG have signed an amicus brief produced by digital rights campaigning organisation Digital Rights Ireland in a US Supreme Court case involving Microsoft and email privacy.

ORG's role

In a narcotics case in 2013, the US Department of Justice attempted to order Microsoft to hand over emails that were held on a Hotmail server in Ireland.

Microsoft argued that the emails on the server should be protected by the laws of the country where the server is physically located, while the Department of Justice argued that it had the right to demand access to emails stored anywhere in the world as long as the company was headquartered within the United States. 

At issue is the Stored Communications Act of 1986, which Microsoft says couldn’t possibly have anticipated cloud storage, in which data is meted out across servers all over the globe to reduce costs and increase speed.

The DoJ contends that emails should be treated as the business records of the company hosting them, by which definition only a search warrant would be needed in order to compel the provision of access to them no matter where they are stored. Microsoft argues the emails are the customers’ personal documents and a US warrant does not carry the authority needed to compel the company to hand it over.

So far, judges in lower courts have consistently ruled against Microsoft, and the case is now progressing to the highest court in the US - the Supreme Court.

Open Rights Group have signed an amicus briefing prepared by Digital Rights Ireland in this case. Many other groups have submitted similar briefings.

Outcome

Although this case was argued before the Supreme Court on 27 February 2018, Congress passed a law rendering the case effectively moot before the Court had time to return a judgment. The Clarifying Lawful Overseas Use of Data (CLOUD) Act grants federal law enforcement the ability to order US-based tech companies like Microsoft to hand over data regardless of where it is physically stored.

After passing the CLOUD Act, the Solicitor General requested that the case be dropped, and on 17 April 2018 the Court issued an opinion indicating that the Government had subsequently used the CLOUD Act to obtain the information from Microsoft and that, accordingly, "no live dispute remains between the parties". The case was dropped.

The CLOUD Act is a huge loss for online freedom as it extends the reach of the US Government to wherever data is physically stored around the globe regardless of where that may be.

If you want to support our work in future legal challenges, you can join ORG here.