Microsoft will face off against the U.S. government before the Supreme Court on Tuesday, arguing a case that has a far-reaching impact on the privacy of digital data. It’s also seeking legislative relief, but digital-privacy organizations aren’t following its lead in Congress.
Microsoft will face off against the U.S. government before the Supreme Court Tuesday, arguing a case that has a far-reaching impact on the privacy of digital data.
It’s an issue that many — including Microsoft, a legion of other tech companies and digital-privacy organizations — wish would be decided by Congress, rather than by the court. But while tech firms are supporting a legislative proposal now before Congress, digital-privacy organizations that are backing them in their court fight aren’t supporting their legislative move.
The case before the Supreme Court was triggered by a U.S. law-enforcement request in 2013 that Microsoft turn over a cloud customer’s email data related to a narcotics investigation. Microsoft refused after realizing the emails were stored in an Irish data center, saying the U.S. should instead work with Irish authorities.
The digital-privacy law now on the books was passed in 1986, when Walkmans were common and “the cloud” was a term used in weather reports. Technology has advanced significantly since then, and laws need to be updated to reflect that, Microsoft argues.
The current Stored Communications Act, part of the Electronic Communications Privacy Act, does not explicitly address if the law applies overseas, and Microsoft will argue before the Supreme Court that means it is assumed to apply only within U.S. borders.
Giving up information stored in other countries would make those countries hesitant to trust U.S. data providers if their own privacy laws were not respected, the company has said. That could mean Microsoft loses the business of some foreign customers.
Microsoft and a long list of tech firms are supporting a recently introduced law called the Cloud Act, which has been sent to the House Judiciary Committee. The legislation, which would amend the Stored Communications Act, sets out a process for how to deal with law-enforcement requests for customer data stored internationally.
It would allow data providers to turn over that information to U.S. law-enforcement agencies if the request was legitimate, the customer it pertained to was a resident of the U.S. and it did not breach a law of the foreign country.
The provider could challenge the request if it believed it was illegal under a foreign government’s laws.
But longtime supporters of Microsoft’s court challenge are breaking with the tech industry on the legislation. Digital-privacy organizations including the Electronic Frontier Foundation and the Center for Democracy and Technology oppose the Cloud Act, saying it does not go far enough to protect consumers.
“This amends (the Electronic Communications Privacy Act) and leaves the consumers behind while taking care of the government and providers,” said Greg Nojeim, senior counsel at the Center for Democracy and Technology.
The organization is concerned it does not put enough burden on law-enforcement agencies to obtain warrants for information and leaves customers vulnerable.
It’s unlikely the Supreme Court’s decision in the Microsoft case will resolve the issue. Paul Rosen, an attorney with Crowell & Moring in Los Angeles and the former chief of staff of the Department of Homeland Security, said the Supreme Court hearing is just the next step.
“I would not be surprised if the court put the burden back on Congress in some form or fashion to address the issue,” he said.
The Supreme Court will hear arguments in the case Tuesday morning. A decision is not expected until June.