|

Even for a behemoth like Microsoft Corp., going head-to-head with the federal government at the U.S. Supreme Court is no small matter. Since its case over emails stored in Ireland began in 2013, the tech giant has rallied the support of the industry, law and computer science academics, and European Union lawmakers in arguing that a domestic warrant should not apply to data kept abroad. Now, the sides are gearing up for oral argument on Feb. 27.

In an interview on Law.com's “Unprecedented” podcast, Microsoft's head of litigation David Howard discusses the company's decision to fight the government. He also talks about prospects for legislation that would change how law enforcement accesses data stored “in the cloud,” and the impact of the EU's General Data Protection Regulation.

Below is an excerpt of the conversation. You can listen to the full podcast above, or on your Apple or Android device. This excerpt has been edited for length and clarity.


Ben Hancock: For a long time preceding this case, many technology companies—perhaps Microsoft included—routinely complied with warrants issued under the Stored Communications Act, even for data stored overseas. What changed?

David Howard: I don't think anything changed. Back in 2013, when this warrant came in, the notion of cloud computing was still relatively young. The notion of cloud computing where we stored customer email in data centers outside the United States was a pretty recent phenomenon.

We spent some time trying to figure out how to deal with the issue, and frankly talking to customers, and recognized that customers—including customers in Europe—cared a whole lot about whether the laws of the countries in which we were storing their data were being recognized.

Break this down for me. What's at stake here?

Well, a few things. First of all, it's whether the laws of countries outside the United States are going to be respected by [the] U.S. government and U.S. courts. Our position is that when the government serves a piece of paper on Microsoft in the United States and wants emails that are stored outside the United States that belong to non-U.S. citizens, there has to be some consideration for the fact that the laws of those other countries apply. And that's an important issue not only for the citizens of those countries, but … for citizens of the United States as well. Because the shoe could easily be on the other foot.

I think the other really critical issue is whether we're going to have to follow the same laws when it comes to digital data as we've been following for hundreds of years when it comes to personal information stored on paper. There was no question prior to the advent of the internet that if you had a diary, for instance, that was stored in Ireland—and the U.S. government wanted to get it—it couldn't serve a warrant in the United States to get that information. It would have to work cooperatively with the Irish government under something called a mutual legal assistance treaty, and might be able to get at it that way.

There have been proposals in Congress to address this issue of international cooperation when you've got data that's stored overseas. But so far there really hasn't been any movement in Congress to pass these bills. Why do you think that is?

Well, I guess I disagree with the premise that there hasn't been any movement in Congress to pass these bills. Just last week, a new proposal was introduced in both the House and the Senate with bipartisan support; it's called the CLOUD Act. It has the support of the tech community, and we believe it also has the support of the U.S. government.

These things certainly don't happen overnight. This is a hard issue and there's been a lot of thought given to it. But this latest proposal is one we're optimistic will move in Congress.

➤➤ Want to read more about how new tech is challenging old laws and changing the legal profession? Sign up for What's Next, a weekly email briefing on the future of law.