It is 2025. The government of Russia has requested Microsoft, the operator of Microsoft 365, which provides email services, among other services, to disclose the contents of an individual's email account. The target is a dual citizen of the U.S. and Russia and a well-known supporter of an opposition political leader. The Russian law enforcement alleges that the individual was a key in organizing the protest against the government after the recent amendments to the Constitution of the Russian Federation. The Russian authorities claim that the individual allegedly broke public assembly rules by organizing the unsanctioned protest, which is “unlawful.” Under domestic law, the Ministry of Internal Affairs of Russia has broad legal authority to acquire all the stored data from the email account for use in the investigation process.[1] In responding to the request, Microsoft tracks the data's location and finds that the metadata[2] is stored in the computer servers in Russia. However, the content of the emails is stored in the U.S. 

How should Microsoft respond to the request of the Russian Government regarding the privacy of U.S. citizens?  Is Microsoft legally obligated to hand over the foreign-stored data to the local authorities? Can Microsoft challenge the request on the grounds that (1) the data was stored across the borders of Russia, and (2) the nationality of the concerned individual? 

Data Flow Across the Borders

The ubiquitous use of the Internet has increased the demand by law enforcement officials in the U.S. and foreign countries for accessing electronic communications stored in data centers in foreign countries.[3] On one hand, since the majority of technology companies are U.S.-based,[4] law enforcement officials from other countries must seek the U.S. government’s assistance in obtaining necessary digital evidence.[5] On the other hand, technology companies often store an individual’s data in jurisdictions other than those of the user or the service provider. Another factor that complicates the data transfer is the jurisdiction where the user resides.[6] Thus, U.S. law enforcement agents have faced challenges in accessing the data stored on servers outside the U.S. territory.

Resolving the Issue Raised in United States v. Microsoft Corporation

The Judge of the Southern District of New York issued a warrant to Microsoft requesting the company to hand over the contents of a customer email stored outside the U.S. territory.[7] After the court denied Microsoft’s motion to quash a warrant issued under § 2703 of the Stored Communication Act (“SCA”) (also called as a SCA warrant), Microsoft appealed the case, arguing that the SCA warrant was subject to territorial limits.[8] Further, the Second Circuit ruled in favor of Microsoft,[9] relying on the presumption established by the Supreme Court that U.S. laws do not have effect outside U.S. territorial jurisdiction unless the law specifies otherwise.[10] The U.S. government appealed the Second Circuit’s ruling, and the Supreme Court granted certiorari.[11] The focal question raised in the Microsoft Ireland case was whether the SCA’s mandatory disclosure provisions applied extraterritorially.[12]

While the case was under the Supreme Court review, it brought significant attention from the public and government agencies alike. In the hearing before the Judiciary Committee in the House of Representatives, not only the representatives of state, federal, and international law enforcement brought testimonies, but also the technology sector, academia, and civil liberties groups shared their views.[13] Department of Justice, while arguing that the Second Circuit’s decision “effectively hamstrung the ability of law enforcement” to obtain data stored by U.S.-based entities abroad, creating a “tremendous problem” that caused “substantial harm to public safety,”[14] proposed a draft bill that would amend respective provisions of the SCA.[15]

Finally, Congress stepped in and passed the CLOUD (Clarifying Lawful Overseas Use of Data Act) in 2018, which amended the extraterritoriality provision of the SCA in explicitly permitting the government to compel U.S.-based service providers to disclose electronic communication or any record to a customer even if they are stored on servers located outside of the U.S. territory.[16] Following the enactment of the CLOUD Act, the Department of Justice issued a new warrant requesting Microsoft to hand in the respective data.[17] Both parties in United States v. Microsoft agreed that the new warrant replaced the old warrant.[18] Consequently, the Supreme Court decided that the case had become moot.[19]

The CLOUD Act is insufficient in addressing the complexities of cross-border data transfer issues. While the Act facilitates access to electronic information stored in foreign countries, it relies on executive agreements to ensure such access. Despite ongoing negotiations with close allies like Canada and Australia to establish bilateral agreements under the Act, similar effective negotiations with countries such as China and Russia are lacking.

This discrepancy becomes particularly problematic given the persistent threat of hacking activities emanating from these countries, posing significant risks to American companies across vital sectors like telecommunications, energy, and water infrastructure. Without comprehensive application of the CLOUD Act to all nations, justice remains elusive. Criminals should not find refuge simply due to their location, and the selective enforcement of the Act undermines its purpose. To truly address the challenges posed by cross-border data transfers and combat cyber threats effectively, there is a pressing need for equitable implementation of the CLOUD Act across all countries. Failure to do so risks perpetuating vulnerabilities in the global digital ecosystem and compromises the integrity of international law enforcement efforts.