United States v. Microsoft: Why the Government Should Win the Statutory Interpretation Argument
In United States v. Microsoft, the U.S. Supreme Court will determine the geographic scope of Section 2703 of the Stored Communications Act (SCA), which allows the government to obtain disclosure of communications in electronic storage upon a showing of probable cause. Three canons of statutory interpretation are potentially relevant: (1) the presumption against extraterritoriality; (2) the principle of reasonableness in interpretation; and (3) the Charming Betsy canon of avoiding conflicts with international law. The Fourth Restatement of Foreign Relations Law, to be published later this year, restates these three canons in Sections 404, 405, and 406.
(The provisions appear as Sections 203, 204, and 205 in the Tentative Drafts of the Fourth Restatement approved by the membership of the American Law Institute [ALI]. Although I served as a co-reporter for the Fourth Restatement, I write here in my personal capacity and the views expressed do not necessarily represent the views of the ALI.)
Applying these three canons leads to the conclusion that Section 2703 reaches the electronically stored communications that the government seeks in this case.
The Presumption Against Extraterritoriality
Section 404 restates the presumption against extraterritoriality: “Courts in the United States interpret federal statutory provisions to apply only within the territorial jurisdiction of the United States unless there is a clear indication of congressional intent to the contrary.” In RJR Nabisco, Inc. v. European Community, the Supreme Court articulated a two-step framework for applying the presumption. At RJR step one, a court looks to see if the presumption has been rebutted by “a clear, affirmative indication” that the provision applies extraterritorially. If so, the court does not proceed to step two but rather applies the provision according to its terms. If the presumption against extraterritoriality has not been rebutted at step one, then a court must determine at RJR step two “whether the case involves a domestic application of the statute . . . by looking to the statute’s ‘focus.’” If whatever is the focus of the provision occurred in the United States, then the case involves a “permissible domestic application even if other conduct occurred abroad.”
The brief for the United States concedes that there is no clear indication of extraterritoriality at RJR step one (p. 16). Microsoft sees a clear indication of non-extraterritoriality in Section 2703’s use of the word “warrant,” which it claims is “a legal term of art that carries a territorial limitation” (p. 15). When Congress has clearly indicated the geographic scope of a provision, the analysis should end there and a court should apply the provision as Congress directed. But there is no clear indication of geographic scope in Section 2703. As the United States persuasively argues, Congress used the word “warrant” in Section 2703 not to indicate its geographic scope but to require a rigorous showing of probable cause (p. 39).
At RJR step two, a court must determine the focus of the provision. The Second Circuit “conclude[d] that the relevant provisions of the SCA focus on protecting the privacy of the content of a user’s stored electronic communications.” The United States argues instead that the focus of Section 2703 is “disclosure” (pp. 21-26), while Microsoft says that its focus is “communications in electronic storage” (pp. 11-12). Determining the “focus” of a statute is more an art than a science, and courts should undertake it with an eye towards reaching sensible results.
Making the applicability of Section 2703 turn on where the communication is stored, as Microsoft urges, would not be a sensible result. It would make it easy for criminals to evade the provision, raising the sort of “troubling consequences” that the Court found relevant to determining the geographic scope of RICO in RJR.
It does not really matter whether the Court concludes that the focus of Section 2703 is on privacy or on disclosure, for they just really just two sides of the same coin. As the United States notes, it is not the transfer of data from one Microsoft server to another that potentially invades a user’s privacy, but rather the disclosure of communications to the government (pp. 26-28). That disclosure occurs in the United States, making the application of Section 2703 a permissible domestic application at RJR step two.
Microsoft’s strongest argument is that because Section 2703 is an exception to the unauthorized access and unauthorized disclosure provisions of the SCA, its geographic scope cannot extend beyond the geographic scope of those provisions (p. 19). But there are precedents for a statutory exception to have a broader geographic scope than the substantive provisions of the same law. It is well settled that both the Copyright Act and the Patent Act do not apply extraterritorially. Yet in Kirtsaeng v. John Wiley & Sons, Inc. and then again in Impression Products, Inc. v. Lexmark International, Inc., the Supreme Court held that exceptions to each act, created by Congress’s adoption of the “first-sale doctrine,” applied to sales occurring outside the United States.
It is certainly open to the Supreme Court to conclude that ordering a provider of electronic communications in the United States, upon a showing of probable cause, to retrieve and disclose information in the United States is a domestic application of Section 2703, even if the provider stores the information outside the United States.
Reasonableness in Interpretation
The presumption against extraterritoriality does not preclude courts from interpreting a statute to include other limitations on its geographic scope if doing so is consistent with the text, history, and purpose of the provision. As Section 405 of the Fourth Restatement puts it, “[a]s a matter of prescriptive comity, courts in the United States may interpret federal statutory provisions to include other limitations on their applicability.”
To be clear, this principle of reasonableness in interpretation is not the multifactor-balancing test found in Section 403 of the Third Restatement. There are statutes under which multifactor balancing may be appropriate, like the Bankruptcy Code. But neither the Supreme Court nor the lower federal courts have adopted such an approach to extraterritoriality more generally.
The principle of reasonableness in interpretation is instead the principle that the Supreme Court articulated in F. Hoffmann-La Roche Ltd. v. Empagran S.A. of avoiding “unreasonable interference with the sovereign authority of other nations.” As Empagran made clear, however, not all interference with the sovereign authority of other nations is unreasonable. Extrapolating from Empagran, Section 405 says: “Interference with the sovereign authority of foreign states may be reasonable if application of federal law would serve the legitimate interests of the United States.”
There is no doubt that the United States has a legitimate interest in the disclosure of electronically stored communications where there is probable cause to believe that the communications relate to criminal activity. Even if this case risks some interference with Ireland’s sovereign authority, applying Section 2703 is clearly reasonable.
The Charming Betsy Canon
Finally, there is the Charming Betsy canon that “an act of Congress ought never to be construed to violate the law of nations if any other possible construction remains.” But applying Section 2703 to require a U.S. internet-service provider to produce information in the United States violates no rule of international law, even if the information in question is stored abroad.
Customary international law limits the jurisdiction of States in certain respects. For a customary international law rule to exist, there must be a general and consistent practice of States followed out of a sense of legal obligation. As Section 401 of the Fourth Restatement (Section 101 in the Tentative Draft) explains, customary international law imposes different rules on different kinds of jurisdiction. Only jurisdiction to enforce is strictly territorial. Customary international law permits jurisdiction to prescribe if there is a genuine connection between the subject of the regulation and the State seeking to regulate. And customary international law does not limit jurisdiction to adjudicate at all, except for certain rules of immunity.
The amicus brief of International and Extraterritorial Law Scholars claims that “the electronic seizure of electronic records physically located in another country is an exercise of extraterritorial enforcement jurisdiction . . . no different than if FBI agents had set foot on Irish soil to retrieve the data themselves” (p. 3). That is simply wrong as matter of international law. States do not view orders to produce information located abroad as equivalent to physical searches by law enforcement officials.
In both civil and criminal cases, U.S. courts have long ordered parties to produce information located abroad. Discussing these cases in the Reporters’ Notes to Section 431 (Section 401 in the Tentative Draft), the Fourth Restatement observes: “Such orders have not provoked the protests from other states that might be expected if such orders constituted extraterritorial exercises of jurisdiction to enforce. In the event of noncompliance with such an order, a court may impose sanctions constituting enforcement, but such sanctions are typically imposed within the territory of the United States in compliance with customary international law’s territorial limits on jurisdiction to enforce.”
Ireland, the United Kingdom, and the European Commission all filed amicus briefs in this case. None of them asserts that using Section 2703 to require the production of information located abroad violates international law. Indeed the United Kingdom says that it does not (p. 5). It notes that under U.K. law telecommunications providers may be required to disclose electronic communications without regard to where the data is stored (pp. 5-6). Ireland observes that Irish courts have the power to order the production of documents located abroad (pp. 5-7). And the brief for the United States identifies other countries that authorize access to data stored abroad (pp. 46-47). Without a general and consistent practice of states that treats accessing data stored abroad as an impermissible exercise of jurisdiction to enforce, there can be no customary international law rule prohibiting it.
The European Commission brief worries about the possibility of conflicts with the EU’s General Data Protection Regulation (GDPR), but it discusses a number of ways the GDPR might permit compliance with a Section 2703 warrant (pp. 8-16). In any event, the answer to these concerns is not found in international law, which does not prohibit conflicting sovereign commands, but rather in a doctrine of international comity. Specifically, the doctrine of foreign state compulsion—restated in Section 442 of the Fourth Restatement (Section 222 of the Tentative Draft)—allows a U.S. court to excuse violations of U.S. law, or to moderate the sanctions imposed for such violations, when a person’s conduct is compelled by foreign law. The Supreme Court recognized such a defense to orders requiring the production of information abroad almost 60 years ago in Societe Internationale pour Participations Industrielles et Commerciales, S.A. v. Rogers, and the brief for the United States concedes that such a defense would be available in cases where foreign law prohibited disclosure (pp. 51-52).
In sum, none of the canons of interpretation relevant to determining the geographic scope of a statute leads to the conclusion that Section 2703 is limited to electronic communications stored in the United States. Under the presumption against extraterritoriality, an order to a provider to produce information in the United States is a permissible domestic application, even if the information is stored abroad. Under the principle of reasonableness in interpretation, the legitimate law enforcement interests of the United States make the application of Section 2703 reasonable, even if it risks some interference with other nations’ sovereign authority. And the Charming Betsy canon simply is inapplicable because applying Section 2703 is not an extraterritorial exercise of jurisdiction to enforce. The government should win the statutory interpretation argument in United States v. Microsoft.
[Cross-posted from Just Security.]