6th Circuit Ruling Created Warrant for Content Standard at Large Tech Companies, say Google, Microsoft
Large tech companies have used a 2010 6th U.S. Circuit Court of Appeals decision to essentially require a warrant before responding to law enforcement requests for content, said representatives from Google and Facebook at a Tuesday Cato Institute event. “We're not getting much pushback,” said Microsoft Attorney Nate Jones. But countless smaller companies “don’t necessarily have the resources or legal acumen” to know to use the decision -- United States v. Warshak -- in such a manner, said Google Senior Privacy Policy Counsel David Lieber. And overseas customers don’t understand the patchwork of standards created by court rulings and federal law, Jones said. Which means a congressional solution is still needed, they said.
Sign up for a free preview to unlock the rest of this article
Timely, relevant coverage of court proceedings and agency rulings involving tariffs, classification, valuation, origin and antidumping and countervailing duties. Each day, Trade Law Daily subscribers receive a daily headline email, in-depth PDF edition and access to all relevant documents via our trade law source document library and website.
The opaqueness of privacy standards for content has damaged industry, Jones and Lieber agreed. “I didn’t appreciate just how much time I would spend dealing with customer concerns,” said Jones, who previously worked at the White House and Justice Department on national security issues. “We're operating in a global marketplace where people have less familiarity with the legal requirements in the U.S,” he said. This damages overseas business and discourages the adoption of new technologies, said Jones.
After the Warshak decision, the de facto “legal requirement” changed -- a warrant was now needed for content, they said. In Warshak, the court ruled the Fourth Amendment prevented law enforcement from obtaining stored email communications without a warrant (http://1.usa.gov/1zpYUiC). “Google and Microsoft and others have relied on that decision,” said Google’s Lieber, who previously was a Senate Judiciary Committee aide. “The perception, at least initially, was our application of that decision beyond the 6th Circuit was aggressive.”
Now it’s nearly the standard for larger tech companies, they agreed. If state and local officials -- “some of whom are not as familiar with the Warshak decision,” Lieber said -- issue subpoenas for content, Google and Microsoft say they have to return with a warrant. “They often times tend not to come back to us, or they will come back to us with a warrant,” said Lieber. “We haven’t seen a lot of pushback on that."
Law enforcement requests have also become more specific since the decision, said Jones. Microsoft is seeing fewer law enforcement requests for content without a warrant, “now that we're in a post-Warshak world,” he said. “We typically require them to be very specific in what type of data they want,” said Jones. Between 10 and 25 percent of Google’s law enforcement requests are looking for content, which Google takes to mean not just emails, but search terms, photos and other original materials, Lieber said. The search engine company asks for a warrant in those cases, he said. “The bulk of requests we receive tend to be transactional information,” said Lieber, which is “pretty run of the mill stuff you tend to provide when you sign up for our services,” such as name and gender. That information can usually be acquired with a subpoena, he said.
Explaining this standard is “difficult,” Jones said. “There is a great fear out there, not just about governments obtaining their information, but doing it without their knowledge.” As companies look to move to cloud-based technology, this fear becomes even more pronounced, because privacy standards for cloud-stored content are not directly addressed in the Warshak ruling. “Without clarifying the law in some of the other respects you risk the adoption of these new technologies,” Jones said.
Smaller companies also have not necessarily applied the Warshak warrant standard, Lieber said. These are “the bigger risks” from a broader policy perspective, he said. Even companies with hundreds or thousands of users can still be “sort of fledgling businesses,” said Lieber. “They'll see an official looking subpoena” requesting content, and not know to ask for a warrant. Congress has to clarify the Electronic Communications Privacy Act for such situations, because court decisions will continue to leave gaps, Lieber and Jones agreed.
In the meantime, major tech companies are still using the courts to try to expand their rights to challenge law enforcement requests, Jones said. In June, Microsoft challenged in the U.S. District Court in New York City a U.S. federal judge’s order to turn over a European customer’s data stored overseas (WID June 25 p11). And though Facebook was forced to comply with a cache of search warrants for users’ private messages (http://bit.ly/1lUHwIJ), it filed an appellate brief in late June to invalidate the warrants and have the information returned (http://bit.ly/1syoeyr). Both cases “raise important questions about what providers rights are to challenge things when they receive them,” Jones said.