In Parts One, Two and Three of my series on the Microsoft v. United States case, which involves Microsoft’s challenge to a search warrant seeking emails from one of its overseas customers, I previously laid out the two central issues in the case. The ultimate question is whether the statute governing electronic privacy disclosures – the Electronic Communications Privacy Act (ECPA) – allows the government to use a search warrant served in the United States on Microsoft to obtain emails located overseas. (You can read more about the case at Microsoft’s Digital Constitution site.)

It’s a close case, partly because the portion of ECPA before the Second Circuit wasn’t drafted to address potential extraterritorial applications. The case law pertaining to the presumption against extraterritorial application of domestic statutes is murky, and as I observed in Part Two, there are good reasons to question whether the warrant actually operates extraterritorially in the sense governed by the presumption.

That said, the government’s case is not airtight. It relies on the Marc Rich case for the proposition that “The test for the production of documents is control, not location.” Microsoft principally distinguishes Marc Rich on the form-of-process issues, i.e., that it concerned a subpoena, not a warrant. But there are other ways of distinguishing Marc Rich that some of the amici have raised, such as by noting that the target of the subpoena in Marc Rich was not a caretaker or trustee for property of a third party, whereas here Microsoft is. Law professor Orin Kerr has identified other issues that were not briefed, such as the fact that the government failed to seek an All Writs Act order requiring Microsoft’s assistance in the execution of the warrant. It’s unlikely that the Second Circuit will take up these issues now, though, since the parties didn’t brief them below.

It’s also unclear how much the practical policy considerations identified by the lower courts would weigh into the Second Circuit’s consideration. The magistrate judge predicted that a ruling for Microsoft would “seriously impede[]” law enforcement efforts, and interpreted the statute in light of this concern. The parties and amici predict mayhem from a ruling for the government. Microsoft predicted “international friction” from conflicts between differing privacy laws and damage to its own business interests, while the Government of Ireland complained in its amicus brief that sustaining the warrant would infringe on its national sovereignty. The U.S. government, for its part, devoted an entire section of its appellate brief to “policy considerations,” which mainly involved substantial delays resulting from the use of Mutual Legal Assistance Treaty (MLAT) processes.

The government has a slight edge on two key textual grounds. First, Microsoft stores the sought emails in an “electronic communications system,” which is a defined term that includes “facilities for the transmission of wire or electronic communications, and any computer facilities or related electronic equipment for the electronic storage of such communications.” In other words, the statute treats Microsoft’s storage of electronic communications as part of a single, undifferentiated “electronics communications system,” not lots of separate parts that have independent legal significance. This isn’t a bulletproof argument since it only partially resolves the characterization problem that I identified in Part Two and could fall apart if the court decides to expand the extraterritoriality limitations, but it is certainly helpful to the government.

The second ground is in section 2703, which frames the primary legal duty of disclosure. It provides that a “governmental entity may require” certain disclosures using warrant, subpoena, or order, then sets out the conditions under which the “entity” may “require” the disclosure. Formulating the legal duty that way is pretty weird, but as Professor Kerr recently observed, ECPA was originally designed as protection against wanton disclosure of personal information by service providers, not as a comprehensive regime for search and seizure of online data.

And that leads to a final point about policy. For decades, ECPA did a great job of governing electronic search and seizure in most of the practical situations that arose. But the technological environment in 2015 has changed so significantly from that of 1986 that Congress needs to completely rewrite the law to address its new applications. ECPA simply doesn’t anticipate contemporary practices like distributing computing power and electronic storage all around the world in bits and pieces. Leaving the statute as it stands will only invite courts to rewrite it for convenience. Tweaking ECPA to apply extraterritorially is unlikely to succeed, either, since companies engaged in international technology projects will still encounter conflicts with other nations’ privacy or disclosure laws.

Microsoft’s suit does us all a public service by clearly revealing ECPA’s fading adequacy. Congress should pass a comprehensive replacement that addresses the private sector’s concerns about compliance burdens while still allowing law enforcement agencies to go get the bad guys. In short, Congress needs to make sure the law reflects the realities of this brave new cyberworld regardless of how the Second Circuit resolves Microsoft v. United States.