On Wednesday the Second Circuit will hold argument in Microsoft v. United States, the case in which the technology giant challenges the U.S. government’s attempt to obtain emails stored overseas by serving a search warrant on the company domestically. In Part Two of my four-part series, I waded into Microsoft’s characterization of the warrant as authorizing an “extraterritorial” search not authorized by the Electronic Communications Privacy Act, or ECPA.

In this part I turn to Microsoft’s argument that the statutory distinction between the forms of process used to obtain overseas emails – in this case “warrants” and “subpoenas” – is categorical and essential. In essence, Microsoft argues that each form of process operates in more or less the same way it does outside the statute (citations omitted):

There is no question that the terms “warrant” and “subpoena” “describe different categories . . . of things.” A warrant constitutes the judicial authorization, founded on a finding of probable cause, of an activity that is uniquely assigned to law enforcement—intruding upon an individual’s reasonable expectation of privacy to conduct a search and seizure. A search warrant is directed toward a particular place to be searched and person or thing to be seized, rather than a person who might possess or control the sought-after evidence. And “[t]o preserve advantages of speed and surprise, [a warrant] is issued without prior notice and is executed, often by force, with an unannounced and unanticipated physical intrusion.”
A subpoena, in contrast, “command[s] a person to appear before a court,” and may order the person “to bring specified documents, records, or things.” It does not authorize law enforcement searches or the seizure of a customer’s property, nor is it directed to a particular location. Unlike a warrant, “the issuance of a subpoena initiates an adversary process that can command the production of documents and things only after judicial process is afforded.” That process allows the recipient, or the party with a privacy interest in the documents (such as the reporter in our opening hypothetical), to challenge a subpoena.

(Actually, ECPA authorizes three types of process if you include the “court orders” authorized under 18 U.S.C. § 2703(d), which we’ll get to in a moment.)

Much rests on the distinction between warrants and subpoenas, Microsoft argues. For warrants, Microsoft pithily observes, “[t]he search and seizure occur where the evidence is, not where the agent sits.” In negative terms, this bars courts from applying the “control” test that typically applies to subpoenas, which means that as long as the party receiving the subpoena has control over the sought information, it must provide it. In positive terms, it would mean that the U.S. government can only obtain emails stored by Microsoft’s domestic operations, not its international operations. The alternative, Microsoft contends, would allow an ECPA warrant to have the same geographic scope as a subpoena, thus authorizing a “Frankenstein super-warrant-subpoena hybrid” for warrant-level rummaging by law enforcement around the world.

Two other textual aspects of ECPA support Microsoft’s argument. The existence of a third form of process under 2703(d), which provides for a court order for non-content information, suggests that Congress intended not to deviate from the usual meaning of “warrant” or “subpoena.” In addition, ECPA’s allowance for warrants to be served or executed without the presence of a law enforcement officer indicates that Congress knew how to establish non-standard procedures when it wanted to.

The government doesn’t think the warrant/subpoena distinction is particularly important, since it devotes only one footnote to rebutting it. Instead, the government focuses on its own textual counterargument: ECPA creates a legal duty of disclosure by the entity – here Microsoft – that doesn’t depend on the type of process. For warrants, the statute says in paragraph (a), the government “may require the disclosure [of emails] by a provider[.]” For subpoenas, the statute says in paragraph (b), the government “may require a provider . . . to disclose” emails[.]” For warrants and court orders issued under 2703(d), the government “may require a provider . . . to disclose” the sought information. In each case, the government argues, there is no reason in the text to think “that the power of one of these instruments is broader or narrower in geographic scope than another.”

In its favor, the government’s interpretation lines up the forms of process with the burdens of proof assigned to them, i.e., probable cause goes with the warrant, a lesser burden goes to subpoenas, and the 2703(d) order goes somewhere in between. In addition, the government observes, Microsoft’s reading of the statute creates an odd result that certain categories of information would be entirely outside the scope of the statute for no apparent reason.

It’s a close case, and the arguments for both sides are strong. Why would the statute distinguish between the three forms of process if the form didn’t matter? The statute doesn’t define the precise territorial reach of the ECPA “warrant,” so Microsoft fills in the silence by arguing that l’essence de warrant is inherently territory-bound; thus so must be the potentially accessible data. The government’s argument infers the opposite, that the lack of a restriction or explicit distinction between the reach of the two forms of compelled disclosure means that they are identical.

As I mentioned before, the case is scheduled for argument on Wednesday morning in New York City. My final installment in this series will offer some concluding thoughts about this important case and the future of ECPA.