How Microsoft’s Supreme Court Case Affects US Startups

On Tuesday, the U.S. Supreme Court will hear oral arguments from Microsoft in what many expect to be a resolution of a years-long legal battle over how it—and other big tech companies of its ilk—handles user data stored overseas.

Follow Crunchbase News on Twitter & Facebook

This is important for startups for two reasons:

1. The results of this Supreme Court case have direct bearing on how many popular cloud computing platforms – such as those operated by Amazon, Google, and Microsoft – can treat private user data going forward.
2. The ambiguity around how this data is viewed under current law is prompting some lawmakers to propose more explicit regulation around overseas data regulation, which may make it easier for countries to share private data with one another during investigations.

The Background

In December 2013, Microsoft was asked to turn over some user some data to U.S. federal investigators, including emails. Microsoft handed over certain account information but did not comply with the request for emails on grounds that since the email data was located on foreign servers – in this case, at a datacenter in Ireland – it was outside US investigators’ jurisdiction.

The opening lines of a blog post from the time by John Frank, Microsoft’s VP of EU Government Affairs, summarized the company’s position by saying “[t]he U.S. government doesn’t have the power to search a home in another country, nor should it have the power to search the content of email stored overseas.”

Thus began a protracted legal dispute over whether Microsoft did indeed have to turn over data on foreign servers. At first, Microsoft was ordered by a federal magistrate judge to hand over the emails, but Microsoft appealed to the District Court for the Southern District of New York, which also sided with the government. Microsoft filed an appeal to the Second Circuit court, which ultimately overturned previous decisions, ruling in Microsoft’s favor in 2016. But after additional legal back-and-forth the Justice Department filed an appeal with the US Supreme Court to hear its case.

Oral arguments begin Tuesday, February 27th at 10 AM Eastern time.

Can’t Teach An Old Law New Tricks

The law at the center of this case is the Stored Communications Act of 1986, passed long before cloud computing and email became mainstream technologies. Among other things, the law requires law enforcement officials to get a warrant to search electronic records.

Solicitor General Noel J. Francisco said in the briefing on the merits of the government’s case “the government may compel a U.S. service provider to disclose electronic communications within its control, regardless of whether the provider stores those communications in the United States or abroad.”

Dozens of organizations have filed amicus briefings in support of Microsoft’s position that the government doesn’t have a right to demand data stored on foreign servers. Companies that filed friend of the court briefings include Google, IBM, Reddit, Amazon, Apple, Cisco, Dropbox, eBay, Facebook, Mozilla, HP, SAP, Oath, and Verizon. Nonprofits like the ACLU and EFF as well as governments in Ireland, 33 U.S. States and the Commonwealth of Puerto Rico, and EU Parliament Members – among many, many others – have all sided with Microsoft.

A New Law, And How All Of This Affects Startups

For now, under the Stored Communications Act, customer data stored on foreign servers seems to be somewhat outside the reach of U.S. law enforcement.

However, companies that deal with sensitive data—take cryptocurrencies and encrypted communications as examples—need to be particularly aware of how and where the most critical of this data is stored and transmitted.

This could all change though if proposed legislation is signed into law. On February 6th, the Clarifying Lawful Overseas Use of Data (CLOUD) Act was introduced by Senators Orrin Hatch (R-UT), Chris Coons (R-DE), Lindsey Graham (R-SC), and Sheldon Whitehouse (D-RI). A similar bill was introduced in the House by Representative Doug Collins, a Republican from Georgia.

Under the CLOUD Act, the U.S. could enter into bilateral information-sharing arrangements with foreign countries, giving both parties access to foreign data stored within each other’s borders. The bill has support from many large technology companies but draws legitimate criticism from privacy advocates.

Perhaps especially if the CLOUD Act passes, or if the Supreme Court rules against Microsoft, tech startups will have to start thinking about how to protect user data right from the start. It will no longer be a question to kick down the road. Whether it’s through a proven strategy like using strong encryption for data on-device and in transit or a more experimental one like building a decentralized organization on a blockchain, don’t be surprised if more companies start emphasising how they keep private data out of government hands.