This week Cisco signed onto an amicus “friend of court” brief along with Amazon, Apple, and Microsoft in litigation between the U.S. Department of Justice (DOJ) and Google over data sought via a search warrant. The case is another in a series that turns on whether the Stored Communications Act (SCA also commonly referred to as ECPA) enables the U.S. government to demand access to data stored outside the territorial boundaries of the United States.

As noted in my blog from last year, Cisco previously signed briefs in support of Microsoft in litigation before the U.S. Court of Appeals for the Second Circuit in New York. In that case, Microsoft claimed and the Court agreed that:

1) The data demanded by DOJ was localized in a data center in Ireland;
2) SCA warrants are territorial in nature and cannot force a company to assist in retrieving data physically stored elsewhere in the world;
3) DOJ should have used a Mutual Legal Assistance Treaty (MLAT) to seek data from the Government of Ireland, which also supported the Microsoft view.
4) If Congress wants the law to reach data in foreign data centers, it must say so explicitly.

A magistrate judge in the current Google matter held that while the law may not have extraterritorial reach, the privacy invasion demanded by DOJ would actually occur in the US. By contrast, amicus brief supporters assert that when a provider can show that data does have a location and that this location is outside the US, then a search and seizure of that data would occur in a foreign territory. In such instances, the U.S. government should use an MLAT when demanding access because SCA warrants do not have extraterritorial reach. We argue that this is a function of how the current law was written by Congress. Therefore, only Congress is properly positioned to balance the needs of law enforcement against the risks that companies will be subject to conflicting legal requirements in different countries.