In the Matter of the Search of Content Stored at Premises Controlled by Google Inc. and as Further Described in Attachment A

Filing 84

ORDER by Judge Richard Seeborg Denying 47 Google's Motion for De Novo Determination of Dispositive Matter Referred to Magistrate Judge. (cl, COURT STAFF) (Filed on 8/14/2017)

1
2
3
4

UNITED STATES DISTRICT COURT

5

NORTHERN DISTRICT OF CALIFORNIA

6
7
8

In the Matter of the Search of Content Stored
at Premises Controlled by Google Inc. and
as Further Described in Attachment A

ORDER DENYING GOOGLE’S
MOTION FOR DE NOVO
DETERMINATION OF DISPOSITIVE
MATTER REFERRED TO
MAGISTRATE JUDGE

9
10
11
United States District Court
Northern District of California

Case No. 16-mc-80263-RS

12
13

I. INTRODUCTION

14

Google objects to the magistrate judge’s order denying its motion to quash a search

15

warrant seeking foreign-stored e-mails. It claims execution of the warrant would be an

16

impermissible extraterritorial application of the Stored Communications Act (“SCA” or “the

17

Act”), 18 U.S.C. § 2701 et seq. For the reasons that follow, the magistrate judge’s order is

18

affirmed and Google is ordered to comply fully with the terms of the warrant.
II. BACKGROUND

19
20

A. Factual Background

21

Google is a domestic company incorporated in Delaware with a principal place of business

22

in California. It offers users a variety of different online and communications services. Google

23

stores user data in various locations, some inside the United States and some elsewhere. Google’s

24

network automatically moves data from one storage location to another as frequently as needed to

25
26
27
28

optimize performance, reliability and other efficiencies. As a result, the countries in which
specific user data is stored may change over time. It is possible, for example, that the network will
change the location of data between the time when the legal process is sought and when it is
served. Only Google personnel in Google’s Legal Investigations Support team are authorized to

1

access the content of communications in order to produce it in response to legal process. All such

2

Google personnel are located in the United States.

3

B. Procedural Background

4

On June 30, 2016, the magistrate judge authorized a search warrant, under 18 U.S.C.

5
6
7
8
9
10

§ 2703(a), directing Google to produce stored content related to certain email accounts. Google
moved to quash with respect to content stored outside the United States. The magistrate judge
denied that motion and ordered Google to produce all content responsive to the search warrant that
is retrievable from the United States, regardless of the data’s actual location. See Dkt. No. 46.
Google now moves for de novo review of the magistrate judge’s determination. The government
opposes Google’s motion and requests an order to show cause why Google should not be held in
contempt for failure to comply with the magistrate judge’s order.

11
United States District Court
Northern District of California

C. Statutory Background
12
The SCA was enacted as Title II of the Electronic Communications Privacy Act of 1986.
13
It imposes general obligations of non-disclosure on service providers and creates several
14
exceptions to those obligations. The first three sections of the SCA—Sections 2701, 2702, and
15
2703— contain its major provisions. Section 2701 criminalizes unauthorized access of a facility
16
through which an electronic communication service is provided. Section 2702 outlines the
17
circumstances in which service providers may voluntarily disclose information associated with
18
and contents of electronic communications. Section 2703 sets forth procedures the government
19
must use to require service providers to produce customer communications and records. Basic
20
subscriber information can be obtained by an administrative subpoena. See 18 U.S.C.
21

§ 2703(c)(2). Other non-content records can be obtained by a court order (a “§ 2703(d) order”).

22
See id. § 2703(c)(2), (d). To obtain the content of electronic communications, stored recently (i.e.,
23
for less than 180 days), the government must secure a warrant that has been issued using the
24
procedures described in the Federal Rules of Criminal Procedure. See id. § 2703(a). For older
25
electronic communications, a warrant is only required if the government does not provide notice to
26
the subscriber or customer. See id. § 2703(b)(1)(B).
27
ORDER RE: MOTION FOR DE NOVO REVIEW
CASE NO. 16-mc-80263-RS

28
2

III. LEGAL STANDARD

1

It is not obviously clear where this matter falls within the scope of 28 U.S.C. § 636 and

2
3

thus which standard of review applies. The parties agree that de novo review should apply and,

4

indeed, de novo review seems most appropriate both because the matter is analogous to a

5

dispositive motion, see Strong v. United States, 57 F. Supp. 2d 908, 913-14 (N.D. Cal. 1999), and

6

because courts have routinely held that the exercise of a magistrate judge’s powers under

7

§ 636(b)(3) are accorded de novo review. See In re Search of Info. Associated with

8

[redacted]@gmail.com that is Stored at Premises Controlled by Google, Inc., No. 16-MJ-00757

9

(BAH), 2017 WL 3445634, at *4 (D.D.C. July 31, 2017) (“In re Search”). Accordingly, the

10

magistrate judge’s order is reviewed de novo.
IV. DISCUSSION

United States District Court
Northern District of California

11
12

A. Motion For De Novo Review

13

The central question here is whether the execution of a search warrant for foreign-stored

14

communications, issued under the SCA, constitutes an extraterritorial application of that statute.

15

The Second Circuit appears to be the only court of appeal thus far to have considered this issue.

16

See In the Matter of a Warrant to Search a Certain E-Mail Account Controlled & Maintained by

17

Microsoft Corp., 829 F.3d 197 (2d Cir. 2016) (“Microsoft I”), reh’g denied en banc, 855 F.3d 53

18

(2d Cir. Jan. 24, 2017) (“Microsoft II”). In Microsoft I, a unanimous panel held that such a

19

warrant constitutes an unlawful extraterritorial application of the SCA. In a split 4 to 4 decision,

20

the Second Circuit denied the government’s petition for rehearing en banc.1 Since then,

21

apparently every other court to consider the issue has rejected the holding of Microsoft. See In re

22

Search, 2017 WL 3445634, at *5.
To decide whether the presumption against extraterritoriality limits the reach of a statutory

23
24

provision in a particular case, courts apply a two-part test. See Morrison v. National Australia

25
26
27

1

Given the recent wave of motions being filed in analogous cases across the country, basic
familiarity with the Microsoft decision is assumed and the arguments presented therein are not
described in detail here.
ORDER RE: MOTION FOR DE NOVO REVIEW
CASE NO. 16-mc-80263-RS

28
3

1

Bank Ltd., 561 U.S. 247, 261-70 (2010). At the first step, courts ask “whether the statute gives a

2

clear, affirmative indication that it applies extraterritorially.” RJR Nabisco, Inc. v. European

3

Cmty., 136 S. Ct. 2090, 2101 (2016). If not, courts determine “whether the case involves a

4

domestic application of the statute.” Id. They do this by looking to the statute’s focus. “If the

5

conduct relevant to the statute’s focus occurred in the United States, then the case involves a

6

permissible domestic application even if other conduct occurred abroad; but if the conduct

7

relevant to the focus occurred in a foreign country, then the case involves an impermissible

8

extraterritorial application regardless of any other conduct that occurred in U.S. territory.” Id.

9

In this case, the magistrate judge found, at step one, that section 2703 does not contemplate
or permit extraterritorial application. At step two, she decided that the conduct relevant to the

11
United States District Court
Northern District of California

10

SCA’s focus takes place inside the United States. Not surprisingly, Google does not object to the

12

magistrate judge’s decision at step one. Rather, the parties’ dispute centers on step two. Relying

13

on Microsoft, Google argues that the SCA’s focus is user privacy and that “the invasion of the

14

customer’s privacy takes place under the SCA where the customer’s protected content is

15

accessed.” 829 F.3d at 56. The magistrate judge, however, followed as persuasive the analysis of

16

the dissenters in Microsoft II. She reasoned that the conduct relevant to the focus of the SCA is

17

the disclosure of the data in the service provider’s possession and that such disclosure happens

18

where Google accesses and delivers the information—i.e., in the United States. She further

19

reasoned that, even assuming the SCA’s focus is privacy, the warrant requirement protects that

20

interest. She thus concluded that, “[i]f statutory and constitutional standards are met, it should not

21

matter where a service provider chooses to store the 1’s and 0’s.” Order at 8 (citing Microsoft II,

22

855 F.3d at 61-62 (Jacobs, J. dissenting)).

23

Before considering the propriety of the magistrate judge’s extraterritoriality analysis, it

24

must be noted that the SCA warrant here can be properly characterized as “a domestic execution

25

of the court’s statutorily authorized enforcement jurisdiction over a service provider, which may

26

be compelled to retrieve electronic information targeted by the warrant regardless of where the

27

information is ‘located.’” In re Search, 2017 WL 3445634, at *14. Courts have the power to
ORDER RE: MOTION FOR DE NOVO REVIEW
CASE NO. 16-mc-80263-RS

28
4

1

exercise authority on entities over whom they have personal jurisdiction, including compelling

2

those entities to retrieve data from abroad. See id. (citing Blackmer v. United States, 284 U.S.

3

421, 438 (1932)). A statute may thus authorize courts to issue orders compelling an entity within

4

its enforcement jurisdiction to produce records located abroad that are relevant to an offense

5

committed in the United States. See id. at *15 (citing United States v. Bank of Nova Scotia, 730

6

F.2d 817, 828 (11th Cir. 1984)).2 As explained in In re Search, “where the evidence is stored or

7

‘located’ is irrelevant. Instead, the critical inquiry is whether the service provider has sufficient

8

‘control’ to retrieve and disclose the targeted records and communications in the United States.”

9

Id. at *17. Accordingly, as an initial matter, Google is obligated to comply with the warrant as a

10

proper exercise of the court’s enforcement jurisdiction.
The extraterritoriality analysis compels the same conclusion. Sections 2702 and 2703

United States District Court
Northern District of California

11
12

clearly concern the disclosure of customer communications; indeed, they are titled “Voluntary

13

Disclosure” and “Required Disclosure,” respectively. While Section 2701 relates to unauthorized

14

access, it recognizes that providers have authority to access customers’ electronic

15

communications. Thus, considering sections 2701, 2702, and 2703 together, “it is clear that the

16

SCA protects user privacy by prohibiting unlawful access of customer communications (such as

17

hacking), and by regulating a provider’s disclosure of customer communications to third parties.”

18
19
20
21
22
23
24
25
26
27

2

Google argues that Congress used the term “warrant” in section 2703 to convey a territorial
limitation. As others have noted, however, an SCA warrant does not appear to be a traditional
search warrant. “The SCA does not describe the warrant as a search warrant. Nor does it contain
language implying (let alone saying outright) that the warrant to which it refers authorizes
government agents to go to the premises of a service provider without prior notice to the provider,
search those premises until they find the computer, server or other device on which the sought
communications reside, and seize that device (or duplicate and “seize” the relevant data it
contains).” Microsoft I, 829 F.3d at 226 (Lynch, J. concurring). “Rather, the statute expressly
requires the ‘warrant’ not to authorize a search or seizure, but as the procedural mechanism to
allow the government to ‘require a [service provider] to disclose the contents of [certain]
electronic communication[s]’ without notice to the subscriber or customer.” Id. at 227. Moreover,
the nature of the records demanded is different from that of the physical documents sought by
traditional search warrants. See id.; see also Microsoft II, 855 F.3d at 61 (Jacobs, J. dissenting)
(“At stake in this case is not whether Microsoft can be compelled to import and deliver a disk [],
but whether Microsoft can be compelled to deliver information that is encoded on a disk in a
server and that Microsoft can read.”).
ORDER RE: MOTION FOR DE NOVO REVIEW
CASE NO. 16-mc-80263-RS

28
5

1

Microsoft II, 855 F.3d at 68 (Cabranes, J. dissenting). To the extent the statute focuses on privacy,

2

the focus is on disclosures to third parties, not on the provider’s access to user data. Section 2701

3

expressly exempts from its prohibition of unlawful access conduct authorized by the “entity

4

providing a wire or electronic communications service.” 18 U.S.C. 2701(c)(1).
Google claims that conduct relevant to the focus of the SCA occurs outside the United

5
6

States because (1) the searching, accessing and retrieval of foreign-stored communications

7

intrudes on user privacy and (2) such acts are essential to the statutory prerequisites for disclosure.

8

As to the intrusion on user privacy, the conduct relevant to the SCA’s focus is a provider’s

9

disclosure or non-disclosure of emails to third parties, not a provider’s access to a customer’s data.
See 18 U.S.C. 2701(c)(1). Moreover, Google’s mere access and retrieval of foreign-stored data

11
United States District Court
Northern District of California

10

does not amount to an infringement of a user’s reasonable expectation of privacy or a meaningful

12

interference with a user’s possessory interests, see United States v. Jacobsen, 466 U.S. 109, 113

13

(1986), and, furthermore, the warrant requirement fully protects user privacy.
As to the question of whether Google is undertaking essential aspects of compliance with

14
15

section 2703 outside the United States, the answer is no. As a factual matter, the information

16

sought by the government is easily and lawfully accessed in the United States, and disclosure of

17

that content would likewise take place in the United States. Indeed, only personnel in Google’s

18

Legal Investigations Support team are authorized to access the content of communications in order

19

to produce it in response to legal process and all such Google personnel are located in the United

20

States. See Dkt. No. 37, ¶ 5.3 Accordingly, the conduct relevant to the SCA’s focus occurs in the

21

United States. See RJR Nabisco, 136 S. Ct. at 2101 (“If the conduct relevant to the statute’s focus

22
23
24
25
26
27

3

The government argues that the Senate’s ratification of the Cybercrime Convention in 2006
further suggests that Congress intended the SCA to require a provider in the United States to
disclose foreign-stored data in its custody or control. Google responds that ratification of a treaty
expresses the will of the Senate only and that “‘the views of a subsequent Congress form a
hazardous basis for inferring the intent of an earlier one,’” Waterman S.S. Corp. v. United States,
381 U.S. 252, 269 (1965), especially where, as here, so much time has passed between enactment
of the SCA and ratification of the Convention. Because the magistrate judge’s decision rests on
sound statutory analysis, this secondary argument need not be reached.
ORDER RE: MOTION FOR DE NOVO REVIEW
CASE NO. 16-mc-80263-RS

28
6

1

occurred in the United States, then the case involves a permissible domestic application even if

2

other conduct occurred abroad.”) The conduct allegedly occurring abroad—i.e., Google’s

3

accessing of foreign-stored e-mails—is not relevant to the focus of the SCA because section 2701

4

specifically excludes providers from the statute’s prohibitions against access to stored

5

communications.

6

Google insists the magistrate judge engaged in “judicial-speculation-made-law,” Morrison,

7

561 U.S. at 261, when she decided how the SCA should apply to the world of “cloud” computing,

8

which did not exist when Congress enacted the statute. This argument, however, conflates the two

9

prongs of the Morrison analysis, see Microsoft II, 855 F.3d at 74, and, in any event, the magistrate
judge’s decision is based on a reasonable statutory interpretation, not on a policy determination.

11
United States District Court
Northern District of California

10

Moreover, while not dispositive, the policy implications of Google’s interpretation of the SCA are

12

worth noting. Because Google automatically moves data from one location to another to optimize

13

efficiencies, Google’s interpretation would render United States warrant authority arbitrarily

14

confined based on where the data is located pursuant to an algorithm, not any territorially

15

meaningful storage decision. Additionally, while the government is generally able to use Mutual

16

Legal Assistance Treaties (“MLATs”) to obtain evidence located abroad, this process would likely

17

be useless in seeking electronic communications held by service providers like Google because by

18

the time the MLAT process had begun, any electronic communications targeted in an SCA

19

warrant could have moved to a completely different country. See In re Search, 2017 WL

20

3445634, at *26.

21

Of course, government requests for communications of foreign citizens or residents raise

22

serious international relations concerns. In his concurrence in Microsoft I, Judge Lynch argued

23

persuasively, while it is not clear that it matters whether the customer is a United States person or

24

not under the rather simplistic “focus” test adopted by the Supreme Court in Morrison, “it should

25

matter.” Microsoft I, 829 F.3d at 230 (emphasis in original). On this basis, he suggested that the

26

relevant conduct, for purposes of the Morrison step two analysis, is the invasion of privacy which

27

occurs where the person whose privacy is invaded customarily resides. Id. Yet, here, as in
ORDER RE: MOTION FOR DE NOVO REVIEW
CASE NO. 16-mc-80263-RS

28
7

1

Microsoft, the record does not establish the nationality of the customer whose emails are sought.

2

Judge Lynch was ultimately persuaded that the warrant in Microsoft was nevertheless an

3

extraterritorial application of the SCA because that case “could well be [] one of . . . records stored

4

at the behest of a foreign national on servers in his own country.” Microsoft I, 829 F.3d at 230.

5

This case, however, is different. While Microsoft’s storage algorithm is based on the user’s self-

6

reported location, Google’s equivalent has no territorial tether. As such, there is no basis for

7

concluding that this case “could well be” one involving “records stored at the behest of a foreign

8

national on servers in his own country.” Id. Relatedly, “the interests of foreign internet electronic

9

communication service providers, whose headquarters are abroad and whose customers choose to
subscribe to those services with the knowledge that the provider is located outside the United

11
United States District Court
Northern District of California

10

States are not at stake here.” Microsoft II, 855 F.3d at 76 (Droney, J. dissenting). While the

12

policy concerns raised by the parties are significant and require the attention of Congress, Google

13

has failed to show that it is being compelled to perform conduct relevant to the SCA’s focus

14

outside the United States.

15

B. Request for Order to Show Cause

16

The government asks the court to issue an order to show cause why Google should not be

17

held in contempt for refusing to comply with the search warrant and the magistrate judge’s order.

18

The government made a similar request to the magistrate judge and she declined to grant it. See

19

Dkt. No. 31 (“The court is confident that the parties can work out their differences without court

20

intervention but remains available to help if they cannot. The parties must raise any disputes via

21

the joint letter process in the court’s standing order, which is attached.”). The government did not

22

seek review of the magistrate judge’s order, nor has it sought to avail itself of the joint letter

23

process described in the standing order. Further, Google sought review of the magistrate judge’s

24

order less than one week after the magistrate judge issued her amended order. In light of the

25

Second Circuit decision in Microsoft and the absence of relevant Ninth Circuit precedent,

26

Google’s diligent, good faith efforts to comply with current law do not warrant contempt at this

27

stage of the proceedings.
ORDER RE: MOTION FOR DE NOVO REVIEW
CASE NO. 16-mc-80263-RS

28
8

1

V. CONCLUSION

2

The magistrate judge’s order is affirmed and Google is ordered to produce all content

3

responsive to the search warrant that is accessible, searchable, and retrievable from the United

4

States pursuant to the terms of the warrant. The government’s request for an order to show cause

5

is denied.

6
7

IT IS SO ORDERED.

8
9
10

United States District Court
Northern District of California

11

Dated: August 14, 2017
______________________________________
RICHARD SEEBORG
United States District Judge

12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
ORDER RE: MOTION FOR DE NOVO REVIEW
CASE NO. 16-mc-80263-RS

28
9