LAUREL BEELER, Magistrate Judge.
The government applied for, and the court issued, a search warrant under 18 U.S.C. § 2703(a), the Stored Communications Act ("SCA"), directing Google to produce stored content related to certain email accounts.
Google has a distributed system where algorithms determine how it sends and stores data — in packets or component parts — in aid of overall network efficiency. In this case, the result is that Google has content that is responsive to the search warrant and is stored wholly outside of the United States. The legal issue is whether § 2703(a) reaches content stored outside of the United States. Citing the Second Circuit, Google contends that the government cannot compel it to disclose the extraterritorial content.
The SCA regulates disclosure of data in a service provider's possession. The service provider — Google — is in the district and is subject to the court's jurisdiction; the warrant is directed to it in the only place where it can access and deliver the information that the government seeks. This disclosure is a domestic application of the SCA. The court thus orders Google to produce all content responsive to the search warrant that is retrievable from the United States, regardless of the data's actual location.
Google — headquartered in the United States and incorporated in Delaware — has its principal place of business in California.
Google has a legal team in the United States — the Legal Investigations Support team — that produces information in response to search warrants and other requests for legal process.
The search warrant — signed on June 30, 2016 — authorized production of information from specific Google email accounts regarding subscriber information, evidence of specified crimes, and information about the account holders' true identities, locations, and assets.
Google moved to quash or amend the search warrant; the government opposed the motion.
The warrant here issued under 18 U.S.C. § 2703(a), which is part of the Stored Communications Act ("SCA"). Section 2703 sets forth the legal processes that the government must use to require service providers such as Google to produce customer communications and records. For example, only an administrative subpoena is needed for basic subscriber information and transactional information. 18 U.S.C. § 2703(c)(2). The government can obtain a court order without notice to the customer for other non-content records if it "offers specific and articulable facts showing that there are reasonable grounds" that the records "are relevant and material to an ongoing criminal investigation." Id. § 2703(d). Other user content can be obtained by subpoena or a 2703(d) order with notice to the subscriber or customer. Id. § 2703(b)(1)(A). To obtain stored communications, the government must obtain a "warrant issued using the procedures described in the Federal Rules of Criminal Procedure (or, in the case of a State court, issued using State warrant procedures) by a court of competent jurisdiction." Id. § 2703(a). The SCA defines a "court of competent jurisdiction" as (1) a U.S. district or appeals court that has jurisdiction over an offense being investigated, is in the service provider's district, or is acting on a request for foreign assistance under 18 U.S.C. § 3512, or (2) a state court of general criminal jurisdiction authorized by state law to issue search warrants. Id. § 2711(3). It is otherwise silent about its territorial reach or the reach of its warrant procedures.
The procedures for obtaining a search warrant are in Federal Rule of Criminal Procedure 41 — titled "Search and Seizure." Rule 41(b)'s venue provision limits its territorial reach to federal districts, generally providing for warrants for persons or property in the issuing court's district and sometimes allowing warrants for persons or property outside the district (but still in a federal district) in specified contexts, such as (1) the persons and property were in the district when the warrant issued, (2) investigations involving domestic or international terrorism, and (3) tracking devices installed in the district. Fed. R. Crim. P. 41(b)(1)-(4). Rule 41(b)(5) allows the issuance of a warrant for property outside the jurisdiction of any state or district but in (1) "a United States territory, possession, or commonwealth," (2) "a United States diplomatic or consular mission in a foreign state," or (3) a residence "owned or leased by the United States and used by United States personnel assigned to the United States diplomatic or consular mission in a foreign state." Rule 41(b)(6) allows warrants to issue in one district for searches of computer and media in other districts under certain circumstances.
The SCA does not specify whether it or its warrant provisions apply outside the United States. The court thus presumes that they do not under the canon of statutory construction known as the presumption against extraterritoriality. RJR Nabisco, Inc. v. European Cmty., 136 S.Ct. 2090, 2100 (2016); Morrison v. Nat'l Australia Bank, Ltd., 561 U.S. 247, 255 (2010). "Absent clearly expressed congressional intent to the contrary, federal laws will be construed to have only domestic application." RJR Nabisco, 136 S. Ct. at 2100 (citing Morrison, 561 U.S. at 255).
There are several reasons for the presumption. Id. "Most notably, it serves to avoid the international discord that can result when U.S. law is applied to conduct in foreign countries." Id. "[I]t also reflects the more prosaic commonsense notion that Congress generally legislates with domestic concerns in mind." Id. (quotation omitted). "We therefore apply the presumption across the board, `regardless of whether there is a risk of conflict between the American statute and a foreign law.'" Id. (quoting Morrison, 561 U.S. at 255).
Three recent Supreme Court decisions establish a two-part framework to analyze whether a statute applies extraterritorially. RJR Nabisco, 136 S. Ct at 2101; Kiobel v. Royal Dutch Petroleum Co., 133 S.Ct. 1659, 1665-69 (2013); Morrison, 561 U.S. at 261-70. "At the first step, we ask whether the presumption against extraterritoriality has been rebutted—that is, whether the statute gives a clear, affirmative indication that it applies extraterritorially." RJR Nabisco, 136 S. Ct at 2101. "We must ask this question regardless of whether the statute in question regulates conduct, affords relief, or merely confers jurisdiction." Id. "If the statute is not extraterritorial, then at the second step we determine whether the case involves a domestic application of the statute, and we do this by looking to the statute's `focus.'" Id. "If the conduct relevant to the statute's focus occurred in the United States, then the case involves a permissible domestic application even if other conduct occurred abroad; but if the conduct relevant to the focus occurred in a foreign country, then the case involves an impermissible extraterritorial application regardless of any other conduct that occurred in U.S. territory." Id.
The parties do not dispute that at step one, section 2703 and its warrant provisions do not contemplate or permit extraterritorial application.
Only the Second Circuit has considered the extraterritorial application of the SCA. In Microsoft, it held that the SCA did not apply outside the United States and Microsoft need not disclose user content stored in Ireland. Microsoft, 829 F.3d at 201-02, 216-21. Like Google, Microsoft provides web-based email. Id. at 202. It stores the contents of emails and other non-content information on a network of servers. Id. Its "service offerings" are "segmented into regions." Id. Most customer data (such as email, calendar entries, and documents) is stored in data centers in the region where the customer is located. Id. The customer self-reports the customer's location when subscribing to the Microsoft service; Microsoft does not verify user identity or location. Id. at 202-03. Based on the user's country code, Microsoft transfers data associated with the user to the server associated with the country code (for example, the Dublin datacenter), and (at the time) deleted most data sets in the United States. Id. at 203. At some offices in the United States, Microsoft could collect account data stored on its international servers. Id.
The Second Circuit denied the government access to the Ireland content. It determined that the statute's focus was user privacy, rejected the government's contrary argument that the SCA focused on "disclosure of content," and concluded that requiring Microsoft to disclose content stored in Ireland would be an unlawful extraterritorial application of the act. Microsoft, 829 F.3d at 216-21. The government sought rehearing en banc, which the Second Circuit denied in a four-four split decision. See 2017 WL 362765 (2nd Cir. Jan. 24, 2017). The court follows as persuasive the reasoning of the dissenters from the denial of rehearing en banc and concludes that the disclosure of information from Google's headquarters in the United States is a domestic application of the SCA. Id. at *5-18 (four dissenters — Circuit Judges Jacobs, Cabranes, Raggi, and Droney — each wrote a dissent; each dissenter joined the others' dissents). The statute's application here is lawful, and Google thus must provide all responsive information.
The parties stipulate that the only place to access the information is in the United States.
In sum, the disclosure is a domestic application of the SCA. Other courts have reached similar conclusions after a similar analysis of the Microsoft decision. See, e.g., In re: Information associated with one Yahoo email address that is stored at premises controlled by Yahoo, No. 2:17-mj-1234-WED, ECF No. 1 at 6-8 (E.D. Wis. Feb. 21, 2017);
The court denies Google's motion to quash the warrant for content that it stores outside the United States and orders it to produce all content responsive to the search warrant that is retrievable from the United States, regardless of the data's actual location.