Stanford Law Review Volume 68 April 2016 ARTICLE Against Data Exceptionalism Andrew Keane Woods* Abstract. One of the great regulatory challenges of the Internet era—indeed, one of today’s most pressing privacy questions—is how to define the limits of government access to personal data stored in the cloud. This is particularly true today because the cloud has gone global, raising a number of questions about the proper reach of one state’s authority over cloud-based data. The prevailing response to these questions by scholars, practitioners, and major Internet companies like Google and Facebook has been to argue that data is different. Data is “unterritorial,” they argue, and therefore incompatible with existing territorial notions of jurisdiction. This Article challenges this view. The Article argues that the jurisdictional challenges presented by the global cloud are not conceptually as novel as they seem. Despite the technological wizardry of modern life, the “cloud” is actually a network of storage drives bolted to a particular territory, and there is substantial case law suggesting that courts think of data as a physical object. Moreover, even if the cloud were a free-floating ether, data can be thought of as an intangible asset, like money or debt, which flows across borders; courts have been adjudicating such jurisdictional disputes for centuries. These precedents suggest numerous grounds for states to assert jurisdiction over data—not a single test, as major Internet companies claim. After showing that these jurisdictional problems are not unprecedented, the Article draws from these precedents and outlines practical steps that courts, Congress, and the President can take to alleviate jurisdictional conflicts over the cloud. As Microsoft’s cross-border dispute with the U.S. Department of Justice works its way through the courts, the President negotiates a treaty with the United Kingdom regarding cross-border access to the cloud, and Congress rewrites the Electronic Communications Privacy Act, finding a grounded approach to addressing this problem—one rooted in longstanding jurisdictional and conflicts principles—has never been more critical. * Assistant Professor, University of Kentucky College of Law. The Author thanks Jack Goldsmith, Ryan Goodman, Orin Kerr, Matthew Perault, Jennifer Granick, Tino Cuellar, Jen Daskal, Al Gidari, Nicole Jones, Rick Salgado, Greg Nojeim, Nate Jones, Alex Abdo, Albertina Antognini, Alan Rozenshtein, Peter Swire, Will Baude, Shalev Roisman, as well as members of the legal and policy teams at Google, Facebook, Microsoft, and the GNI. The Article benefited from workshops at NYU Law School, Stanford’s Center for Philanthropy and Civil Society, the Junior International Law Scholars Association’s annual meeting, the Center for Strategic and International Studies, and Harvard’s Berkman Center for Internet and Society. The Author is especially grateful to Gail Kent for organizing a meeting with GCHQ, technology firms, and civil society groups at Wilton Park, where this Article first took shape. 729 Against Data Exceptionalism 68 STAN. L. REV. 729 (2016) Table of Contents Introduction ............................................................................................................................................................ 731 I. The Problem ................................................................................................................................................. 739 A. Evidence in the Global Cloud................................................................................................... 739 B. Jurisdictional Confusion ............................................................................................................. 745 C. A Broken International System .............................................................................................. 748 D. Government Response ................................................................................................................. 751 II. Is Data Different? ....................................................................................................................................... 754 A. The Claim: “Data Is Different” ................................................................................................. 755 B. The Reality: Data Is Not So Different .................................................................................. 756 1. Data as an intangible asset ................................................................................................ 756 a. Intangibility ................................................................................................................... 756 b. Mobility ........................................................................................................................... 758 c. Divisibility and fungibility ................................................................................... 759 d. Distance between the asset holder and the asset ....................................... 760 2. Data as a physical asset ....................................................................................................... 760 C. Summary .............................................................................................................................................. 763 III. Jurisdiction over Data in the Cloud ................................................................................................ 764 A. Prescriptive Jurisdiction ............................................................................................................. 765 1. Location of the data ............................................................................................................. 766 2. Location of the harm .......................................................................................................... 767 3. Citizenship of the suspect ................................................................................................ 768 4. Citizenship of the victim .................................................................................................. 768 5. Citizenship of the data controller ............................................................................... 769 B. Enforcement Jurisdiction ........................................................................................................... 769 C. Integrated Analysis......................................................................................................................... 772 IV. Conflicts of Laws over the Cloud ..................................................................................................... 774 A. A Conflicts Approach to Evidence in the Global Cloud ........................................... 774 1. Identifying true conflicts .................................................................................................. 775 2. Weighing state interests ................................................................................................... 776 3. Reciprocity ............................................................................................................................... 778 B. Blocking Statutes ............................................................................................................................. 779 V. Implications for Law and Policy ....................................................................................................... 781 A. Reforming ECPA ............................................................................................................................ 781 B. Interpreting ECPA ......................................................................................................................... 785 C. Improving Mutual Legal Assistance .................................................................................... 786 D. The Case Against a Global Treaty ......................................................................................... 787 Conclusion ............................................................................................................................................................... 788 730 Against Data Exceptionalism 68 STAN. L. REV. 729 (2016) Introduction On December 4, 2013, a magistrate judge in the Southern District of New York issued a search warrant for the contents and metadata associated with an e-mail account stored by Microsoft.1 Microsoft produced the relevant data stored on its American servers.2 But Microsoft, like many Internet companies, uses data centers located around the world to balance data loads and ensure that a user’s data3 is promptly available wherever the user accesses it.4 Much of this particular customer’s data was stored on the company’s data center in Ireland.5 The company therefore refused to hand over that data on the grounds that the Stored Communications Act (SCA),6 which is part of the Electronic Communications Privacy Act (ECPA),7 does not apply extraterritorially.8 A district judge was unconvinced and upheld the warrant.9 A number of amici have argued that allowing the U.S. government to compel 1. See In re Warrant to Search a Certain E-mail Account Controlled & Maintained by Microsoft Corp., 15 F. Supp. 3d 466, 467-68 (S.D.N.Y. 2014) [hereinafter Microsoft E-mail Search Warrant Case], appeal docketed sub nom. Microsoft Corp. v. United States, No. 14- 2985-cv (2d Cir. argued Sept. 9, 2015). 2. Id. at 468. 3. This Article