Why did we decide to intervene in a case before the US Supreme Court?

US vs. Microsoft: the Brazilian experience and the impact that the decision may cause globally

Among the cases that will be tried by the United States Supreme Court this year is United States v. Microsoft Corporation, which basically discusses whether the US government can obtain the content of communications stored on servers located outside the country. In addition to defining the scope of warrants issued by US judges, the case has serious repercussions for discussions of jurisdiction and law enforcement access to user data in the rest of the world.

As a contribution to the debate that will be held at the Supreme Court, InternetLab, an independent research center for Law and technology, filed yesterday an amicus brief taking the Brazilian experience with the theme to the Court, regarding the impact that the decision may cause globally depending on how the case is solved.

Understand the case

In the scope of a drug trafficking investigation, US authorities obtained a court order determining for Microsoft to breach the secrecy of emails which are stored on the company’s servers located in Ireland. Instead of handing the content of the requested emails, Microsoft decided to question the legality of the order. Having lost in the District Court for the Southern District of New York, the company appealed to the Court of Appeals for the Second Circuit, which reversed the previous decision, concluding in favor of Microsoft.

The US government then appealed to the Supreme Court, which accepted the case to be trialed in October 2017. The main disputed issue is whether the order issued by the US judge for the disclosure of the content of communications stored outside the US could be considered “extraterritorial”. If so, it would be illegal.

The US government denies that the case implicates on any extraterritorial exercise of power. As Microsoft could access the information from the US, the country where it will be delivered to the investigation authorities, the government argues that the fact that the data is stored abroad is irrelevant.

Microsoft, in its turn, argues that the US legislation in question (the Stored Communications Act) never had the intention of granting powers beyond the US borders to judges. As the company is being forced to make the data apprehension in Ireland as if it were an agent of the state, indeed there would be the exercise of extraterritorial power, which makes this order for breach of secrecy illegal. For the US government to have access to the requested information, Microsoft states that it would be necessary to follow the procedures provisioned in the MLAT for criminal matter celebrated with Ireland.

Repercussions in Brazil

Beyond the questions of interpretation of the US legislation, the decision of the US Supreme Court will define the limitations of the US government’s reach on communications made from services offered by Internet companies located in that country. This means to say that a decision favorable to the US government would then grant it powers to request to these companies data about communications of any citizen, independently of the place where they are located or the country in which this communication happened. This would significantly expand the access to communication prerogatives by the US government, which could happen in spite of this information being protected by national legislation of other countries that may have guarantees and their own mechanisms to access this same data. This would include data of over 100 million Brazilian users of the major Internet platforms located in the US.

In addition, the decision may represent an alarming precedent as it would recognize the power of a government (in this case, of the US) to access information of citizens independently of it being under the jurisdiction of other countries whose legislation can establish different degrees of privacy protection and due legal process. In practice, if favorable towards the US government, the decision would be a strong argument for investigation authorities from other countries to demand the same kind of prerogative, establishing a dynamic of accessing users’ communication data that surpasses the existing international cooperation treaties, precisely thought for the equalization of these types of jurisdictional conflicts.

In this context, it is worth reminding the notorious confrontations between Brazilian investigation authorities and US companies. In the scope of criminal investigations in Brazil, it is common for Brazilian authorities to obtain orders for the breach of secrecy of electronic communications but face difficulties regarding the fulfillment of the orders by US companies. The main reason for this is that the sought data is outside of Brazilian territory, controlled by parent companies which are forbidden by US legislation (the same Stored Communications Act) to disclose this information to foreign governments outside of the usual diplomatic procedures, the MLATs.

Conflicts of this kind have led to the arrest of executives and even the blocking of applications (even before “end-to-end cryptography” became a technical barrier!) and they continue to generate millionaire fines imposed to the subsidiary companies located in Brazil. Last December, the issue was taken to the Federal Supreme Court through the Ação Declaratória de Constitucionalidade n. 51.

In it, ASSESPRO (Federation for the Information Technology Companies Associations) requests the assertion of the constitutionality of several mechanisms of international cooperation for the obtention of communication content. Although the Marco Civil extends the Brazilian jurisdiction for data that is stored, generated, and analysed in Brazil and to any company that provides the service in the country, such data and companies are also many times under the US legislation, which, as it was said, prohibits the disclosure of communication content to foreign authorities outside of the procedures established in the MLATs.

The discussion that the Federal Supreme Court will have to face is not simple: it also goes through recognizing the demands of the investigation authorities that claim to have their work obstructed by the inefficiency and tardiness of these MLATs. In this sense, the decision of the US Supreme Court will certainly influence the argumentation of our Justices.

InternetLab’s amicus: the main arguments

From research results from our area of “Privacy and Surveillance”, InternetLab’s intervention in the dispute aims to strengthen the voices that see an extraterritorial measure on the prerogative used by the US government, which will put at stake the usage of international cooperation mechanisms for the production of evidence in the digital context, rousing the jurisdiction conflicts and overruling the guarantees to privacy embedded in these mechanisms. In this sense, our intervention argues for three main ideas:

First of all, that an order for breach of confidentiality issued by a US judge can be enforced and has extraterritorial effects whenever the communications being targeted are located in countries that have mutual legal assistance treaties with the United States. In these cases, the countries in question decided, within their sovereignty, that the appropriate mechanism to access evidence implying both countries is the diplomatic one: so the due legal process is guaranteed. In Brazil, this procedure is present in the Executive Order no. 3.810/2001.

Secondly, that an order for breach of confidentiality issued by a US judge can be enforced and has extraterritorial effects whenever the targeted communications are submitted, simultaneously, to the jurisdiction of countries that establish conflicting rules about the access to this information. In the case of data generated in Brazil, at the same time that the Brazilian Internet Civil Rights Framework in its article 11 determined the enforcement of the Brazilian legislation to all collected, analysed, or stored information in the national territory, which would, in theory, include the disclosure of this information to investigation authorities before a court order, the Stored Communications Act — to which US companies that act in the country are also submitted — prohibits the disclosure of the content of communications to foreign authorities. In this case, the double jurisdiction on this data cannot be ignored by judges from both countries involved.

Thirdly, that the issues involved in the case should be faced as public policy choices and, therefore, should be taken by other judiciary levels. The Legislative and Executive Branches should act in order to improve the international legal assistance treaties, making them more efficient, and putting forward the discussions about alternative models of cooperation, in a way to secure the preservation of interests of sovereign states and their investigation authorities, but also the right to privacy and to the due legal process in the cases that involve the access to Internet users’ data.

The complete brief, which was written in pro bono partnership with Boies Schiller Flexner LLP, is available at the Supreme Court’s website. We emphasize that the elaboration of this brief did not involve any kind of compensation from Microsoft to InternetLab.

The future

The US Supreme Court should decide the case until September 2018. With the end of the deadline for the presentation of amici curiae, the opportunities to intervene in the process have ended. Meanwhile, in Brazil, we are waiting on the procedures of ADC n. 51, which, until now, has only one amicus curiae made by Facebook Brasil.

To ponder an issue like this is a task that surpasses the limits of the juridical technique. It is a public policy decision that involves the interests of different sectors and segments of society. For this reason, and with the compromise to the informed debate on the topic, InternetLab has been promoting discussions and producing research on the access to digital data in the scope of criminal processes, MLATs, and reformation proposals. With this, we aim to understand the difficulties presented by authorities, the obligations imposed by companies, and the bottlenecks of the current system of international legal assistance, in a way to mitigate the difficulties, lessen the conflicting obligations, and correct the bottlenecks. All with respect to the principles of the Brazilian Internet Civil Rights Framework, which recognizes the global scale of the network and protects human rights such as privacy and freedom of speech.

Our representation before the US Supreme Court goes directly in the sense of urging its Justices to take into account all of these elements during the trial.

By Dennys Antonialli and Jacqueline de Souza Abreu

Translation: Ana Luiza Araujo

Originally published on JOTA [in Portuguese]