In re Search of Info. Associated With Accounts Identified as [Redacted]@Gmail.com, CASE NO. 2:16–mj–02197–DUTY–1

• Decision Date: 13 July 2017
• Docket Number: CASE NO. 2:16–mj–02197–DUTY–1
• Citation: 268 F.Supp.3d 1060
• Parties: IN RE SEARCH OF INFORMATION ASSOCIATED WITH ACCOUNTS IDENTIFIED AS [REDACTED]@GMAIL.COM and others Identified in Attachment A that are Stored at Premises Controlled by Google Inc., 1600 Amphitheater Parkway, Mountain View, CA 94025, Defendants.
• Court: U.S. District Court — Central District of California

268 F.Supp.3d 1060

IN RE SEARCH OF INFORMATION ASSOCIATED WITH ACCOUNTS IDENTIFIED AS [REDACTED]@GMAIL.COM and others Identified in Attachment A that are Stored at Premises Controlled by Google Inc., 1600 Amphitheater Parkway, Mountain View, CA 94025, Defendants.

CASE NO. 2:16–mj–02197–DUTY–1

United States District Court, C.D. California.

Signed July 13, 2017

ORDER RE GOVERNMENT'S MOTION FOR AN ORDER TO COMPEL IMMEDIATE PRODUCTION OR REQUIRE GOOGLE, INC. TO SHOW CAUSE WHY GOOGLE, INC. SHOULD NOT BE HELD IN CONTEMPT (Dkt. 6)

JOHN E. MCDERMOTT, UNITED STATES MAGISTRATE JUDGE

I. INTRODUCTION

This case presents the issue of whether Google, Inc. ("Google") may refuse to produce information stored on foreign data servers responsive to a warrant issued pursuant to the Stored Communications Act ("SCA"), 18 U.S.C. § 2703.

The Second Circuit, in the only appellate decision to date, ruled that Microsoft was not required to repatriate information stored on a server in Dublin, Ireland, because to do so would be an impermissible extraterritorial application of the SCA. In the Matter of a Warrant to Search a Certain E–Mail Account Controlled and Maintained by Microsoft Corp., 829 F.3d 197, 222 (2d Cir. 2016) (" Microsoft I" ). On whether to grant rehearing, the en banc panel split four to four, denying rehearing en banc and leaving the panel opinion in place. 855 F.3d 53, 55 (2d Cir. 2017) (" Microsoft II"). Every Magistrate Judge decision since Microsoft, however, has either rejected the Microsoft I ruling and agreed with the four dissenting opinions in Microsoft II, and/or distinguished Microsoft I on the facts. These five cases all hold that disclosure of electronic information in the United States retrieved from computers abroad does not constitute an extraterritorial application of the SCA.¹ Four of the five cases involved Google. These cases all reason that, because there is no invasion of privacy until disclosure of the data in the United States, the warrants in dispute are a domestic application of the SCA.

This Court also agrees with the dissenting opinions in Microsoft II and further agrees that Microsoft I is distinguishable on its facts as to Google. Google, therefore, will be required to comply forthwith with the SCA warrant issued in this case.

II. PROCEDURAL BACKGROUND

On November 3, 2016, this Court, at the request of the Government, issued a search warrant pursuant to 18 U.S.C. § 2703 of the SCA calling for the disclosure of information in 33 gmail accounts in the possession, custody, or control of Google, Inc. (Dkt. 2.) The request was supported by an extensive affidavit from a Government agent establishing probable cause to believe that information regarding an ongoing criminal investigation is contained within the identified gmail accounts. (Dkt. 1.) This Court has jurisdiction of the matter because the alleged criminal activity occurred in this District. This Court has in personam jurisdiction over Google, which Google does not contest. (Dkt. 30, Transcript ("Tr.") at 41.) The warrant makes clear that Google was not asked to search the accounts for content information related to criminal activity. Government personnel will conduct a content search of the account information after an electronic copy of it is produced by Google to the Government.

Google complied with the warrant to the extent information from the subject gmail accounts was stored in the United States but withheld records stored outside the United States based on the Microsoft I ruling. The Government then filed the instant Motion For An Order To Compel Immediate Production ("Motion") on May 1, 2017. (Dkt. 6.) The Court heard oral argument on the Motion on June 21, 2017. (Dkt. 30, 31.)

III. FACTUAL BACKGROUND

Attached to the Government's Motion is a Stipulation of Facts. (Dkt. 6.) The Stipulation states that Google is a United States company with a principal place of business in California. (Stipulation of Facts ("Stip.") ¶ 1.) Google stores user data in various locations in and outside of the United States. (Stip. ¶ 2.) Some user files are broken into parts and different parts of files may be stored in different locations and different countries at the same time. (Stip. ¶ 3.) The Stipulation then provides:

Google operates a state-of-the-art intelligent network that, with respect to some types of data including some of the data at issue in this case, automatically moves data from one location on Google's network to another as frequently as needed to optimize for performance, reliability and other efficiencies. As a result, the country or countries in which specific user data, or components of that data, is located may change. It is possible, therefore, that the network will change the location of data between the time when the legal process is sought and when it is served. In addition, for certain types of data, including some of the data at issue in this case, Google's tool that queries the network does not report the country in which foreign-stored data is located.

(Stip. ¶ 4 (emphasis added).)

At the hearing, Google provided more information on its operating system. It stated that any transmission of data in a foreign country back to the United States would not occur by human hand but through a direction or command from Google headquarters in Mountain View, California, to servers abroad. (Tr. at 30.) Data is distributed overseas for efficiency and optimization reasons, not because of anything that the account holder did or requested. (Tr. at 31–32.) Indeed, the account holder has no expectation whether the data is abroad or in the United States. (Tr. at 33.) Google's system operates automatically and thus a user cannot use it to put data outside the reach of U.S. law enforcement. (Tr. at 33.) Google's system is not controlled by an individual but by network parameters. (Tr. at 44.) In this respect, Google's system differs significantly from Microsoft's system, in which users enter a country code like Ireland at registration and then Microsoft migrates the data to Ireland to be stored there. (Tr. at 33, 44.)

The data on Google's network is dynamic, often on the move, and could be in the United States before the warrant was executed but not when executed or left after it was executed, and information now overseas could be back in the United States at any time. (Tr. 34–35.) It could move multiple times in the course of a week. (Tr. at 35.) The data, moreover, is being moved around not because of what somebody in Mountain View is doing with a keystroke or at the user's Request but because it is happening automatically. (Tr. 35.) Google's system can move data around automatically because Google's user agreements authorize Google to provide its services in the most efficient way possible. (Tr. 35–36.) Although some countries have passed blocking statutes to prevent production of data stored in their jurisdictions, Google's system moves data around to foreign servers and back to the United States irrespective of those statutes. (Tr. at 36–37.)

In responding to the warrant, a Google employee in Mountain View executed a key stroke to query the network and whatever came up is what Google produced. (Tr. at 38.) Notably, before the Microsoft I ruling, Google queried its global network, foreign and domestic, when producing data in response to SCA warrants. See In Re Search Warrant No. 16–960–M to Google, 232 F.Supp.3d 708, 713–14 (E.D. Pa. 2017). Based on the Microsoft I ruling, however, Google rewrote its algorithms or instructions to limit its search to data centers in the United States. (Tr. at 39.) Google discloses to the Government what it finds in the United States at the time its personnel conduct their search. (Tr. at 40.)

When responding to legal process, Google only collects and produces data through Google personnel located in the United States. (See Stip. ¶ 5.) Google readily admits that if Google is not required to produce data held by Google outside the United States, neither the United States Government nor any foreign government is able to obtain the data. (See Tr. 43 ("It can create a situation in which no government anywhere can get the data"); Tr. 44 ("There is data that neither the U.S. government nor any government can obtain on Google's network").)

IV. APPLICABLE FEDERAL LAW

A. The Stored Communications Act ("SCA")

The SCA was passed as part of the Electronic Communications Privacy Act of 1986, Pub. L. No. 99–508, 100 Stat. 1848 (1986). 18 U.S.C. § 2701, entitled "Unlawful access to stored communications," makes it a criminal offense to access stored electronic communications without authorization. § 2701(a) and (b). Notably, this provision does not apply to conduct by the provider of electronic communications services or by the user, nor does it apply to compelled disclosures under § 2703. § 2701(c). Section 2702, entitled "Voluntary disclosure of customer communications or record," prohibits an electronic communications provider from disclosing the contents of stored data with specified exceptions.

Section 2703, entitled "Required disclosure of customer communications or records," governs how the Government may compel disclosure of customer data. Under § 2703(c)(2) the Government may obtain non-content customer and transactional information by an administrative subpoena, which requires no judicial review. Under § 2703(c)(2) and (d), other non-content records may be obtained by court order, which may be issued based on "specific and articulable facts showing ... reasonable grounds to believe that the contents or records ... are relevant and material to an ongoing criminal investigation."

Under § 2703(a), (b)(A), and (c)(A), the Government may require disclosure of the contents of electronic communications "only pursuant to a warrant issued using the procedures described in the Federal Rules of Criminal Procedure ... by a court of competent jurisdiction." The SCA defines a court of competent jurisdiction as a United States district court...