This post is written by Associate Editor Andy Countryman. Opinions and views expressed herein are those of the writer alone.
If I save something to my cloud drive (Google Drive, Apple iCloud, Amazon Cloud Drive, etc.), where is it stored? For disinterested users with a rudimentary understanding of what data is, I imagine the line of thinking typically goes something like this: “Well, I know most of the online services use ‘cloud’ storage, but I know there are not invisible storage boxes floating over my head. I suppose my data has to be physically located somewhere.” And after hitting this point of digging, the user is satisfied with his attempt at understanding how cloud storage works. But, this picture is incomplete without the introduction of the internet and servers.
Online service providers, such as Microsoft with its Outlook email service, do store the information in a physical location – on a server at a data center. Data is located in a physical building somewhere and can be accessed with the click of a button from somewhere else. For instance, if an email service provider wanted to retrieve the content of an outgoing email, it could instruct a computer, robot, or person located at the data center to read the email and report back.
Companies with users across the globe must serve them efficiently and cost-effectively. Many companies have set up data centers in centralized locations across the globe to sharpen the delivery of online services. These global companies encounter foreign laws with regularity. None of this is novel; but what is yet to be seen is how technologies like cloud storage will impact the relationship between domestic and foreign laws.
This is the backdrop by which Microsoft opposed a search warrant by the government, under the Stored Communications Act of 1986 (SCA), of emails located on a Microsoft-owned server in Dublin, Ireland. There is no question that the SCA gives government the authority to compel a company to disclose information stored domestically. However, the SCA generally does not have exterritorial reach. Meaning, the SCA cannot be used by the government to force a company to turn over information that is stored in another country. In obtaining a search warrant, the government ordinarily would need to use the treaty mechanisms in place with the country where the information sought is located. But, using the treaty mechanisms can be slower and cumbersome.
The United States argued that because the conduct occurred domestically, that is, Microsoft retrieved the files from here in the United States, that the search warrant was only being applied domestically. The United States believes that the SCA focuses on disclosure, not necessarily on the storage. Further, the United States argued that the information was within Microsoft’s control domestically even though it may have been physically located abroad.
While both sides have an interest in winning the case, both the United States and Microsoft agree that changes needed to be made to the SCA. The issue with extraterritoriality was only one indicator of the need for an update. Fortunately for both sides, and with both sides supporting, Congress recently passed the Clarifying Lawful Overseas Use of Data Act (CLOUD Act). In all likelihood, the CLOUD Act will moot the case and the United States will be able to use the Act, in conjunction with a new search warrant, to cause Microsoft to turn over the emails located in Ireland. Practically, the CLOUD Act assesses heightened importance on executive agreements between the United States and foreign countries. Issues such as the expediency of MLATs seem to be directly targeted by the Act, but continued debate will likely occur as country-specific agreements are drafted.
 United States v. Microsoft Corp., 138 S. Ct. 356 (2017)
 18 U.S.C. §§ 2703
 United States of America v. Microsoft Corporation, 2018 WL 835269 (U.S.), 3 (U.S.,2018)
 Id. at 13.
 Peter Swire and Jennifer Daskal, What the CLOUD Act Means for Privacy Pros, iapp.org, https://iapp.org/news/a/what-the-cloud-act-means-for-privacy-pros/.
 Swire and Daskal, supra note 6.