Against data exceptionalism.

• Author: Woods, Andrew Keane
• Position: Continuation of II. Is Data Different? B. The Reality: Data Is Not So Different through Conclusion, with footnotes and tables, p. 756-789

1. Data as an intangible asset

   1. Intangibility

      One aspect of data that might lead one to believe that old, territorial rules will not easily apply is its intangible nature: the fact that we cannot hold digital ones and zeros in our hands. This intangibility, however, is not on its own a novel problem because courts have adjudicated disputes over intangible assets like stock and debts for many years. (131) Indeed, courts have come up with a number of different approaches to locating intangible assets. (132) For example, intellectual property rights like trademarks are typically found to be located wherever they were created or registered. (133) Debts are typically located where the debtor resides (134)--as that is typically, though not always, where steps can be taken to ameliorate the debt. As early as the nineteenth century, shares of stock have been treated like mortgages, bonds, and promissory notes for the purposes of taxation: both the stock owner's domiciliary state and the issuer's state of incorporation are legally able to tax capital gains made from the sale of stock. (135) In property claims, corporate shares are typically found to be located in the state where the corporation was incorporated--not the location of the piece of paper that grants the holder stock ownership. (136)

      As the Restatement (Third) of the Foreign Relations Law of the United States cautions, "intangible property may have different situs for different purposes, and none at all for some purposes." (137) The appropriate test for a court to apply when determining the location of data that is sought in connection with a criminal investigation may very well be different than the appropriate test for determining location for tax purposes or civil disputes. In fact, in many cases it will not matter where the intangible asset is located as long as the court has jurisdiction over a defendant who can command the asset's production. (138) But before turning to the jurisdictional grounds upon which a state might assert its authority over cloud data, it is worth noting that there is a great deal of similarity between data and intangible assets, and courts have considerable experience negotiating claims involving those assets--either by giving them a fictional situs, or by ignoring the situs and granting jurisdiction nonetheless. (139)

   2. Mobility

      The data exceptionalists also suggest that jurisdiction based on location makes little sense when the subject is data because data is so mobile: it is easy to move data from one location to another at the speed of light. (140) But mobility, as a feature of an asset class, is hardly unique to data. Consider money, which can be wired from one location to another in an instant. Courts have little trouble determining the location of money for the purposes of asserting jurisdiction over the asset. The same is true for nearly everything, given the speed of modern communications and transportation networks. Courts have no special difficulty determining jurisdiction over people, goods, or any of the other highly mobile assets that regularly flow across jurisdictional lines. So data's mobility cannot be enough on its own to make us worry that territorial jurisdiction rules will be especially problematic. (141)

      One feature of data that is not shared by debt, money, or other assets is how easy it is to copy and store in multiple locations at once. But this does not necessarily change the core of the territoriality analysis. Indeed, courts have inquired whether the act of moving data is meaningfully different from the act of moving material information. In an ongoing dispute regarding patent infringement, the U.S. International Trade Commission (ITC) found that it had jurisdiction, under section 337 of the Tariff Act of 1930, (142) over a patent dispute involving a Texas company that received digital files from a Pakistani company and then printed them, creating the infringing product. (143) On appeal, the Texas company, as well as a number of amici including industry groups representing Google and Apple, argued that the ITC did not have authority over the dispute because the e-mailed files did not constitute "importation of 'articles.'" (144) The Federal Circuit agreed, noting that when the Tariff Act was passed, the word "articles" did not refer to digital information. (145) The case seems to suggest that while data's mobility creates novel market arrangements, it does not present a fundamental theoretical challenge to the way we think about jurisdiction in the physical, territorial world.

   3. Divisibility and fungibility

      Another feature of data that some see as problematic for territoriality is its divisibility and, relatedly, its interchangeability. (146) That is, one user's data might be divided into several different parts and distributed on servers in different locations or jurisdictions. When an Internet user visits Flickr to view the photos he uploaded, for example, he does not have a claim over particular ones and zeros. Rather, the user asks the data holder (in this case, Yahoo!) to present him with a particular configuration of ones and zeros that will allow him to see what he deposited in the cloud. (147) The ones and zeros are divisible and interchangeable; the user does not care if they are the same ones and zeros that were initially uploaded to Flickr, or if they have been divided among or commingled with other ones and zeros, as long as they are configured in a certain, recognizable way when he calls upon them.

      But these features are neither novel nor unique to data. Consider money in a bank account. When customers deposit two $5 bills with a bank, they do not expect the bank to hold that money in its exact form; indeed, they expect that the bank may divide that money up and distribute it widely around the bank's many branches (or with the bank's many other customers). But they expect that when they call upon the bank to make a withdrawal, the bank will give them $10--made up of some combination of $10 bills, $5 bills, and $1 bills. These are not the same paper bills the user deposited--those have been divided and distributed--and they may not even be the same dollar configuration of bills--the customer may have deposited two $5 bills and received a $10 bill--but customers do not care because they recognize that money is divisible and fungible. Once the money is deposited, it will be divided up and it will commingle with other money; the user's only concern with the money is that it be there when the user visits the bank. Ones and zeros are fungible, too. What matters to the user is how those ones and zeros are reconfigured so that they appear familiar when the user calls the data up on their screen.

      What about ones and zeros that are improperly displayed--ones and zeros that in a given configuration do not reflect the file or image that the user initially uploaded? Here, too, there is an analogue in the financial world. Suppose that a user deposits a single $100 bill of U.S. currency in a bank account. The bank might turn around and exchange that money for some amount of Mexican pesos or Japanese yen. If the account holder were to call upon the bank and receive pesos or yen, he may be disappointed--not unlike the Flickr user who may be disappointed to find his account filled with someone else's photographs (or worse, a configuration of ones and zeros that does not depict an image at all). The ones and zeros do not matter to the user, just as the particular $100 bill does not matter to the banker; what matters is what the data controller, like the bank, produces when the user comes calling.

   4. Distance between the asset holder and the asset

      The fact that users may not be in the same location as their data, and may not know where it is, has led some to suggest that data is incompatible with territorially bound legal rules. (148) But this separation is not unique to data. Money can be stored in an offshore bank account; debts can be held against someone in another jurisdiction; and someone might hold stock in a mutual fund that is located in another jurisdiction, and the mutual fund might hold stocks in companies distributed around a huge number of jurisdictions. In each of these scenarios, there is a jurisdictional barrier between the asset holder and the asset, and yet courts have simple rules to establish a location for the asset and to determine their jurisdiction over the dispute in question. (149) Data should be no different.

2. Data as a physical asset

   All of the features that are thought to make data difficult to square with a territorial conception of jurisdiction are premised on the idea that data is hard to locate. But in many ways, it is easier for courts to assert jurisdiction over data than over intangible assets because, unlike debts or stock, data has a physical and therefore territorial presence wherever it is stored Unlike stocks, debts, and bank wires, data resides on physical drives that can be seized. (150) In fact, while it may feel to the casual Internet user as if data floats around in a transnational ether, it is in fact stored in a physical location, usually one near the user. Microsoft's own affidavits in the Microsoft Corp. case suggest that data centers are located as near as possible to the end user. (151) Moreover, as a number of network engineers and computer scientists attested in that case, it is in fact impractical for companies handling massive amounts of data to parse individual accounts and spread the accounts across different jurisdictions if they do not need to do so. (152) If the user stays put in a particular location, it makes sense for the data to stay put as well.

   This suggests that data is in fact much more tangible than classic intangibles like debts or stock. It may not matter to typical banking customers whether their money is held in Switzerland, Japan, or the Cayman Islands, as long as it is available when they need it. Yet it does...