Microsoft, Verizon, and other tech giants have long believed that the United States cannot force a company to hand over data stored outside the United States. Verizon’s chief lawyer Randall Milch publically commented on this issue in February.
He said that the company’s view is “simple,” adding: “The U.S. government cannot compel us to produce our customers’ data stored in datacenters outside the U.S., and, if it attempts to do so, we would challenge that attempt in court.”
Microsoft’s deputy general counsel David Howard also released a statement on the issue:
The U.S. government doesn’t have the power to search a home in another country, nor should it have the power to search the content of email stored overseas.
Microsoft’s chief legal counsel warned last December that Microsoft would fight any attempt by governments to seize data not located within their country:
“…assert available jurisdictional objections to legal demands when governments seek this type of customer content that is stored in another country.”
The case itself addressed a search warrant issued to Microsoft for a customer’s data stored in Dublin, Ireland — a datacenter dedicated for European citizen data. In December, Judge James Francis authorized the search and seizure of the contents of all emails, records and other information regarding the identification of one of Microsoft’s webmail users. It is believed that the request originates from an intelligence agency. While Microsoft’s Global Criminal Compliance (GCC) team turned over so-called non-content information stored on U.S. servers, such as the user’s name and country as well as address book information, it refused to hand over the contents of the emails because they were stored on a server in another country. For this reason the company sought to quash the search warrant, arguing that U.S. courts are not authorized to issue warrants for extraterritorial search and seizure of emails.
Judge Francis, however, disagreed and denied Microsoft’s motion to quash the verdict. Microsoft must hand over a user’s emails stored on a server in Dublin, Ireland, ruled magistrate judge James Francis of the U.S. District Court of the Southern District of New York. If the warrant had been a conventional search warrant Microsoft could have been right since there are territorial restrictions on those warrants, Francis said. However, a search warrant on electronic communications is not conventional but rather a hybrid: part search warrant and part subpoena, he said. He said that this may apply to “traditional” search warrants, but not those seeking online stored content, which falls under the Stored Communications Act. “Mutual legal assistance” requests made between two nation states allow governments to seek foreign assistance in acquiring data for domestic intelligence or law enforcement purposes.
“Microsoft’s argument is simple, perhaps deceptively so,” Francis said in his ruling.
“This language is significant, because it equates ‘where the property is located’ with the location of the ISP, not the location of any server.”
“Even when applied to information that is stored in servers abroad, an [U.S. Stored Communications Act] Warrant does not violate the presumption against extraterritorial application of American law,” Francis wrote in his ruling on Friday.
Francis said Internet providers, like Google, Microsoft, and others, would have to hand over the data because the “burden on the [U.S.] government” to work with other nations would be “seriously impeded.”
But Francis cited one expert, claiming this process “generally remains slow and laborious, as it requires the cooperation of two governments and one of those governments may not prioritize the case as highly as the other.” — Judge James Francis
Microsoft vows to appeal this ruling. “This is the first step toward getting this issue in front of courts that have the authority to correct the government’s longstanding views on the application of search warrants to content stored digitally outside the United States,” Microsoft stated in a blog post. The ruling directly impacts the Microsoft Azure Cloud business. Foreign companies may be hesitant to move to Microsoft’s cloud if the US government can look at their data at will.
The move puts the U.S. further in conflict with foreign laws, particularly European data protection and privacy law, which aim to protect data from being taken outside the 28 member state’s jurisdiction. In response to the ruling in the US, Mina Andreeva, European Commission spokeswoman for justice, fundamental rights and citizenship:
“The commission’s position is that this data should not be directly accessed by or transferred to US law enforcement authorities outside formal channels of co-operation, such as the mutual legal assistance agreements or sectoral EU-US agreements authorising such transfers.
“Access by other means should be excluded, unless it takes place in clearly defined, exceptional and judicially reviewable situations.”
“the European Parliament reinforced the principle that companies operating on the European market need to respect the European data protection rules – even if they are located in the US.”
But the ruling by U.S. Magistrate Judge James Francis in New York has now further entrenched existing opinions shared by The Obama Administration, the U.S. Dept. of Homeland Security, and the Justice Dept. into the judicial system. This has been a disappointment by many who had originally hoped the Obama administration would bring new transparency to government, work with European allies, and lessen government surveillance and overreach.
But in fact only the opposite has happened. Leaks by Edward Snowden showed the a massive expansion of the NSA surveillance program approved by the Obama administration. The justice department is headed by Eric Holder, directly appointed by Obama and is a close friend and ally of the President. The Justice Department agrees with the ruling discussed above and frequently tests the limits of the constitution. Obama also recently appointed an FCC commissioner who appears to be in the back pocket of cable companies and is looking to dismantle net neutrality. So much for the ‘hope and change’ policies from the 2008 campaign.
Read the Judge’s full ruling
Read Microsoft Official Response: TechNet