US Government to drag Microsoft to Supreme Court over long-running cross-border data jurisdiction case

The US Government has continued its dogged attempts to get Microsoft to turn over data held on their servers overseas, despite an 8 judge panel earlier this year finding in favour of Microsoft’s assertion that the US Government does not have jurisdiction overseas, and that prosecutors and investigators should go through normal “mutual legal assistance requests” channels to request access data of interest held in other countries.

The long-running case began in December 2013 when a New York district court judge issued a warrant asking Microsoft to produce all emails and private information associated with a certain account (believed to belong to a drug trafficker) hosted by Microsoft. The account’s emails were stored on a server located in Dublin, Ireland, one of many datacenters held by Microsoft around the world to improve the speed of service it provides its non-U.S. customers. Microsoft provided account information kept on its U.S. servers but refused to turn the emails over, arguing that a U.S. judge has no authority to issue a warrant for information stored abroad.

Microsoft moved to vacate the warrant for the content held abroad on 18 December 2013. In May 2014, a federal magistrate judge disagreed with Microsoft and ordered it to turn over the emails. Microsoft appealed to the District Court for the Southern District of New York.

In July 2016 it looked like Microsoft had won in front of the 3 judge panel, but the US government did not let the case lie and appealed to the full 8 judge panel.

In January 2017 Microsoft won that case after the Second Circuit Court of Appeals in New York was split 4-4 in a vote, leaving an earlier July decision in place, meaning the Justice Dept. could not force Microsoft to turn over customer data stored on servers outside the US.

Yesterday the Justice Department filed a petition asking the Supreme Court to review the lower court opinion, insisting the Second Circuit federal appeals court had “seriously misinterpreted” the law, saying  it should not matter where the information is stored if it can be accessed “domestically with the click of a computer mouse.”

Microsoft’s head legal counsel Brad Smith, disagreed, saying “The [Justice Department’s] position would put businesses in impossible conflict-of-law situations and hurt the security, jobs, and personal rights of Americans,” saying recent hearings held in the House and Senate committees earlier this month showed lawmakers have “strong support” for updating the 31-year-old privacy law at issue in this case.

“It seems backward to keep arguing in court when there is positive momentum in Congress toward better law for everyone,” he said.

Microsoft has insisted that if the US government wanted access to the data they should pursue existing legal avenues to access the data, such as going through the EU mechanisms for law enforcement and data transfer. The government complained this was slow and cumbersome, even though Ireland’s government earlier offered to speed up evaluation of any request that the US government would make in this case.

Microsoft also noted that instead of forcing the company to compromise their business the government should fix any issues with the current data sharing agreements with foreign governments.

If the US Government prevailed in its insistence that it has jurisdiction over any data held overseas by an American company it would have a damaging effect on the business of cloud service companies such as Microsoft and Google, who may be shut out of markets such as the EU with tight privacy laws.

While the US Justice Department has applied to take the case to the Supreme Court it is not known yet if they will succeed. If the Supreme Coutrt declines to hear the case the current precedent will stand, which would be the best for Microsoft and other cloud businesses who do extensive business overseas, and of course also protect the rights of users of Microsoft services in countries other than USA.