Federal Judge Rules Against Microsoft In Overseas Search Warrant Case

8

Microsoft, Verizon, and other tech giants have long believed that the United States cannot force a company to hand over data stored outside the United States. Verizon’s chief lawyer Randall Milch publically commented on this issue in February.

He said that the company’s view is “simple,” adding: “The U.S. government cannot compel us to produce our customers’ data stored in datacenters outside the U.S., and, if it attempts to do so, we would challenge that attempt in court.”

Microsoft’s deputy general counsel David Howard also released a statement on the issue:

The U.S. government doesn’t have the power to search a home in another country, nor should it have the power to search the content of email stored overseas.

Microsoft’s chief legal counsel warned last December that Microsoft would fight any attempt by governments to seize data not located within their country:

“…assert available jurisdictional objections to legal demands when governments seek this type of customer content that is stored in another country.”

The case itself addressed a search warrant issued to Microsoft for a customer’s data stored in Dublin, Ireland — a datacenter dedicated for European citizen data.  In December, Judge James Francis authorized the search and seizure of the contents of all emails, records and other information regarding the identification of one of Microsoft’s webmail users. It is believed that the request originates from an intelligence agency. While Microsoft’s Global Criminal Compliance (GCC) team turned over so-called non-content information stored on U.S. servers, such as the user’s name and country as well as address book information, it refused to hand over the contents of the emails because they were stored on a server in another country. For this reason the company sought to quash the search warrant, arguing that U.S. courts are not authorized to issue warrants for extraterritorial search and seizure of emails.

Judge Francis, however, disagreed and denied Microsoft’s motion to quash the verdict. Microsoft must hand over a user’s emails stored on a server in Dublin, Ireland, ruled magistrate judge James Francis of the U.S. District Court of the Southern District of New York.  If the warrant had been a conventional search warrant Microsoft could have been right since there are territorial restrictions on those warrants, Francis said. However, a search warrant on electronic communications is not conventional but rather a hybrid: part search warrant and part subpoena, he said. He said that this may apply to “traditional” search warrants, but not those seeking online stored content, which falls under the Stored Communications Act.  “Mutual legal assistance” requests made between two nation states allow governments to seek foreign assistance in acquiring data for domestic intelligence or law enforcement purposes.

“Microsoft’s argument is simple, perhaps deceptively so,” Francis said in his ruling.

 “This language is significant, because it equates ‘where the property is located’ with the location of the ISP, not the location of any server.”

“Even when applied to information that is stored in servers abroad, an [U.S. Stored Communications Act] Warrant does not violate the presumption against extraterritorial application of American law,” Francis wrote in his ruling on Friday.

Francis said Internet providers, like Google, Microsoft, and others, would have to hand over the data because the “burden on the [U.S.] government” to work with other nations would be “seriously impeded.”

But Francis cited one expert, claiming this process “generally remains slow and laborious, as it requires the cooperation of two governments and one of those governments may not prioritize the case as highly as the other.” — Judge James Francis

Microsoft vows to appeal this ruling. “This is the first step toward getting this issue in front of courts that have the authority to correct the government’s longstanding views on the application of search warrants to content stored digitally outside the United States,” Microsoft stated in a blog post. The ruling directly impacts the Microsoft Azure Cloud business. Foreign companies may be hesitant to move to Microsoft’s cloud if the US government can look at their data at will.

The move puts the U.S. further in conflict with foreign laws, particularly European data protection and privacy law, which aim to protect data from being taken outside the 28 member state’s jurisdiction. In response to the ruling in the US, Mina Andreeva, European Commission spokeswoman for justice, fundamental rights and citizenship:

“The commission’s position is that this data should not be directly accessed by or transferred to US law enforcement authorities outside formal channels of co-operation, such as the mutual legal assistance agreements or sectoral EU-US agreements authorising such transfers.

“Access by other means should be excluded, unless it takes place in clearly defined, exceptional and judicially reviewable situations.”

“the European Parliament reinforced the principle that companies operating on the European market need to respect the European data protection rules – even if they are located in the US.”

But the ruling by U.S. Magistrate Judge James Francis in New York has now further entrenched existing opinions shared by The Obama Administration, the U.S. Dept. of Homeland Security, and the Justice Dept. into the judicial system. This has been a disappointment by many who had originally hoped the Obama administration would bring new transparency to government, work with European allies, and lessen government surveillance and overreach.

But in fact only the opposite has happened. Leaks by Edward Snowden showed the a massive expansion of the NSA surveillance program approved by the Obama administration. The justice department is headed by Eric Holder, directly appointed by Obama and is a close friend and ally of the President. The Justice Department agrees with the ruling discussed above and frequently tests the limits of the constitution. Obama also recently appointed an FCC commissioner who appears to be in the back pocket of cable companies and is looking to dismantle net neutrality. So much for the ‘hope and change’ policies from the 2008 campaign.

Obama Net Neutraility

Read the Judge’s full ruling

Read Microsoft Official Response: TechNet 

Sources: BBC, ZDNet, Reuters, Computer Weekly, PC World

About Author

Suril is a scientist, journalist and obsessive Microsoft observer. He holds an advanced degree in Biotechnology with minors in Biochemistry, Microbiology, and Molecular Biology. Send him tips on twitter: http://www.twitter.com/surilamin

  • Vương Vi-Nhuyễn – 王微軟

    Security -> Privacy, I personally don’t get why people make such a big deal over their privacy. :-

    • http://twitter.com/surilamin surilamin

      “Those Who Sacrifice Liberty For Security Deserve Neither” -Benjamin Franklin

      I think this is the philosophical debate we’re having here. Many differing opinions. Some value security more, others value their privacy/freedom.

      • Tips_y

        Very true. People have the right and the need to feel secure in their own country.
        But the opposite to that need is the need of other people outside of our country to be protected from our over-stepping the bounds into their own rights and needs to feel protected.

    • KelvBlue

      I suppose anyone can flash you a badge and go fumbling through your house in the name of security does not mean anything to you, especially those officials are from another country.

      The government will not stop to exert their control, if the practice like this become a norm, the next step they will be putting a camera in every household.

      Moderation should be achieved.

  • GreatPhones

    The 2nd to the last paragraph was priceless. Who would expect a liberal administration to respect the rights of individuals? They only believe in the rights of government.

    • http://twitter.com/surilamin surilamin

      Exactly.

      I did not want to get too political, since we are after all a site about technology.

  • Zicoz

    Just one thing to do for Microsoft &Co, buy an island in the Pacific and create their own country. Then move all of their stuff there.

  • Tips_y

    So now we know more clearly what the “‘hope and change’ policies from the 2008 campaign” really mean. It means that the U.S.’ “hope” is to over-reach its power, reach, and clutch into other countries – and that there is the “change” they want to achieve.

    What is next, that they can just simply finger me, put their hands on me, shackle and handcuff me, haul me away, while sleeping in my own bed in my own country?! Rather a chilling thought!