Federal Judge Unswayed by Microsoft's Objections to Data Demands
Microsoft data housed on servers in Ireland is protected by mutual legal assistance treaties, said Daniel Castro, a senior analyst at ITIF. "If that process doesn't work, countries should work to fix it -- not circumvent it by compelling access to data." Whether or not the U.S. government has the authority to compel seizure of data overseas, it's bad policy, he added.
08/04/14 12:51 PM PT
Microsoft's objections to a court order requiring it to turn over a customer's emails held on a server in Ireland have been rejected.
Judge Loretta Preska of the U.S. District Court for the Southern District of New York last week issued an oral ruling in the case, reportedly saying the Electronic Communications Privacy Act of 1996 (ECPA) authorizes such extraterritorial collections of data by the U.S. government.
The ruling "suggests that courts can disregard the limits to traditional evidence gathering for digital data and leaves open the possibility [that] other courts interpreting ECPA and 'warrants' issued under ECPA can disregard other inherent limits to that power," Hanni Fakhoury, a staff attorney at the Electronic Frontier Foundation, told the E-Commerce Times.
The judge stayed her ruling to give Microsoft time to file an appeal, which the company said it would do.
What the Fuss Is All About
U.S. Magistrate Judge James Francis late last year issued a search warrant requiring Microsoft to turn over all the data requested in a warrant to the U.S. authorities.
Microsoft refused, contending that warrants issued by U.S. courts do not apply in other countries.
In April, Judge Francis denied Microsoft's motion to quash the warrant in part. Microsoft appealed that ruling to Judge Preska's court.
Judge Preska's Argument
Judge Preska reportedly reasoned that she saw no difference between a company's own records and a customer's email.
She also endorsed Judge Francis' ruling, which held that Microsoft simply could copy the emails from the U.S.
Judge Preska reportedly drew on a Department of Justice case in 1984, in which it was held that a court could require a company to disclose its business records no matter where in the world those records might reside. Such disclosure would not require the consent of the country in which they were stored.
Preska held that the ECPA implicitly authorizes the extraterritorial collection of data because Congress was aware of the ruling in that case and therefore implicitly authorized extraterritorial gathering of data.
Mike Houlihan of Waggener Edstrom referred the E-Commerce Times to an earlier statement by General Counsel Brad Smith, indicating the company would file an appeal.
Objections to the Latest Ruling
"One of the problems with the magistrate's opinion now affirmed by Judge Preska is that it reinterpreted the word 'warrant' in ECPA to mean something different than it has traditionally meant, namely that an ECPA 'warrant' can extend extraterritorially, which a traditional warrant cannot," Fakhoury pointed out.
Judge Preska's assumption that a customer's stored emails are the business records of Microsoft is flawed, Jim Dempsey, senior counsel at the Center for Democracy & Technology, told the E-Commerce Times.
Those emails "are the property of the subscriber, and the U.S. government should not be able to force Microsoft or anyone else to perform a search and seizure of property in another country," he fumed.
Rule of Law?
Data held on servers in Ireland is protected by mutual legal assistance treaties, Daniel Castro, a senior analyst at the Information Technology and Information Federation, told the E-Commerce Times. "If that process doesn't work, countries should work to fix it -- not circumvent it by compelling access to data."
Whether or not the U.S. government has the authority to compel seizure of data overseas, it's bad policy, Castro said. Other countries might follow suit or retaliate by making it illegal for companies to turn over data under those conditions, "creating a Catch-22 for companies in multiple jurisdictions."
Fallout From the Ruling
U.S. exporters of high-tech services are reeling from revelations about the National Security Agency's surveillance activities, and this ruling "could see the center of cloud services technology shifting from the U.S. to Europe or Asia if those countries don't implement extraterritorial data gathering," said Rob Enderle, principal analyst at the Enderle Group.
Companies likely will spin out their foreign subsidiaries at arm's length as an investment, he told the E-Commerce Times, the way IBM did with its African and German holdings during World War II and with its South African properties during the era of apartheid in South Africa.