Microsoft doesn't have to give US government foreign data, says court

Image: Microsoft

On Thursday, the Second Circuit Court of Appeals in New York ruled that Microsoft and other tech companies could not be ordered to turn over customer data stored on servers outside of the US.

"We conclude that § 2703 of the Stored Communications Act does not authorize courts to issue and enforce against U.S.-based service providers warrants for the seizure of customer e-mail content that is stored exclusively on foreign servers," the decision said.

The decision was an appeal of search warrant originally issued by the US Justice Department, relative to an international drug case. What made the original search warrant novel was the fact that it demanded data on an email account that Microsoft had stored in a datacenter located in Ireland. And, just a reminder, Microsoft is headquartered in Redmond, Washington.

In this latest decision, a panel of the court ruled in a 3-0 decision in favor of appealing the warrant. The original decision was made in July 2014 by a US District Court in New York.

SEE: Box Zones remove data sovereignty obstacles for cloud users in Europe and Asia

Microsoft's case has been at the forefront of public conversations about data sovereignty issues, especially dealing with partnerships between US and European companies. The EU has recently captured headlines about changes in its data sovereignty laws, and some were concerned that a final victory against Microsoft could harm relations between the US and the EU. There were also fears that a ruling against Microsoft would lead to a mass exodus of international firms from US cloud providers.

More about IT Security

In support of Microsoft, a host of tech companies filed briefs in the company's defense. Verizon, Gannett, Apple, Amazon, Fox News Network, and Cisco were all among the names of those who showed their support.

At the center of this issue was the Stored Communications Act, a law written into legislation in 1986. Circuit Judge Gerard Lynch called the law "badly outdated," and recommended that it be updated to better reflect the privacy expectations of modern citizens. Circuit Judge Susan Carney used similar language in her part of the decision.

"Neither explicitly nor implicitly does the statute envision the application of its warrant provisions overseas. Three decades ago, international boundaries were not so routinely crossed as they are today, when service providers rely on worldwide networks of hardware to satisfy users' 21st-century demands for access and speed and their related, evolving expectations of privacy," Carney wrote.

As noted by ZDNet's Zack Whittaker, it is unclear whether or not the Justice Department will appeal the ruling. The ruling also reversed a contempt charge placed on Microsoft.

The 3 big takeaways for TechRepublic readers

1. According to a new ruling, Microsoft doesn't have to turn over email data stored on an Irish server to the US government.
2. The case has been closely followed by privacy advocates, who will likely consider the decision a big win.
3. The ruling will be a sign of relief to US cloud providers with international clients, and firms who store their data on US-owned servers overseas.

Also see

Source: http://www.techrepublic.com/article/microsoft-doesnt-have-to-give-us-government-foreign-data-says-court/#ftag=RSS56d97e7