Microsoft does not need to hand Irish email to US prosecutors, finds court

Ruling against Microsoft would be bad for business, finds appeals court

In a landmark ruling, the US Federal Appeals Court has judged that the US Department of Justice (DoJ) has no authority to demand that Microsoft hand over an email residing on a server located in Ireland.

The DoJ demanded in 2013 that as a US company Microsoft must disclose the contents of the email, which is understood to be related to a drug trafficking case, on the basis of the Stored Communications Act (SCA) an endeavour in which it was supported by a New York court in 2014. Redmond appealed the ruling.

Today the Federal Appeals Court found in favour of Microsoft and against the previous court judgement. In its conclusion the appeals court said that the demands by the US government would effectively allow the SCA to be used to gain access to any information anywhere in the world, a use for which it was never intended. This, it argued, would be damage US business interests.

"US-based providers alone may be compelled to give US authorities access to information held anywhere in the world, without regard to applicable foreign law or whether the customer-provider relationship has any substantial nexus to the
United States," it said (PDF).

"This Court should not endorse that view, which risks placing US providers at a significant competitive disadvantage in foreign markets."

Summing up, the appeals court concluded:

"This Court should conclude that the SCA does not authorise US courts to issue warrants that operate extraterritorially to compel providers to disclose foreign information lacking a substantial nexus to the United States.

"Alternatively, if the Court concludes otherwise, it should require the magistrate judge to conduct an international comity analysis before deciding whether the warrant in this case should be enforced in respect to information stored in Ireland."

The judgement will please privacy campaigners worried about the reach of the US authorities in the wake of the Snowden revelations, and also US cloud providers concerned about what a loss by Microsoft would mean for their businesses.

Update

A spokesperson from the Electronic Freedom Foundation (EFF) sent Computing this statement:

"This is a groundbreaking decision that helps protect privacy rights around the world. The court concluded that under the Stored Communications Act the government can't use a US search warrant to obtain a customer's email stored on servers outside the country.

"In our amicus brief supporting Microsoft in this case, we urged the court to reject the government's argument that the search warrant it obtained for email contents was like a subpoena that would require Microsoft to turn over information, regardless of where it was stored.

"The court recognised the vital privacy protections under the SCA, and correctly ruled that the government can't use a US search warrant to force Internet service providers to reach email stored outside the US."