Product and service reviews are conducted independently by our editorial team, but we sometimes make money when you click on links. Learn more.

US Judge Says Microsoft Can't Protect Data on Foreign Soil

By - Source: Toms IT Pro

Microsoft attempted to quash a search and seizure warrant issued by the U.S. District Court in New York State, but was handed a setback earlier this week. U.S. Magistrate James. C. Francis IV of the United States District Court, Southern District of New York denied Microsoft's argument that the warrant was invalid because the bulk of the data was located on a server in Dublin, Ireland.

The request for a warrant was granted on December 4, 2013 when Francis issued it and ordered Microsoft to provide information for a specific email account. Microsoft initially complied, but halted the process once it was clear the data was stored in a server in Dublin. The company's argument: the warrant is not valid for search and seizures on foreign soil.

The Memorandum and Order is a 27 page summary of legal theory and legal arguments that have been punted back and forth between Microsoft's legal team and the U.S. District court.

[Read: IRS Under Hot Water for Missing Windows XP Deadline]

Microsoft's main argument against the warrant is that although they can tap into the server and gain access to the information the court is asking for, the request ought to proceed in the same way a court would obtain a physical document sitting in a file cabinet overseas. Using that criteria, Microsoft contends the U.S. has no authority to force the company to infringe on the rights of a foreign country by retrieving data that resides there.

The court disagrees since the data is "stored at premises owned, maintained, controlled, or operated by Microsoft Corporation." The fact that the premises is located in another country is immaterial to the court; in fact, the court argues it is not where the data is located, but where the Internet Service Provider is located that is important. Citing several prior cases and documents, the court points out that even for physical documents, it is about who controls the data and not where the data is located.

That argument does have history to back it up. For example, if a U.S. company has physical locations throughout the world, and the company is being investigated for criminal activity, a court can still compel the company to produce documents. The fact the documents might be sitting in a building overseas is not a reasonable excuse to withhold or delay the documents.

The court also contends that requiring Microsoft to search and seize the data from the overseas server is acceptable since it does not require any deployment of U.S. law enforcement nor the company to send staff to where the data is located.

One issue that seemed to underlie the push by the courts is expediency. While the court makes an argument that compelling Microsoft to retrieve electronic data is similar to demanding physical documents, the court only extends that analogy to a point.

If the government had to use the same process for seizing electronic data as it uses to obtain physical documents from locations overseas, it would significantly slow down law enforcement, according to the court. To help speed things up, the government uses a special Stored Communications Act (SCA) warrant that allows it to bypass having to work under the slower and more burdensome guidelines of a conventional search warrant.

"To be clear, we respect the critical role law enforcement plays in protecting all of us. We're not trying to frustrate any government investigations, and we believe the government should be able to obtain evidence necessary to investigate a possible crime. We just believe the government should have to follow the processes it has established for obtaining physical evidence outside the United States," says David Howard, corporate vice president and deputy general counsel at Microsoft in a blog post.

Microsoft is planning to challenge this particular setback in what Howard refers to as "a necessary step in our effort to make sure that governments follow the letter of the law when they seek our customers' private data in the future."

The problem is that the "letter of the law" is still very much open to interpretation and there are twenty-seven pages of one Magistrate's opinion to prove it.


More Government News