Court Ruling: Microsoft Must Turn Over Data Stored in Ireland

JUDGE RULES THAT MICROSOFT MUST TURN OVER DATA STORED IN IRELAND WILL HAVE A “CHILLING EFFECT” ON AMERICAN TECHNOLOGY BUSINESSES

On July 31, 2014, Judge Loretta A. Preska of the United States District Court for the Southern District of New York upheld an earlier lower court ruling that Microsoft must turn over a customer’s emails, held by Microsoft, in a data center in Ireland.

An issue in this case is whether data, emails in this case, kept in overseas data centers, operated by American companies, are subject to US search warrants.

This is a criminal subpoena (the warrant suggests that it is related to drugs), but it is our editorial opinion that the reach of a US subpoena outside the US, exceeds its jurisdiction. Can the US government assert a right to digital content wherever it is stored in the world simply because it is held by a US company?

Preska’s judgment is based on the Stored Communications Act – drafted in 1986. The Internet today is very different. In our opinion, the legislation needs a comprehensive redrafting.

Microsoft similarly challenged that federal prosecutors cannot seize the data in Ireland because to US law does not apply to that jurisdiction.

“The government cannot seek and a court cannot issue a warrant allowing federal agents to break down the doors of Microsoft’s Dublin facility,” Microsoft’s lawyers pleaded in court documents.

stored filesIf you take it out of the context of computer data, and think of it as important papers locked in a desk in Ireland, you would never even think about it not being Ireland’s laws that controlled access to the desk, and it would require the US prosecutor to follow international laws to obtain the important papers from the desk.

So why is computer data not similarly protected, regardless of where it is housed?

“What is at stake is the privacy protection of individuals’ email and the ability of American tech companies to sustain trust around the world,” Bradford L. Smith, Microsoft’s general counsel, said after the ruling.

This ruling will almost certainly create legal uncertainty and suspicion of American companies around the world (especially for Irish and EU consumers) regarding the protection of their data.

Trust in the cloud is fragile and American technology companies cannot afford to alienate customers or foreign governments.

This decision, at this time, is especially troubling because technology is rapidly shifting to a Software as a Service (SaaS) model, where service providers often have all your most valuable asset data, and customers rely on services that store emails, app data, pictures, documents and other private information in the “cloud”.

If this decision is not reversed, the US technology sector’s business model worldwide and our leadership in technology globally will be substantially compromised.

This decision is also causing a clash between European and United States privacy laws.

Ireland is contending that the Mutual Legal Assistance Treaty in Criminal Matters between Ireland and the US (which has been in force since 2001) controls these type of international criminal matters.

Russia passed a law that obligates Internet companies to store Russian citizens’ personal data inside Russia. The operators of personal data in Russia will be obliged to use databases located exclusively in Russia and to indicate these databases’ addresses.

More countries are almost certainly going to follow suit and pass restrictive laws to “protect its citizen data” and this we believe will eventually lead to government control of information and possible censoring of information.

Allowing the government to reach across borders to retrieve evidence will harm U.S. technology sector companies that store their data overseas, as foreign customers will convert to non-U.S. services and this decision will have a “chilling effect” on America’s technology companies and their revenues.

Note: As of this writing, Microsoft looks like it will be found in contempt of court by defying the Court Order from US Judge Preska that Microsoft must hand over data stored in Ireland. Keep coming back to our blog for more on this exciting and developing case.