Microsoft wins federal appeal over warrants for data held outside US

Warrants issued by US authorities do not apply to electronic data, such as emails, held on servers outside the country, a federal appeals court ruled Thursday, handing a big victory to Microsoft.

The Stored Communications Act “does not authorize courts to issue and enforce against U.S.‐based service providers warrants for the seizure of customer e‐mail content that is stored exclusively on foreign servers,” the three-judge panel of the Second Circuit US Court of Appeals ruled Thursday.

The “presumption against extraterritorial application of United States statutes is strong and binding,” the panel concluded.

A magistrate judge issued a warrant in 2014 for the emails of a Microsoft customer suspected in drug trafficking. The Redmond-based company provided all the information that was stored inside the US, but balked at touching the data it maintained on servers in Ireland.

The government argued that Microsoft had to “deliver records, physical objects, and other materials” no matter where they were located, so long as they were subject to the company’s custody and control, according to court documents.

Circuit judges Susan L. Carney and Gerard E. Lynch and District Judge Victor A. Bolden disagreed, ruling that Congress did not intend the warrant provisions of the law to apply outside the US.

Read more

Facebook’s 'data transfers to US' to be probed by Irish online security watchdog

The Stored Communications Act, passed in 1986, focused on “providing basic safeguards for the privacy of domestic users,” the judges argued, and employed the term “warrant” accordingly, without abandoning the instrument’s territorial limitations and constitutional requirements.

Interpreting “warrant” to require Microsoft or any other service provider to retrieve materials beyond US borders would “require us to disregard the presumption against extraterritoriality that the Supreme Court re‐stated and emphasized,” the judges wrote.

At the heart of the case was the free email account service, offered by Microsoft since 1997 and currently called Outlook.com. While the name of the customer whose emails were subject to the federal warrant has been redacted for privacy reasons, court documents show the address ending in msn.com.

The content of users’ emails, “along with a variety of non‐content information related to the account and to the account’s e‐mail traffic,” is stored on a network of servers around the world, Microsoft told the court. Locating such data centers in Ireland helps reduce network latency to users in Europe, the company explained.