7.18.2016

Microsoft Wins One for Privacy

US Government Can’t Seize Customer Emails Stored Outside the Country

microsoft.jpg

The second US court of appeals ruled Thursday that the US government can’t force a company to turn over emails stored on servers located outside the US. Back in 2014, a lower federal court ordered Microsoft to turn over emails of a criminal suspect which were stored on servers in Dublin, Ireland.

"The second US court of appeals ruled Thursday that the US government can’t force a company to turn over emails stored on servers located outside the US."

The lower court ruling falls under the Electronic Communications Privacy Act (ECPA), specifically Title II, Stored Communications. Commonly known as the Stored Communications Act (SCA), Title II regards voluntary and compelled disclosing of "stored wire and electronic communications and transactional records". The ECPA was created to supplement the Fourth Amendment, which only protects “persons, houses, papers, and effects, against unreasonable searches and seizures". The ECPA makes no mention of extradition from foreign countries, which is handled by extradition treaties. As such, the ECPA alone will not allow the seizing of emails from Microsoft’s Ireland servers.


In recent years, the Justice Department has been at odds with US companies over data. There is an ongoing discussion about the balance of privacy and security. Companies have invoked privacy arguments to protect customers, while law enforcement has argued that they need access to data for security reasons. 

"In recent years, the Justice Department has been at odds with US companies over data."

A ruling at the federal appeals court level is very powerful. This is because the Federal court system is 3-tiered, with district courts, appeals courts and the US Supreme Court. Some will remember the recent San Bernardino case involving the FBI’s orders for Apple to unlock an iPhone. The divisive case was dropped, with the FBI suddenly finding a third-party to unlock the phone.


Rulings made by a district court may be appealed to a Circuit Court, which hears all appeals within its geographical circuit. Very rarely, a case may make it to the US Supreme Court. A ruling made by the US Supreme Court is binding on all lower courts, meaning they must follow that ruling in deciding future similar cases. This is called precedence, and works similarly for US circuit courts. Thursday’s ruling will prevent companies from having to give up communications stored overseas for similar Federal cases in the second circuit, and the decision may be referenced all over the country.

"This is good news for tech companies, especially those that provide cloud services."

This is good news for tech companies, especially those that provide cloud services. Customers care deeply about whether a company can be trusted to protect their data. Added to the mix is the very outdated set of laws regarding data and privacy (the ECPA was passed in 1986). This is a step in the right direction, but we still have a ways to go.