Microsoft Challenges U.S. Effort to Obtain Customer Data Stored Outside of Country

Court documents reveal that Microsoft last week filed an objection to a federal ruling, arguing that the United States government is illegally seeking to obtain customer data that is stored internationally. While the software giant's efforts to protect customer privacy should of course be lauded, this is at best a legal gray area.

This battle started when the US government issued a search warrant in December demanding that Microsoft relinquish customer data that is stored in the firm's Ireland-based data centers. While it's not clear which customer this concerns—let alone which country the customer is based within—we do know that it involves data stored in an MSN/Outlook.com web mail account.

The Microsoft argument is simple enough: The US government does not have the legal right to ask for data stored overseas. But the government, of course, disagrees. And so, too, did a federal court, which ruled against a Microsoft annulment request in April.

In the new filing last week, Microsoft has again objected to the search warrant. And the filing plays heavily on the post-Snowden sentiments that have cast a suspicious light on everything the US government does with regards to spying and privacy.

"The Government cannot seek and a court cannot issue a warrant allowing federal agents to break down the doors of Microsoft's Dublin facility," the complaint notes. "Likewise, the Government cannot conscript Microsoft to do what it has no authority to do—i.e. execute a search warrant aboard ... the Government takes the extraordinary position that by merely serving a warrant on any US-based email provider, it has the right to obtain the private emails of any subscriber, no matter where in the world the data may be located, and without the knowledge of or consent of the subscriber or relevant foreign government where the data is stored."

A big part of Microsoft's filing involves an esoteric argument over terms such as "warrant" and "subpoena," and the Government's and court's interpretations of these terms. But looking past the fine print, the issue here is simple enough: Microsoft does not believe the government can force it to cough up user data stored in another country. And it is making this sensitive issue public because the decision will impact international customers, many of whom will shun the company's online services if the US government is allowed this transgression.

That all sounds very clear and fair. But the US government's argument is likewise clear: As a US company, Microsoft must in fact comply with US court orders, regardless of the location of data involved in the case. And that search warrant was issued as part of a criminal investigation: The government isn't randomly looking for data, it's investigating a crime.

In his April ruling against Microsoft, US District Court Judge James Francis wrote that Microsoft's argument, while "deceptively simple," is undermined by the Stored Communications Act (SCA), a federal law that involves how and when Internet service providers must disclose "stored wire and electronic communications and transactional records." Put simply, by trusting a third party with data, that person has in effect relinquished their expectation to privacy.

(It's a bit more nuanced than that, and the SCA figures heavily in the subpoena/warrant semantics I'm trying desperately to avoid as well.)

"The SCA authorizes the Government to procure a warrant requiring a provider of electronic communications service to disclose e-mail content in the provider's electronic storage," Judge Francis writes. "No exposure takes place until the information is reviewed in the United States, and consequently no extraterritorial search has occurred." He notes that were this not the case, a criminal could simply lie about their location to ensure that their data was stored in another country and thus beyond the reach of law enforcement.

It's a thorny issue. But Microsoft has some help on the way. Verizon has already filed a motion supporting Microsoft. And the Electronic Frontier Foundation is on board as well. "United States search warrants do not have extraterritorial reach," EFF lawyer Lee Tien claims. "The government is trying to do an end run."

The case could drag on for quite a while, but Microsoft is expected in court in late July for oral arguments.