Microsoft digs in on digital privacy

Microsoft is squaring off against the Justice Department in a case that could have drastic ramifications for the protections on people’s data.

This week, a federal judge ruled against the software giant, which had challenged a government search warrant for data stored on a server overseas. The ruling, though, was put on hold while Microsoft filed an appeal, which it promised to do quickly.

{mosads}That’s likely to prolong the already months-long fight over legal protections for emails and documents stored in data centers abroad, turning the issue into a landmark battle over digital privacy.

“The stakes are huge for both sides,” said Orin Kerr, a George Washington University law professor and former Justice Department official.

“This is really about what happens with privacy in the global Internet and this is one of the first cases to really grapple with the problem,” he added. “This is the first round in an ongoing debate on where are the limits of privacy abroad.”

The case centers on a search warrant issued by a New York judge in December ordering Microsoft to hand over a user’s emails and records, which are stored in a data center located in Ireland.

Microsoft challenged the warrant, claiming that the U.S. government does not have any authority to go after information stored in Ireland, without permission from the local government. Instead, Microsoft argues that the U.S. needs to go through a treaty process that allows it to get evidence from foreign countries.

The government, however, maintained that Microsoft was “mistaken” in that analysis.

“Overseas records must be disclosed domestically when a valid subpoena, order, or warrant compels their production,” U.S. Attorney for the Southern District of New York Preet Bharara wrote in a brief to the court.

A number of major tech companies including Verizon, AT&T and Apple have all filed briefs supporting Microsoft’s argument, as has the online rights group Electronic Frontier Foundation.

For the companies, the case is partly about repairing the public’s trust after more than a year of disclosures from Edward Snowden caused many to be wary of American tech products, and also about resolving the conflicting laws between different nations. The European Union, for instance, which has taken a much stronger approach to privacy, might take issue with a company that shuttled data stored abroad back to the U.S. government. 

“You have the potential to get the E.U. concerned over whether this sort of a ruling would clash with privacy protections in E.U. law,” said Craig Newman, managing partner at the Richards Kibbe and Orbe law firm, who attended Thursday’s arguments.

In ruling against Microsoft on Thursday, Judge Loretta Preska agreed with the government that the question came down to who controls the data, not where it is stored. Since Microsoft is able to hand over the information without having to physically enter Ireland’s sovereignty, she declared, it should have to comply with a search warrant for the data.  

In her decision, Preska also ruled that personal emails are considered a “business record” under the law, similar to financial transactions that the government can obtain to track down terrorists or arms dealers laundering money abroad.

Microsoft had argued that emails, instead, are personal private communications that belong to the user, much like a letter sent through the mail.

The legal ambiguity in the case is partly due to a decades-old law that critics say needs to be replaced.

Part of the 1986 Electronic Communications Privacy Act outlines rules for protecting digital information under the constitutional right to privacy, but does not provide a clear legal framework for dealing with the data stored on servers outside of U.S. territory, since the concept of multinational data centers was still years away.

Some aspects of that law have come under scrutiny from Capitol Hill, but lawmakers have yet to take up a plan for defining how law enforcement officials should deal with data stored abroad.

Michael Vatis, a partner at the Steptoe and Johnson law firm, which is representing Verizon in the case, argued that they need to fix that soon.

“I think the principle of separation of powers dictates, really, that this issue should be resolved by Congress,” he said. “And until it does so, the government can’t use a search warrant to get information abroad.”