Microsoft refuses to comply after judge revives overseas data search warrant

Microsoft refuses to comply after judge revives overseas data search warrant

Summary: A US judge has lifted a stay on a ruling, forcing Microsoft to hand over data it stores overseas. But the software giant said it will not comply, pending an appeal.

SHARE:
72

A US judge has lifted a stay on an order that will force Microsoft to hand over data it stores overseas.

US District Judge Loretta Preska on Friday issued an order lifting a stay on her previous order that Microsoft comply with a federal warrant seeking a customer's email held by the company on servers in Ireland.

But on Saturday, Microsoft confirmed that it would not comply with the order, potentially landing the company in contempt of court. 

As Reuters reported, the software giant said it "plans to appeal," pending efforts to have the order overturned by an appeals court.

Microsoft has publicly committed to fighting the warrant in order to protect their customers. The company argues that customer email deserves the same legal protections that US mail and the contents of telephone conversations currently have. In this case, the warrant was issued under the Stored Communications Act (SCA) using a less-stringent standard.

The case remains of the highest importance to some companies in the US technology industry scene.

Other major tech giants lent a hand in the second stab at the case. Verizon submitted an amicus brief in Microsoft's support, concerned that its overseas data could also be at risk. Apple, AT&T, and Cisco also threw their weight behind the software giant.

Microsoft, Verizon, and Cisco all suffered as a result of the US National Security Agency's actions leaked by whistleblower Edward Snowden. 

According to Preska's order, both Microsoft and the federal government expressed a desire to the District Court that the case be heard on appeal to the Second U.S. Circuit Court of Appeals as soon as possible.

But the government and Microsoft disagree on the next step to the appeal.

The government says that the order is not appealable at this stage, and Preska agrees. The Friday order says that the contempt order would be subject to appellate review. This disagreement over the path to appeal is, says the order, "the subject of hot dispute."

The details of the case under which the government seeks the data have not been revealed.

Topics: Government US, Privacy

Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.

Talkback

72 comments
Log in or register to join the discussion
  • Stay strong Microsoft

    in a battle between overreaching extra-territorialist courts and your customers, your customers deserve the win.
    Mac_PC_FenceSitter
    • And If They Don't...

      They can always vote with their wallets by doing business with non-US companies.

      I wonder if the honorable judge Loretta has given a thought about the day China and Russia should decide to follow her precedent -- and demand international companies based in their countries turn over records from American data centers as well?!?
      ReadandShare
      • Foreign policy isn't the job of courts

        Their job is to apply the law. Blame the stupid law on the President and Congress.

        We Americans have the bad habit of evaluating judicial decisions based on their outcomes rather than on whether we think the law was properly applied. The reactions to this decision is a good example of this.
        John L. Ries
        • Can you blame the law?

          Since U.S. law doesn't apply outside the U.S. it seems like you can only blame the judge for saying it does.
          Buster Friendly
          • actually you can

            When parts of the law state that the law does apply extra-territorially, an example is the sections of the patriot act which requires data centre operators comply with terrorism related investigations regardless of where the physical data center is, of concern I deciding if the law applies it stipulates that it does if it is an American company or a company with a presence in the US.
            aesonaus
          • I don't think that's the issue

            I think the issue is more basic than that - can the US government force someone to break a law in another country that currently has a peaceful relationship. If the data center is someplace that doesn't have a law against it, then the issue is different.
            Buster Friendly
          • Nope

            The operators of the data centers are not American companies, nor companies with a presence in the US. They are local companies chartered under local law who happen to be owned by US companies.

            When parts of the law state that the law does apply extra-territorially, then said parts of the law are simply void. The law gets its power from the US Constitution. As the Constitution itself does not apply extraterritorially, neither does any law based upon it.
            hydroxide
          • hydroxide: "The law gets its power from the US Constitution.

            As the Constitution itself does not apply extraterritorially, neither does any law based upon it."

            In some cases, U.S. law is based on treaties ratified by the U.S. Congress (the Senate) and signed by the U.S. President. The U.S. Constitution provides for this mechanism. In this case, international law gets embodied into U.S. law.

            The only international agreement that comes to mind in the context of this article is the U.S.-EU Safe Harbor Framework. While not specifically a treaty, it does represent an agreement amongst nations, the EU and the U.S. Department of Commerce, dating back to 2000. It seems to me that this agreement should have the status of international law in the context of this case.

            Clearly, there is some conflict between the U.S.A. Patriot Act and the U.S.-EU Safe Harbor Framework. For an interesting legal analysis on this topic, see:

            "The Patriot Act vs the EU data reform: the
            devil is in the detail"
            http://www.mayerbrown.com/files/Publication/0456f193-5573-4e1c-a775-7f839f2bb323/Presentation/PublicationAttachment/d4cc1938-76f6-4327-b888-b9549b6400b4/Patriot%20vs%20EU.pdf

            According to the legal analysis in the above-linked article, U.S. law enforcement needs to work directly with European law enforcement to acquire the data involved. Microsoft, and in the case of the article article, the bank, are caught between a rock and a hard place.
            Rabid Howler Monkey
          • Noting...

            ...that executive agreements are not judicially enforceable. Even compacts ratified by majority vote in both houses of Congress are technically statutes that the Congress itself can repeal or modify at any time. Treaties are the only international agreements specifically provided for under the US Constitution and they can only be ratified with the advice and consent of two thirds of the Senate (which is why recent Presidents have preferred executive agreements and compacts to treaties).
            John L. Ries
          • The US Constitution itself doesn't say that

            You might claim that this is a time-honored principle of unwritten international law, overriding the constitutions and laws of all states, but I doubt that even you could find a case where a court anywhere in the world has actually held that, or a treaty to which the US is a party that actually states that; and I've already cited counterexamples.

            Ergo, if the statute in question is unconstitutional, that wouldn't be the reason.
            John L. Ries
          • They are subsidiaries under the control of a US company

            These foreign subsidiaries are fully under the control of a US entity, which itself is subject to US law.

            The entire "extraterritorial" argument is a ruse. MS does not become exempt from US law just because it operates some overseas.

            Yes, MS may be in a difficult position if the laws conflict, but that does not mean that they get to avoid US law by such game playing.
            cuhulin1
          • US law is not supreme over that of other nations

            What makes you assume that US law or national interest somehow takes precedent over the laws or interests of other nations (or peoples)?

            This kind of arrogance often leads to painful lessons until people smarten up.
            psichel
          • It applies in Redmond...

            ...and it applies to MS. That's really all that matters.

            Imagine the reaction a US bankruptcy court judge might have to a claim that the contents of the debtor's Swiss bank account are irrelevant because they're in Switzerland and thus not under US jurisdiction.
            John L. Ries
          • The reaction is simple, John Ries:

            An application for cooperation to Swiss authorities. No, Switzerland is not under US jurisdiction, which is why you need the cooperation of local authorities.

            And such cooperation happens every single day in criminal investigations, too. Just because you or the judge believe that the rest of the world are US colonies and you can ignore the sovereignty of other nations doesn't make it so. And there are plenty of jail cells in Europe for Americans who believe their being American puts them above the law.
            hydroxide
          • Simpler that that

            The money in Switzerland is the property of the bankrupt debtor that is the subject of the US bankruptcy case. If the court orders him to hand it over to the trustee, then he is legally bound to comply (the bank is not a party to the case). If he doesn't, then the court can hold him in contempt, can lift the automatic stay on collection actions that is the primary benefit of bankruptcy in the US, or can dismiss the case outright. In either of the latter two cases, debtors would be free to seek relief in the Swiss courts. It's possible that the trustee could also sue for control of the account in the Swiss courts, but I don't know enough about the intricacies of bankruptcy law to say.

            But the mere fact that the money is in Switzerland would be of no concern to a US bankruptcy court, which was my point. The money would be effectively in the debtor's possession, which is all that really matters.
            John L. Ries
          • Ack!

            Creditors, not debtors. And it would be awfully nice if I could correct the grammar.
            John L. Ries
          • No need for such insults

            The judge isn't insulting Foreign countries, so why do you say she is?

            Microsoft clearly is subject to US jurisdiction. it has the power to tell its subsidiaries what to do. All the US judge is saying is I order you to use that power. Satya does not need to leave Redmond to comply.
            cuhulin1
          • @John

            Using your example of the US bankruptcy court... upon issuance of a US judge's findings, etc. -- US officials would then work through Swiss authorities. The US judge has no jurisdiction over Switzerland.
            ReadandShare
          • Switzerland

            that is a bad example John. The account is still in that person's / company's name. In this case, the servers belong to an Irish company, in an Irish building on Irish soil, beholden to Irish Law, especially privacy law.

            According to the law under which the company that owns the server operates, it is illegal for them to hand over the data to a third party outside the European Union without either getting a valid EU warrant or they must first obtain written permission from all affected parties - the account holder, all people with whom he has communicated and any third party mentioned in the emails.

            If the US Government force Microsoft USA to hand over the data without a valid Irish / EU court order (and the are mechanisms in place for doing this already), then Microsoft Ireland will face prosecution.

            And it will make using any cloud service with any ties to the USA outside the USA untenable. It will essentially mean the end of international cloud services, they will become disparate and national.
            wright_is
          • The servers belong to an Irish company...

            ...that is wholly owned and controlled by MS, which is a US corporation headquartered in the US. Therefore the servers are effectively owned and controlled by the latter, just as much as money in a Swiss bank account owned by a US resident citizen would be.
            John L. Ries