U.S. search warrant can acquire foreign cloud, email data, judge rules

U.S. search warrant can acquire foreign cloud, email data, judge rules

Summary: Comments made by Verizon's chief lawyer (and heavily disputed by legal experts and academics at the time) have been proven false.

(Image: CBS News)

U.S.-based Internet, email, and online storage providers can be forced to hand over overseas data, if so requested by a U.S. government search warrant, a federal judge has ruled.

The move puts the U.S. further in conflict with foreign laws, particularly European data protection and privacy law, which aim to protect data from being taken outside the 28 member state's jurisdiction.

It's long been known that U.S. authorities can legally, under its own legal system, acquire data from outside the United States. But the ruling by U.S. Magistrate Judge James Francis in New York has now further entrenched existing opinions shared by U.S. Dept. of Homeland Security and the Justice Dept. into the judicial system.

In remarks, Francis said Internet providers, like Google, Microsoft, and others, would have to hand over the data because the "burden on the [U.S.] government" to work with other nations would be "seriously impeded."

These so-called "mutual legal assistance" requests made between two nation states allow governments to seek foreign assistance in acquiring data for domestic intelligence or law enforcement purposes.

But Francis cited one expert, claiming this process "generally remains slow and laborious, as it requires the cooperation of two governments and one of those governments may not prioritize the case as highly as the other."

"This language is significant, because it equates 'where the property is located' with the location of the ISP, not the location of any server." 
— Judge James Francis

He said that this may apply to "traditional" search warrants, but not those seeking online stored content, which falls under the Stored Communications Act.

"Even when applied to information that is stored in servers abroad, an [U.S. Stored Communications Act] Warrant does not violate the presumption against extraterritorial application of American law," Francis wrote in his ruling on Friday.

The case itself addressed a search warrant issued to Microsoft for a customer's data stored in Dublin, Ireland — a datacenter dedicated for European citizen data. 

Microsoft complied with the search warrant "to the extent of producing the non-content information stored on servers" in the U.S., but filed a motion seeking to quash the warrant asking for overseas data.

It remains unclear which U.S. law enforcement or intelligence agency requested the data, however. 

Microsoft told the Reuters news agency that it challenged the warrant because the U.S. government should not be allowed to extraterritorially search the content of emails held outside the country.

Verizon's chief lawyer Randall Milch made similar remarks in a blog post in February. He said that the company's view is "simple," adding: "The U.S. government cannot compel us to produce our customers' data stored in datacenters outside the U.S., and, if it attempts to do so, we would challenge that attempt in court."

However, legal experts, lawyers, and academics, were quick to rebuff Milch's claims, with one international legal expert calling his comments "misleading." 

Verizon spokesperson Ed McFadden said at the time Verizon would "let the report stand on its own," and did not comment further.

ZDNet reached out to Verizon for renewed comment but did not immediately hear back. We will update the story if we hear back.

Topics: Privacy, Cloud, Data Centers, Security

Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.


Log in or register to join the discussion
  • Keep pounding the nails in the coffin.

    Clients domestic and foreign are already abandoning US big data on privacy concerns. This only reinforces their paranoia. Cloud providers are pushing back because they know the ultimate price of these federal tactics will be loss of market share to companies based in nation states that protect their client data.
  • Wow!!

    SO the US laws extend into other parts of the world. The US companies are going to be hurt by this, business wise.
    • it's inevitable...

      I.T. is one of the only dominant global industries left in the US. When nobody trusts them with that they will only have finance which has been globally waning trust over the last decade too.
      All of this from bad government policy.
      Wonder what they will do when nobody buys their cars, borrows their money or uses their I.T. products and services.
    • U.S. laws ARE applicable and ARE enforceable upon U.S. companies

      You obviously missed a major point in what the court decision said.

      In summary, the law is binding upon Microsoft even if it -literally stored its data in "the cloud"!
  • U.S. government is the problem

    If they held to the spirit of their Constitution, instead of trying to bend it completely out of recognition, or ignored it entirely; there wouldn't be a problem. And it all starts at the top with the criminal in the White House.
    • They are taking cues from current Administration.

      Our current president now has the distinction of being the absolute worst president ever. His approach to ignoring US Laws and choosing who certain laws apply to...has broken down any sense of justice IMO.

      Even President Carter (once held the position of worst president ever IMO)
      • Worst ever?

        You must have a very short memory.
        x I'm tc
      • Ya, really short memory.

        You may not like Obama. Everyone has an opinion I know. But theres no question that good ol' George Bush was the worst.

        Unless you find it to be a highly important feature for a president of the most powerful nation in the world to be able to put on a clown act without effort.

        "I'm telling you there's an enemy that would like to attack America, Americans, again. There just is. That's the reality of the world. And I wish him all the very best." --George W. Bush, Washington, D.C., Jan. 12, 2009

        "I've abandoned free market principles to save the free market system." --George W. Bush, Washington, D.C., Dec. 16, 2008

        This thaw -- took a while to thaw, it's going to take a while to unthaw." --George W. Bush, on liquidity in the markets, Alexandria, La., Oct. 20, 2008

        "We've got a lot of relations with countries in our neighborhood." --George W. Bush, Kranj, Slovenia, June 10, 2008

        "Let me start off by saying that in 2000 I said, 'Vote for me. I'm an agent of change.' In 2004, I said, 'I'm not interested in change --I want to continue as president.' Every candidate has got to say 'change.' That's what the American people expect." --George W. Bush, Washington, D.C., March 5, 2008

        "I'll be long gone before some smart person ever figures out what happened inside this Oval Office." --George W. Bush, Washington, D.C., May 12, 2008

        "I couldn't imagine somebody like Osama bin Laden understanding the joy of Hanukkah." --George W. Bush, at a White House menorah lighting ceremony, Washington, D.C., Dec. 10, 2001

        "I would say the best moment of all was when I caught a 7.5 pound largemouth bass in my lake." --George W. Bush, on his best moment in office, interview with the German newspaper Bild am Sonntag, May 7, 2006

        "They misunderestimated me." --George W. Bush, Bentonville, Ark., Nov. 6, 2000

        Ummm...no G.W. I don't think they did. But I cant be entirely sure as I cant say for sure W.T.F. your talking about.
    • Was it 1986?

      Where were you in 1986 when the Stored Communications Act was made into law?

      Everybody is waking up to this now simply because it is in the news.

      As for your comment about the "Criminal in the white house"... Far be it for me to defend Obama but he was not around in 1986 when the SCA was enacted into law (Reagan was); he was not around in 1994 when CALEA was enacted into law (Clinton was); nor was he in the white house in 2001 when the Patriot Act was enacted into law (Bush was).

      Furthermore, the "spirit of the U.S. constitution" (particularly the 4th amendment in this case) prohibits government from "unreasonable search and seizure". And when law enforcement complies with and gets a court to issue a warrant based on established law, that still remains "reasonable" for all intents and purposes and it remains "within the spirit of the U.S. constitution"...

      Let me take it a step further. The U.S. constitution guarantees us "due process under the law". There has been no violation of due process in fact, MSFT's act of filing this court motion was provided for by the "due process under the law" guarantee under the constitution. End result: the court ruled that the warrant was valid and also ruled MSFT must disclose

      So what is your point?
  • our lousy leaders

    Our government is out of control. If I want cellular data secret, I would buy a foreign sim, or phone, and let the EU watch my data.

    Our lousy leaders are costing us big!!!!!! No one trusts us! Maybe we need to join Canada-
    David Blumenthal
    • hockey anyone?

      what makes you think Canada will have us. we have been bullying them since b. arnold tried to take Quebec. oh yes, we also have subverted their national pastime.
      • Out leader sucks too...

        Subverted our national pasttime? You mean with Canadian players on those teams? To see how the league would play out US vs Canada just look at past few Olympics...

        As for bullying us, the ultimate result of the US attacks on Canada was the White House and significant portion of Washington being burned to the ground...

        Still, we aren't bitter and would be happy to have you join us. But our current leader is even more devious than any of last few US presidents...
    • Canada would gladly take New York

      They're grumpy about winter and snow just like us, and love donuts. :)
    • Hypocrisy!

      So its OK if the EU wants to watch your communications... But its not OK if the U.S. watches your communications!

      You should know that the Third Party Doctrine applied most often in this case was established into U.S. law first. Subsequently, EU countries followed suit.

      In other words, had the roles been reversed in this case, an EU court seeking to uphold EU laws would order MSFT to disclose the information in the warrant.

      So what's your point?
  • Bow - WoW

    The US Courts are going overboard with its laws which basically challenges INTERNATIONAL LAWS and its implementation. US Domestic Laws have absolutely no jurisdiction outside US and its territories. They are NOT International Law Enforcers of LOCAL US LAWS. Period. Who gave them this right? They are basically bulldozing with their Laws into the International fields. How would THEY react if a Foreign Law Body encroaches their territories or stamps their foot in US or its territories? Will they allow any such actions by Foreign bodies? NO JUSTIFICATIONS HERE else they are going bonkers.
    P K Pal
    • Quandry

      MS can't hand over the data without its executives being prosecuted in Ireland.

      I guess they will have to decide which country's prisons offers the best food...

      EU citizens have stored their data in good faith on servers under EU jurisdiction. If the NSA hadn't already shaken their faith in the cloud, this decision certainly will.

      No wonder countries like Germany are working feverishly to make national clouds.
      • Quoting:

        "MS can't hand over the data without its executives being prosecuted in Ireland.

        "I guess they will have to decide which country's prisons offers the best food..."

        There is no pending case against any MSFT execs in Ireland... However, if MSFT fails to disclose the information in the warrant (and assuming the decision is not reversed) then there will be no reason for them to have to decide which jails they will be held in.

        "EU citizens have stored their data in good faith on servers under EU jurisdiction".

        Ignorance of the law is not, by any means or description, "good faith"... The problem here is not that the U.S. court is breaking the law... If that was the case then a simple writ of mandamus to the higher court will resolve this issue.

        Under U.S. law, and as interpreted by Judge Francis in this case, disclosure is required. I don't know which MSFT privacy policy applies in this case but its either that MSFT failed to disclose that it is under U.S. jurisdiction or that fact was in its privacy policy and yet the customer did not read the privacy policy.
  • lets force yet another company to move out of the country.

    The foreign market is pretty large; too large to ignore. If Verizon or other companies like them moved out of the country then this law would no longer apply and yet they could still sell their services here. Thank you homeland security for contributing to jobs moving off shore.
    • Still sell services?

      Not sure they could. The recourse the US government has is to ban the sales of their goods and services. Probably doesn't matter where headquarters is, only if a company does business here or not.
      x I'm tc
  • U.S. search warrant can acquire foreign cloud, email data, judge rules

    The US Government is over-stepping its bounds in International Law. Unless there is an International FISA Court to help with those decisions, they are going to have to go directly to the Host Government and get permission to get the data.

    We're getting too big for our britches on the World Stage and it could have BACKLASH if they are not careful.