There are other, legal ways to nab Microsoft emails, privacy groups remind Supremes

Redmond finds allies in Irish data centre spat

By Rebecca Hill

Posted in Security, 19th January 2018 15:03 GMT

Allowing Uncle Sam to seize emails stored in Microsoft's Irish data centre would violate foreign data protection laws and risk setting a damaging precedent, the US Supreme Court has been told.

In briefs filed in the long-running dispute, IBM and international campaign groups argued that the government does have other ways of gaining the information.

They are lobbying for the Supreme Court to uphold the decision made by the United States Court of Appeals for the Second Circuit, which ruled in Microsoft's favour. The Supremes were brought into the spat after the US Department of Justice appealed the Second Circuit's decision.

Privacy International, backed by 26 other global rights groups, filed an amicus brief (PDF) that warned of the "profound implications for the resilience of data protection laws all over the world".

It argued that in demanding access to emails stored in servers in another country, the warrant "flatly conflicts with Irish and European Union law".

The brief said there was no existing case law that directed the result, and pointed out that there are established government-to-government channels for transfer of personal data to law enforcement, called mutual legal assistance treaties (MLAT).

"Rather than relying on the process established through these MLATs," Privacy International said, "the US government is seeking to unilaterally seize data held in Ireland, conflicting with both Irish and EU data protection laws, and undermining the right to privacy that those laws were designed to protect."

A similar argument was made by IBM, which said the government has "ample tools at its disposal, aside from the [Stored Communications Act], to obtain the same data that it seeks here".

MLATs "may be imperfect... [but] they are not unworkable", IBM said in its amicus curiae (PDF). It added that although the Stored Communications Act needed to be updated to "reflect contemporary technological developments, such as the cloud, that is a problem for Congress, not this Court, to rectify".

Oi, force Microsoft to cough up emails on Irish servers to the Feds, US states urge Supremes

READ MORE

Both IBM and Privacy International warned of the effect granting the DoJ access would have on future cases and other companies.

"Similar violations of foreign law would occur in countless other cases if the Government is given the expansive authority to issue extraterritorial warrants that it now seeks," said Privacy International.

The group argued that, if granted, the US government's demand "creates an untenable situation for many other companies" because it would set a precedent.

"Companies would increasingly be in the position of having to potentially violate the laws of the countries in which they operate in order to comply with warrants issued in the US," the campaign group said.

Meanwhile, IBM said that it could damage US cloud providers' business prospects.

The court should "recognize that while this case involves an individual cloud user, the Court's decision may well have a significant impact on enterprises", Big Blue said.

It argued that – unlike individuals – enterprise clients can, and do, "contract for a menu of specific conditions relating to data storage and maintenance, including the data's physical location".

This is crucial to the case because the US government has argued that Microsoft has the sole power to choose where it stores data, and should be able to migrate it back to the US, to hand it over to the government.

IBM said that allowing access to cloud data stored abroad would "significantly disadvantage US cloud services providers when it comes to competing for enterprise clients, who may prefer to use cloud services from a company with no presence in the United States".

It added: "This concern is not a hypothetical; it was on full display following disclosures about the US government's surveillance programs, and it continues to be a topic of significant concern for enterprise customers today."

Both briefs urged the Supreme Court to affirm the judgment of the Second Circuit.

Oral arguments are due to be heard in the case at the end of next month. ®

Sign up to our NewsletterGet IT in your inbox daily

35 Comments

More from The Register

Microsoft Store adds ‘private audience’ apps to its Store

A velvet rope for digital tat, to help with betas, promos and maybe Windows 10 S

Hawaii Live-Go! Microsoft launches Honolulu admin tool for cloud and on-prem

One tool to rule them all

Microsoft starts buying speculative execution exploits

Adds bug bounty class for Meltdown and Spectre attacks on Windows and Azure

Microsoft's Teams lights solitary candle, hipsters don't notice

Slacklike turns one

Microsoft ports its Quantum Development Kit to Linux and macOS

Now that it's not Windows-only, you can simulate a theoretical computer on a real computer

BlackBerry calls out between two worlds: Microsoft, Dynamics sandboxes walk with me

When container realms collide

Microsoft: Yes, we agree that Irish email dispute is moot... now what's this new warrant about?

Redmond backs down without actually backing down

Skype for Biz users: Go watch nature vids. Microsoft wants you to get good at migration

New roadmap for Teams does everything but name Skype's death date

Microsoft says 'majority' of Windows 10 use will be 'streamlined S mode'

Which is just-about an admission Win 10 is a mess

Microsoft lobs Skylake Spectre microcode fixes out through its Windows

Just go install Intel's patch while we hunt the next CPU-level security flaw in Intel's silicon