US DOJ can’t access data stored abroad with just a warrant, court rules

The US Department of Justice cannot force Microsoft to produce the contents of a customer’s email account stored on a server located outside the US with just a warrant, a US Court of Appeals has ruled on Wednesday.

Microsoft has been battling the US DOJ on this matter since 2014, when it challenged the search warrant issued under the Stored Communications Act in a drug case.

Microsoft argued that the warrant “would violate international law and treaties, and reduce the privacy protection of everyone on the planet.” Later that year, the company went so far as to urge the judge who presided over the case to find them in contempt for refusing to hand the emails stored in its Dublin facility over to the US government, so that they could lodge an appeal to the ruling as soon as possible.

Now, the United States Court of Appeals for the Second Circuit sided with Microsoft, and ruled that clause 2703 of the Stored Communications Act does “not authorize courts to issue and enforce against US‐based service providers warrants for the seizure of customer email content that is stored exclusively on foreign servers.”

The court concluded that the US “Congress did not intend the Stored Communications Act’s warrant provisions to apply extraterritorially”, as the “focus of those provisions is protection of a user’s privacy interests.”

They also pointed out that the prosecutors had at their disposal other ways for obtaining foreign-stored data, as the United States has Mutual Legal Assistance Treaties with other countries, “which allow the signatory states request one another’s assistance with ongoing criminal investigations, including issuance and execution of search warrants.”

Brad Smith, Microsoft’s president and chief legal officer, welcomed the ruling.

“The decision is important for three reasons: it ensures that people’s privacy rights are protected by the laws of their own countries; it helps ensure that the legal protections of the physical world apply in the digital domain; and it paves the way for better solutions to address both privacy and law enforcement needs,” he noted, and expressed his hope that this decision will spur the US Congress and the executive branch to come together to modernize the International Communications Privacy Act.

The US DOJ was disappointed with the ruling, but has yet to decide to appeal it.