Microsoft won a significant legal victory when the U.S. Circuit Court for the Southern District of New York found on July 15 that the company was right to refuse to turn over the contents of an email account to investigators from the U.S. Department of Justice.
But it was also a win for every other company in the United States that has data stored outside the United States. It was also a victory for overseas companies and governments around the world that were concerned about the U.S. government's efforts to access data stored around the world or even as it zipped along the Internet.
That concern was so great that the DOJ demands on Microsoft were one of the reasons the European Courts of Justice invalidated previous agreements between the United States and the EU on sharing data. Those demands were effectively driving a wedge between the United States and the EU because European legislators feared how far the U.S. intelligence and police agencies would go to gain access to data on European servers.
In this case, the data in question was the contents of email stored on a Microsoft server located in Ireland that belonged to a person who was a citizen of the EU. The court found that the warrant that the Justice Department was attempting to use to force Microsoft to turn over the email was invalid since it could only apply to data located within the United States.
For now, at least, Microsoft is off the hook in regards to the email in Ireland. In an effort to make sure it stays that way, the company has begun implementing a series of data centers that cannot be accessed from the United States as a way to prevent having to comply with such demands in the future. But Microsoft may not have heard the last of this case from the DOJ.
While at this point the DOJ has not announced any plans to appeal, a number of observers have said that an appeal to the U.S. Supreme Court is likely. The reason is that the DOJ wants to be able to continue demands for information located overseas and isn’t likely to give up without a fight. Meanwhile, there are growing cries for legislative clarification.
In his concurring opinion to the majority ruling, Circuit Judge Gerard Lynch wrote strongly of the need for Congressional action. “Although I believe that we have reached the correct result as a matter of interpreting the statute before us, I believe even more strongly that the statute should be revised with a view to maintaining and strengthening the Act’s privacy protections, rationalizing and modernizing the provisions permitting law enforcement access to stored electronic communications and other data where compelling interests warrant it."
There is a need, Lynch wrote, to clarify "the international reach of those provisions after carefully balancing the needs of law enforcement (particularly in investigations addressing the most serious kinds of transnational crime) against the interests of other sovereign nations.”