US seeks access to data on foreign servers
A court case in America could open the floodgates for the US Justice Department to demand access to US computer data stored overseas.
But internet giant Microsoft is fighting in a Manhattan court to overturn a search warrant demanding Microsoft release material stored on a server in the Republic of Ireland as part of a probe into alleged international drugs offences.
Gavin Dent, chief executive officer of Bermuda-based hosting company QuoVadis Services, which operates in several countries, said: “With the omnipresence of the internet and cloud computing, people may forget that your data is always in an actual place and may be subject to local laws in surprising ways.
“Most companies are very careful about where they physically do business and increasingly are becoming mindful of data sovereignty.
“In other words, they want to make sure that their computer-services customer data are based in a jurisdiction that does not expose them unwittingly to other country regulations or surveillance.
“QuoVadis, and other Island providers are seeing an uptick in business by offering the same cloud services as found onshore but under the clear data sovereignty of Bermuda.”
Microsoft is arguing in the Second Circuit Court of Appeals in New York that a US search warrant cannot be used to force tech companies to turn over data stored outside of the US.
The company is appealing a decision last year when US District Judge Loretta Preska ruled the company had to hand over e-mail stored on Irish servers to comply with the drugs case warrant.
But lawyers for Microsoft — along with other tech companies — insist that they cannot be forced to turn over overseas information because US warrants do not apply outside the United States.
The case is part of an ongoing fight over who has jurisdiction over stored data by users, when it can be stored anywhere in the world.
Judge Preska ruled in 2014 that because the servers are run by Microsoft, which is based in the US, the actual location of servers does not matter.
Microsoft general counsel Brad Smith told Bloomberg: “Some public-sector companies say, ‘I cannot put my data in the data centre of an American company unless you win this case’. I have had that said to me on multiple occasions.”
Faiza Patel, a law professor and expert in surveillance at the New York University law school, said Microsoft’s argument was about jurisdiction and sovereignty.
She added that courts were having difficulty deciding whether data stored outside the US is similar to a physical object stored in that foreign country, where the laws of the foreign country apply — not those of the US.
Ms Patel added that the US Justice Department has a clear legal right to request business records from US-based companies using a subpoena.
Microsoft says that “business records” include subscriber information, which is information about the account itself, such as the name of the account holder, the date it was created, e-mail addresses and billing information.
It has already given the Justice Department information stored in the US.
But the Justice Department is arguing that business information should include not just subscriber information but the contents of e-mails.
Microsoft responded that the contents of e-mails stored in Ireland do not belong to the company and it cannot be forced to hand them over.