Microsoft told hand over emails by US court

Microsoft has been ordered by a United States federal court to turn over a customer’s emails and other information stored in a Dublin data centre.

In a ruling with possible implications in Ireland for privacy laws and for major multinationals operating here, US District Judge Loretta Preska said a search warrant approved by a federal magistrate judge required the company to hand over any data it controlled, regardless of where it was stored.

“It is a question of control, not a question of the location of that information,” Preska said after a two-hour court hearing in New York.

The judge said she would temporarily suspend her order from taking effect to allow Microsoft to appeal her decision to the 2nd US Circuit Court of Appeals. Brad Smith, Microsoft’s general counsel and executive vice president, legal and corporate affairs, said the decision would not represent the final step in this process.

“We will appeal promptly and continue to advocate that people’s email deserves strong privacy protection in the US and around the world,” he said.

The case appears to be the first in which a corporation has challenged a US search warrant seeking data held abroad.

In a four-page affidavit in support of the company’s case, former Justice Minister and ex-Attorney General Michael McDowell had said it is illegal under Irish law for Microsoft to hand over information stored here to the US government without an Irish judge’s approval. He argued, as an independent expert witness for Microsoft, that Ireland’s data protection acts “highlight its sovereign interest guarding against foreign law enforcement activities within its borders by any means other than the applicable [mutual legal assistance treaty].”

The case centres on the prosecution of a drug trafficker, and prosecutors want Microsoft to hand over emails stored in Microsoft’s server in Dublin, without going through existing international treaties. Cooperation with the US seeking information for criminal prosecutions is covered by Irish and European mutual legal assistance treaties and a 2008 criminal justice act.

Microsoft has described it as potentially allowing federal agents to break down the door of its Dublin facility.

A federal magistrate had agreed a simple warrant, normally not valid outside US jurisdiction, was enough to force US-headquartered companies to hand over data. The ruling, if upheld, has deep implications, particularly for Ireland with its heavy US corporate footprint, essentially allowing US law enforcement agencies to easily get information held in other countries without worrying about international treaties.

Prosecutors argued that using the treaties would be too “cumbersome.”

Leading US privacy advocates, the Electronic Frontier Foundation, said Ireland’s sovereignty risks being “trampled on.”

A number of technology companies filed court briefs in support of Microsoft’s position, including AT&T Inc, Apple Inc, Cisco Systems Inc and Verizon Communications Inc. They are worried that they could lose billions of dollars in revenue to foreign competitors if customers fear their data is subject to seizure by US investigators anywhere in the world.

The technology companies argued that US search warrants cannot be executed overseas under the law. But lawyers for the US Justice Department said the warrant only required the company to provide documents it controls, just as US banks can be forced to hand over transaction records held in foreign countries.