Can the Government Search Your Emails on a Foreign Server?

ServersCan the US government search your emails if the server they're stored on is located outside the United States?

That's the question the US Supreme Court was going to have to decide in the case of United States v. Microsoft.

Microsoft had challenged a US search warrant seeking emails related to a drug trafficking investigation. The emails were stored on a Microsoft server in Dublin, Ireland.

The US government contended that it didn't matter where the data was actually stored, since Microsoft could easily retrieve it from its US headquarters in Redmond, Washington.

Stored Communications

The case was based on the Stored Communications Act — which predates the Internet. The Act says that electronically stored communications are protected by the Fourth Amendment from unreasonable searches, but it says nothing about data stored outside the US.

The US Court of Appeal for the Second Circuit concluded that the Act wasn't intended to allow searches outside the US.

US Courts generally don't apply US law outside of the territory of the US unless Congress has clearly stated its intention for the laws to have extraterritorial effect.

(For example, the Foreign Corrupt Practices Act (FCPA) prohibits bribery by US companies and persons anywhere in the world.)

Cloud Storage

Cloud storage of data is a huge and global market, estimated at $247 billion. Microsoft alone has 100 data centers in 40 countries.

As the New York Times noted,

Both sides in the case have legitimate concerns. If the court sides with Microsoft and declines to allow searches for data stored in another country, the government will be hampered in investigating crimes like terrorism, child pornography and fraud.

If the court sides with the government and rules that it may demand data stored overseas by American companies, those companies will find it much harder to do business abroad.

The German government has announced that it won't use any American company for data services if the US government is allowed to search data held by US companies in overseas servers.

The Supreme Court justices heard oral arguments in the case on February 27. 

Moot Point

However, the whole case has been rendered moot thanks to legislation passed by Congress since the case was filed.

As Reuters reported, the "Cloud Act" was supported by Microsoft and other technology companies but opposed by some civil rights organizations.

On March 22, President Trump signed into law the legislation that makes clear that US judges are allowed to issue warrants for data stored on foreign servers.

So, the answer to the question I posed at the start of this blog is, "Yes, it can... probably"

Companies that object to complying with such search warrants can seek legal protection if they believe the US warrants conflict with foreign laws, and specifically with foreign laws dealing with data privacy.

As I discussed in this blog post, companies in the US and around the world are preparing to  comply a new  set of European Union (EU) regulations called the General Data Protection Regulation (GDPR).

comments powered by Disqus