A federal court overstepped in demanding Microsoft turn over an email account’s contents stored in Ireland, an appeals court said.

Share story

A federal court overstepped its bounds when it demanded that Microsoft turn over the contents of an email account stored in Ireland, an appeals court said Thursday.

The ruling gives the company a victory in one of the highest-profile fights between U.S. technology giants and governments over the power to police cyberspace.

The case centered on an MSN.com email account that U.S. prosecutors sought in 2013 as part of a drug-trafficking investigation.

Microsoft, after discovering the email account’s contents were stored in an Irish data center, challenged the ruling, saying the warrant amounted to an international seizure beyond the U.S. government’s powers.

The government has said existing data-storage law gives it the right to compel Microsoft to turn over the emails. Two lower federal courts agreed with the government. Microsoft’s latest appeal was heard in September.

In Thursday’s ruling, a panel of judges on the 2nd U.S. Circuit Court of Appeals in New York said the Stored Communications Act, a statute that outlines privacy of electronic records, does not give courts the authority to compel U.S. email providers to hand over customer content stored exclusively on foreign servers.

When Congress wrote the 1986 law, Circuit Judge Susan Carney said, there was no indication it was intended to apply beyond U.S. borders. The law was designed to ensure that Fourth Amendment protections against unreasonable search and seizure applied to the digital age, she said.

In a statement, Peter Carr, a Justice Department spokesman, said “we are disappointed with the court’s decision and are considering our options.”

Lawyers who have been tracking the case said the government would likely appeal in the event it lost.

Brad Smith, Microsoft’s president and chief legal officer, said the ruling was a victory for privacy and the right of people to have their data controlled by their own laws, not those of foreign governments. “This was a law written to protect privacy, not reduce it,” he said.

The case has worldwide implications. Internet service providers like Microsoft store an increasing number of documents, photos and sensitive material on behalf of businesses and individuals, raising the importance of the rules that govern law-enforcement access to that material.

Microsoft’s business increasingly relies on web-based services sold across borders, as does Amazon.com’s Amazon Web Services cloud-computing unit.

Many of the rules governing the storage of that data, including the Stored Communications Act and other provisions of the 30-year-old Electronic Communications Privacy Act, are vague or silent on technological developments since, leaving gaps that have led to conflict between Silicon Valley and government authorities.

Earlier this year, Apple and the FBI sparred over the law-enforcement agency’s request for help unlocking an iPhone owned by one of the perpetrators of the December mass shooting in San Bernardino, Calif.

And Microsoft separately is suing the Justice Department, arguing that a law that can be used to bar companies from telling customers that law-enforcement agencies came knocking for their data is unconstitutional.

As in the Apple iPhone case, Microsoft’s resistance to the government in the Ireland case drew support from a range of technology giants and civil-liberties groups.

Internet civil-liberties advocates hailed Thursday’s decision as a victory for privacy rights around the world. “This is a groundbreaking decision that helps protect privacy rights around the world,” the Electronic Frontier Foundation said in a statement.

But in a concurring opinion, Circuit Judge Gerard Lynch, a member of the three-judge panel that ruled unanimously in favor of Microsoft, disagreed. He said the ruling was about the reach of a piece of American law, and should not be “celebrated as a milestone in protecting privacy.”

He noted concerns raised by prosecutors that, under the court’s interpretation of the law, U.S. citizens could potentially avoid the reach of U.S. warrants simply by indicating to firms like Microsoft that they live outside the country, causing companies to store their data abroad.

The policy concerns at issue in the case “require the attention of Congress,” Lynch said.

Microsoft’s Smith agreed, repeating on Thursday his call for Congress or the White House to step in.

“I think the real question now is what the U.S. government will choose to do,” Smith said. “We can all spend the next two years in court arguing about a law that is 30 years old, or we can sit down and write the law that is needed for the future.”

U.S. Rep. Suzan DelBene, D-Medina, said in an interview that Thursday’s ruling might help jump-start legislation to clarify the government’s ability to grab data stored abroad.

She’s among the sponsors of the International Communications Privacy Act, a bill that would clarify that U.S. courts can obtain information stored overseas only if it obtains a warrant and the data belongs to U.S. citizens. For other matters, authorities would be required to work through local governments.

Some in Congress wanted to wait for the outcome of the Microsoft case before considering the bill, said DelBene, a former Microsoft executive.

“Frankly, the decision today by the court will be helpful,” she said. “These are not partisan issues. We’re trying to make sure that our laws in the digital world reflect the standards and expectations in the physical world” around privacy protections.