Major Privacy Win For Microsoft in 'free for all' Data

The US government cannot force Microsoft to give authorities access to the firm's servers located in other countries, a court has ruled.

The decision is being seen as a precedent for protecting the privacy of cloud computing services.

The US Department of Justice had wanted to access a server in Ireland, as part of an investigation into a drugs case.

The ruling, made by an appeals court, overturns an order granted by a court in Manhattan in 2014.

The US Dept. of Justice  (DoJ) said it was disappointed by the decision and was considering what it would do next. If it appeals, the case could then move to the US Supreme Court.

Microsoft said it welcomed the ruling. "It makes clear that the US government can no longer seek to use its search warrants on a unilateral basis to reach into other countries and obtain the emails that belong to people of other nationalities," Brad Smith, president and chief legal officer, of Microsoft told the BBC. "It tells people they can indeed trust technology as they move their information to the cloud," he said. Microsoft thanked the companies that had backed its appeal, which included the likes of Amazon, Apple and Cisco.

No bullying

Another of Microsoft's backers was the Open Rights Group , a UK-based organisation that campaigns for digital rights. "The US Court's decision has upheld the right to individual privacy in the face of the US State's intrusion into personal liberty," the group's legal director Myles Jackman said recently. "As a consequence, US law enforcement agencies must respect European citizens' digital privacy rights and the protection of their personal data.

Microsoft boss Satya Nadella has made cloud computing and its security a big focus for the company "States should not arbitrarily reach across borders just because they feel they can bully companies into doing so."

Microsoft had warned that allowing the search warrant to be conducted could open up a global privacy "free for all". Other countries, the company said, would perhaps seek to apply their own search warrants to servers located in the US.

Echoing a constant concern of those in tech industry, Microsoft said the laws were simply too outdated to be effective. "The protection of privacy and the needs of law enforcement require new legal solutions that reflect the world that exists today - rather than technologies that existed three decades ago when current law was enacted." 

Safe havens

But there is continued concern in the law enforcement community that cloud storage, together with encryption, is providing something of a safe haven for criminals.

Judge Susan Carney ruled against the DoJ on the basis that the Stored Communications Act of 1986 limited the reach of warrants applicable outside the US. She noted that such restrictions were vital to maintaining good relations with other nations. Furthermore, she said there were mechanisms available for co-operation between countries in investigations - though law enforcement agencies often complain that this route is more expensive and time-consuming.

"Going to court to seek a Stored Communications Act (SCA) warrant is normally a quicker path than dealing with international resolution channels," explained Daniel Stoller, senior legal editor at Bloomberg Law Privacy & Security News. He said the initial decision in 2014 interpreted the SCA in a way that favoured the DoJ's view. But the appeals court prioritised international law in its ruling.

Another judge involved in the ruling, Gerard Lynch, said the 1986 law was in urgent need of an update.

"I concur in the result," he wrote. "But without any illusion that the result should even be regarded as a rational policy outcome, let alone celebrated as a milestone in protecting privacy."

BBC

« Next Steps For Data Protection: Implementation, Compliance & Best Practice
Mining Bitcoin Just Halved »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

Perimeter 81 / How to Select the Right ZTNA Solution

Perimeter 81 / How to Select the Right ZTNA Solution

Gartner insights into How to Select the Right ZTNA offering. Download this FREE report for a limited time only.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

FT Cyber Resilience Summit: Europe

FT Cyber Resilience Summit: Europe

27 November 2024 | In-Person & Digital | 22 Bishopsgate, London. Business leaders, Innovators & Experts address evolving cybersecurity risks.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

GTB Technologies

GTB Technologies

GTB Technologies is a cyber security company that focuses on providing enterprise class data protection and data loss prevention solutions.

Duo Security

Duo Security

Duo combines security expertise with a user-centered philosophy to provide two-factor authentication, endpoint remediation and secure single sign-on tools.

NetKnights

NetKnights

NetKnights is an independent IT security company which offers services and products for strong authentication, identity management and encryption.

e-Lock

e-Lock

e-Lock services include IT security consulting and training, security systems integration, managed security and technical support.

Crown Sterling

Crown Sterling

Crown Sterling delivers next generation software-based, AI-driven cryptography in the form of random number generators and encryption products.

Navixia

Navixia

As a leading Swiss IT security specialist, Navixia offers a global and pragmatic approach to information security.

PricewaterhouseCoopers (PwC)

PricewaterhouseCoopers (PwC)

PricewaterhouseCoopers is a multinational professional services network of firms headquartered in London, United Kingdom and operating in 157 countries.

Drip7

Drip7

Drip7 is a micro-learning platform that is re-inventing the way companies train their employees and build lasting cultural change around the importance of cybersecurity.

xorlab

xorlab

xorlab is a Swiss cybersecurity company providing specialized, machine-intelligent defense against highly engineered, sophisticated and targeted email attacks.

TechBase

TechBase

TechBase is an innovation and start-up center offering technology-oriented start-ups optimal conditions for successful business development.

ATSG

ATSG

ATSG is a global leader in transformational technology solutions for today’s digital enterprise. Cybersecurity ranging from Advisory & Assessment to Fully Managed Detection and Response Services.

Strategic Technology Solutions (STS)

Strategic Technology Solutions (STS)

Strategic Technology Solutions specialize in providing Cybersecurity and Managed IT Services to the legal industry.

SecureTeam

SecureTeam

SecureTeam are a UK-based information security practice, specialising in all areas of cybersecurity.

SentryMark

SentryMark

Stay a Step Ahead of Emerging Threats. Deviate from the traditional siloed defenses and get the proactive and responsive cybersecurity solutions and services you deserve with SentryMark today.

NopalCyber

NopalCyber

NopalCyber makes cybersecurity manageable, affordable, reliable, and powerful for companies that need to be resilient and compliant.

Luxembourg House of Cybersecurity (LHC)

Luxembourg House of Cybersecurity (LHC)

Luxembourg House of Cybersecurity (formerly SecurityMadeIn.lu) is the backbone of leading-edge cyber resilience in Luxembourg.