Decision in Microsoft case could set dangerous global precedent, experts say

The US government takes on Microsoft in a Manhattan court on Wednesday morning – and if the verdict goes badly for the software giant, the decision could set a dangerous legal precedent across the world, experts warn.

The long-running case concerns a single Hotmail email account, stored on a Microsoft server in Ireland and of interest to the Department of Justice (DoJ), which tried to force Microsoft to recover the emails from its foreign facilities without working with the Irish police.

The case associated with the email account involves narcotics. But the decision about the validity of the DoJ’s warrant could signal to national governments across the globe whether they can compel tech companies with a local presence to turn over private correspondence to law enforcement.

Craig Newman of the law firm Patterson Belknap Webb & Tyler, which regularly deals with issues of cybersecurity, said: “If you take this case and you flip it over, when you’re dealing with a European or an Asian ISP that has a service arm in the United States and there are emails of American citizens on that server, does that create the risk that a foreign government can simply send a subpoena to them and force them to turn over journalists’ emails?”

Jim Kinsella, a former Microsoft executive who now runs a company providing secure cloud storage in Europe, said a loss for Microsoft would also be a loss for citizens in countries like Germany and France who have voted to drive back incursions into their own private data and have much stricter data laws than their counterparts in the US do.

“Private citizens of democratic governments should be able to influence those laws,” Kinsella said. “A European citizen has no influence when he uses a Google account that goes through sets of servers the US says they get to reach into.”

Last year, technology companies including Apple and Amazon; privacy groups; leading computer scientists; and media companies, including the Guardian, filed legal briefs backing Microsoft in a case the company has described as “fundamental to the future of global technology”.

Microsoft has so far lost twice in court but is challenging the order in the US court of appeals for the second circuit in New York.

Brad Smith, Microsoft’s top lawyer, told the Guardian last year that a win for the US will also encourage other governments to follow suit. “The US government cannot expect to have one model that it follows without anticipating that the rest of the world will follow that model,” Smith said. “And this is a model that encourages governments to reach into other territories. That does not seem like a sound approach to international stability or mutual respect in the 21st century.”

Electronic Frontier Foundation’s senior staff attorney Lee Tien said a win for the US would make everyone’s data “fair game” for governments outside the US. “Maybe your data goes to a country where they’re not as protective of data as the United States and they decide they don’t even need a warrant,” said Tien.

The trial comes after US attorney general Loretta Lynch vowed at her confirmation hearings to make the DoJ the standard-bearer for US response to cybercrime. Despite considerable opposition from Apple’s Tim Cook and others in the tech community, the DoJ has been adamant about its desire to see tech companies, especially email providers, give backdoor access to governments, both by providing the same kinds of personal information those providers use to target advertising and by weakening encryption.

Smith and others have argued that the US could have used existing law to obtain the emails, in particular the mutual assistance in law enforcement treaty (MLAT, a legal device for ensuring international cooperation between police departments). “The government of Ireland filed an amicus brief, which is pretty unusual,” said Newman. “They said they stood ready to consider use of the treaty.”

This month represents an inflection point for digital lawmaking. The Cybersecurity Information Sharing Act (Cisa) is due to return to the floor of Congress soon, after emphatic public objections to it on privacy grounds from many different corners, and the European Union is likely to pass General Data Protection Regulation (GDPR), which would force tech companies to safeguard their data or face heavy fines.

Ultimately, if the case doesn’t break Microsoft’s way, things may become harder, not easier, for law enforcement. Yahoo, said Newman, has non-US Yahoo companies that house its servers overseas. “[Some foreign Yahoo businesses] are a separate stand-alone entity, so that if there’s a subpoena or warrant addressed to that entity, serving it in the US would be a fool’s errand,” said Newman. Yahoo itself would have to work through a law enforcement treaty in order to get that information, since email account holders own their emails. If the tech world sees government overreach along the lines proposed by the US in this case, many other international providers may follow suit, he said.