A U.S. federal appeals court just ruled Microsoft (MSFT) - Get Microsoft Corporation (MSFT) Reportisn't obligated to turn over e-mails stored on Irish servers. Cloud service providers, including some of Microsoft's rivals, are breathing a huge sigh of relief. But the controversy that made the ruling so important is far from over.
Three years ago, a New York federal court authorized a warrant for e-mails and other info belonging to a user being investigated in a drug-trafficking case. Microsoft fought the ruling after finding out the e-mails were stored in Ireland, arguing their storage in a foreign jurisdiction meant they're not subject to a U.S. warrant. However, the court once more ordered Microsoft to hand over the e-mails in 2014, arguing its order is partly like a subpoena and thus requires Microsoft to provide data in its possession regardless of its location.
Now, an appeals court has reversed this decision, stating the warrant provisions of the 1986 Stored Communications Act aren't meant to be applied to overseas content. It also rejected the argument that the Supreme Court's approval of criminal rule changes that allow warrants to be granted for the remote access of electronic content required Microsoft to access the e-mails, stating the rule changes only expanded authority within U.S. territory.
Tech giants, including Microsoft rivals such as Alphabet's (GOOGL) - Get Alphabet Inc. Class A Report Google, Apple (AAPL) - Get Apple Inc. (AAPL) Report, and Amazon (AMZN) - Get Amazon.com, Inc. Report, have backed Microsoft in this dispute. So have telecom giants such as Verizon (VZ) - Get Verizon Communications Inc. Report , and service providers such as Rackspace (RAX) and Accenture (ACN) - Get Accenture Plc Class A Report , as well as media companies and civil liberties groups.
For cloud service providers, the stakes are high. U.S. cloud providers trying to convince foreign businesses and institutions to move workloads to cloud data centers will inevitably have a much harder time convincing many of them to do so if the data related to those workloads are subject to U.S. warrants -- something that naturally wouldn't be the case if the data was kept on local corporate data centers.
Moreover, foreign governments could return the favor by ordering data belonging to U.S. companies and stored by foreign cloud service providers to be handed over, even if it resides in the U.S. For both U.S. and international enterprise cloud engagements, the appeals court ruling does away with a big potential headwind -- one that already had Microsoft and others setting up foreign cloud data centers whose content they can't access -- for the time being. But more work may be needed before it's put to rest for good.
The government will most likely appeal the latest ruling. Moreover, as law professor Jennifer Daskal observes, the fact U.S. authorities now can't get a warrant to obtain the data of an American citizen if it's stored on a foreign server creates clear law enforcement challenges, as it means the data can only be obtained through a diplomatic request whose approval could take months.
In addition, the ruling could make governments push for localization rules that require companies to keep data within the country it was created in. That would hurt the value proposition of cloud services in situations where using a foreign data center would be cheaper, deliver better performance or otherwise be more sensible. It would also raise costs for cloud providers and potentially subject the data of U.S. multinationals to access by foreign governments whose standards for making such requests aren't as high as the U.S. government's.
As Daskal and others point out, new legislation -- legislation that takes into account domestic law enforcement needs, but also protects the traditional data privacy rights of individuals and businesses -- will be needed to provide final resolution for this issue. Until then, the controversy over cloud data access will rage on.