US interception in the EU faces new legal challenges

No legal foundation

The group argues that the order requiring Microsoft to hand over data from its Dublin data centre has no legal foundation, and that affording extraterritorial reach to US warrants violates fundamental principles of international co-oporation. 

“There is no basis in law for the extraordinary result sought by the United States," says the group.

US is “infringing privacy legislation”

The US government’s position is arbitrary and designed to infringe privacy legislation in other countries, the CDT argues, citing an earlier US Supreme Court case.

“Here, the government again attempts to leverage a significant real-world difference between physical evidence and electronic data... to expand its authority and diminish privacy protection – to extend warrants extraterritorially and circumvent the laws of the nation in which the data is stored.”

Surveillance undermines cloud services 

Other organisations submitting legal arguments alongside the Center for Democracy and Technology include the Chamber of Commerce of the United States, the National Association of Manufacturers and the Software Alliance.

The groups are trade organisations whose members hold data on cloud servers and who believe they hold an interest in the case.

Their submission states that the beneficial economic and societal uses of cloud computing would be undermined by infringements of privacy relating to the data stored.

They claim that business and individual users will spurn cloud technology if their data is held by providers who are liable to pass it to government agencies.

Mutual Legal Assistance Treaties – the correct approach

The Center for Democracy and Technology argues that the correct way for governments to access the data of foreign nationals is to make a formal request to the foreign government in question, rather than to order US technology companies such as Microsoft to intercept it.

“The US government itself has recognised the need to respect the laws of other nations when it seeks evidence located in their borders. That is why the United States has entered into Mutual Legal Assistance Treaties (MLATs), which provide a means of obtaining another country’s assistance in gaining access to data stored in that country – including evidence in criminal and related matters.”

Questions raised over security of Parliamentary data

The Microsoft case is likely to have implications for reassurances made by William Hague in September, over the security of UK parliamentary data, following  Parliament’s decision to use Microsoft’s cloud services for Parliamentary data.

Hague indicated the storage of the data, which is likely to include sensitive emails, files and correspondence from MPs and ministers, within the EU would ensure that Microsoft, which owns Office 365, would not be liable to demands from the US government.

“The relevant servers are situated in the Republic of Ireland and the Netherlands, both being territories covered by the EC Data Protection Directive," he said.

Hague said the proper way for the US government to access such data would be through a direct request to the UK government.

"Any access by US authorities to such data would have to be by way of mutual legal assistance arrangements with those countries,” said Hague.

Privacy violations 

CDT believes that, if the US government is successful in enforcing its warrant against Microsoft, the public will lose trust in US technology companies, particularly in Europe, where citizens enjoy greater privacy rights.

Memories of Nazi data abuses had a significant impact on the development of European privacy legislation, the CDT argues.

“The ‘extensive accumulation of personal data by the Nazi regime’ is one example of the ‘abuse in recent history of private and personal information’ that has supported European vigilance in protecting personal privacy and resisting state intrusions into private life’.”

Pressure groups warn Microsoft of breach of Irish law

A separate amicus brief was lodged on Monday by Digital Rights Ireland (DRI), in conjunction with UK civil rights organisations Liberty and the Open Rights Group. 

DRI argues that the US warrant against Microsoft  would violate Irish law, were Microsoft to release the data. They also argue that only the MLAT approach ensures the protection of internationally held data.

“We say that requests for data held in Ireland should be made through the Mutual Legal Assistance Treaty system between the US and Ireland in a way which would ensure compliance with Irish law. In short, we argue that the US should not unilaterally assert jurisdiction over the personal information of foreigners held abroad.”