Microsoft cloud privacy case has huge implications

Summary

This blog post, "Microsoft cloud privacy case has huge implications", is a blueAPACHE article from 2015 covering security. A far-reaching privacy legal battle between Microsoft and the US government has been in the courts for many months. In December, it became a headline again when Microsoft unveiled a list of companies (including Amazon) that supported its efforts to overturn the decision by a US judge compelling it to hand over customer emails stored on a server overseas. It is written for readers evaluating emPOWER Cloud, Managed Detection and Response. The underlying security practice it describes, reducing attack surface and improving detection and response, is not tied to a specific product version and remains relevant to any organisation managing cyber risk today.

Key facts

Article

A far-reaching privacy legal battle between Microsoft and the US government has been in the courts for many months. In December, it became a headline again when Microsoft unveiled a list of companies (including Amazon) that supported its efforts to overturn the decision by a US judge compelling it to hand over customer emails stored on a server overseas. The case has serious implications for cloud computing because the ruling by US Magistrate Judge James Francis in New York in April 2014 held that customers of US internet service providers in other countries would not be protected by the laws of their own jurisdictions against investigation by US law enforcement agencies. As Microsoft general counsel and executive vice president, legal and corporate affairs, Brad Smith puts it: “This case involves not a narrow legal question, but a broad policy issue that is fundamental to the future of global technology.” He argues that if a government “wants to obtain email that is stored in another country, it needs to do so in a manner that respects existing domestic and international laws.” Microsoft claimed the US government was putting fundamental privacy rights at risk. The US government was arguing emails stored “in the cloud cease to belong exclusively to you. Instead, according to the government, your emails become the business records of a cloud provider. Because business records have a lower level of legal protection, the government claims it can use a different and broader legal authority to reach emails stored anywhere in the world”. And it accused the Department of Justice of challenging people’s ability around the world “to rely on the privacy protections of their own governments and laws”. Chris Marshall, Managing Director of blueAPACHE explains; “This decision will have a huge impact on the future of cloud computing. If the US government has access to files stored in other countries simply because the provider is based in the US, no one will want to use global cloud providers.

“We recognised this issue five years ago when first building our cloud infrastructure. To protect client’s privacy from unwarranted intrusion by foreign government agencies, we needed to ensure all server and redundancy platforms were owned and maintained within Australia. It was the more expensive option, but the current Microsoft case highlights how fickle privacy can be when you opt for cheaper offshore options.” This problem is potentially multiplied when you take the Australian 2014 Privacy Act changes that threatens hefty penalties for Australian organisations who fail to protect their client’s data. The irony is that the US government doesn’t appear to appreciate that the big losers if it gets its way in this case will be US-based companies offering cloud computing services to customers in other markets. A decision which reinforces the primacy of US law enforcement over the independence of foreign jurisdictions should further deter customers from signing up to US-owned services.

Related

• emPOWER Cloud
• emPOWER Cloud (pillar hub)
• emPOWER Microsoft Practice (pillar hub)
• Managed Detection and Response
• emPOWER Security (pillar hub)

Frequently asked questions

Who ruled on the case described in this article, and what did the ruling hold?

US Magistrate Judge James Francis in New York, in a ruling from April 2014, held that customers of US internet service providers in other countries would not be protected by the laws of their own jurisdictions against investigation by US law enforcement agencies.

Who is quoted from Microsoft in this article, and what is their role?

Brad Smith, Microsoft's general counsel and executive vice president of legal and corporate affairs, who called the case "a broad policy issue that is fundamental to the future of global technology."

Which major company did Microsoft reveal as supporting its legal challenge, per this article?

Amazon, named among a list of companies Microsoft unveiled in December that supported its efforts to overturn the ruling.

What argument did the US government make about ownership of emails stored in the cloud, according to the article?

That emails stored in the cloud cease to belong exclusively to the customer and instead become the business records of the cloud provider, which the government claimed carry a lower level of legal protection.

Who is quoted from blueAPACHE in this article, and what decision does he describe?

Chris Marshall, Managing Director of blueAPACHE, who explains that blueAPACHE recognised this data sovereignty issue five years earlier and ensured its server and redundancy platforms were owned and maintained within Australia.

Why does Marshall say blueAPACHE chose Australian-owned infrastructure over cheaper offshore options?

To protect client privacy from unwarranted intrusion by foreign government agencies, even though it was the more expensive option, as the Microsoft case demonstrated how fickle privacy protections can be with offshore providers.

What Australian legislation does the article say compounds this privacy risk for local organisations?

The Australian 2014 Privacy Act changes, which the article says threaten hefty penalties for Australian organisations that fail to protect their clients' data.

Who does the article argue would be the biggest losers if the US government succeeds in this case?

US-based companies offering cloud computing services to customers in other markets, since a ruling reinforcing US law enforcement primacy would further deter international customers from signing up to US-owned services.

Source

• origin post (2015)

Knowledge Base