A federal appeals court has ruled against the American government and said it cannot force Microsoft and other companies to turn over customer emails stored on servers outside the United States.
A unanimous decision by a three-judge panel at the second circuit court of appeals in Manhattan is a defeat for the US Department of Justice and a victory for privacy advocates and for technology companies offering cloud computing and other services around the world.
Circuit judge Susan Carney said communications held by US service providers on servers outside the United States are beyond the reach of domestic search warrants issued under the Stored Communications Act, a 1986 federal law.
"Congress did not intend the SCA's warrant provisions to apply extraterritorially," she wrote. "The focus of those provisions is protection of a user's privacy interests."
Microsoft had been challenging a warrant seeking emails stored on a server in Dublin, Ireland, in a narcotics case.
It is believed to be the first US company to challenge a domestic search warrant seeking data held outside the country.
Today's decision reversed a July 2014 ruling by then-chief judge Loretta Preska of the US district court in Manhattan requiring Microsoft to turn over the emails.
The ruling also voided a contempt finding against the company.
"We obviously welcome today's decision," Brad Smith, Microsoft's president and chief legal officer, said in a statement.
He said the decision gave people more confidence to rely on their own countries' laws to protect their privacy, rather than worry about foreign interference, and helped ensure that "legal protections of the physical world apply in the digital domain."
Peter Carr, a Justice Department spokesman, said the government agency was disappointed by the decision and reviewing its legal options.
Fears for free-for-all collection of emails
The case has attracted strong interest from the technology and media sectors, amid concern that giving prosecutors expansive power to collect data outside the country could make it harder for US companies to compete there.
Dozens of companies, organisations and individuals filed briefs supporting Microsoft's appeal, including the US Chamber of Commerce, tech companies Amazon, Apple, Cisco, news media CNN, Fox News, and telcos Gannett and Verizon.
Had the court gone the other way, "it would have been like the Wild West, with no clear, stable legal rules applying," Greg Nojeim, senior counsel with the nonprofit Centre for Democracy & Technology in Washington DC, said.
Microsoft had said the warrant could not reach emails on the Dublin server because US law did not apply there.
The company also said enforcing the warrant could spark a global "free-for-all," where law enforcement authorities elsewhere might seize emails belonging to Americans and stored in the United States.
Modernising old law
US federal prosecutors countered that quashing warrants such as Microsoft's would impede their own law enforcement efforts.
But Judge Carney said limiting the reach of warrants serves "the interest of comity" that normally governs cross-border criminal investigations.
She said that comity is also reflected in treaties between the United States and all European Union countries, including Ireland, to assist each other in such probes.
Some law enforcement officials have said obtaining such assistance can, nonetheless, be cumbersome and time-consuming.
The Justice Department is working on a bilateral plan to streamline how US and British authorities request data from companies in each other's country.
A bipartisan bill was introduced in the US senate in May to clarify when and where law enforcement may access electronic communications of US citizens.
Circuit judge Gerard Lynch, who concurred in the judgment, urged Congress to modernise the "badly outdated" 1986 law to strike a better balance between law enforcement needs and users' privacy interests and expectations.
Lynch said the law, as it stands now, lets Microsoft thwart an otherwise justified demand to turn over emails by the "simple expedient" of choosing to store them outside the United States.
"I concur in the result, but without any illusion that the result should even be regarded as a rational policy outcome, let alone celebrated as a milestone in protecting privacy," he wrote.