The private emails and personal information of web users can be handed over to US law enforcement – even if that data is stored on servers outside the US, according to a New York court ruling.  Privacy campaigners have warned that the decision, which would affect users of US internet services, shows "stark contempt" for European citizens and is in direct conflict with EU rules on data protection.  In a detailed ruling on Friday, US Magistrate Judge James Francis said that US companies, including Microsoft and Google, must turn over private information when served with a valid search warrant from US law enforcement agencies.  "Even when applied to information that is stored in servers abroad, an SCA warrant does not violate the presumption against extraterritorial application of American law," he concluded.  Microsoft had sought to challenge a government search warrant which demanded one user's information from a server in Dublin as well as servers in the US, arguing that Ireland is beyond the borders of US law, but Francis rejected Microsoft’s motion.  “Forcing US companies to turn over data that is held overseas makes citizens in the UK vulnerable to any requests if they use US services,” Jim Killock, executive director of Open Rights Group, told the Guardian.  “Given what we know about the extent of access to personal data from the Snowden revelations, this can only undermine customers' confidence in US businesses even further. What we already know about surveillance now seems to be true for ordinary policing.”  David Howard, Microsoft’s corporate vice president and deputy general counsel, explained in a blog post that the company was seeking to formally challenge the search warrant.  “The US government doesn’t have the power to search a home in another country, nor should it have the power to search the content of email stored overseas,” he wrote.  "The US has entered into many bilateral agreements establishing specific procedures for obtaining evidence in another country. We think the same rules should apply in the online world, but the government disagrees."  Francis ruled that the search warrant issued on electronic communications is not a conventional warrant, giving it power beyond that of a standard US warrant.  "It is executed like a subpoena in that it is served on the ISP in possession of the information and does not involve government agents entering the premises of the ISP to search its servers and seize the email account in question," his ruling explained, adding that territorial restrictions might impede law enforcements.  “This judgment increases the apprehension EU citizens will feel that their data is not protected under US law,” said Caspar Bowden, an independent privacy researcher who pre-empted Prism in a report to the EU parliament in Oct 2012.  “It is starkly contemptuous of the Mutual Legal Assistance treaties between countries, giving a licence to ignore assurances of due process made to foreign countries, merely because a [treaty] might be onerous or time-consuming or rejected on grounds foreseen and agreed with that foreign country, such as political offences (or criminalised copyright).  “If the US Cloud industry was worried before about lack of confidence of foreign customers, this judgment just upped the ante very considerably (subject of course to any appeals),” Bowden warned.  Microsoft will continue its appeals process, taking the case to a higher court and attempting to combat some of the “jurisdictional challenges” brought about by the internet and the sluggish speed with which the law is updated.  “This is the first step toward getting this issue in front of courts that have the authority to correct the government’s longstanding views on the application of search warrants to content stored digitally outside the United States,” said Howard.  • Microsoft announces privacy changes in the wake of search of blogger's email
Emails and private information from customers of US companies must be handed over – even if  data is stored outside  US. By Samuel Gibbs