New US Senate bill aims to limit access to emails stored abroad

The legislation follows Microsoft's refusal to turn in emails in Ireland to U.S. law enforcement

Legislation introduced in the U.S. Senate on Thursday aims to place limits on access by U.S. law enforcement agencies to emails and other communications stored abroad.

The proposed legislation comes against the backdrop of a dispute between Microsoft and the government, in which the tech company has refused to hand over emails held by it at a facility in Dublin, Ireland.

The new bill, called the Law Enforcement Access to Data Stored Abroad (LEADS) Act, aims to amend the Electronic Communications Privacy Act to authorize the use of search warrants extraterritorially, only where the government wants to obtain the contents of electronic communications belonging to a U.S citizen or permanent resident alien or a company incorporated in the U.S.

It also provides that the court issuing the warrant shall modify or vacate the warrant, if it finds that it would require the communications provider or remote computing service to violate the laws of a foreign country.

The bill was introduced by U.S. Senators Orrin Hatch, a Republican from Utah and current member and former chairman of the Senate Judiciary Committee, Chris Coons, a Democrat from Delaware and member of the Judiciary Committee, and Dean Heller, a Republican from Nevada.

"The government's position that ECPA warrants do apply abroad puts U.S. cloud providers in the position of having to break the privacy laws of foreign countries in which they do business in order to comply with U.S. law," Coons said in a statement.

"This bill proposes a more principled legal blueprint for balancing law enforcement needs with consumer privacy rights," said Microsoft general counsel Brad Smith in a blog post. "It also creates an important model that will help advance the international conversation that is so critically needed."

U.S. Magistrate Judge James C. Francis IV of the U.S. District Court for the Southern District of New York in April declined to quash a December warrant that authorized the search and seizure of information, including content and identifiers such as name and physical address, of a Web-based email account stored at Microsoft's premises.

The company held that courts in the U.S. are not authorized to issue warrants for extraterritorial search and seizure, but Judge Francis held that a warrant under the Stored Communications Act, a part of the ECPA, was "a hybrid: part search warrant and part subpoena." It is executed like a subpoena in that it is served on the Internet service provider who is required to provide the information from its servers wherever located, and does not involve government officials entering the premises, he noted.

Microsoft is appealing the order after some procedures are met.

There are some specific concerns with the bill, wrote Greg Nojeim, senior counsel at online civil liberties organization Center for Democracy & Technology in a blog post, while applauding the bill's overall thrust.

One odd result will be that the LEADS Act would establish one rule - the extraterritorial warrant - for U.S. law enforcement to access content that a U.S. provider stores abroad on behalf of an American, and the multinational Mutual Legal Assistance Treaty, or MLAT process, for a person who sits in the cubical next door, but who may be a non-citizen working in the U.S. on a temporary visa, Nojeim wrote. MLAT governs exchange of information between countries for law enforcement purposes.

John Ribeiro covers outsourcing and general technology breaking news from India for The IDG News Service. Follow John on Twitter at @Johnribeiro. John's e-mail address is

Join the CSO newsletter!

Error: Please check your email address.

Tags U.S. SenateInternet-based applications and servicessecurityMicrosoftlegislationgovernmentinternetprivacy

More about HatchIDGMicrosoftNewsTechnology

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by John Ribeiro

Latest Videos

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

  • 150x50

    IDG Live Webinar:The right collaboration strategy will help your business take flight

    Speakers - Mike Harris, Engineering Services Manager, Jetstar - Christopher Johnson, IT Director APAC, 20th Century Fox - Brent Maxwell, Director of Information Systems, THE ICONIC - IDG MC/Moderator Anthony Caruana

    Play Video

More videos

Blog Posts