In an attempt to evade the long arm of U.S. intelligence that could mark a sea change in internet privacy, Microsoft has announced plans to build two new data centers in Germany that will store user information in a secure network and not allow access to anyone—including the U.S. government and Microsoft staff themselves—without explicit approval by the user or a “data trustee.”
If permission is granted by the user or the trustee, Microsoft would still be required to operate under their supervision.
In this case, the trustee is T-Systems, a subsidiary of German conglomerate Deutsche Telekom. By stationing its data servers in Frankfurt am Main and Magdeburg, Microsoft will be placing user data under German privacy protections, which are some of the strictest in Europe.
The move comes amid growing public outcry over government eavesdropping in the wake of Edward Snowden’s 2013 revelations that exposed National Security Agency (NSA) mass surveillance at home and abroad. And it may help address new privacy concerns arising just weeks after the U.S. Senate passed the controversial Cybersecurity Information Sharing Act (CISA), which supporters say would make it easier for tech companies to respond to security breaches—but which opponents say is nothing more than a government surveillance bill in disguise.
Microsoft, which publicly opposed CISA, has been in an ongoing legal battle with the Department of Justice (DOJ) after the company in December 2013 refused to hand over emails from a drug trafficking suspect stored on servers in Dublin, Ireland. Microsoft told DOJ officials they would have to get a warrant from an Irish court.
With that case still underway, the company’s initiative signals that it may be looking for a whole new approach to privacy.
The implications of the move are significant, even if they are not necessary fail-safe. As The Verge writes:
It’s an approach that’s comparable to Apple’s use of encryption that even the iPhone-maker can’t break — theoretically taking away the option of government authorities forcing the company to give up users’ data. However, none of these tactics are ever completely secure. For example, the Snowden revelations showed that despite Europe’s outward desire for data sovereignty, many local spy agencies still funneled European citizens’ data to the NSA.
Paul Miller, an analyst for Forrester, notes that although Microsoft is confident in the security of German servers, this arrangement has yet to be tested in the courts. “To be sure, we must wait for the first legal challenge. And the appeal. And the counter-appeal,” said Miller.
More importantly, though, Microsoft’s decision could end up affecting more than just its own users. If the German trustee model becomes a recognized standard for data security, then customers of other cloud computing firms like Google and Amazon could demand similar arrangements. EU officials might also be emboldened by the move. Last month, the EU Court of Justice invalidated the longstanding Safe Harbor treaty allowing US companies to send data on European citizens back to America. The treaty is currently being renegotiated, and Microsoft’s support for the data trustee model could feed into these debates.
The data centers—which are connected to each other by a private network that will operate separately from the internet—are aimed at organizations working with sensitive information, such as health or finances.
“These locally deployed versions of Microsoft’s commercial cloud services adhere to German data handling regulations and customers will be able to view how and where data is processed,” the company stated on Wednesday.
