Microsoft admits it 'cannot guarantee' data sovereignty

Microsoft says it "cannot guarantee" data sovereignty to customers in France – and by implication the wider European Union – should the Trump administration demand access to customer information held on its servers.

The Cloud Act is a law that gives the US government authority to obtain digital data held by US-based tech corporations irrespective of whether that data is stored on servers at home or on foreign soil. It is said to compel these companies, via warrant or subpoena, to accept the request.

Talking on June 18 before a Senate inquiry into public procurement and the role it plays in European digital sovereignty, Microsoft France's Anton Carniaux, director of public and legal affairs, along with Pierre Lagarde, technical director of the public sector, were quizzed by local politicians.

Asked of any technical or legal mechanisms that could prevent this access under the Cloud Act, Carniaux said it had "contractually committed to our clients, including those in the public sector, to resist these requests when they are unfounded."

"We have implemented a very rigorous system, initiated during the Obama era by legal actions against requests from the authorities, which allows us to obtain concessions from the American government. We begin by analyzing very precisely the validity of a request and reject it if it is unfounded."

He said that Microsoft asks the US administration to redirect it to the client.

"When this proves impossible, we respond in extremely specific and limited cases. I would like to point out that the government cannot make requests that are not precisely defined."

Carniaux added: "If we must communicate, we ask to be able to notify the client concerned." He said that under the former Obama administration, Microsoft took cases to the US Supreme Court and as such ensured requests are "more focused, precise, justified and legally sound."

The Cloud Act was signed into law in 2018 following challenges the FBI faced when getting data via service providers through Store Communications Act warrants, which was itself legislated before cloud computing became a viable thing. Microsoft challenged previous requests, including one concerning a 2016 drug trafficking probe, when emails of a US citizen were held on Microsoft servers in Ireland, and Microsoft argued the SCA did not cover data held outside the US.

The bill was supported at the time it became law by AWS, Microsoft, and Google – and was criticized by civil rights groups. European cloud providers with skin in the game have talked up the potential data sovereignty issue for customers in the EU, although, as Microsoft has said, it has not received data requests from the US government for data held on Microsoft servers in Europe.

Back at the hearing in France, Microsoft was asked if a data request was well framed, would the corporation be "obliged to transmit the data?"

Carniaux admitted: "Absolutely, by respecting this process. But again, this has not affected any European company, or a public sector body, since we have been publishing these transparency reports."

Microsoft transparency reports are twice yearly publications in which the business reveals how it manages user data requests, content removal, and more.

Legrande chimed in to say that for the past three years Microsoft has implemented a technical environment to minimize data transfers and keep customers data within the EU, "whether at rest, in transit or being processed, or whether it is data generated by application logs, including the support part."

As proceedings continued, Carniaux was asked if in the event of an injunction that was legally justified, could he, as Microsoft director of public and legal affairs, "guarantee our committee, under oath" that data on French citizens could not be transmitted to the American government without the explicit agreement of the French government.

"No," said Carniaux, "I cannot guarantee that, but, again, it has never happened before."

The Register asked Microsoft to comment on this but it declined to do so.

Mark Boost, CEO at Civo, claimed: "One line of testimony just confirmed that the US hyperscaler providers cannot guarantee data sovereignty in Europe."

"Microsoft has openly admitted what many have long known: under laws like the CLOUD Act, US authorities can compel access to data held by American cloud providers, regardless of where that data physically resides. UK or EU servers make no difference when jurisdiction lies elsewhere and local subsidiaries or 'trusted' partnerships don't change that reality.

"This is more than a technicality. It is a real-world issue that can impact national security, personal privacy and business competitiveness. We've already seen examples like the Scottish police case, where sensitive data was transferred out of jurisdiction and beyond intended control. The recent Microsoft testimony demonstrates how this can now happen on demand by US authorities.

"The French Senate has set a precedent by demanding answers, and the UK and Europe have an opportunity to do the same. We're already seeing a shift towards building homegrown solutions that support true data sovereignty rather than data residency. The government now needs to help industry accelerate this trend by reducing its over-dependence on hyperscalers."

AWS was this week at pains to point out "five facts" about how the Cloud Act works following an uptick in "inquiries about how we manage government requests for data." First off, it says the legislation does not give US government "unfettered or automatic access to data stored in the cloud."

"The CLOUD Act primarily enabled the US to enter into reciprocal executive agreements with trusted foreign partners to obtain access to electronic evidence for investigations of serious crimes, wherever the evidence happens to be located, by lifting blocking statutes under US law.

"Under US law, providers are actually prohibited from disclosing data to the US government absent a legal exception," it adds, "To compel a provider to disclose content data, law enforcement must convince an independent federal judge that probable cause exists related to a particular crime, and that evidence of the crime will be found in the place to be searched."

AWS says it has not yet disclosed enterprise or government customer data under the Act; the principles of the Act are "consistent with international law and the laws of other countries"; and the law does "not limit the technical measures and operatonal controls AWS offers to customers to prevent unauthorised access to customer data."

The final point AWS makes - and one no doubt aimed at European rivals trying to exploit the data sovereignty movement - is that the Cloud Act does not only apply to US-headquarterd companies, it is applicable to all "electronic communication service or remote computing service providers" that do business stateside.

"For example, European-headquartered cloud providers with US operations are also subject to the Act's requirements. OVHcloud, a French headquartered cloud service provider that operates in the US, notes in its CLOUD Act FAQ page that 'OVHcloud will comply with lawful requests from public authorities. Under the CLOUD Act, that could include data stored outside of the United States'."

"Similarly, other cloud providers headquartered in the EU and elsewhere, also have operations in the US."

Despite this, mistrust of the Trump administration by some in Europe, notably including Dutch politicians, means worries linger about the state of relations between those in the EU trading bloc and the US.

Microsoft, like AWS and Google, has embarked on a campaign to assure any concerned customers in the EU that it can provide data sovereignty in the wake of Trump 2.0 and the US President's less than friendly stance towards nations once considered close allies, including the tariff policy that has derailed predictability in industries across the world.

• Sovereign-ish: Google Cloud keeps AI data in UK, but not the support
• Europe's exascale dreams inch closer as SiPearl finally tapes out Rhea1 chip
• SUSE launching region-locked support for the sovereignty-conscious
• EU rattles its purse and AI datacenter builders come running

Microsoft President Brad Smith noted the "volatile" economic and geopolitical tensions between the US and Europe and vowed to build more datacenters in Europe among other measures. AWS will have services in place by the end of this year to address worries and Google is tackling these issues too.

Nevertheless, there is a movement in Europe to become less reliant on American big tech, with technical advisors pressing the point for independence, and local techies and lobbyists urging the head of the European Commission to create a sovereign infrastructure.

Given the billions of dollars US giants transact with customers in Europe, they are going to put up a big fight to retain the business. And they have time on their side, as building self reliance cannot be achieved overnight.

We asked Google to comment and it referred us to a previous blog published in May. AWS, which also earlier sent over its aforementioned blog post from July 22, told us it nothing further to add. ®