Microsoft admits it 'cannot guarantee' data sovereignty
- Reference: 1753448408
- News link: https://www.theregister.co.uk/2025/07/25/microsoft_admits_it_cannot_guarantee/
- Source link:
The [1]Cloud Act is a law that gives the US government authority to obtain digital data held by US-based tech corporations irrespective of whether that data is stored on servers at home or on foreign soil. It is said to compel these companies, via warrant or subpoena, to accept the request.
Talking on [2]June 18 before a Senate inquiry into public procurement and the role it plays in European digital sovereignty, Microsoft France's Anton Carniaux, director of public and legal affairs, along with Pierre Lagarde, technical director of the public sector, were quizzed by local politicians.
[3]
Asked of any technical or legal mechanisms that could prevent this access under the Cloud Act, Carniaux said it had "contractually committed to our clients, including those in the public sector, to resist these requests when they are unfounded."
[4]
[5]
"We have implemented a very rigorous system, initiated during the Obama era by legal actions against requests from the authorities, which allows us to obtain concessions from the American government. We begin by analyzing very precisely the validity of a request and reject it if it is unfounded."
He said that Microsoft asks the US administration to redirect it to the client.
[6]
"When this proves impossible, we respond in extremely specific and limited cases. I would like to point out that the government cannot make requests that are not precisely defined."
Carniaux added: "If we must communicate, we ask to be able to notify the client concerned." He said that under the former Obama administration, Microsoft took cases to the US Supreme Court and as such ensured requests are "more focused, precise, justified and legally sound."
The Cloud Act was signed into law in 2018 following challenges the FBI faced when getting data via service providers through Store Communications Act warrants, which was itself legislated before cloud computing became a viable thing. Microsoft challenged previous requests, including one concerning a 2016 drug trafficking probe, when emails of a US citizen were held on Microsoft servers in Ireland, and [7]Microsoft argued the SCA did not cover data held outside the US.
[8]
The bill was supported at the time it became law by AWS, Microsoft, and Google – and was criticized by civil rights groups. European cloud providers with skin in the game have talked up the potential data sovereignty issue for customers in the EU, although, as Microsoft has said, it has not received data requests from the US government for data held on Microsoft servers in Europe.
Back at the hearing in France, Microsoft was asked if a data request was well framed, would the corporation be "obliged to transmit the data?"
Carniaux admitted: "Absolutely, by respecting this process. But again, this has not affected any European company, or a public sector body, since we have been publishing these transparency reports."
Microsoft transparency reports are twice yearly publications in which the business reveals how it manages user data requests, content removal, and more.
Legrande chimed in to say that for the past three years Microsoft has implemented a technical environment to minimize data transfers and keep customers data within the EU, "whether at rest, in transit or being processed, or whether it is data generated by application logs, including the support part."
As proceedings continued, Carniaux was asked if in the event of an injunction that was legally justified, could he, as Microsoft director of public and legal affairs, "guarantee our committee, under oath" that data on French citizens could not be transmitted to the American government without the explicit agreement of the French government.
"No," said Carniaux, "I cannot guarantee that, but, again, it has never happened before."
The Register asked Microsoft to comment on this but it declined to do so.
Mark Boost, CEO at Civo, claimed: "One line of testimony just confirmed that the US hyperscaler providers cannot guarantee data sovereignty in Europe."
"Microsoft has openly admitted what many have long known: under laws like the CLOUD Act, US authorities can compel access to data held by American cloud providers, regardless of where that data physically resides. UK or EU servers make no difference when jurisdiction lies elsewhere and local subsidiaries or 'trusted' partnerships don't change that reality.
"This is more than a technicality. It is a real-world issue that can impact national security, personal privacy and business competitiveness. We've already seen examples like the Scottish police case, where sensitive data was transferred out of jurisdiction and beyond intended control. The recent Microsoft testimony demonstrates how this can now happen on demand by US authorities.
"The French Senate has set a precedent by demanding answers, and the UK and Europe have an opportunity to do the same. We're already seeing a shift towards building homegrown solutions that support true data sovereignty rather than data residency. The government now needs to help industry accelerate this trend by reducing its over-dependence on hyperscalers."
AWS was [9]this week at pains to point out "five facts" about how the Cloud Act works following an uptick in "inquiries about how we manage government requests for data." First off, it says the legislation does not give US government "unfettered or automatic access to data stored in the cloud."
"The CLOUD Act primarily enabled the US to enter into reciprocal executive agreements with trusted foreign partners to obtain access to electronic evidence for investigations of serious crimes, wherever the evidence happens to be located, by lifting blocking statutes under US law.
"Under US law, providers are actually prohibited from disclosing data to the US government absent a legal exception," it adds, "To compel a provider to disclose content data, law enforcement must convince an independent federal judge that probable cause exists related to a particular crime, and that evidence of the crime will be found in the place to be searched."
AWS says it has not yet disclosed enterprise or government customer data under the Act; the principles of the Act are "consistent with international law and the laws of other countries"; and the law does "not limit the technical measures and operatonal controls AWS offers to customers to prevent unauthorised access to customer data."
The final point AWS makes - and one no doubt aimed at European rivals trying to exploit the data sovereignty movement - is that the Cloud Act does not only apply to US-headquarterd companies, it is applicable to all "electronic communication service or remote computing service providers" that do business stateside.
"For example, European-headquartered cloud providers with US operations are also subject to the Act's requirements. OVHcloud, a French headquartered cloud service provider that operates in the US, notes in its [10]CLOUD Act FAQ page that 'OVHcloud will comply with lawful requests from public authorities. Under the CLOUD Act, that could include data stored outside of the United States'."
"Similarly, other cloud providers headquartered in the EU and elsewhere, also have operations in the US."
Despite this, mistrust of the Trump administration by some in Europe, notably including [11]Dutch politicians , means worries linger about the state of relations between those in the EU trading bloc and the US.
Microsoft, like [12]AWS and [13]Google , has embarked on a campaign to assure any concerned customers in the EU that it can provide data sovereignty in the wake of Trump 2.0 and the US President's less than friendly stance towards nations once considered close allies, including the tariff policy that has derailed predictability in industries across the world.
[14]Sovereign-ish: Google Cloud keeps AI data in UK, but not the support
[15]Europe's exascale dreams inch closer as SiPearl finally tapes out Rhea1 chip
[16]SUSE launching region-locked support for the sovereignty-conscious
[17]EU rattles its purse and AI datacenter builders come running
Microsoft President Brad Smith noted the " [18]volatile " economic and geopolitical tensions between the US and Europe and vowed to build more datacenters in Europe among other measures. AWS will have services in place by the end of this year to address worries and Google is tackling these issues too.
Nevertheless, there is a [19]movement in Europe to become less reliant on American big tech, with technical advisors pressing the point for independence, and local techies and lobbyists [20]urging the head of the European Commission to create a sovereign infrastructure .
Given the billions of dollars US giants transact with customers in Europe, they are going to put up a big fight to retain the business. And they have time on their side, as building self reliance cannot be achieved [21]overnight .
We asked Google to comment and it referred us to a previous [22]blog published in May. AWS, which also earlier sent over its aforementioned blog post from July 22, told us it nothing further to add. ®
Get our [23]Tech Resources
[1] https://www.congress.gov/bill/115th-congress/house-bill/4943
[2] https://www.senat.fr/compte-rendu-commissions/20250609/ce_commande_publique.html
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offprem/paasiaas&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aIZNLAjFu5hWFzbG10lXIQAAAAE&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offprem/paasiaas&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aIZNLAjFu5hWFzbG10lXIQAAAAE&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offprem/paasiaas&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aIZNLAjFu5hWFzbG10lXIQAAAAE&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offprem/paasiaas&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aIZNLAjFu5hWFzbG10lXIQAAAAE&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[7] https://www.theregister.com/2016/07/14/microsoft_wins_landmark_irish_warrant_case_against_usa/
[8] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offprem/paasiaas&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aIZNLAjFu5hWFzbG10lXIQAAAAE&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[9] https://aws.amazon.com/blogs/security/five-facts-about-how-the-cloud-act-actually-works/
[10] https://us.ovhcloud.com/legal/faqs/cloud-act/
[11] https://www.theregister.com/2025/03/19/dutch_parliament_us_tech/
[12] https://www.theregister.com/2025/06/03/aws_european_sovereign_cloud/
[13] https://www.theregister.com/2025/05/21/google_sovereign_cloud_updates/
[14] https://www.theregister.com/2025/07/10/google_uk_data_sovereignty/
[15] https://www.theregister.com/2025/07/09/sipearl_rhea1_tape_out/
[16] https://www.theregister.com/2025/07/08/suse_sovereign_support/
[17] https://www.theregister.com/2025/07/01/eu_shakes_its_purse_and/
[18] https://www.theregister.com/2025/04/30/microsoft_getting_nervous_about_europes/
[19] https://www.theregister.com/2025/04/30/microsoft_getting_nervous_about_europes/
[20] https://www.theregister.com/2025/03/17/european_tech_sovereign_fund/
[21] https://www.theregister.com/2025/05/22/ditching_us_clouds_for_local/
[22] https://cloud.google.com/blog/products/identity-security/google-advances-sovereignty-choice-and-security-in-the-cloud
[23] https://whitepapers.theregister.com/
Re: Where does this leave Microsoft telemetry ?
I'm sure that if anyone actually read Microsoft's terms and conditions, they'd find that using Windows implicitly grants MS the right to slurp telemetry from them.
Re: Where does this leave Microsoft telemetry ?
My thoughts have always been "Who the fuck do the Yanks think they are? A load of fucking crooks and conmen."
Re: A load of fucking crooks and conmen
with a convicted felon in charge.
He's already selling 'Trump 2028' merch to the faithful.
{yes, the constitution says that he can't run but with the SCOTUS in his pocket, who knows}
There have been so many things
that had never happened before Trump. I'd count on it happening if I were any country in the EU. I'd start building my own localized data farms if I were the EU, and possibly make US based ones in the EU illegal since they are nothing more than spying machines.
Re: There have been so many things
This has nothing to do with the mad orange king. Even before 2018 when the Cloud Act was made law, National Security Letters were a thing, as far back as 2001 when the PATRIOT act was made law.
Re: There have been so many things
And we all did predict all of this in this forum.
There is no guarantee for data sovereignty with US companies. And they are not allowed to talk about data requests in certain cases, and that was covered in ElReg over the years as well.
So: no, I don't believe Microsoft's report, and we all have warned about this issue.
Re: There have been so many things
That exactly, they aren't allowed to say if they've been made to hand over data in some circumstances so all the "we've never done it" claims are smoke and mirrors. The question should be "Are there any circumstances where you would have to hand over EU data to the US government and not be able to tell anyone?"
Re: There have been so many things
Makes me think of the Regulation of Investigatory Powers act aka RIPA in the UK passed 20 years ago which prohibits those served with a demand under RIPA from notifying the subject of the request and requiring them to deny any such request has been made. Worse it's been increasingly built on since as UK public are so tech illiterate and lacking in memory retention that the govt and media just wait a few years and again start on about tackling the wild west of the internet
Re: There have been so many things
There is no guarantee of sovereighty with any cloud company, Yankee or otherwise. Microsoft are just the case in point.
You either go on-prem - and even thats vunerable to a sufficiently motivated state actor - or you risk assess it.
There are no absolutes in this game - ever. Lets stop pretending there are.
Re: There have been so many things
This is the truth, you can't really trust what a company based in the US, Brazil, UK, France, China, Russia, or anywhere else does with your data. They are all beholden to local laws.
Re: There have been so many things
Not just local law, but also international agreements and data sharing under such agreements as Five Eyes.
Re: There have been so many things
Snowden disclosed NSA had full access to Microsoft, Google, FaceBook etc servers prior to 2012.
Seems people have forgotten...
Re: There have been so many things
@Roland6
"Snowden disclosed NSA had full access to Microsoft, Google, FaceBook etc servers prior to 2012.
Seems people have forgotten..."
What he did was one of the most significant exposures to be made and yet fell out of public concern so quickly. I can understand him cast as both the hero and the villain but as I side with the people before the government I do wish he was treated better than exile.
Re: There have been so many things
"yet fell out of public concern so quickly". I wonder why.
Re: There have been so many things
A National Security Letter does not allow access to the content of communication, only the metadata.
And the Cloud Act, eventually, should not apply to most EU citizens:
An ECS or RCS provider may challenge a domestic warrant that compels disclosure of the contents of an electronic communication if:
- the customer or subscriber is not a U.S. citizen or national, lawful permanent resident, corporation, or other unincorporated entity;
- the customer or subscriber does not reside in the United States; and
- the required disclosure creates a material risk that the provider violates the laws of a foreign government with which the United States has in effect an executive agreement on data access.
However, according to the CLOUD Act site on the DoJ, the US is still in negotiation with the EU for one of these "executive agreement"s. So the third point above cannot ever be true for the EU until an agreement is made. This means, I think, that other motions to quash would have to be used if providing data would violate local laws (e.g. GPDR).
Re: There have been so many things
You are incorrect. An NSL does two things: it requests something, and requires that you not tell anyone about the contents of that request.
Technically correct, but with massive caveats
By law, NSLs can request only non-content information, like transactions, contact info, audit log records and that kind of thing. The law forbids using them to collect actual content. This means if a provider uses zero knowledge encryption of content, an NSL alone definitely cannot result in anything extra being provided. This does not preclude the use of an NSL to gather metadata and then the utilisation of other pieces of legislation to then gather info about, and eventually grab, the resulting data if it is plaintext. For instance: Are EXIF tags content? Are identified objects and category keywords logged in a SharePoint database considered to be content? Nope. Microsoft loves keeping your data plaintext (from their perspective) where possible by encouraging all but the most highly paying customers to use encryption keys Microsoft possesses and controls.
Additionally, Microsoft brags at every possible opportunity about how they go above and beyond to help law enforcement, even forming the Microsoft Digital Crimes Unit (DCU) and being instrumental in working with organisations like the IWF to proactively catch out users they deem as undesirable by scanning every piece of content they get their grubby mitts on, including any data you chose to encrypt using your own keys. For example, OneDrive will happily decrypt your encrypted ZIP files without your express consent, if they can work out the key, and they’ll happily use bruteforce techniques to achieve this. You can observe this for yourself by encrypting a ZIP containing known malware with “infected” as an encryption password. OneDrive will detect the malware because it has decrypted your ZIP and scanned its contents. Also don’t even think about using any complex password and then using any other related service to provide the decryption password, because if you do, they will attempt to use it to decrypt your files and scan them. Likewise for encrypted Excel or Word documents, where they will happily slurp data using connected services (such as whenever you edit an image) whenever you edit them to do things like add tags. Microsoft invented a whole bunch of categorisation tools for detecting all manner of content and will perform custom queries for law enforcement utilising any derived metadata they’ve created about the contents of your files.
Microsoft does everything in their power to demonstrate to Joe Public that they probably shouldn’t be trusted, irrespective of which servers your data is stored on, and irrespective of network flows being limited to specific countries. Just. Say. No.
Data sovereignty at the nation state level is just misdirection. The real problem is far simpler. They cannot be trusted with anything private at all.
Re: There have been so many things
When I see a brand new poster with a posting history of 2 posts, I immediately think MS' PR are trying and failing to manage this story.
Welcome, we've known here for years that the US can rummage through any data held on a server owned by a US company located outside the US.
Re: There have been so many things
In 2001 nobody expected that Russian asset would become US president.
Re: There have been so many things
Twice.
It's time for the Spanish Inquisition to make an appearance and take him away
Re: There have been so many things
Four times.
Re: There have been so many things
That seems...unexpected.
Re: There have been so many things
Decades back the US tax authorities marched into the US branch of a Swiss bank and demanded details of customer accounts held in Switzerland. To comply they would be breaking Swiss banking law. Not to comply would be non compliance with the warrant so a US offence. They complied because local law supersedes foreign law in as much as the local authorities were already there with cuffs ready.
The only solution is to make it impossible to access the data. This was done and the next time it happened the folks in the US protested they were not physically able to comply. It was accepted as a valid personal defense but the bank was still fined daily for non compliance.
Re: There have been so many things
Yeah, but RIPA says if you don't tell 'em any encryption key they can [1]lock you up , until you do.
[1] https://www.legislation.gov.uk/ukpga/2000/23/section/53
Tell us something new
As many commentards here, myself included, have been pointing out for a long time, any data placed on a server operated by a US company is available for slurpage by the US TLAs. If they really want it, the data is taken by means of a National Security Letter. Then, even the weak protections afforded by the Cloud Act don't apply. They'll just copy it. Nobody will even know it was copied as the US company cannot even tell you about it.
If you're an EU company and you put your data on a US cloud provider's servers, regardless of pretty words like "sovereign", you are breaching GDPR, client confidentiality agreements and who knows what else.
Just say no to US cloud services.
Re: Tell us something new
Just say no to US cloud services.
Just like I remember a [1]Just say No campaign from long ago.
[1] https://en.wikipedia.org/wiki/Just_Say_No
Re: Tell us something new
" Just like I remember a Just say No campaign from long ago. "
I can not recall whether that was no to sex or to drugs... Must have been drugs.
The '60s are a blur too but wasn't that campaign a Nancy Reagan initiative ?
Might be ungentlemanly but drugs would still have been the better offer. ;)
Re: Tell us something new
You are breaching GDPR in a wholly irrelevant way though. This elephant has been in the room since GDPR was formed and its just one example. Look at Safe Harbour.
If the benefit from data interchange is big enough - even the EU turns a blind eye to it.
So whilst you are breaching GDPR or Client Confidentiality - no one will point it out because no-one else in the room is wearing kecks either.
Re: Tell us something new
If you're an EU company and you put your data on a US cloud provider's servers [...] you are breaching GDPR
Surely not if you encrypt it with a key YOU control. Microsoft can't hand over data they can't read.
Re: Tell us something new
Sure, but that only works if all you're doing with that cloud is storing data. In most real-world scenarios, the cloud will be actually running a workload on that data, and that means it can't be encrypted all the time.
Re: Tell us something new
> Surely not if you encrypt it with a key YOU control. Microsoft can't hand over data they can't read.
Only if that encryption happens on your premises, not theirs.
Which makes it rather difficult to have an app on a cloud-hosted server reading/writing cloud hosted storage in a secure way.
Re: Tell us something new
Are you speaking of the key that is available in your GitHub repository that is controlled by Microsoft?
Re: Tell us something new
Or even the key that you created locally and then sent to the appropriate colleagues via Outlook or Teams in Office 365.
If you ever made a secret key and sent it over any network outside (and sometimes even inside) your business, the US already has a copy.
" the government cannot make requests that are not precisely defined."
US Government; Give us all the data.
Is that precise enough?
Fool
Anyone who ever believed otherwise is a fool.
I appreciate the importance of data sovereignty, but given the horrendous number of security holes Microsoft’s cloud services seem to suffer from, it’s all a bit of a moot point.
what this article is about is that data sovereignty is not available from Microsoft hosted solution, so them having holes is a moot point if you are after data sovereignty
In short, the American government demands the same right to hoovering offshore data "owned" by American cloud and internet service providers exactly the same as the Chinese government does of Chinese providers.
Typical case of the pot calling the kettle black.
There's not one Government that wont. They are all at it. Some just pretend more than others.
Typical case of the pot calling the kettle black.
Wok surely ?
I'm gonna play devils advocate here. Mark Boost is being a little disengenuous, There is no way if you are asked to guarantee something under oath, that you will answer yes unless you personally are aware its watertight and there are clearly ways that it may not be.
That doesnt mean that MS (or anyone else) couldnt engineer a situation where its very very very difficult for it to happen in practise.
For instance MS US and MS France are 2 seperate companies, with 2 legally seperate sets of employees and infrastructure. So you engineer it so neither set of empoyees has **any** data access to the other set of infra. Lets also say France has a law saying export of French data for a Cloud Act request is a crime. The US Ceo has to obey US law and says give me data on pain of jail time. The French CEO has to obey french law and says non - J'irai en prison.
Result : Legal Stalemate.
Of course whether MS has the will to implement this is a another story. Just like its theoretically possible for the Data grab to happen - its also theoretically possible to prevent it - leaving edge cases like the NSA hacking it out of France etc.
The reality is that bad lawyers and politicians play the absolutes game. Good Lawyers and Techies play the risk game. What is the likelyhood Uncle Sam will do a slurp and what are the consequences if they do do.
Lets face it - if you want to protect your data you hide it in a cupboard in the basement at the bottom of a long stair behind a door that says beware of the Leopard, and you patch your leopard against Zero days.
Difference though is that MS US *owns* MS France. In the US judiciary's books, that means MS US controls MS France. And even before the Trumpet, that was the view of other legal eagles. who demanded that MS US give access to stuff under MS Ireland's control, despite MS US protesting and saying "it's not under our control". Result: MS US paying a nominal daily fine of being in contempt of court for *not* giving the Justice Department access to said contentious files.
Again, if you merely *touch* something Leftpondian, whether that's a currency, or you use a service of theirs, or you do business with them, the view of the US judiciary is that you fall under US law and as such you can be prosecuted for something in the US that is not a crime elsewhere (see the recent traders who had their sentences undone because in the UK they never broke any laws, but the US believed they did until they undid those sentences in the US).
So, lesson here is: reduce/stop your exposure to anything Leftpondian.
Take Back Control?
Wait! What are you saying? That we have no sovereignty? You mean all that shit about Take Back Control was for nothing?
Well shoot me in both feet with a double-barrelled shot gun.
Seriously?
Now you're just being naive.
If the FBI delivers a National Security Letter to Microsoft saying "give us all data that company x stores on your cloud services, regardless of where in the world the servers are located", Microsoft will deliver that data. They cannot refuse to comply with a National Security Letter.
No ifs, no buts, no "but the French arm of our company says it would be illegal", no clever legal arguments. You deliver it or your US CEO goes to prison.
Do you honestly believe that a Microsoft subsidiary can lock their US masters out of their network? The US operation will simply log in and copy the data as instructed.
Re: Seriously?
Isn't no access to the data by the US owner sort of the whole point of this "sovereignty" scheme?
Re: Seriously?
The "sovereignty" scheme is smoke and mirrors cooked up by marketing, sales, and legal.
Re: Seriously?
A National Security Letter does not allow access to the content of communication, only the metadata.
Re: Seriously?
That will tell 'em!
Re: Seriously?
The FBI used them time and time again to get access to the content
Who is gonna arrest them?
Where does this leave Microsoft telemetry ?
If they have to obey an order from the government of the USA to hand over data that they have access to on servers in other countries ... what about data that they have access to stored on Windows PCs in other countries ?