Can a U.S. business store mail on a server outside the U.S.?

Question

If you are a business incorporated/registered in the US, is it currently (Feb. 28 2018) legal to store emails on mail servers outside the US?

Answer 1

In the absence of national security concerns, it is legal to store emails on mail servers outside the US. This is true even of information protected by HIPAA.

This is a good thing, because the way the Internet works is a sort of pony express style network. Your email goes from server to server to server, potentially all over the world even if the sender and recipient of the email are not too far from each other in the same country, by a route that only the most sophisticated techies can even determine, and spends time in all of the unknown servers it crosses through en route. An email I send from Denver to my brother in Boston could easily detour through servers in Canada and Iceland en route, for example. So, if it was illegal for a U.S. business to have an email on a non-U.S. server, it could easily violate the law every day without even knowing it.

Defense contractors and intelligence agency contractors would typically be subject to much more stringent cyber security requirements set forth in their contracts and mandated by various DOD and intelligence agency regulations which might prohibit storing emails on mail servers outside the U.S. The exact details of those requirements typically aren't publicly available to people who do not have security clearances, and might involve crypto standards rather than the physical locations of the servers used, for example.

Note, however, that the fact that server is outside the U.S. would not relieve the U.S. based business of the obligation to comply with subpoenas and other legal process related to data in foreign servers which they control. Generally, court orders act on the person and subject that person to penalties if they fail to comply, rather than upon the thing involved in a direction to comply with court process. But, if the information was in foreign servers, a subpoena to get the information might have to be aimed at the U.S. company, rather than the foreign server management company in the absence of a cumbersome process called issuance of letter rogatory.

Similarly, the U.S. business would not be immune from liability, for example, under U.S. child pornography laws, simply because the U.S. business had emails and data on a server outside the U.S. rather than in the U.S., at least, if the U.S. person or business could effectively exercise control over that data, in the eyes of a judge.

A final point worth noting is that it would be much easier for the NSA to obtain legal authority to hack email of a U.S. business on foreign servers than it would be for the NSA to get legal permission to hack the email of a U.S. business on domestic servers. As far as U.S. intelligence agencies are concerned, almost all non-U.S. sources are legitimate hacking targets for any alleged intelligence objective, read very leniently.