2

I have a local Exchange server, which has several spam and email reception issues (Due to an expired subscription to a spam filtering system). I was looking at the Office 365 Exchange Online protection (https://products.office.com/en-us/exchange/microsoft-exchange-online-protection-email-filter-and-anti-spam-protection-email-security-email-spam) as a solution for our problems. Exchange Online Protection would act as a gateway for incoming and outgoing emails of my organization.

We looked into hosting our emails in Office 365 but then I faced the issue described below.

Office 365 services are hosted in the United States and we are located in Canada. This makes the data on the Office 365 servers under the USA PATRIOT Act (See this for more information https://www.congress.gov/bill/107th-congress/house-bill/3162). For people that are not aware of what the USA PATRIOT Act is, it is a law in the United States that allows the government to have access to any data that is hosted in the United States in order to protect citizens against potential threats.

I called the Office 365 team to have more information in what information is kept on their servers when using this "Spam Filtering" service. As per the answer they gave me, only the information in the header of the email is kept, for reporting and monitoring purposes.

I know from experience that email headers contain the following information:

  • Email sender
  • Email recipient
  • Source server
  • Subject
  • If the email contain an attachment

The emails that are sent from and to our organization contains information that we would not like the Government to see (Don't worry, nothing illegal, violent or dangerous for citizens).

My question is, how can keeping the header of the emails on the data center of Office 365 in the United States affect the privacy of my information since the content and attachment of emails are not under their control?

Second question: Would having the email header, and therefore the subject, sender and recipient information could lead the Government to force us to provide the information, even though we host the full content in Canada?

Let me know if there are any clarification required.

migrated from serverfault.com Aug 14 '15 at 1:35

This question came from our site for system and network administrators.

  • 2
    There is an easy rule as a minimum: If you don't want a foreign government to access your data, don't host with companies from that country (even when operating in your own country). And regardless of what is or is not logged in the O365 systems, you give full control to MS over your mail if they act as a gateway - every mail has to go through their system and there is nothing preventing them for storing it in full (and make it easy for intelligence agencies to do the same). – Sven Aug 13 '15 at 10:54
  • For what it's worth, Microsoft does not automatically hand over data to any government, even when that government issues a warrant. They require a court order at least to even consider releasing data in most jurisdictions, and they fight court orders instead of merely complying. This says nothing about what backdoors or exploits US government agencies like the NSA might have access to. See: microsoft.com/about/corporatecitizenship/en-us/reporting/… – Todd Wilcox Aug 13 '15 at 13:49
  • From the above link: "In the second half of 2014, Microsoft disclosed content in response to 3.37 % of the total number of law enforcement requests received." – Todd Wilcox Aug 13 '15 at 13:51
  • I believe Patriot Act requests are handled by the FISA court, which is reported separately, since originally they were not allowed to report FISA requests at all. Now they are allowed limited reporting of FISA requests which is available here: microsoft.com/about/corporatecitizenship/en-us/reporting/fisa "While we report on the number of orders received, receipt of an order does not mean Microsoft ultimately disclosed the information sought. We have successfully challenged requests in court, and will continue to do so when we believe there are grounds for a challenge." – Todd Wilcox Aug 13 '15 at 13:55
  • Overall, this whole line of questioning should involve your company's general counsel. The legal implications of using EOP might be beyond the scope of SF.SE. – Todd Wilcox Aug 13 '15 at 13:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.