Foreigners can be protected by the Electronic Communications Privacy Act (ECPA). The parts of the ECPA that prevent ISP's from revealing electronic communications apply to foreigners when their emails are stored on a domestic server, the Ninth Circuit has ruled.

In Suzlon Energy v. Microsoft, the plaintiff had directed a subpoena to Microsoft seeking the substance of emails between a citizen of India with respect to fraud litigation in Australia. Microsoft did not comply with the subpoena, taking the position that to do so would violate the ECPA. The federal trial court agreed and quashed the subpoena.

The case went up on appeal to the Ninth Circuit. A unanimous appellate panel decided that the statutory language of ECPA extends its protections to the Indian citizen. The Ninth Circuit reasoned that if Congress had intended to limit the application of the statute to citizens of the United States only, Congress would have done so explicitly.

The Ninth Circuit also stated that limiting the ECPA only to US citizens could cause practical problems. An ISP would have to go about the difficult task of trying to ascertain whether an account holder was a US citizen.

Still, the Ninth Circuit was clear that the ECPA governs "at least" when the requested information is stored on servers within the United States. In this case, the emails in question were housed on Microsoft's U.S. servers.

The Ninth Circuit made plain that it was not considering whether the ECPA could apply to information stored outside of the United States. Indeed, two years ago, another Ninth Circuit panel concluded that the ECPA does not govern email interceptions beyond the U.S.