While attending Columbia’s conference on Internet Governance and Cyber-Security, a few issues were brought to light that will be of interest to those concerned with the intersection between technology, law and security. Listening to the Executive Vice President, Legal and Corporate Affairs of Microsoft, Brad Smith, many issues were brought up in regards to data residency and troubling legal loopholes under current law.

One important case that revels legal challenges in the face of technological changes is a lawsuit brought by the U.S. Government against Microsoft which ordered the company to turn over information relating to a user whose data was stored at a data center in Dublin, Ireland.

The legal view is that the U.S. government can compel any U.S.-based cloud provider to disclose a user’s content data stored outside the United States simply because the U.S. company is subject to American control and jurisdiction. This might seem fair at first glance to have American companies subject to American law, but what about the law of the foreign territory they inhabit?

This issue as it stands may not be attention grabbing, but as Mr. Smith points out, what happens when this situation involves a Chinese company on American soil?

China’s internet giant, Alibaba, is planning to open a data center in Silicon Valley in order to expand into cloud services for business, both Chinese and American. Though this announcement has attracted some attention, when subjected to the legal scenario of Microsoft in Ireland, a Chinese company hosting American data becomes worrisome, because as the law currently stands, the Chinese government is legally free to compel Alibaba, to disclose any information in the company’s control, even if that data is stored in America.

As TechCrunch points out, “One can imagine that most American citizens would be surprised to learn that American privacy and civil liberties laws were inapplicable to their own data housed on America soil.”

This situation reminds us that technological innovation comes with legal hurdles and we must be careful to protect our personal information and maintain trust with our Internet companies and governments that regulate them.