Slashdot Mirror
American Judge Claims Jurisdiction Over Data Stored In Other Countries
New submitter sim2com writes: "An American judge has just added another reason why foreign (non-American) companies should avoid using American Internet service companies. The judge ruled that search warrants for customer email and other content must be turned over, even when that data is stored on servers in other countries. The ruling came out of a case in which U.S. law enforcement was demanding data from Microsoft's servers in Dublin, Ireland. Microsoft fought back, saying, 'A U.S. prosecutor cannot obtain a U.S. warrant to search someone's home located in another country, just as another country's prosecutor cannot obtain a court order in her home country to conduct a search in the United States. We think the same rules should apply in the online world, but the government disagrees.'
If this ruling stands, foreign governments will not be happy about having their legal jurisdiction trespassed by American courts that force American companies to turn over customers' data stored in their countries. The question is: who does have legal jurisdiction on data stored in a given country? The courts of that country, or the courts of the nationality of the company who manages the data storage? This is a matter that has to be decided by International treaties. While we're at it, let's try to establish an International cyber law enforcement system. In the meantime."
If this ruling stands, foreign governments will not be happy about having their legal jurisdiction trespassed by American courts that force American companies to turn over customers' data stored in their countries. The question is: who does have legal jurisdiction on data stored in a given country? The courts of that country, or the courts of the nationality of the company who manages the data storage? This is a matter that has to be decided by International treaties. While we're at it, let's try to establish an International cyber law enforcement system. In the meantime."
I think the fact that it's an American company being ordered to produce the data factors in here. The judge does have jurisdiction over the company, which makes it a different situation from ordering a company in another country to turn over data stored there. If you want to get out of a country's legal jurisdiction, you need to be out of their jurisdiction.
Microsoft, however, is subject to the jurisdiction of the U.S. Federal Court system, and when a Magistrate Judge orders them to produce something, they are compelled to produce it. It doesn't really matter where the something is. Basically the court is saying the search warrant can be executed like a subpoena.
From the linked article:
A search warrant for email information, he said, is a "hybrid" order: obtained like a search warrant but executed like a subpoena for documents. Longstanding U.S. law holds that the recipient of a subpoena must provide the information sought, no matter where it is held, he said.
EU law already makes it illegal to pass "personal data" to any location which lacks the protections available in Europe. The so-called Safe Harbor provisions apply for te US situation, but everyone who understands the EU law knows that the Safe Harbor arrangements are just smoke and mirrors - they afford precisely no protection at all - they exist to enable EU companies to export data to the US while claiming they have complied wth the law.
"Cock Up Your Beaver" does not mean what you think. This sig is intended to clog filters and annoy do-gooders
Denmark recently sold its digital infrastructure (digital identities, national bank payments, etc) to a US company. The Danish government said there was nothing to worry about, because the servers would still be in Denmark. Thank you, USA, for proving the Danish government wrong.
The search warrant analogy is completely spurious. An American court cannot compel a search of a foreign property. But they can certainly compel an American company (or individual) to produce information owned by the company that happens to reside in a file folder in another country, or be liable for contempt of court.
Sensationalism, thy name is slashdot.
Brett
In what appears to be the first court decision addressing the issue, U.S. Magistrate Judge James Francis in New York said Internet service providers such as Microsoft Corp or Google Inc cannot refuse to turn over customer information and emails stored in other countries when issued a valid search warrant from U.S. law enforcement agencies.
Emphasis mine. I read this to mean that if you use any US owned mail provider the FBI can subpoena anything they want through a US judge. That just seems horribly wrong and would put the world wide operation of any company at the mercy of the jurisdiction where they're headquartered. By this logic the NSA can get a subpoena to demand all US companies turn over any information they got anywhere in the world. You could never trust a foreign company to follow local laws. If this stands it's a horrible precedent.
Live today, because you never know what tomorrow brings
Microsoft does not own the information; they as a third party own the server on which someone else's information resides, a server which is held and taxed as a foreign asset outside US regional jurisdiction. It's one thing to compel Microsoft as a transnational company to produce one of their corporate records regardless of where they have stored it: agreeing to subject themselves to the US judicial system is part of incorporating in the US. It's entirely another when they are being told their foreign offices are actually territory of the US government and anyone or anything which resides there must submit to the pleasures of the US judicial system.
If I had written a letter in Britain and put it in a British safety deposit box I don't think the court would have the guts to demand it, even if the bank were jointly owned in the US. But scan that letter and store on the server and suddenly it's free game. Why? Because now it's easy to sneak the data out of the country without bothering the local authorities? Good news for people torrenting.
I suppose if you live in other countries you should doublecheck that any web companies you do business with do not also have a US presence because if they do any of your data could be subject to requisition by the US government even if it's data which has never left your country.
When things get complex, multiply by the complex conjugate.