Judge: US Search Warrants Apply To Overseas Computers
jfruh (300774) writes Investigators in a criminal case want to see some emails stored on Microsoft's servers in Ireland. Microsoft has resisted, on the grounds that U.S. law enforcement doesn't have jurisdiction there, but a New York judge ruled against them, responding to prosecutors' worries that web service providers could just move information around the world to avoid investigation. The case will be appealed.
Multinationals have operated above the law for far too long. The US is sending a clear message that if you do business in a country you are subject to its laws -- globally.
Going to take a position I know will be unpopular in this thread, but:
The leverage they have is that you're accused of committing a crime within the borders of the US, and evidence you have access to can be demanded under a warrant that covers details related to that crime. Their physical inability to seize it by force(because it's in another jurisdiction) is about as relevant as their inability to unlock your bank safe. Either way they can punish you for not turning over evidence that is covered by the warrant.
If the local branch of Microsoft has access to and control over the servers, they only need to demand the local branch to do so, that doesn't mean they are extended juristiction. If the data could only be accessed from outside the US it would be more interesting.
That's good news, since it's one step closer towards closing the gap between the haves and have-nots.
Being rich enough to shuttle assets to other countries shouldn't mean you get away with breaking the law, because that's an inequal application of justice, and therefore unconstitutional.
An enigma, wrapped in a riddle, shrouded in bacon and cheese
"...responding to prosecutors' worries that web service providers could just move information around the world to avoid *dictatorships suppressing said information*".
Fixed it for ya.
If country X bans something, I happily move somewhere else where it's allowed assuming it was important to me.
Now what if this worked the other way. Some muslim country gets to search people's US computers even if they know they can't store their Porn on their Muslim country computer. Now they can say that storing that data in the USA isn't enough reason to avoid getting thrown in jail.
There doesn't appear to be any reference to where the email accounts user is located. If it was a US user trying to hide their data on overseas servers there might be some reasoning behind it, but if US courts are trying to get a hold of non-US users data on non US servers there is a serious issue here.
It's going to be interesting when the Chinese government issues Google a warrant to get data from the US.
Opus: the Swiss army knife of audio codec
Microsoft always sold their cloudservices in the EU with the argument that the data is physically located outside the US so the Patriot Act doesn't apply. Now that this has been proven false, EU-based cloudfirms will use this argument to choose a non-US based firm even more in their commercials than they do already. Good for the non-US based firms.
Is there something equivalent to "extradition" laws, but that apply to overseas evidence instead of oversees defendants?
This is like if you to go to a country border to talk with a friend you have at the other side. Each one will stay in their corresponding country without breaking any immigration law, but you can talk through the fences (the air is not restricted to one particular country .. yet). Then, your country authorities could demand the person, at the other side of the fences, to said them what you were talking about when you left the place. But this person has all the right to say nothing, because he/she is living in "another" country, with different rules and laws.
Also, this is co-related with what the Europe rules demand about information their citizen have in other countries. So, this means that each country is not an independent one and that anybody can break the physical borders in their quest about what they think, with their current laws and though, that justice could be?
It seems that a basic international ruling on the Internet it is needed to clarify limits before any judge in any country be able to invent whatever thing that, obviously, will break the other country laws.
I never fail to find the bravado and hubris underlying American exceptionalism... exceptional.
Land of the free... as long as you're not in one of our many many prisons ( http://nomadcapitalist.com/201... ), which has a higher per capita incarceration rate than Cuba, which is second on the list. Oh, and speaking of Cuba, there's always http://en.wikipedia.org/wiki/G....
Home of the brave... because you'd be pretty brave too if your military budget was larger than the nearest eight other countries combined ( http://pgpf.org/Chart-Archive/... )
Where all men are created equal... except, of course, when they're not ( http://www.pbs.org/newshour/ru... ) and a man can make something from himself even if he starts out life with nothing (but probably not): http://money.cnn.com/2013/12/0... )
And where the rule of law is universal and sacrosanct... except in those cases where it's not convenient ( https://www.globalpolicy.org/u... ) and ( https://www.eff.org/nsa-spying... )
Oh well, enjoy your "freedoms".
As said on http://arstechnica.com/tech-policy/2014/07/obama-administration-says-the-worlds-servers-are-ours/
> Companies like Apple, AT&T, Cisco, and Verizon agree. Verizon said (PDF) that a decision favoring the US would produce "dramatic conflict with foreign data protection laws." Apple and Cisco said (PDF) that the tech sector is put "at risk" of being sanctioned by foreign governments and that the US should seek cooperation with foreign nations via treaties, a position the US said is not practical.
Now, the tech sector is "at risk" of being sanctioned by foreign governments...
In other news, judges in North Korea, Iran, Indonesia, Saudi Arabia, the UK and China all declare their rulings (regarding international jurisdiction of their respective nations' laws) to have jurisdiction internationally...
Better still, web-based companies with datacenters in many jurisdictions could store your data in a completely distributed fashion, where it isn't possible to retrieve the original without access to all (or at least several) of the servers. So they could subpoena all the data held in the US, and the UK, and Australia, and all the other surveillance states, but without a copy of the complementary data in Switzerland and Belize and on a pirate barge in the middle of the Pacific, they won't be able to reconstruct what you actually have stored up there. Better yet, if they contract with third-party storage providers wholly resident in those other countries, the US (for example) would have zero basis to subpoena those other companies - they are not "doing business" in the United States.
A modern corporate giant is not one big company across the planet just because their offices all have the same logo outside. Local offices are separate legal entities in each country.
Suppose MegaMultinational, Inc. has its headquarters in New York and it is legally (in NY) ordered to do something by the court. If it commands its German subsidiary MegaMultinational GmbH to "just hand stuff over" this will likely be in contravention of local German law. Why would the local CEO risk jail by complying?
"Don't belong. Never join. Think for yourself. Peace." V.Stone, Microsoft Corporation
This is one more reason to make extra sure that companies that you deal with have zero US presence. In fact in many jurisdictions it would be illegal to follow these US laws due local privacy laws. By doing business in the US, any data on individuals that you have, even stored in other jurisdictions is subject to their laws, meaning you'll often have the choice of breaking US law, or breaking the laws of the country you're in.
Much safer to just avoid all dealings with the USA.
As a reader of Slashdot, I know that Microsoft only exists for the sole purpose of spying on behalf of the US government. So I know that this story is pure fiction. I mean whoever made it up didn't even put much effort into good names; Brad Smith? Come on, that's so generic.
We could potentially end up in a situation where the main branch of MS screams at the EU branch from across the Atlantic and no one over here is willing to comply.
________
Entranced by anime since late summer 2001 and loving it ^_^
And told the US courts that it must make its request through them.
is full of crap, which is of course illegal in china. so the CCP can get MS to give them all my incriminating 'speech' because it's saved in the US?
Yeah this is going to be a 'good thing'.
but a New York judge ruled against them, responding to prosecutors' worries that web service providers could just move information around the world to avoid investigation.
IANAL but when information is subpoenaed the company is breaking the law if they move, destroy or hide any requested information. If the party receiving the subpoena is found to have hidden evidence then the judge can rule against them as if the evidence was available and damaging. (it's more complicated than what I'm saying but I think this is the basic process) So I'm not really sure what the prosecutors are worried about that isn't already adequately covered under current law. It would be no different than someone using Fedex to send a paper document to another country. We have that situation covered under current law.
a European court issues an injunction under the European privacy laws against MS handing over the bits?
Lacking <sarcasm> tags,
If the judge can find a person (or company?) in the US that has control of X outside of US jurisdiction,
then maybe the judge can compel the person to bring that X before the court. (Where control means can get it without leaving US jurisdiction.)
If there is no such person, then I don't see how a US judge can compel somebody somewhere else to do anything.
Is Microsoft UK the *SAME* company as Microsoft USA? I know they have the same marketing/brand and sell the same items, but one is registered as a UK/Eire/EU company for TAX reasons and the other is a registered US one.
In these days of 'Internal Marketplaces' and companies braking into subsidiaries, is the UK arm of a company technically the same company as the parent if they are both under very different jurisdictions ?
Could this ruling be used on a subsidiary of a foreign organisation based in the US to get access to the parent company's data?
Or, to turn it around, could this be used by another nation on a foreign subsidiary of an American company to access the Main companies data?
Laters Sol "Have you found the secrets of the universe? Asked Zebade "I'm sure I left them here somewhere"
So it's difficult. It sounds difficult when you translate all the legal gobbledegook into reality:
American boss [on phone]: "Irish underling, I have a guy here pointing a gun at my face. He wants you to release the data!"
Irish underling: "I understand, boss, but I have a guy here pointing a gun at my face, saying 'don't do it or else.'"
American boss: "Tough shit. Do it."
Irish underling: "No. He'll shoot me."
American boss: "I don't care about your problems, but I'm your boss so you better care about mine. Do it or else you're fired."
Irish underling: "Death or unemployment. Gee, that's a hard choice. NOT!![click]"
Amiercan boss: "YOU'RE FIRED!" [off phone] "I tried. I really tried. There's nothing I can do! I am unable to obtain the data."
American government: "Here's what you're going to do: you're going to show me that you have entered that guy as terminated in the employee records. Then you're going to hire a new datacenter admin and send him to Ireland."
American boss: "But the new guy won't be able to do it either! The Irish government will stop him, just like the last guy."
American government: "You're just going to have to be sneaky about it. Lie to that other government. Or have your guy shoot the the cop before the cop shoots him. Break their laws and get out before they can stop you. Or hire an Irish lawyer to persuade the Irish cops to lower their guns. I don't care how you do it, but you better do it, or else I will shoot you."
American boss: "I have an idea. I'll go to Ireland and do it myself!"
American government: "Nice try, but you're not going anywhere out of range of my gun."
A warrant is not something that requires cooperation. It is legal permission for investigators to break-in to a certain place, search for and take listed things. So if this is justified, let them do it!
The warrant should allow particular investigators to break-into whichever servers listed, grep around and download listed items. Done. If they cannot, find 1337r agents. If you need keys, get warrants for physical access to machines.
These "compell" warrants are quite a stretch -- they compell MS to violate EU law, to certify what they turn over, and to never be sure they've fully complied (how could they know they got it all)?
Excuse me but doesn't Ireland get a say in the matter? The warrant being served involves something physically located on a foreign shore, or is it this administrations thinking it can do whatever it wants with another country like it has to it's own citizens. Ireland ought to tell Obama to kiss their shillelagh, that they have jurisdiction in this matter and if you want something you need to request it through diplomatic channels.
How convenient for the US that foreigners have all the obligations of our citizens, but none of the rights!
If Microsoft comply, they will be sued by their EU customers and maybe even the EU governments themselves.
There's a reason that jurisdiction applies. You can't be legally required to do something in one country, and then legally required by another country to not do it.
Sorry, US, but if Microsoft comply without getting it right, the EU are likely to fine them into oblivion, and the EU is JUST AS BIG, if not larger, a market as their US market.
Seriously, America, you do not own the world.
an American judge decides American laws apply to foreign lands. Could you ever imagine the a decision the other way?
All your server are belong to us!
the wholly owned subsidiary of MS, but subject to IRISH laws which require a court order from an IRISH court to release data.
The disk crashed and we lost the data - like her at the IRS... terribly sorry...
If the data is physically in country A, then the court of country A can ban the company that owns it from releasing it, regardless of its 'ownership' by someone else. And it gets lots more interesting if the data is owned by MS Ireland, not MS USA...
Why doesn't Microsoft just pull an IRS and say "the hard drive crashed, they are no where to be found"
" One of the reasons why companies put data centers in Ireland is to comply with EU rules about the locations of personal information. If the US can pierce EU rules regarding personal information simply because someone in the US has access to the servers, then that could lead to EU rules prohibiting such access." And the US is attempting an end run around the established Interpol channels and other countries' laws. And, in typically ignoramus US fashion, the US is unaware of what precedent it will set, if this is successful, and how it will blow back in their faces, if another country tries it. As much as the US would like to ignore reality, the truth is the servers are in another country, and,no matter who owns them, they are subject to that countries rules and regulations. The US is attempting to impose its laws on the rest of the world. You are right- this is not a matter for the US courts, it is for the world court to decide. And my bet is the WC will decide that the laws of the country where the servers are located will prevail.
Republican leadership = Idiocracy
(Title is ironic)
We really need to find a way to start over with the US. Don't know how that could work without being worse in the interim, but we are in dire straits.(sp?)
If the warrant had been a conventional search warrant Microsoft could have been right since there are territorial restrictions on those warrants, [magistrate judge James Francis of the U.S. District Court of the Southern District of New York] said.
...
However, a search warrant on electronic communications is not conventional but rather a hybrid: part search warrant and part subpoena, he said.
“It is executed like a subpoena in that it is served on the ISP in possession of the information and does not involve government agents entering the premises of the ISP to search its servers and seize the email account in question,” he said.
Moreover, if treated like a conventional warrant, “the burden on the government would be substantial, and law enforcement efforts would be seriously impeded,” Francis said. To obtain the contents of emails stored abroad, U.S. law enforcement would have to comply with treaties that require the cooperation of two governments. Such requests could be time consuming or even denied, Francis said, adding that the U.S. does not have such treaties with all countries.
Source: PCworld
To move data across jurisdictions is trivial. If it were made this easy to stymie law enforcement whenever the evidence in question is electronic data, we'd end up with much bigger problems. They should at least have to go through the trouble of setting up a shell company...
The one valid concern I've seen raised regarding this issue (which I have not seen raised in this specific case) is when such a warrant would be at odds with data privacy laws in the other jurisdiction; this is a lose-lose situation for the party on whom the warrant is served. I'd feel bad for them, but it was their choice to operate across jurisdictions in the firs place, and their responsibility to be in compliance with all parties; if that's not possible, and they choose to operate anyway, I don't pity them at all.
Judge: US Search Warrants Apply to US Corporations.
There. FTFY.
The parent post was clearly not written by a Canadian, as any good Canadian knows that Tim Horton's does NOT serve poutine. Otherwise though, your post is spot on.
If I can be modded down for being a troll, can I be modded up for being an orc, or a balrog?
This will finally give the IRS the tools it needs to crack open the books on all those shady Swiss & Cayman tax dodges and make the 1% pay their damn taxes.
man, I crack me up...
the preceding comment is my own and in no way reflects the opinion of the Joint Chiefs of Staff
The judge is not claiming jurisdiction overseas. The judge is claiming jurisdiction over Microsoft USA, who has stipulated that the data in question exists and that they have access to it.
Another instance of unqualified people being stakeholders in things they know nothing about.
You can not move data, it can only be copied. ( Well, you could put the HDD in a car, but that's not what this ruling is arguing.)
The existing law works. If said data is stored in the US, then copied to UK and the data.US is deleted... that's destroying evidence. There are already laws for this.
"Seriously, America, you do not own the world."
But also the EU does not own the world.
The possibility that multinational corporation which has split itself up for the purpose of playing different legal jurisdictions off each other has put itself in a position where the pieces create legal liability for other pieces does not necessarily invalidate any of those laws. It may be that they really are running an multinational scam and now they are caught.
I may be having a bad case of deja vu, but wasn't this discussed in detail only recently?
Another analogy. You have your office on the Mexican border with your office wall right on the border.
You build a save into that wall. The court orders you to turn over the contents of the safe.
You say no, and say they cannot get into it because it is in Mexico.
It is a BS argument, they will keep you in jail for Contempt of Court until you comply.
US corporations or anything incorporated in the USA is going to fall under US law. To allow multinationals anymore exceptions above the law than they already have would be EXTREMELY foolish!
What wouldn't surprise me is how Microsoft could get away with stuff while humans in other countries can not... thinking of what they'll do to Assange or what they are doing to Kim Dot Com who are not under US jurisdiction but are/will be subject to it anyhow... along with anybody else the USA is upset with.
Democracy Now! - uncensored, anti-establishment news
I think this is great news as this offers a huge incentive for other countries to stand up competing infrastructure to the US and decimate US domination over the Internet.
The Internet I signed up for was never intended to be controlled by a handful of global, massive content companies.
US law certainly does not apply to other countries. If the US regime starts claiming this, then the regime in Washington has gone completely rogue, and must not be tolerated by the civilised world. If this is allowed to stand, then Saudi, Kuwait, Israel, and other nasty regimes with abysmal human rights records, will be able to start applying their laws to US citizens.
Can you please nuke these stupid and arrogant Muricans into oblivion so that we do not have to endure their all your bases are belong to us attitude anymore?
Thank you.
For us europeans is quite confusing to have USA as our military ally and surveillance enemy.-Ignacio Agulló
I assume the US judge applied US law to this case. I assume there are laws in Ireland that place limits on the transfer of data.
So, in Ireland, Irish Microsoft might not be allowed to transfer relevant data that authorities in the USA are legally demanding from USA Microsoft.
This seems to be a trivial example of the complexity of international law which hitherto has gone unnoticed because nobody questioned the practice (don't say, don't ask). (Or, just for fun, the NSA simply got the data without the need to ask anyone).
So this is a test case to see who wins - Ireland/EU standing up for their rights, Microsoft hiring the best legal brains, the Congress insisting that existing US law must be followed.
Clear the ring and place your bets.
The problem arises when the NSA or CIA get them selves a nice secret court to appoint them warrents to snoop about foreign intelligence servers and computers . All in the name of counter terrorism of course.
Eg. G8 Geneva 2008, Indie News servers in London.
ish :)
That's good enough for Guantanamo so it should be good enough for you and me, right? :-D
Honestly, it's as if they want to wreck the US tech industry. I wouldn't be surprised if 20 years from now there was no longer an internet but instead just a bunch of regional intranets and national nets, each one totally disconnected to anything outside. We're already seeing the beginnings of this right now what with China's "Great Firewall" or whatever they call it and Iran's moves in that direction. The US' "What's yours is mine, BEEYOTCH" attitude is only gonna accelerate things.
Did they happen to rule on whether Nigerian princes who use cloud services in the US would be covered by the same thing?
It's OK Bender, there's no such thing as 2.