Slashdot Mirror
Microsoft Agrees To Contempt Order So It Can Appeal Email Privacy Case
An anonymous reader writes: Microsoft made news some weeks ago for refusing to hand over customer emails stored on its Dublin, Ireland servers to the U.S. government. The district judge presiding over the case agreed with the government and ordered Microsoft to comply with its demands. On Monday, Microsoft struck a deal with the U.S. government in which the company would be held on contempt charges but would not be penalized for it until after the outcome of an appeal. The district judge endorsed the agreement (PDF) on Thursday.
First time I've wanted to actually compliment Mickeysoft on something in years.
Just another day in Paradise
The ruling applies to anyone doing business in the United States. So it would apply to European companies having a cloud that included the USA as well. What it will mean is either:
a) Europe and the USA create a treaty covering this so there is black letter law
b) There are not global clouds
c) There is de-facto situation where the USA rules governing warrants are enforceable for most everyone and anyone not wanting to be subject to USA warrants needs to stay on Europe only cloud services.
Microsoft has already hedged themselves in Europe by informing their customers that using Azure is agreeing to export and to not upload any data for which would be illegal to export. So legally they should be fine in Europe. I think they are very worried about (b) becoming the outcome. I just don't see it though. Apple, Google, IBM, Amazon... all face the same issue. Corporations want global clouds. They are probably on balance hostile to European privacy laws. The pressure is going to be applied to European governments to go towards (a) or (c).
The physical location of the data matters because of European Data Protection laws. Microsoft would run afoul of the laws of Ireland if they gave data stored on servers in Ireland to a third party without the actual owner of the data agreeing or a court order by an Irish court. The government lawyers obviously tried to argue that they don't need an Irish court, and the U.S. judge at first bought the argument. And now it seems as if the U.S. court might have changed its mind but want this to be sorted out by the higher court.
The scope of jurisdiction in the ruling is clear cut. Physical presence on the USA. BTW there is no law. This has been existing law for two centuries. It is just being applied to computer data the same way it was to objects and paper historically. The difference is that law enforcement agencies didn't ask for multiple shipping containers full of paper documents but with big data search tools are perfectly comfortable asking for those kinds of quantities of electronic data.
In terms of USA law the law enforcement agencies are using established international channels and legal orders. They aren't doing anything different from what they've done for decades. Microsoft is asking to do something different because the frequency and quantity as opposed to the previous situations with paper records is skyrocketing.
Also it is important to understand that between WWI and the 1970s we lived in a world where governments were mostly mildly hostile to international trade. Governments were perfectly comfortable with lower levels of international trade and laws that mildly discouraged trade. You really have to look at the colonial age 1812-1914 to really have a period comparable to today where governments were strongly pro-trade.
I don't think you get the real problem. It's not about the export of data (which is not at issue here), it's disclosing private data to a third party. This doesn't mean export - even if the third party in question appeared in Ireland in front of the data center, this still would be illegal.
Because Microsoft will become persona non grata in Europe if they are required to hand over data to the US against local law.
This has always been something people have warned about ... the PATRIOT act basically says "we can force any company to hand over your data from anywhere in the world, and we don't give a damn about your laws and it stays secret".
So Microsoft is in the position of complying with the US government, and losing business elsewhere ... or telling the US government to shove it.
When the US has decided their secret laws trump the laws of every other country, this was inevitable -- and people have been warning about this for years.
I know many governments already basically say "you can't store government data in a US cloud service or on a US server" for exactly this reason.
Basically, the US passed a law which put companies between a rock and a hard place. And now they have to choose between long term profits, or America's zeal for security.
Quite frankly, the US needs to get slapped back down and told by the rest of the world not our fucking problem.
Lost at C:>. Found at C.
Microsoft has already hedged themselves in Europe by informing their customers that using Azure is agreeing to export and to not upload any data for which would be illegal to export. So legally they should be fine in Europe.
Just because they put something in a license, doesn't make it legal.
For instance, EULA's are meaningless in a number of European countries.
Also, contract do not trump law. So if there are laws that prohibit this, the contract (or atleast those specific terms) is invalid.
Slashdot social media options: AIM, ICQ, Yahoo, Jabber and Mobile Text. Why no MySpace?
It is actually illegal. You can't deliberate engage in activities to make it more expensive or complex for law enforcement to search subpoenaed records. That's contempt of court.
It is actually illegal. You can't deliberate engage in activities to make it more expensive or complex for law enforcement to search subpoenaed records. That's contempt of court.
Emphasis in your quote.
As gets mentioned every time this story appears on slashdot, this is a warrant not a subpoena. The two are different tools. Both are used to find things but one is clean and neat, the other broad and aggressive. As a parallel, a subpoena is a scalpel and a warrant is a chainsaw.
A subpoena says 'We know you have this specific information, provide it to us within a time frame'. They get subpoenas of this type all the time. There is no dispute a subpoena would get the document no matter where in the world Microsoft held it.
A warrant says 'We will search for and take anything even remotely related to this, search it ourselves on our own terms.' When they demanded dumps of servers and copies of databases they were told the servers were in another nation and were not subject to a US warrant.
As was discussed in the previous incarnations of this story, the warrants are rather broad demanding they turn over everything related to the email address and user in question even if it isn't related to a criminal investigation. They want it all, everything the user ever touched or potentially touched, everything sent to the user, everything related to the user. While government investigators can usually get that through a broad warrant, they cannot get that with a subpoena. A subpoena would give them the specific emails related to the crime under investigation, but it is quite likely they already have the specific documents they could ask for.
//TODO: Think of witty sig statement