Microsoft To US Gov't: the World's Servers Are Not Yours For the Taking

Microsoft is currently fighting a legal battle with the U.S. government, who wants to search the company's servers in Ireland using a U.S. search warrant. An anonymous reader points out a new court filing from Microsoft that argues the U.S. itself would never stand for such reasoning from other governments. Microsoft General Counsel Brad Smith writes, If the Government prevails, how can it complain if foreign agents require tech companies to download emails stored in the U.S.? This is a question the Department of Justice hasn’t yet addressed, much less answered. Yet the Golden Rule applies to international relations as well as to other human interaction. In one important sense, the issues at stake are even bigger than this. The Government puts at risk the fundamental privacy rights Americans have valued since the founding of the postal service. This is because it argues that, unlike your letters in the mail, emails you store in the cloud cease to belong exclusively to you. Instead, according to the Government, your emails become the business records of a cloud provider. Because business records have a lower level of legal protection, the Government claims it can use a different and broader legal authority to reach emails stored anywhere in the world.

Comments

US Government to Microsoft

[Anonymous Coward]

I guess we'll just have to pay you for backdoor access like usual.

Re:US Government to Microsoft

[DUdsen]

Exactly - I was wondering if this is all for show ... convince us Europeans that our data on servers in Dublin is safe from prying eyes in the USA. Once we stop worrying then it will be business as usual, but the heat will be off from the USA. Unfortunately: once suspicions have been raised, those who really care will not forget, so welcome to private pictures of cute pussies and of illicit love letters, but the stuff that they really wanted will, often, be located elsewhere.

What they are playing for here is not to get the NSA out but to get the shadowy backroom dealers of the federal level to put weight on the open court not to openly declare that date hosted at an american owned data-center falls under US and not EU law regardless of contracts and location. The problem is corporate contracts and government tenders, if an competitor can make an good case with "public evidende" that the an US owned datacenter cannot live up to EU data protection regulation they are cut of from that market entirely. And a court case count a lot more then a set of newspaper articles here. If MS looses this one MS azure and office365 revenue will go down significantly, as they have now given the EU governments all the ammunition it needs to ban American owned companies from bidding without facing IMO/ITO lawsuits.

Microsoft To US Gov't: the World's Servers Are Not

[The Grim Reefer]

US Gov't to Microsoft: "All your servers are belong to us"

It's bullshit, but it's the same bullshit as usual

[Qzukk]

The government has always claimed that they can show up and take anything that I give to anyone else without any kind of warrant or subpoena, unless the person I gave the item to has the balls to go to the mat for me over it.

Email on a cloud provider server? That's taking candy from a baby, they've probably already cashed their check from the NSA.

If foreign governments read my private emails...

[pigiron]

I'll never get a visa from anybody.

Hiding evidence

[flink]

If you are a US citizen, I don't think you could get out of producing a document the court ordered you to supply by airmailing it to a confederate in another country. Similarly, if the data in question are related to Microsoft's US operations, then MS, being a corporation incorporated in the US, should be required to produce them.

Re:Hiding evidence

[OzPeter]

If you are a US citizen, I don't think you could get out of producing a document the court ordered you to supply by airmailing it to a confederate in another country. Similarly, if the data in question are related to Microsoft's US operations, then MS, being a corporation incorporated in the US, should be required to produce them.

And what do you think of MS's rebuttal of that position?

"Imagine this scenario. Officers of the local Stadtpolizei investigating a suspected leak to the press descend on Deutsche Bank headquarters in Frankfurt, Germany," Microsoft said. "They serve a warrant to seize a bundle of private letters that a New York Times reporter is storing in a safe deposit box at a Deutsche Bank USA branch in Manhattan. The bank complies by ordering the New York branch manager to open the reporter's box with a master key, rummage through it, and fax the private letters to the Stadtpolizei."

Allowing things like this is going down a similar road to "well if the CIA wants to torture foreign nationals, then they can't complain about foreign s[y agencies torturing US citizens"

Re:Hiding evidence

[Trepidity]

Their analogy also fits how I personally think the case should be resolved. The court seems to be unsure about the personal access of Microsoft's American staff though. In your example, a U.S.-based employee has to be ordered to comply with the German subpoena. But it sounds like in this case, Microsoft's U.S. employees can comply with the subpoena fully themselves, without having to order Microsoft Ireland employees to assist. So the court seems to be leaning towards thinking that in that case, as corporate officers subject to U.S. jurisdiction, they can be served subpoenas to retrieve that data, even if the data is elsewhere—because data isn't a legal person.

You could imagine a kind of really walled-off setup where Microsoft US employees literally can't access Microsoft Ireland data without a Microsoft Ireland employee authorizing it. And then the Microsoft Ireland employee would be directed to only authorize it in accordance with Irish law. The trouble is that that's a really cumbersome way to run an international business. So Microsoft US employees, or at least some of them, seem to have direct access to worldwide Microsoft data.

Re:Hiding evidence

[nbauman]

If you are a US citizen, I don't think you could get out of producing a document the court ordered you to supply by airmailing it to a confederate in another country. Similarly, if the data in question are related to Microsoft's US operations, then MS, being a corporation incorporated in the US, should be required to produce them.

That's what the tobacco companies did in the 1960s.

They did a lot of research to find out if cigarettes really caused lung cancer and all those other things.

If their research came out favorable to cigarettes, they could have waved it around to "rebut" the Surgeon
General and get the regulators off their backs.

Their researchers found that cigarettes were harmful too.

So the tobacco executives told the researchers to kill all their animals, and destroy all their written results, and their lawyers wrote a few memos summarizing the whole thing. Lawyer-client privilege is the strongest secrecy you can have. Then they sent the memos to their law firm in London.

It finally got out. After a lot of lawsuits, the tobacco companies finally agreed to come clean with everything. But they managed to kill 400,000 Americans every year, and none of them went to jail. Eat your heart out, Osama bin Laden.

Re:Hiding evidence

[vux984]

And what do you think of MS's rebuttal of that position?

"Imagine this scenario...."

That's a good scenario, and it raises some interesting questions that SHOULD also be looked at. But its fundamentally a different scenario.
The part where it breaks down though is that they have a warrant to seize the documents of a New York Times reporter.

The New York Times is a wholly American company.
The New York Times reporter is presumed to be an American citizen. If the "New York Times" were a wholly owned subsidiary of Deutche Bank and the New York Times employee was instead a German citizen and an employee of Deutche Bank ... THEN it would be equivalent.

Lets compare apples to apples.

Re:Hiding evidence

[theshowmecanuck]

Or Microsoft could move that part of its operation entirely to Ireland and lay off all their American employees. Problem solved, no access from the U.S. needed except for people who use that use Azure from there. I'm sure congress will be behind that solution since they seem happy to have every other job offshored.

Re:Hiding evidence

[FrankDrebin]

Q: WTF has citizenship got to do with court jurisdiction? A: Almost nothing.

Re:Hiding evidence

[Kjella]

So Microsoft US employees, or at least some of them, seem to have direct access to worldwide Microsoft data.

And quite probably the other way around, this would create hell on all forms of international access/accounts as the Germans would find a person working for Microsoft Germany who'd be compelled to access documents on US servers in violation of US law. Let's also not forget that even if you're in your own country and relatively safe you are committing a crime abroad, which could be nasty if you ever decide to go on holidays to a country that has an extradition agreement with that country. Also, if you know people from Microsoft US are going to break the law and let them keep access then that should probably count as some kind of criminal conspiracy, like a security guard not sounding the alarm. I think the EU can shut these jokers down quite quick even if the US courts won't.

Re:Hiding evidence

[Fuzion]

The rebuttal described by Microsoft doesn't involve the German government sending any orders to any entity outside of Germany either. This is the relevant quote from the article:

Germany’s Foreign Minister responds: “We did not conduct an extraterritorial search – in fact we didn’t search anything at all. No German officer ever set foot in the United States. The Stadtpolizei merely ordered a German company to produce its own business records, which were in its own possession, custody, and control. The American reporter’s privacy interests were fully protected, because the Stadtpolizei secured a warrant from a neutral magistrate.”

"[N]o way would that response satisfy the U.S. Government” because the documents held by the foreign company for safekeeping are private letters, not business records. And any attempt to take possession of those letters through a warrant – even one served on the company entrusted with those letters – would constitute a seizure by a foreign government of private information located in another country.

Re:Hiding evidence

[BitZtream]

But they managed to kill 400,000 Americans every year

I'm fairly certain that they didn't actually light the cig for me, nor did they put it in my mouth or anything else.

I started smoking of my own free will, and likewise, I stopped.

They've done plenty of scummy things along the way, but pretending they are the sole responsible party just makes you look stupid and unwilling to take responsibility for your own actions. Man up.

Re:Hiding evidence

[nbauman]

But they managed to kill 400,000 Americans every year

I'm fairly certain that they didn't actually light the cig for me, nor did they put it in my mouth or anything else.

I started smoking of my own free will, and likewise, I stopped.

They've done plenty of scummy things along the way, but pretending they are the sole responsible party just makes you look stupid and unwilling to take responsibility for your own actions. Man up.

Not only did they manipulate you with the most expensive, sophisticated marketing programs the world has seen outside of government, and not only did they get you hooked to the most addicting drug known, they even convinced you that it was your free will, your fault and your personal responsibility.

Re:Hiding evidence

[nbauman]

One of the ways the tobacco industry censored the truth was through advertising in magazines and newspapers. If you go to the library and look through consumer magazines from the 1970s, you can find magazines where 75% of the ads are for cigarettes.

People have studied the content of the magazines, and for the most part, publications with cigarette advertising never published anything about the harms of smoking. Generally speaking, when a publication runs a story that's unfavorable to a product, they let the advertisers know beforehand, so they don't have their ads appearing in an issue that knocks them.

For example, if they had an article on the dangers of air travel, they wouldn't run airline ads.

Same thing with cigarettes. They'd have to lose a whole issue's cigarette ads. I've looked up articles on smoking and health, and I've almost never found them in magazines that run cigarette ads. They were always in magazines like Readers Digest and Consumer Reports.

Re:Hiding evidence

[Solandri]

The New York Times is a wholly American company.
The New York Times reporter is presumed to be an American citizen. If the "New York Times" were a wholly owned subsidiary of Deutche Bank and the New York Times employee was instead a German citizen and an employee of Deutche Bank ... THEN it would be equivalent.

That's an even more dangerous line of thinking. It would result in every major corporation in the U.S. immediately moving their HQ to a more warrant-friendly country and reincorporating there. Your citizenship has nothing to do with any activities you conduct abroad. When you do things in other countries, their laws take precedence, not the laws of your country of citizenship.

The core issue is that in the past, when you did things, you did them in the country you were currently in. So if I traveled to Macau and gambled, I was not subject to U.S. or my home state's gambling laws. Heck, if I traveled there and killed someone, the U.S. can't file murder charges against me. Physical location was an easy way to determine legal jurisdiction.

But in our modern networked world, it is now possible to do things outside the country you are in. I can now gamble in Macau over the Internet from the comfort of my living room. Physical location is no longer adequate to determine jurisdiction. It hasn't happened yet, but eventually some hacker is going to mess up some hospital's ICU computers in another country and kill someone. This issue needs to be resolved somehow by the International community in a manner which is consistent and reciprocal without being destructive.

Microsoft is correctly pointing out that the Justice Dept. unilaterally declaring that it is privy to any documents held abroad simply because the company holding those documents happens to be HQed in the U.S. is self-destructive because of its broad overreach. If the Justice Dept. gets their way, basically no non-U.S. entity would ever want to house records with a U.S. company even if those records are kept in their country, because of the U.S. government's overreaching powers to obtain those records. Those companies would be forced to reincorporate outside the U.S. if they wished to continue keep international customers.

A much more constructive approach would be like extradition treaties - countries develop treaties where they agree to respect each others' search warrants under certain circumstances.

Re:Hiding evidence

[Trepidity]

They're not trying to compel Microsoft Ireland to do anything though: they're trying to compel Microsoft U.S. to retrieve the data and turn it over to the court. Since Microsoft U.S. has access to the data, they are able to do that. If Microsoft Ireland were firewalled off so U.S. employees could not access Ireland data, it wouldn't be an issue.

Re:Hiding evidence

[BitZtream]

Lets put common sense on it. Anyone with half a clue, especially a smoker realizes when they get up in the morning after smoking for any period of time that its not good for you. You have to be an idiot to not understand what it does to you, and you are a complete moron if you believe what some company selling you a product says. You can potentially ignore that it causes cancer out of ignorance, but cancer is really not the biggest problem with smoking from a health perspective.

Yes, they made it intentionally more addictive, but it didn't kill me when I stopped, did it? They did nothing (and haven't been legally allowed to for 30 years at least) to entice me into smoking my first one.

I maintain that there is personal responsibility involved in the decision to smoke. I'm sorry you can't cope with reality, but there it is. Are you so fucking retarded that you think there are companies that don't lie and spin things daily to get you to buy their products? If so, that just makes you an idiot, not me.

So, what MS is saying is...

[Anonymous Coward]

...a server in every small business and a PC on every desktop was actually a good idea after all, because this Cloud thing means you own nothing, much less have control over it.

Agreed.

Yep, they're not the US Government's

[neminem]

Reminds me of a great exchange I had with my crazy grandmother, that I still remember despite being like 7 years old at the time: I was whining because I was bored of sitting in her hotel room and wanted to go play in the pool. She said something like, "don't you know the world doesn't revolve around you? It revolves around *me*!" (She said it jokingly, but if you knew her, you would know that she didn't really mean it as a joke.)

On the same note, Microsoft clearly doesn't believe the world's servers are the US government's for the taking, because they know full well, they're *Microsoft's* for the taking. Remember that incident with no-ip a few months ago, where Microsoft declared no-ip was letting spammers use its domain, snatched like a million domains belonging to no-ip users, and proceeded to completely botch everything up? That was awesome.

Re:Yep, they're not the US Government's

[david_thornley]

Read the Constitution. The Fourth Amendment does not mention geography, and uses the words "people" and "person" instead of "citizen".

The US Is Like Fantasia

[TrollstonButterbeans]

Atreyu: But I can't! I can't get beyond the boundaries of Fantasia!
[G'mork laughs and Atreyu gets a little angry]
Atreyu: What's so funny about that?
G'mork: Fantasia has no boundaries.

Re:So let's have end-to-end encryption

[Greyfox]

Woah just slow down there buddy! We can't have end-to-end encryption because... um... look at the monkey! Look at the funny monkey!

Re:It's bullshit, but it's the same bullshit as us

[kwbauer]

That is patently false. Warrants have always been used to access storage units and safe deposit boxes. Have there been exceptions? Certainly as there are always exceptions but those exceptions also generally get thrown out.

The real problem is that too many people have been way too happy to promote the thinking that if it didn't exist the late 1700's, then it wasn't covered in the Bill of Rights. The first example of this is guns and liberals are still making this claim on a daily basis.

Personal effects should no be limited to where they are stored or what they are stored on.

Ibid

[pigoon]

The real crime is that legalese hasn't been reduced into a programming language so we can outsource these lawyers.
Pretty sure we could reduce all lawyers into a Tit-For-Tat game theory program.

While not (the universe is dead)
Whatever you say; I disagree
End

Ibid.

Re:It's bullshit, but it's the same bullshit as us

[timeOday]

But the ad-driven Internet has effectively relegated personal documents to business records. When google is already reading and adding commercials to every email, it's much harder to argue these are intended to be private, person-to-person communications. Google's multi-billion dollar business actually is snooping, and its users consent to that.

What?!?!

[BenSchuarmer]

Why do they hate our freedom?

Re:Microsoft says the US wants a pony.

[Anonymous Coward]

Last I checked, Ireland was not part of the US.

Re:Extradition

[taustin]

There actually is a treaty that would allow prosecutors to go to a Irish court and get a search warrant. Why they haven't done so, nobody knows (though I suspect the standards of probable cause are stricter in Ireland).

Re:If foreign governments read my private emails..

[TheGratefulNet]

well, there's always mastercharge and bank americard.

(wait - what year is this, again?)

Re:It's bullshit, but it's the same bullshit as us

[Anonymous Coward]

Google can't fine me a bajillion dollars and throw my ass in jail till I die.

I masturbate in the bathroom. I pull my blinds down, but they don't cover every little crack, someone who goes up 15 feet, could possibly squint through a crack and see me fapping. Does that make it hard to argue that I wasn't trying to have privacy? How fucking stupid.

They say they also aren't "reading the emails" per se, just lifting keywords from it. Who makes the same argument? Who? Oh wait, that's right, NSA. They aren't spying on you.... they're just looking for keywords in phone conversations, etc, for probable cause.

Look, I have a right to be secure in my persons, houses, papers, and effects in possesions from the government conducting unreasonable searches and seizures. Just because I don't have a perfect lock system, doesn't mean they get to open my door and file through everything because my obvious intent didn't perfectly align with my actions.

The government uses intent a lot for crimes. Well, the person's intent for email is to have their inbox private. That should be good enough. The government's role in all of this is to pass laws making my inbox a lot more secure, having standards for encryptions, etc.

I'm sorry I live in a country where most citizens see nothing wrong with the government mandating shitty backdoors into everything.

You see it wrong

[aepervius]

"I'm fairly certain that they didn't actually light the cig for me, nor did they put it in my mouth or anything else."

But they did. They paid and sponsored programs to show smoking happy people, you couple in love, or "heroes" all lighting cigarettes. Never sponsored a program showing you a 50-70 guy dying horribly of cancer. They influenced the culture to to make people smoke more and more, all the while knowing they were sending death sentences down the line. WITHOUT that cultural influence,a dvertising, and glorification in the media of the cigarettes until recentely, I can wager that you would not have lighted a cigarette. In fact now that smoking stopped being cool, cigarette smoking in high school has dropped like a stone in the last 40-50 years. 50% of youth smoked by the end of high school post war (50ies), nowadays it is less than 20%.

Your smoking was not your decision alone, but also a product of a culture of praising smoking in media.