In Privacy Victory, Microsoft Wins Appeal Over Foreign Data Warrant (zdnet.com)

In what is being perceived as a major victory for privacy, Microsoft has won the reversal of a court order that required it to turn over to the United States government the contents of a customer's email account stored on an Irish server. ZDNet reports: The case centered on a uniquely-different warrant that was issued by U.S. prosectors in that it was for data stored in an email account stored by Microsoft overseas. Prosecutors said that because the data was hosted by a U.S.-based company, Microsoft must comply. But the judges concluded that Congress did not intend the law used in the case -- the Stored Communications Act -- to apply outside the US. The judges said was a "rational policy outcome" and should be "celebrated as a milestone in protecting privacy." The appeals court also reversed a charge of contempt, which allowed the company to trigger an appeal. The software giant has been battling U.S. prosecutors for two years over data held in its Dublin, Ireland datacenter, which it says cannot be accessed or retrieved by a US search warrant.

Comments

As little as I like Microsoft

[colinrichardday]

This is good news. We need to rein in the government.

Re:As little as I like Microsoft

[houghi]

This is reasonable good news. But it is not great news. A company won over government. However we, the people are left out of it.

And it is sad if we are happy when companies win over government. Because that means NOBODY is on our side.

Are the sheep happy that the wolf is killed by the lion? Sure, but in the end it means nothing to the sheep.

Do understand that neither of these parties represent the public (anymore).

Re:As little as I like Microsoft

[stephanruby]

A company won over government.

No, it's more like a government won against another government. You can bet the Irish government and the EU weren't happy about this initial ruling. By complying with the initial ruling, Microsoft would have been forced to break the local data protection laws.

Microsoft had been placed in an untenable position. And you're right, the reversal is reasonable good news, but it's not great news. That initial ruling was totally insane to begin with. It should have been reversed within 24 hours, not within three years.

Re:As little as I like Microsoft

[Gr8Apes]

Then again, many consider you wrong. Why can a government claim rights over assets under another government's sovereignty? What you're proposing is that gov A can tell a company based under gov B's control to supply it with information that is in direct violation of gov B's laws, merely because it has a presence somewhere under gov A's sovereignty. So, let's assume that there's a letter in Disney France's possession. So the US gov can force Disney HQ to produce said letter if France's laws forbid releasing such data without a *French* warrant?

It's obvious to me that gov A would have to go to gov B to get a valid warrant from gov B to get whatever they wanted, and yes, that makes for a painful process. Such is the rule of law. You don't just get what you want from anywhere you want because you passed some law in a banana republic.

Re:As little as I like Microsoft

[DarkOx]

Disagree. Microsoft is a US entity it should have to follow US rules wherever it goes as long as it remains a US entity. Additionally it should have to follow the rules for whatever locality it happens to be in. Yes that may make it impossible to perform certain activities where the laws are totally incompatible.

Maybe Microsoft simply cannot operate a server in the EU under the current rules because of this conflict; that is probably the case and I don't care. If MS can't do it neither can anyone else and I am sure the politicians would 'fix' the problem in hurry and change the laws; the economic consequences of not doing so being probably pretty bad.

As a US citizen you are not free to violate federal law even while abroad! Admittedly there is a presumption against the extraterritorial applicability of United States law unless there is explicit language in the law to indicate it was the intent of Congress for the law to have applicability outside the US. So most laws don't apply but there are ones that certainly do like FCPA, the same should apply to court orders. A US court should be able to order a US citizen or entity to comply with a subpoena for evidence, if its turn over all your E-mails fine turn over all the E-mails in the USA, if its turn over all your E-mails in Ireland than you must turn over all your E-mail stored in Ireland.

Don't like move HQ to Ireland and surrender your citizenship, with all the various import restrictions, foreign reporting, loss SEC related consequences for your publicly held company that implies.

Re:As little as I like Microsoft

[sjames]

It is supposed to exist in the public interest.

Re:As little as I like Microsoft

[stephanruby]

Personally I actually disagree that this is good news. Here is a case where the rule of law was utilized, a warrant was issued by a court on the public record for data. Microsoft is a US entity and should have to follow lawful orders from a US court.

You're missing the point. Microsoft may be a US entity, but the Microsoft employees in Dublin are subject to Irish and European laws and they can be thrown in prison for violating the local data protection laws (or worse, they can be thrown in prison for the rest of their lives for doing espionnage for a foreign power).

This is not to say of all the business lost by Microsoft and other US companies outside of the US, because if such a warrant were to be implemented, no local government not already under the control of the US would allow its own citizens to use cloud services, email services, and a search engine under the ultimate control of the US government. When it comes down to it, if Europe really wanted to replace Microsoft and Google, it could.

And if the US really wanted that data, they should have asked the Irish government. That's what the actual rule of law dictates. There are treaties for such things. Trying to circumvent the sovereignty and the jurisdiction of a close ally and trade partner isn't cool. And unless the US is willing to backup Microsoft with US military troops on Irish soil, it was putting the local employees of Microsoft in a very precarious position.

Re:As little as I like Microsoft

[stephanruby]

Disagree. Microsoft is a US entity it should have to follow US rules wherever it goes as long as it remains a US entity.

Yes, Microsoft is a US entity, but most likely Microsoft-Ireland is an Irish corporate entity for tax and liability reasons. Not to mention its employees, are going to be mostly Irish and/or Europeans.

And the nationality of the entity doesn't really matter here. If for instance, I was working in China, or in Saudi Arabia, for a US entity, I would still follow the local laws, before I would follow an illegal spying order from the United States.

My life and my genitals are just too precious to me.

Re:As little as I like Microsoft

[stephanruby]

Disagree. Microsoft is a US entity it should have to follow US rules wherever it goes as long as it remains a US entity.

Are you saying that if a Chinese company suddenly purchased your US-based employer tomorrow, that you would be willing to commit acts of espionage in the United States if your new Chinese employer required you to do so?

Re:As little as I like Microsoft

[sjames]

Given current conditions, I'd say it is in the public interest. The DOJ needs to learn that it isn't omnipotent and does not have carte blanche.

Long road to victory

[qbast]

So I guess tomorrow the government will appeal the decision.

Time to ensure ownership is via local subsidiary

[Bruce66423]

This highlights the need to ensure that the server and so its data is held by a company incorporated under the law of the nation concerned. If that is so, local law trumps US law because the local board of directors will be in criminal court if they release the data to an unauthorised user, even if that is the US government.

Re:You know what this means, right?

[zugmeister]

Better than setting up a server at home and pretending nobody will hack it.

Not sure how I feel about this

[rsilvergun]

On the one hand it's nice to see privacy, on the other hand this is basically a get out of jail free card for any corporation that wants to hide it's illegal doings. I mean, if all I have to do to squash a warrant is host the data in a country that doesn't give a rat's behind... There actually _ are _ crimes I'd like prosecuted, like tax evasion. I pay mine after all.

Re:Not sure how I feel about this

[OfficeLackey]

Corporate documents like board minutes, tax docs or HR policies would be available or obtainable at any corporations registered headquarters. For Microsoft, they would be available in the US. But non-corporate data, your goods and services, can't be held to that same standard. If Google buys a car in Europe and it is driven there, the US can't mandate the car be shipped to America for inspection. The government has no control over an asset outside of it's borders. The problem is data isn't a physical asset like a widget or cog. (which we have established laws for) So certain branches of the government want to make special laws and rules for it so they can increase their reach/power.

Re:Not sure how I feel about this

[WolfgangVL]

There actually _ are _ crimes I'd like prosecuted, like tax evasion. I pay mine after all.

It's statements like these that got us where we are today.

Re:Not sure how I feel about this

[erapert]

1. You didn't pay more than $1.6 billion in taxes. I guarantee you didn't.
2. Corporations must make a profit or they cease to exist (and thus also your job ceases to exist). Taxes cut into the profits.
3. If you want a dog to come to you when you call you don't beat him when he shows up. You offer him a reason to come. It's the same with corporations: you can't tax the hell out of them and expect them to stick around. You'll get more tax revenue from having more corporations with bigger profits than you will by driving all the corporations away and taxing the life out of the few that are foolish or small enough to remain.
4. It's not tax evasion if they're abiding by the law.