Slashdot Mirror
Court Denies US Government Appeal in Microsoft's Overseas Email Case (pcworld.com)
An equally divided federal appeals court refused to reconsider its landmark decision forbidding the U.S. government from forcing Microsoft and other companies to turn over customer emails stored on servers outside the United States. From a report: The U.S. Court of Appeals for the Second Circuit, in a 4-4 decision Tuesday, declined to rehear its July decision that denied the DOJ access to the email of a drug trafficking suspect stored on a Microsoft server in Ireland. Microsoft has been fighting DOJ requests for the email since 2013. The DOJ has argued that tech companies can avoid valid warrants by storing customer data outside the U.S. Judges "readily acknowledge the gravity of this concern," but the 31-year-old U.S. Stored Communications Act (SCA) doesn't allow worldwide search under a U.S. warrant, wrote Judge Susan Carney. "We recognize at the same time that in many ways the SCA has been left behind by technology," Carney wrote in Tuesday's decision. "It is overdue for a congressional revision that would continue to protect privacy but would more effectively balance concerns of international comity with law enforcement needs and service provider obligations in the global context in which this case arose."
DOJ butt hurt about ruling continues to.seek unfettered access to all data regardless of where it is or who owns it.
So, is US congress now going to change the law so a US judge can permit the US DOJ to access foreign servers? May we assume reciprocity, so that other countries can then serve warrants to providers in the USA and legally demand access to data stored on US soil?
I think not..
To Terminate, or not to Terminate, that's the question - SCSIROB
So, is US congress now going to change the law so a US judge can permit the US DOJ to access foreign servers? May we assume reciprocity, so that other countries can then serve warrants to providers in the USA and legally demand access to data stored on US soil?
I think not..
Another solution is to pass a law saying that all US citizen data has to be kept in servers in the US.
The benefit is that foreign countries don't get to access our citizens' data as easily (Russia, China, Canada).
The *real* solution is that E-mail and other data should be encrypted end-to-end, where the provider and location don't matter. Proton mail and Lavabit come to mind.
I remember when DropBox first came out, it required a driver to install (in WinXP) to synchronize the data to the cloud, and asked whether they had any plans to add encryption. Their response was "Oh, we'll never add encryption! That's the end-user's responsibility, and besides... it's haaaaaard!"
We need turn-key solutions. If good security is a checkbox "make my messages private", more people would use it.
USA is all that matters, the rest of the world can go fuck themselves.
You should apply to work at the White House - I hear they're hiring.
The DOJ has argued that tech companies can avoid valid warrants by storing customer data outside the U.S.
It's not a valid warrant, because the court that issued it doesn't have jurisdiction.
(Billionaire US business owner) "Hell yes! Go after those dirty drug dealers! Those bastards shouldn't be able to hide their evils in another country!"
(Billionaire's accountant) "Sir, might I remind you that your tax haven data is stored in Ireland..."
(Billionaire US business owner) "Nevermind! Those meddling DOJ bastards don't need access to anything."
This court was right, I think, to write that although there are problems either way, it's not the job of the court to rewrite the law - that's up to Congress to fix it.
One possibility is that Congress won't allow warrants on foreign *servers*, but will allow some form on subpoenas on US *companies* who possess evidence about people in the US.
One reasonable argument (maybe right, maybe wrong) is that if a US company has some evidence about a US person, related to a US case, they can, after a court hearing, be subject to a US subpoena. Where the US company chose to physically store the bits isn't all that relevant, some would say. Anyway, the court is correct, I think, in saying the Congress needs to work out the law on this - the court doesn't need to rewrite the law.
Speaking of the DOJ and government...
AN IMPORTANT MESSAGE FROM MIKE PENCE
WASHINGTON (WHPB)—Vice-President Mike Pence has issued the following message to the American people:
Dear American People,
What with all the hoopla and hullabaloo of Inauguration Week, we didn’t really get a chance to get to know each other. And so, if you don’t mind, I thought that I’d take a minute or two to tell you a thing or two about Mike Pence.
I’m what most people would call a “fun guy.” In my spare time, I enjoy golf and heterosexuality. And I’m something of a voracious reader. My favorite book, of course, is the Bible, but I enjoy other books, too. I’m a big fan of “The Da Vinci Code,” which has a lot of stuff about the Bible in it. And Paul Ryan just gave me a copy of “Atlas Shrugged,” by Ayn Rand. I just started reading that one, so I haven’t gotten to any parts in it about the Bible yet, but it’s darn good.
Another thing I read recently, and it’s probably become my second-favorite piece of reading material right after the Bible, is the Twenty-fifth Amendment to the United States Constitution. It’s all about how to remove the President and replace him with the Vice-President. I have to admit that it was a kick to start reading the dusty old Constitution for the very first time and see yours truly right in there!
It turns out that the Twenty-fifth Amendment says that the country can remove the President if he is found to be “incapacitated.” That can mean anything from physically incapacitated, like being in an irreversible coma, to mentally incapacitated, like being seen raving like a lunatic during a visit to the C.I.A. Either way, if folks decide that it’s time to put a fork in you, see you later, alligator!
Whenever I read something great, I tell everyone I know to go out and read it, too. And so, my fellow-Americans, I encourage each and every one of you, history buffs or otherwise, to read the Twenty-fifth Amendment today—especially Section 4, which is a little complicated but really exciting, too. If you enjoy reading it as much as I did, let me know. I’m in my office in Washington and you can reach me anytime—I’m of sound mind and body.
Well, I’m super-glad we had the chance to get to know each other a little better. Until next time, here’s Mike Pence saying, God bless America. And God bless the Twenty-fifth Amendment.
-MP
The DOJ is butt-hurt. But too bad. The US can't just decide that their warrants are valid EVERYWHERE ... If there is anything fishy, they won't go that route
The problem -- which the DOJ and other parties absolutely know -- is that they are using a warrant.
You say they won't go that route if there is anything fishy, but the fact that they are attempting to use a warrant is extremely fishy.
There is an enormous difference between a warrant which they are using, and a subpoena that they would be trying to do if the one person in the case was all they wanted.
With a subpoena the company must produce information. They must produce the information no matter where it is held, and they must produce it as binding evidence. If they really want to capture the one person, a subpoena to provide all the information about the request is a simple matter. The government gets copies of all the documents they are demanding, particularly all the business records related to the subscriber. Since the DOJ is claiming they are trying to catch a subscriber and the people they're email, these subpoenas are more than enough.
With a warrant to collect a server, they get the entire physical server. And the government gets to make a copy of the server, and search it for whatever they think is relevant to the information. A warrant means they can take all the objects so they can prevent evidence from being destroyed. They can also collect for more information from the customer about the contents of the communications.
The DOJ could take measures to collect the information using tools other than a warrant that provide all the information and require Microsoft to keep it confidential. Instead of use those, they continue to demand a warrant to seize the entire server.
//TODO: Think of witty sig statement
This is how I want tech companies to protect my privacy. With a four-year lawsuit designed to delay handing over my data (and it ultimately won!). Compare and contrast to Lavabit, which decided to shut down in 2013 after printing out its private keys in 2-pt. font.
Your ad here. Ask me how!
If worse comes to worse, Microsoft will give its foreign branches enough independence (enough to make it a separate company) to deny any request it wants from the US branch.
Realistically, doing so would create a catch-22 lose-lose situation for American corporations.
Don't give information to US authorities from foreign servers: they're violation of US law and you get penalised
DO give away information to US authorities from foreign servers: (often) they're in violation of the privacy/access/etc laws in said foreign country, and they get penalised
I'm not American, and certainly not a fan of some of the international shenanigans perpetrated by US corporations, but allowing a law like this would be a *huge* disadvantage for US companies and possibly even a death sentence for some. As it is, many companies (including many I've worked at) have rules against doing business with US entities that store data outside of the service country, due to laws protecting customer information and privacy. So entities like Amazon, Google, etc are basically on the no-go list for vendors when it comes to any RFP that involves customer info.
The government was arrogant and idiotic for even thinking to try pushing this through the courts. They might as well run a razor across their own throat.
Just another case of multinationals are outside any countries control.
It's a fecking free for all
Go well
With the very recent event of the US pulling out of the TPP, I feel it's unlikely that others in the International Community, will take kindly to foreign powers accessing servers in their territories. Should US lawmakers update the law and change it to allow for US laws to operate in this manner, I imagine that companies like Microsoft, will outsource the administration of those non-US servers, so they have a non-US division operating them, thus leaving them outside of the reach of US laws.
Awk! Pieces of eight. Pieces of eight. Pieces of seven... ERROR: General Protection Fault. [Paroty Error.]
Who got in first? GCHQ? DEA? NSA? CIA? ..."
No legal team likes to see a case that starts with redacted pages in a public court setting.
So the USA will often use charity groups, public private police partnerships to look at big company databases for words, terms, photographs that might surround drug culture. That then gets reported to a company as is then the clean origin of a case.
A legal team can then talk in public about how the case started and the role of a GCHQ, DEA, NSA, CIA can stay historically PRISM like hidden.
The other issue is a very Irish issue. The UK used its mil, the Royal Ulster Constabulary Special Branch, GCHQ to track every call and computer network in Ireland from the 1970's on. It was then easy to create new informants as they called interesting people already been watched.
Interesting people got an offer to become informants or not. If they did, their role was secure. As they moved up in rank, more information flowed back to the UK.
Ireland does not really want to have a new discussion about its data security nationally going back decades. Who is still been legally tracked and how.
Are US, UK or Irish contractors now been used to legally watch people in Ireland or with Irish accounts for historical reasons?
To keep users thinking their data is safe in Ireland the US shortcut is still hidden. The GCHQ, NSA, CIA will still have the same role as always.
The DEA can now get some NSA data in the raw thanks to new raw data sharing options in the USA.
"Obama Opens NSA’s Vast Trove of Warrantless Data to Entire Intelligence Community, Just in Time for Trump" (January 14 2017)
https://theintercept.com/2017/...
"...NSA share vast amounts of private data gathered without warrant, court orders or congressional authorisation with 16 other agencies, including the FBI, the Drug Enforcement Agency,
Ireland can sell its international networking products as been legally secure and as been low cost in terms of staff and tax.
Its win win win. The US and UK get to keep on spying and sharing the raw data with other agencies. Ireland can tell the world no nation can legally access data in Ireland.
Domestic spying is now "Benign Information Gathering"
Quite simply there seems to be some kind of magical thinking that you can balance something unreasonable against basic rights. For instance anyone who thinks that it would be "Balanced" for a US court to order people in another country to do something is insane. The whole US revolution was about things like taxation without representation. So what makes the US seem to think that people in other countries should give two shits what their courts say when we have exactly zero input into the laws, the lawmakers, or any other body that would hold these bozos to account?
This is the sort of thinking that as the US economy runs down will cause the rest of the world to not even lift a single finger as they finally slip into unrelenting pain and misery.