Slashdot Mirror
Google, Unlike Microsoft, Must Turn Over Foreign Emails, Rules Judge (fortune.com)
Every year Google receives more than 25,000 requests from U.S. authorities for "disclosures of user data in criminal matters," according to a U.S. judge's recent ruling. But this one is different. An anonymous reader quotes Reuters:
A U.S. judge has ordered Google to comply with search warrants seeking customer emails stored outside the U.S., diverging from a federal appeals court that reached the opposite conclusion in a similar case involving Microsoft. U.S. Magistrate Judge Thomas Rueter in Philadelphia ruled on Friday that transferring emails from a foreign server so FBI agents could review them locally as part of a domestic fraud probe did not qualify as a seizure...because there was "no meaningful interference" with the account holder's "possessory interest" in the data sought.
"Though the retrieval of the electronic data by Google from its multiple data centers abroad has the potential for an invasion of privacy, the actual infringement of privacy occurs at the time of disclosure in the United States," Rueter wrote... The ruling came less than seven months after the 2nd U.S. Circuit Court of Appeals in New York said Microsoft could not be forced to turn over emails stored on a server in Dublin, Ireland that U.S. investigators sought in a narcotics case.
Google announced they'd appeal the case, saying "We will continue to push back on overbroad warrants."
"Though the retrieval of the electronic data by Google from its multiple data centers abroad has the potential for an invasion of privacy, the actual infringement of privacy occurs at the time of disclosure in the United States," Rueter wrote... The ruling came less than seven months after the 2nd U.S. Circuit Court of Appeals in New York said Microsoft could not be forced to turn over emails stored on a server in Dublin, Ireland that U.S. investigators sought in a narcotics case.
Google announced they'd appeal the case, saying "We will continue to push back on overbroad warrants."
"no meaningful interference with the account holder's possessory interest" WTF?
I'll just leave this here:
https://www.youtube.com/watch?v=GyV_UG60dD4
The only good and somewhat permanent solution to this would be for Google, Microsoft, etc to encrypt the e-mails end-to-end and in storage as well, so that nobody, not even them, can see what they contain. Unfortunately, doing so would remove their ability to data mine and monetize the contents of the e-mails and so they will never do this. Hence the ultimate answer will come from another direction, someone who takes over their roles as major e-mail providers but is not interested in mining the contents of the e-mails. This likely will have to be some form of non-profit entity or at least a non-free e-mail service.
So the judge is compelling them to be complicit in commiting a crime? It would be interesting to see if the judge's immunity holds in that circumstance.
If it's on a foreign server, that pretty much sums it up right there.
I wonder what happens if an E.U. court finds that the data transfer of personal data from an E.U. located server to the U.S. without E.U. judicary oversight is illegal. That was one of the arguments in the Microsoft case. If the U.S. judge then orders Google to ignore the E.U. court, he could be held in contempt of the E.U. court and face punitive measures.
That appears to mean that the person who used gmail lives in the US, and Google just randomly decided to store part of it in Ireland.
Then the US needs to have laws which do not allow companies to do this because once the data has left the US and entered the EU it is subject to EU law. You would not want data in the US related to chinese citizens to be subject to the chinese government accessing it would you? The same principle applies here.
That's some twisted logic that to "seize" something it must not be available to the owner any longer.
Rulings like this will KILL US cloud providers. trying to sell services outside the US.
the US needs to have laws which do not allow companies to do this
That would simplify things.
once the data has left the US and entered the EU it is subject to EU law.
You'd think. But the judge didn't seem (according to the fortune.com article) to rule on that, only that the alleged fraudster gave up any right to privacy by giving his email for storage by a third party.
I wonder what the rules are in the tangible world. If I gave you evidence of a crime, and you flew to Ireland and put it in a storage unit, could the US government order you to go and return it from Ireland?
"I don't know, therefore Aliens" Wafflebox1
Psst: constitutional ammendments never go to the president.
Some people encrypt by using rot-13 twice. I prefer the more secure method of using rot-1 a total of twenty six times.
If retrieving a copy of an email while leaving the original intact creates "no meaningful interference" with the account holder's "possessory interest" of that email, how long before this ruling is used as a defence against the RIAA and MPAA's copyright infringement efforts?
Since making a copy of a movie does not create a meaningful interference with the account holder's possessory interest of the movie, surely it can't be worth all those lawsuits?
I don't know if there is such a thing as 'data extradition', but surely working with Ireland would be the best approach? Anything else should surely outside of the immediate jurisdiction of US law enforcement? Maybe Google should invesigate the flip question: would the US accept e-mails on a foreign national stored on a US server to be handed over without the necessary legal paper work?
Jumpstart the tartan drive.
And this is one of the reasons we are moving to Microsoft for our email and file storage. I have no idea why the 4th amendment only applies to Microsoft, not to Google, but so be it.
Of course according to Trump, aliens are not people. I wonder whether he can find a corrupt judge to support that argument.
Nearly impossible
That's a feature, not a bug.
Well, they both have in common that they are American companies. It would be more reliable to have your mail handled by a Russian server, the Russians are probably not going to cooperate with the FBI. They might snoop themselves of course, but the Russians don't care if I pirate American movies or oder pot.
And this is one of the reasons we are moving to Microsoft for our email and file storage. I have no idea why the 4th amendment only applies to Microsoft, not to Google, but so be it.
If you're worried about the government reading your emails, why risk using a USA company at all? Use a company that has no USA presence at all. Or better, roll your own offshore and control your own encryption keys.
Of course according to Trump, aliens are not people. I wonder whether he can find a corrupt judge to support that argument.
He's right there... aliens aren't always people, sometimes they are lizards, sometimes they are amorphous blobs
I would suggest Microsoft Corporation has a "Working Business Relationship" with the US Government, that grants them more leeway in such matters.
My company company is doing the same thing. We're going with an EU-based 365 tenancy, specifically in Ireland were our corporate headquarters are. Yet, having to do a migration of 300 users across three countries is not going to be fun.
Your suggestion presumes that the "US Government" is a monolithic entity, which it's not. Even the judiciary isn't completely in sync with itself.
Corporations need to ensure that their data is held by legal subsidiaries that can only be hit with a warrant by their own country's courts and which have no ability to access data controlled by another legal subsidiary. Whilst not trivial, it is surely possible for the relevant security keys to be strictly under the control of the relevant county's board of directors. That board of directors would be protected by the courts of its domicile - though I guess members may end up being unable to travel to the US if they resist a US warrant. But then sometimes the empire must be resisted...
Protonmail is a foreign and heavily encrypted Swiss email service that uses two passwords, one for account and the other for the mailbox itself. They don't store the passwords or anything else to decrypt emails, or at least the mailboxes. For man in the middle, I have no idea. But any way, if Micro$oft doesn't have to disclose like Google does, know that Protonmail uses Azure, which is M$ owned. They have it for all desktops and smart phones, or you can just log with a web browser that supports JS.
Twitter dropped API keys for government spy programs a few months back because of Muslim witch hunts. However, they just partnered with Google to help them build parts of their software. Funny how Google didn't get exempt but Micro$oft, the platform that a whole bunch of our government decided to use for some reason, does. Wonder why (sarcasm) ? Duh. And now they will go after Twitter next since Google lost and is working with them. Revenge for saying no. Just something to be aware of.
That's why you always choose a zero knowledge provider. Someone that provides you a service but doesn't have access to read the content.
I'm pretty happy with ProtonMail in that area. They are not only located in Switzerland, with much stronger privacy laws, but also, they encrypt end-to-end, and therefore, have no access to the content. Mail between users in ProtonMail are automatically encrypted, while mail to someone outside the system can be sent as a URL the receiver has to have a password to access (and can be time-deleted).
Of course, it's not Google Inbox in terms of features, but it gets the job done. You can always do full PGP with any service, but you have to know what you are doing.
Until things get insanely simple, in this day and age, you've got to learn, and do what you can for your right to privacy.
Is it basically the Google store your emails anywhere - might be in the US, might not, might move around?
In the Microsoft case, wasn't it Microsoft Ireland, an Irish registered subsiduary, holding the data in an Irish datacentre (and only an Irish datacentre)? To comply with the court order, Microsoft Ireland would have had to break Irish/EU data protection laws.
At least, that's my understanding of the difference.
Sigs are so 1990s. No way would I be seen dead with one.
I think this judge is sort of missing the point of why people fight against having their personal data seized. It's not that we don't have access to the seized data, it's that other parties have access to something that I want kept private.
I'd like to see this same argument used when I demand a bunch of classified documents from the government:
"No, no, it's OK, I just want a COPY of the classified stuff. You guys will still have your 'possessory interest'"