Slashdot Mirror
Does US Have Right To Data On Overseas Servers? We're About To Find Out (arstechnica.com)
Long-time Slashdot reader quotes Ars Technica:
The Justice Department on Friday petitioned the US Supreme Court to step into an international legal thicket, one that asks whether US search warrants extend to data stored on foreign servers. The US government says it has the legal right, with a valid court warrant, to reach into the world's servers with the assistance of the tech sector, no matter where the data is stored.
The request for Supreme Court intervention concerns a 4-year-old legal battle between Microsoft and the US government over data stored on Dublin, Ireland servers. The US government has a valid warrant for the e-mail as part of a drug investigation. Microsoft balked at the warrant, and convinced a federal appeals court that US law does not apply to foreign data.
According to the article, the U.S. government told the court that national security was at risk.
The request for Supreme Court intervention concerns a 4-year-old legal battle between Microsoft and the US government over data stored on Dublin, Ireland servers. The US government has a valid warrant for the e-mail as part of a drug investigation. Microsoft balked at the warrant, and convinced a federal appeals court that US law does not apply to foreign data.
According to the article, the U.S. government told the court that national security was at risk.
When isn't it national security?
I don't recall the details of the case and can't be bothered to read up on it, but according to the summary it's a drug investigation. It's a pretty far leap from there to national security.
Also, four years. If nothing's happened yet based on the information in those emails it's VERY unlikely anything is going to happen ever. That alone should rule out a national security issue.
-=This sig has nothing to do with my comment. Move along now=-
What we *will* find out is the opinion of an American court, which has no international power. The proper place for this request is the international court of justice in the Netherlands. Unfortunately the US is the only non-dictatorial country that doesn't recognize this court.
Except for the little detail that the other country has data protection laws that make it illegal to do so. An American court should not be able to override the law where it seems to have had no intent to hide the data from the American authorities.
...but it seems rather reasonable that if a court of law orders you to submit something, the fact that you had stored in another country shouldn't be much of an excuse for not doing so.
The whole crux of the matter is a thing US law enforcement uses called "The Fishing Expedition". If the US had a legitimate legal need for this information all they would need to do is petition a foreign court and get a foreign court order (not that hard to do if an actual investigation is being conducted). Unfortunately for US law enforcement, INTERPOL and foreign courts usually require probable cause and actual evidence of wrongdoing before they will issue such an order, thus the attempt to back-door around that requirement.
Does China, Russia, Germany have a right to your data if you are in the USA but using a such a country's service? Because this is the gate being left open
even if the laws in that other country prevent you from doing so? European data privacy laws tend tp be much stronger than in the US, and US courts have no authority outside the US to overrule other countries laws. If Microsoft complied with the US court order it would be breaking the law in Ireland. They're between a rock and a hard place...
Correct, but you can also get into interesting areas of the subsidiary being setup with binding corporate rules which can (in some cases) prevent the foreign entity from complying.
Help Brendan pay off his student loans
No one forces a multinational company into the shenanigans they play with moving things between jurisdictions. They could have considered beforehand whether they were painting themselves into a corner by doing something other than straightforward offering of services in different places.
The laws of Ireland are not the concern of the courts of the USA, nor vice versa. The US court has issued an order on the US corporate entity which that corporate entity had stipulated that it could meet. Either the US corporate entity was lying before when the said they could satisfy the order or they are lying now when they say they cannot. One way or another the US corporate entity lied to the US court.
If a multinational company wants to reap the benefits of having distinct corporate entities in different jurisdictions they also have the pay the costs, which consist of keeping track of when the obligations between the distinct corporate entities are constrained by the the different jurisdictions they were created to run in.
Any employee of this local subsidiary can simply refuse to comply with the order (I expect every single country has a law that allows employee to refuse employer order to break the law). If we are talking about European countries then it would also be impossible to fire him for this, as such firing would be deemed as reprisal by (local) court. Given that the company (local subsidiary) is not even really interested in firing him, it would even likely lead to employee keeping the job (reinstatement).
"Consider hosting in your own nation, with your own local brands and their much stronger data protection."
That's almost exactly what I've recently told a customer who asked advice about web hosts. Sure, the el cheapo operations look attractive, until you find out where the servers are actually located.
Qatar or UAE? I don't think so. Sydney or Melbourne are just fine, thanks. I'd prefer to deal with my own country's rules.
They sentenced me to twenty years of boredom
A subsidiary is a local company established under local laws and subject to all local laws. It will have its own board of directors - who may well all be employees of the owning company, but still have a separate duty to obey the law. If such a subsidiary breaks the local law, it is a criminal offence and the directors become liable. If they are outside the country, the assets of the company may be seized.
If MS sets up the Irish subsidiary to own and operate the servers, it will be impossible for that subsidiary to obey the US order - because it is a separate legal entity which the US courts have no jurisdiction over.
Between those two legal doctrines, the case is clear. If MS DIDN'T vest ownership in its Irish subsidiary, then it is an idiot. This appears to be part of the story here...
So why not go the way it has always been and should be in the future: Ask the court in the other country to help in that matter. If the U.S. court can prove that the data is really needed in a case, then it should be no problem to get it in a way legal in the country it is stored.
If the idea of U.S. jurisdiction to data stored in other country really gets track, the only result will be that companies will no longer directly operate in other countries, but always have local intermediates which are legally independent of the U.S. company.
Put it more clearly: Any employee of the local subsidary has to refuse that order by the employer, because it is against the law. And firing him because of that refusal will bring the local employer into deep trouble because then the local prosecution could use the local equivalent of RICO laws to shut the company down.
Precisely. This is the US government asserting jurisdiction where it clearly has none, using the tenuous arguments of "cyberspace has no borders" and "corporate citizenship traces back to its origin". If the SCOTUS agrees, then the US has taken a step toward delegitimizing every other nation's sovereignty, over yet another skirmish in the "war on drugs" inflated into a bogus national security concern.
Re-read the headline, replacing US with your favourite enemy.
Does it still hold?
If not, then the answer is "no".
US is not special in international law in any way.
A US warrant only has jurisdiction in the US. It cannot cover any other country. How can the US complain that Russia has hacked US computers and then want to hack other people's computers?
I love stacking my barbecues in the shed at the end of summer - you can't beat a bit of grill on grill action.
This is already happening. For example, the MS cloud in Europe is outsourced to Deutsche Telekom, exactly to make sure MS does not have any customer access. This also means a major part of the revenue goes to Deutsche Telekom and not to MS. The reason for that many prospective European customers would not use this service otherwise due to very shaky legal ground.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
That might expose them to a civil lawsuit in Ireland but that would probably be easier to deal with than the 800 pound gorilla that is the US federal govt.
It's more likely to be a criminal lawsuit and expose them to the 850 pound gorilla that is the EU commission. The EU has a slightly larger economy than the US (by some measures) and an established record of swingeing fines on large US companies which ignore EU laws. Microsft itself has already been fined 1.3 billion euros.
You approach the "overseas", provide enough evidence, ask for a warrant.
Then the authorities, usually a judge, judges the evidence and issues a warrant.
Then you get what you want.
A company like FB/MS or any other can not simply provide data from a german server to an US authority. Regardless what the US man with the gun thinks.
Privacy and data is the holy grail in Europe, like your free speech. If a company would simply send data to the US without a court ruling/warrant here in Europe it would break so many laws it likely would run bankrupt.
How an US lawyer/congress/governor can come to the dumb idea he has a chance to make it law that his warrants are valid world wide is beyond me.
Cost free eBook I read (by iBook/Kobo/Amazon/ObookO/Gutenberg etc.): "The Green Odyssey" by Philip Jose Farmer.
A subsidiary is a local company established under local laws and subject to all local laws. It will have its own board of directors - who may well all be employees of the owning company, but still have a separate duty to obey the law. If such a subsidiary breaks the local law, it is a criminal offence and the directors become liable. If they are outside the country, the assets of the company may be seized.
If MS sets up the Irish subsidiary to own and operate the servers, it will be impossible for that subsidiary to obey the US order - because it is a separate legal entity which the US courts have no jurisdiction over.
Between those two legal doctrines, the case is clear. If MS DIDN'T vest ownership in its Irish subsidiary, then it is an idiot. This appears to be part of the story here...
The court simply has to find that the Irish company is not actually a separate entity. And it's not. It's a shell set up to dodge the law (primarily to not pay taxes). They don't even try to hide it. It's trivial to trace it to actual US citizens. Declare the "Irish" subsidiary to be a shell under the actual ownership and control of Americans (because it is), then throw them in jail for hiding tens of billions from the IRS and breaking tons of other US laws (because they are).