Slashdot Mirror
US Supreme Court To Decide Microsoft Email Privacy Dispute (reuters.com)
The U.S. Supreme Court on Monday agreed to resolve a major privacy dispute between the Justice Department and Microsoft Corp over whether prosecutors should get access to emails stored on company servers overseas. From a report: The justices will hear the Trump administration's appeal of a lower court's ruling last year preventing federal prosecutors from obtaining emails stored in Microsoft computer servers in Dublin, Ireland in a drug trafficking investigation. That decision by the New York-based 2nd U.S. Court of Appeals marked a victory for privacy advocates and technology companies that increasingly offer cloud computing services in which data is stored remotely. Microsoft, which has 100 data centers in 40 countries, was the first U.S. company to challenge a domestic search warrant seeking data held outside the country. There have been several similar challenges, most brought by Google.
It will almost certainly be owned by Microsoft Ireland, a wholly-owned subsidiary of Microsoft Inc, US.
Unfortunately, this is where the story gets interesting. Whilst MS Inc, the US Parent, is incorporated under US Law and therefore subject to US jurisdiction, if the Irish subsidiary is incorporated under Irish law, then the ability of the US government to exert demands on it are potentially eliminated.
I have found that a good test to apply in a situation like this is to reverse the scenario. Here's a hypothetical situation to put this to the test: imagine that "Microsoft Ireland" was found guilty of a criminal offence [it doesn't matter what] and that the fine levied for this was equal to $100 Billion US. Now imagine that Microsoft Ireland are worth a grand total of say $40 Billion US and that extracting even this from them will completely bankrupt them.
Would the Supreme Court / Microsoft (US) inc be willing to allow the reciprocal to happen - i.e. that the plaintiff in the Irish case has the authority to go after Microsoft US for the remaining $60 Billion of their settlement? In other words - does that liability go both ways?
Obviously this is an academic question for a hypothetical situation; my sense is that the US parent would not want an open-door liability like this to be allowed. Which, whilst different in some respects, rather serves to enforce the view that these are two entirely different legal entities, incorporated under the laws of entirely different countries. If Microsoft Ireland had been incorporated under US law, then there might be an argument supporting the view of the US government. If it exists under Irish law, I don't see how the US government's case can have merit.
But then again, I'm not a lawyer...
This has nothing to do with "owning the world". If a Microsoft employee, located in the U.S., can access a server located in [some other country], then the location of that server is irrelevant. That is the argument being used by the U.S. government, and in this case they are correct.
To argue otherwise means:
You're claiming that a person located in the U.S. is governed by EU law, e.g., they can't access a server they own and control except in accordance with EU law, despite the fact that they are not in the EU. You are, in fact, trying to impose EU law on a person sitting at a computer in the U.S.
Any person/business located in the U.S. just has to put all their servers outside the U.S. and access them remotely and they become immune to all U.S. laws. Want to investigate Microsoft/Google/Whoever for securities fraud or some other wrong doing? Sorry, all their documents and e-mails are located on a server outside the U.S. and they don't have to give them to you.
Does that mean that my country's government can compel MS to hand over data stored on servers in the US?
This is really important not only for international privacy but also for US business profits from international sources (which is a major reason for Microsoft being on the right side of the issue).
Use my userscript to add story images to Slashdot. There's no going back.
It doesn't matter who owns the server, since even if it is MS Ireland, they're almost certainly a wholly owned subsidiary of MS US, meaning that MS US owns that data regardless. And if the US government compels MS US to hand the data over, they'll be making a request that's illegal in the country where the action must be undertaken, regardless of whether it's MS US or MS Ireland doing the deed, so in that regard it also doesn't matter who owns the server.
Of course, just because it doesn't matter who owns the server doesn't mean it's legal for the US government to make that request, nor that it's legal for MS (regardless of which brand we're talking about) to hand the data over.
Ideally, the people on the ground in Ireland would simply refuse to comply with the order if MS was compelled to hand over the data. After all, the US government has no authority over them, nor an ability to prosecute them, nor an ability to pursue a prosecution of them via diplomatic channels given that the request was illegal in the first place. In fact, the proper way for this to work is that the US government uses those diplomatic channels to seek an extraction of the data pursuant to its treaties with Ireland or the EU.
Unfortunately, it may be possible for MS US to extract the data from Ireland without the involvement of the people in Ireland. If that's the case, then those Americans may be opening themselves up to contempt or court and other charges for failing to produce documents that they are capable of producing. When Apple was facing a similar situation with the FBI attempting to compel them to add a backdoor to iOS, the rumors leaking from internally indicated that the team that would have been compelled to take those actions planned to quit if push came to shove, and that other companies were already lined up to accept them if need be. I'd expect that the same would be true here: anyone who quit over an issue like this would have no trouble finding work elsewhere in the industry.
You're claiming that a person located in the U.S. is governed by EU law, e.g., they can't access a server they own and control except in accordance with EU law, despite the fact that they are not in the EU. You are, in fact, trying to impose EU law on a person sitting at a computer in the U.S.
Actually, where the person is located does not matter much.
We see this in the US with sales tax on online sales. While you could argue that the sale takes place in the retailers server, according to the law it takes place in the customers home. This is why retailers (assuming sufficient presence, i.e. nexus) must pay sales tax where thew customer lives. The same applies in the EU by the way, for purposes of consumer protection, VAT, etc. Where the company (and its employees) are located does not matter.
Another issue here is the EU-US Privacy Shield: whatever the US supreme court decides must be in line with the agreement with the EU, or we'll face new problems as we did when the previous safe harbor provisions were struck down.
Given that the email belongs to people in the EU, both the provisions of the EU-US Privacy Shield and the EU privacy protection laws apply. AFAIK, this means that the decision to hand over the data must be decided by a EU judge.
Yes, a person in the U.S. can copy personal data from a computer located in the E.U. to a computer located in the U.S.. But doing so without the consent of the person the data belongs to is illegal in the E.U.. The European High Court has decided that even U.S. legal enforcement is not allowed to do so without serving a warrant to the responsible european court first. If a court in the U.S. decides otherwise it would be in contempt of the EHC. I wonder what happens if the EHC then serves a warrant against an U.S. court for doing so.
"You're claiming that a person located in the U.S. is governed by EU law, e.g., they can't access a server they own and control except in accordance with EU law, despite the fact that they are not in the EU. You are, in fact, trying to impose EU law on a person sitting at a computer in the U.S."
You mean like when you get delivered the guy who hacked a US computer from England, because he violated US law from his mother's British cellar?
Then the US company should be held in contempt and charged with obstruction of justice and destruction of evidence. The question here is whether or not you can hide evidence from courts. The fact that it's being done with computers is really quite irrelevant.
This is not a "tech" article at all.
A corporation wants to pretend it's above the law by engaging in a shell game with their documents.
A Pirate and a Puritan look the same on a balance sheet.
You talk a lot about legal and illegal without mentioning jurisdiction which is rather important since the US got jurisdiction over MS US, Ireland over MS Ireland. The US can legally put the thumbscrews on MS US to produce the documents, Ireland can legally put the thumbscrews on MS Ireland to not produce the documents. Which puts Microsoft in a "damned if you do and damned if you don't" position, but there's no "world court" they can appeal to. The US can say we're right, appeal denied and Ireland can say the same. It still won't be possible for Microsoft to comply with both.
It's clear to see why the US - or indeed any country - don't like the idea that you can "jurisdiction shopping", like oh all our company data is outsourced to our wholly owned subsidiary in the Cayman Islands and we wouldn't want to break any local laws, you'll have to go through the courts there. But if that's a problem you should restrict the export of information, like if you're a US company the data on US citizens must be accessible to US courts. Trying to demand that all data held by foreign subsidiaries, even on foreign citizens be available to US courts is begging for trouble.
The reciprocity here is that a Chinese court can demand data on US citizens stored on US servers by a US subsidiary because it's owned by a Chinese company. The US would never grant the permissions it's trying to create for itself, it's one rule for us and one rule for everybody else. Hopefully the supreme court is smart enough to see that, otherwise there is only one choice: Stop making any product made by a US company in any privacy-sensitive context.
Live today, because you never know what tomorrow brings
That is exactly the situation that makes it so interesting from a legal view.
The US courts can order the US company to take the action. But the instant they start messing with the data in Ireland, the emails of a the citizen who lives in Ireland, then the international treaties between the US and Ireland come into play.
If that happens -- meaning the US Supreme Court orders or allows the government to violate the international treaty even though proper channels exist through the treaty -- the consequences get complicated very quickly. Nations routinely violate treaties and the US does it all the time, particularly around military actions. Exactly how the nations respond varies by nation.
Ireland may quietly do nothing and allow the treaty violation. Diplomatic channels have been active since this started, and whatever action is taken will have closed-door diplomatic consequences. More publicly, Ireland's politicians may raise the issue with the international courts or with the UN. They may instead chose a more passive-aggressive stance either with or without public declarations, requiring more strict scrutiny to law enforcement requests and requiring extra time as they triple-check every detail of the request against all applicable law. Since international law enforcement requests must be vetted by all nations involved, Ireland could respond extremely slowly or find reasons to disallow the bulk of future requests, perhaps only allowing the most extreme cases (like child sexual abuse) to pass through in a timely manner.
Other nations may also respond in varying degrees. Like above this may range from no visible response, closed-door diplomatic responses, to increasing difficulty working with the nation, to public statements of disapproval, to full-blown official actions in international policy organizations.
Nations that are firmly against the US could rightly publicise it as yet another instance of the US willfully ignoring their treaty obligations. With Trump routinely going to the media to declare he will disregard treaties this is not a surprising thing. Even before Trump, as a nation the country lost its moral high ground on treaties decades ago; the US is a nation that generally follows the rule of law, but has demonstrated no qualms about violating the rule of law when those in power think they can get away with it. Although this one is relatively small, yet another treaty violation can be added to the stack and the rallying cries about the duplicitous actions of the country, and how the US does whatever it wants without regard to treaties and promises it has made.
If it goes forward, probably the US government will get the data they have been fishing for, they'll win that specific battle, but it will come at a cost for future international cooperation. There will be an enormous cost to all the other international police investigations that use the treaty. While they get the data in one specific case, untold thousands of other cases that are legitimate and using the proper channels will face the negative repercussions, in addition to whatever political fallout comes with it.
//TODO: Think of witty sig statement
This has nothing to do with "owning the world". If a Microsoft employee, located in the U.S., can access a server located in [some other country], then the location of that server is irrelevant. That is the argument being used by the U.S. government, and in this case they are
incorrect. That is because the Microsoft employee can access a server located in [some other country] due to permission from someone ([some other country] MS employees) at the location to enable access to the server. The [some other country] MS employee have 100% rights to physically disconnect their server at anytime under their judgement and the local country's jurisdiction.
Simpler concept: Guy 1 has a ball and Guy 2 also has a ball. Separated by land while under agreement and regulation, both of them can throw the ball to each other. Then separate land Police 1 and Police 2 came. Police 1 can ask Guy 1 to give him his ball. Police 2 can ask Guy 2 to give him his ball. But Police 1 cannot ask Guy 2 for his ball without asking Police 2 first, where Guy 1 is irrelevant. The problem is now Police 1 is asking Guy 1 for Guy 2's ball without asking Police 2.
We are not "claiming that a person located in the U.S. is governed by EU law", but the person located in the EU is governed by the EU law., and outsider can't tell him/her to bypass their law.