Slashdot Mirror
Microsoft Fights Search Warrants for Overseas Emails in the Supreme Court (microsoft.com)
Microsoft's Chief Legal Officer writes about "the landmark Microsoft case that will decide whether the U.S. government can use a search warrant to force a company to seize a customer's private emails stored in Ireland and import them to the United States."
On Thursday, 289 different groups and individuals from 37 countries signed 23 different legal briefs supporting Microsoft's position that Congress never gave law enforcement the power to ignore treaties and breach Ireland's sovereignty in this way. How could it? The government relies on a law that was enacted in 1986, before anyone conceived of cloud computing... When the U.S. government requires a tech company to execute a warrant for emails stored overseas, the provider must search a foreign datacenter and make a copy abroad, and then import that copy to the United States. This creates a complex issue with huge international consequences. It shouldn't be resolved by taking the law to a place it was never intended to go...
The U.S. Department of Justice's attempt to seize foreign customers' emails from other countries ignores borders, treaties and international law, as well as the laws those countries have in place to protect the privacy of their own citizens... It's also a path that will lead to the doorsteps of American homes by putting the privacy of U.S. citizens' emails at risk. If the U.S. government obtains the power to search and seize foreign citizens' private communications physically stored in other countries, it will invite other governments to do the same thing. If we ignore other countries' laws, how can we demand that they respect our laws?
Amicus briefs supporting Microsoft have been filed in the U.S. Supreme Court by Ireland, France, and the European Commission and European privacy regulators. Microsoft even notes that on this issue, "Fox News agreed with the American Civil Liberties Union."
The U.S. Department of Justice's attempt to seize foreign customers' emails from other countries ignores borders, treaties and international law, as well as the laws those countries have in place to protect the privacy of their own citizens... It's also a path that will lead to the doorsteps of American homes by putting the privacy of U.S. citizens' emails at risk. If the U.S. government obtains the power to search and seize foreign citizens' private communications physically stored in other countries, it will invite other governments to do the same thing. If we ignore other countries' laws, how can we demand that they respect our laws?
Amicus briefs supporting Microsoft have been filed in the U.S. Supreme Court by Ireland, France, and the European Commission and European privacy regulators. Microsoft even notes that on this issue, "Fox News agreed with the American Civil Liberties Union."
The servers are located in Ireland in a data centre staffed by Irish people (or who, at least, live there). Will these people obey an order from a court in the USA and risk the wrath of the court in Dublin ? I would not if I were one of them. I do not know what control Microsoft (USA) has over servers in its Irish data centre, but generally the guy who can touch the machine is the one who makes the final decision; and him, being fearful of the Dublin court, could easily restrict access to anyone outside of their data centre.
No matter what the court in the USA decides, what will happen in reality will be interesting to see.
Lodge a warrant with the local MS subsidiary for some data stored on MS USA server/s, and see what happens. Put the shoe on the other foor and see how the USA DoJ reacts.
They sentenced me to twenty years of boredom
Curious that "ignoring borders" is exactly the issue at present, when the US Government has exhausted its spending authority. The Republicans think that borders mean something and that illegal aliens should go home, while the Democrats apparently feel that there are no borders to the United States that anybody is obliged to respect. Europe has been having similar problems over the last year or so.
The Internet is about to get a wake-up call: if you control the data, it doesn't matter where the hard drive is.
I can understand that DoJ is required to make the request/filing, but I do not believe even many of their own lawyers actually think winning would be a good thing. When the ACLU and Fox News both agree the DoJ winning would be bad, you can pretty much take that to the bank. The only interesting question is how narrow the ruling will be.
...that, by the Constitution, international treaties DO supersede Federal law, though not the Constitution itself. Witness WTO lawsuits against Federal and/or State laws. A very bizarre situation, indeed, but you'd think that government lawyers would know this.
.
To reiterate - there's already a legal way to do this where no one breaks any laws if the other country agrees. We should be done at that point and respect others. This might be the only time in recent memory I'm on the side of Microsoft.
Why guess when you can know? Measure!
Prosecutor: The defendant has not turned over emails between their executives discussion the probability of an (oil leak) (fiscal collapse) (other bad thing).
Judge: Why not?
Defendant: Those emails are not stored in this country.
Judge: Which country are they stored in?
Defendant: Please refer to the statement from EvilCO IT explaining that our emails are stored in a database that is then sharded across all our subsidiaries around the world.
Judge: And you need the pieces, the shards, from all the countries to reassemble them?
Defendant: There's some redundancy for catastrophic failures, so no, not all.
Judge: But most.
Defendant: Yes.
Judge: And this can be done from a server here in the United States.
Defendant: No, email accounts are managed by those subsidiaries in those countries. Our EvilCO IT here doesn't have permissions to create them.
Judge: But when a new employee starts, they get access? How?
Defendant: Yes. The US office requests an account for them.
Judge: So you do have permissions to create the new accounts
Defendant: No, only the administrators at the subsidiaries do.
Judge: But you can tell them to do so.
Defendant: Yes
Judge: And they can't say no.
Defendant: I'm not aware of a sysadmin in a subsidiary refusing to create an account for their local shards to an employee authorized by corporate.
Judge: So you claim you don't have permission, but if you make a request then it's always fulfilled.
Defendant: It's fulfilled by an administrator in the subsidiary that has permission.
Judge (daydreaming): Bailiff, please tase this lawyer in the balls repeatedly until he stop this bullshit.
Judge (IRL): Counsel, I think you have constructive access if every time you request access, someone with actual permission grants it.
Defendant: Multiple administrators are required, in each subsidiary, to grant access to the shards necessary to access the email system.
Judge: Yes, multiple, OK, it's a nice shell game. How about turn over the documents about your damned oil spill already?
Regrettably, the courts are aware of the "incidental" creation of copies in each location, as entered into evidence in suits about copyright and copies. They know full well that there is a copy made in RAM in Ireland, then another in the US, then the final copy on the printer in the US, the place where the data is wanted.
If I request a web page from a site in the EU, I don't have to obey EU law, but the server administrator in the EU does. If the EU says "No foreigners may see this", then he can't serve it to me, so I can't import it.
I might really really wish to view it, but if it's in the EU, EU laws apply.
davecb@spamcop.net
Corporations are answerable to sovereign (domestic) government or they aren't: The US DoJ creating a "fuck you, I got mine" end-run some 32 years ago, is irrelevant.
Considering the USA imposes onerous treaties on other countries of the world, one is driven to ask why the DoJ isn't using that leverage? I suspect this is a fishing expedition that would fail even that lax legal requirement.
They sellout every US citizen with Cortana, and they won't give up some foreigner? Jail all the executives for treason and be done with it.
Has the data/email ever been accessed in the USA? Or ever crossed into or out-of the USA?
If data from France to Ireland first goes to USA then to Ireland, then cannot the USA at least capture or request capture of data as it passes thru USA? Same for China or any other country! This is a danger with the internet and not controlling the path data takes.
That, and the fact that it would be illegal for the subsidiary to hand over the customer's data to an overseas kangaroo court.
Danger Will Robinson, DANGER!
Remember that if the United States courts could issue a warrant for data in other countries, those countries could also issue a warrant for data in the United States.
Imagine if you sent an email being critical of Islam to somebody and they happen to be someplace in the Middle East, and that government arrested that person, but also issued a warrant for your email, and decided to file charges against you because it's illegal in THEIR country that you have never been to.
I hope your airplane doesn't fly over their country, or they will be forced to land so they can take you into their custody.
Fail to comply: Get sued in the US.
Comply: Get sued by all the other countries.
There's a reason that we have jurisdictions.
Pretty much, even allowing the CAPABILITY for non-EU personnel to access EU data is an offence, which is why the EU side of Microsoft (an entirely different legal entity) cannot allow it to happen without an EU court order, cannot provide credentials that could make it happen, and cannot be seen to assist in any way, shape or form.
And technically, because the Microsoft US entity doesn't have control of that data, they are then unable to do anything about getting sued into oblivion because what they are being ordered to do is impossible for them to do anything about and the only place that can do anything would be breaking their own laws.
You want this data, you get the EU courts to order it. Good luck!
If it did, it would be in breach of most of the data protection laws in the EU.
They are either data processors (which would be very difficult to organise legally across international boundaries) or not (in which case they shouldn't have access to the unencrypted data at all).
EU laws are much more strict in this, and I can't process any data for my employer outside the EU. Hence things like SurveyMonkey, etc. are off-limits as they are hosted in the US.
WTF exactly, does the Irish e-mail case have to do with partisan differences over immigration? Also you threw in "spending authority" for no known reason at all.
I mean, you could have made some kind of a sensible analogy. Except you failed to do so.
Troll babble gibberish nonsense! Gabble gabble burp fart squeak!
...otherwise we end up with the BS that was perpetrated here in New Zealand against Mega-upload/Kim Dotcom - NZ, a sovereign nation, bowed to pressure from the US Federal Gov't (who were probably acting on called in electoral favor by the RIAA/MPAA).
A dawn raid, with Armed Offenders Squad, the NZ equivalent of SWAT, on four people in KDC's mansion near Auckland - the four people were KDC, his wife, and two children aged six and seven (ish) having loaded firearms in their faces.
It was a filthy act, over the top, and the NZ government should be ashamed of bowing the the US Federal Government like that. I hope the Irish government has bigger balls that ours.
Let Ireland pass a law that makes it a felony for anyone anywhere in the world to order any business that stores data in Ireland to transfer it to another country in violation of the Irish data privacy law and without an Irish courts approval.
Prosecute the Prosecutor.
Issue a Interpol Red Note Warrant for the arrest of the U.S. Department of Justice Prosecutor.