Slashdot Mirror
Microsoft Fights Search Warrants for Overseas Emails in the Supreme Court (microsoft.com)
Microsoft's Chief Legal Officer writes about "the landmark Microsoft case that will decide whether the U.S. government can use a search warrant to force a company to seize a customer's private emails stored in Ireland and import them to the United States."
On Thursday, 289 different groups and individuals from 37 countries signed 23 different legal briefs supporting Microsoft's position that Congress never gave law enforcement the power to ignore treaties and breach Ireland's sovereignty in this way. How could it? The government relies on a law that was enacted in 1986, before anyone conceived of cloud computing... When the U.S. government requires a tech company to execute a warrant for emails stored overseas, the provider must search a foreign datacenter and make a copy abroad, and then import that copy to the United States. This creates a complex issue with huge international consequences. It shouldn't be resolved by taking the law to a place it was never intended to go...
The U.S. Department of Justice's attempt to seize foreign customers' emails from other countries ignores borders, treaties and international law, as well as the laws those countries have in place to protect the privacy of their own citizens... It's also a path that will lead to the doorsteps of American homes by putting the privacy of U.S. citizens' emails at risk. If the U.S. government obtains the power to search and seize foreign citizens' private communications physically stored in other countries, it will invite other governments to do the same thing. If we ignore other countries' laws, how can we demand that they respect our laws?
Amicus briefs supporting Microsoft have been filed in the U.S. Supreme Court by Ireland, France, and the European Commission and European privacy regulators. Microsoft even notes that on this issue, "Fox News agreed with the American Civil Liberties Union."
The U.S. Department of Justice's attempt to seize foreign customers' emails from other countries ignores borders, treaties and international law, as well as the laws those countries have in place to protect the privacy of their own citizens... It's also a path that will lead to the doorsteps of American homes by putting the privacy of U.S. citizens' emails at risk. If the U.S. government obtains the power to search and seize foreign citizens' private communications physically stored in other countries, it will invite other governments to do the same thing. If we ignore other countries' laws, how can we demand that they respect our laws?
Amicus briefs supporting Microsoft have been filed in the U.S. Supreme Court by Ireland, France, and the European Commission and European privacy regulators. Microsoft even notes that on this issue, "Fox News agreed with the American Civil Liberties Union."
The servers are located in Ireland in a data centre staffed by Irish people (or who, at least, live there). Will these people obey an order from a court in the USA and risk the wrath of the court in Dublin ? I would not if I were one of them. I do not know what control Microsoft (USA) has over servers in its Irish data centre, but generally the guy who can touch the machine is the one who makes the final decision; and him, being fearful of the Dublin court, could easily restrict access to anyone outside of their data centre.
No matter what the court in the USA decides, what will happen in reality will be interesting to see.
Lodge a warrant with the local MS subsidiary for some data stored on MS USA server/s, and see what happens. Put the shoe on the other foor and see how the USA DoJ reacts.
They sentenced me to twenty years of boredom
I can understand that DoJ is required to make the request/filing, but I do not believe even many of their own lawyers actually think winning would be a good thing. When the ACLU and Fox News both agree the DoJ winning would be bad, you can pretty much take that to the bank. The only interesting question is how narrow the ruling will be.
...that, by the Constitution, international treaties DO supersede Federal law, though not the Constitution itself. Witness WTO lawsuits against Federal and/or State laws. A very bizarre situation, indeed, but you'd think that government lawyers would know this.
.
To reiterate - there's already a legal way to do this where no one breaks any laws if the other country agrees. We should be done at that point and respect others. This might be the only time in recent memory I'm on the side of Microsoft.
Why guess when you can know? Measure!
Prosecutor: The defendant has not turned over emails between their executives discussion the probability of an (oil leak) (fiscal collapse) (other bad thing).
Judge: Why not?
Defendant: Those emails are not stored in this country.
Judge: Which country are they stored in?
Defendant: Please refer to the statement from EvilCO IT explaining that our emails are stored in a database that is then sharded across all our subsidiaries around the world.
Judge: And you need the pieces, the shards, from all the countries to reassemble them?
Defendant: There's some redundancy for catastrophic failures, so no, not all.
Judge: But most.
Defendant: Yes.
Judge: And this can be done from a server here in the United States.
Defendant: No, email accounts are managed by those subsidiaries in those countries. Our EvilCO IT here doesn't have permissions to create them.
Judge: But when a new employee starts, they get access? How?
Defendant: Yes. The US office requests an account for them.
Judge: So you do have permissions to create the new accounts
Defendant: No, only the administrators at the subsidiaries do.
Judge: But you can tell them to do so.
Defendant: Yes
Judge: And they can't say no.
Defendant: I'm not aware of a sysadmin in a subsidiary refusing to create an account for their local shards to an employee authorized by corporate.
Judge: So you claim you don't have permission, but if you make a request then it's always fulfilled.
Defendant: It's fulfilled by an administrator in the subsidiary that has permission.
Judge (daydreaming): Bailiff, please tase this lawyer in the balls repeatedly until he stop this bullshit.
Judge (IRL): Counsel, I think you have constructive access if every time you request access, someone with actual permission grants it.
Defendant: Multiple administrators are required, in each subsidiary, to grant access to the shards necessary to access the email system.
Judge: Yes, multiple, OK, it's a nice shell game. How about turn over the documents about your damned oil spill already?
In a case like this, the certificate necessary to access said email would long have been revoked, and only with a formal request to the Attorney General and the Data Protection agency of Ireland, the U.S. prosecution would be able to get a new one granting access to the email they want.
Regrettably, the courts are aware of the "incidental" creation of copies in each location, as entered into evidence in suits about copyright and copies. They know full well that there is a copy made in RAM in Ireland, then another in the US, then the final copy on the printer in the US, the place where the data is wanted.
If I request a web page from a site in the EU, I don't have to obey EU law, but the server administrator in the EU does. If the EU says "No foreigners may see this", then he can't serve it to me, so I can't import it.
I might really really wish to view it, but if it's in the EU, EU laws apply.
davecb@spamcop.net
They sellout every US citizen with Cortana, and they won't give up some foreigner? Jail all the executives for treason and be done with it.
It's not about borders but the jurisdictions operating within them. The EU has very strong data protection laws, the US does not.
Fail to comply: Get sued in the US.
Comply: Get sued by all the other countries.
There's a reason that we have jurisdictions.
Pretty much, even allowing the CAPABILITY for non-EU personnel to access EU data is an offence, which is why the EU side of Microsoft (an entirely different legal entity) cannot allow it to happen without an EU court order, cannot provide credentials that could make it happen, and cannot be seen to assist in any way, shape or form.
And technically, because the Microsoft US entity doesn't have control of that data, they are then unable to do anything about getting sued into oblivion because what they are being ordered to do is impossible for them to do anything about and the only place that can do anything would be breaking their own laws.
You want this data, you get the EU courts to order it. Good luck!
If it did, it would be in breach of most of the data protection laws in the EU.
They are either data processors (which would be very difficult to organise legally across international boundaries) or not (in which case they shouldn't have access to the unencrypted data at all).
EU laws are much more strict in this, and I can't process any data for my employer outside the EU. Hence things like SurveyMonkey, etc. are off-limits as they are hosted in the US.