9 ms·
Google must turn over foreign-stored emails pursuant to a warrant, court rules
- deleted 10y ago[deleted]
- tomrod 10y agoIt's been fun, Gmail, but I think it may be time to go. Not that I have anything to hide, but I don't like my protections being whittled away. Any suggestions on what provider to seek out now? Lavabit?
- pg_is_a_butt 10y agoNot that i have anything to add, but when did your ability to run your own email server whittle away? you're all idiots.
- sbov 10y agoHow about yourself?
- tomrod 10y agoI'm not sure where to start. What do you suggest?
- pmlnr 10y agohttp://www.iredmail.org/ http://www.iredmail.org/ for mail, http://radicale.org/ http://radicale.org/ for contacts and calendar, http://www.rainloop.net/ http://www.rainloop.net/ for better webmail. Ask https://indiehosters.net https://indiehosters.net to set it up for you for a minor fee.
- Alupis 10y agoWell, email is a hard problem. Hosting it yourself requires quite a bit of effort and knowledge to achieve high deliverability and low spam. Any solution is going to require you to be a mail server admin, which isn't for the feint of heart. You can't really be a casual once-in-a-while admin to get good results. Sometimes it is worth paying a hosting service to take care of these problems for you. With that said, Zimbra is a wonderful, easy to setup, all-in-one solution (email, calendars, contacts, etc)... and it's free (the Open Source license version).[1] It works for small setups (<5 users) all the way up to huge installations (Comcast uses Zimbra for it's webmail service). [1] https://www.zimbra.com/ https://www.zimbra.com/
- jbmorgado 10y agoThat's not really a good solution, if you setup your own personal email server your outgoing emails in many cases will unfortunately end in a SPAM box since they will originate from an unknown server.
- deleted 10y ago[deleted]
- mahyarm 10y agoGet your own domain for your email first. That is really the biggest hurdle. Providers can be swapped out without much work that way.
- keyboardhitter 10y agoI suggest runbox.com. https://runbox.com/why-runbox/email-privacy/ https://runbox.com/why-runbox/email-privacy/
- bduerst 10y ago>Runbox will not disclose account information or email data to authorities unless presented with a Norwegian court order. Isn't that the same as what's happening here?
- stonogo 10y agoNo, Google is being presented with an American court order.
- mynameisvlad 10y agoPhrasing Runbox's sentence in another way: > Runbox will not disclose account information or email data to authorities unless presented with a court order issued by the country we do business in. And then it becomes identical to this situation.
- keyboardhitter 10y agoIt is a good point, I guess my assumption was this would be a lesser chance than it happening at Google. In any case, they have been reliable as an email host, so I am grateful for that. I wanted to suggest another option; not a perfect option.
- manquer 10y agoWell Google does business in every country , so still better to be compliant with one country with better privacy safe guards than a company which has to please every government
- kalleboo 10y agoThe manning cable leaks showed that Norway is under America's thumb.
- bduerst 10y agoBecause GMail is being served warrants for overseas data? Most email providers will comply with search warrants on individuals, regardless of the government.
- SAI_Peregrinus 10y agoI've been liking protonmail.com Not US based, encrypted storage, easy to use.
- eriknstr 10y agoNo surprise there. Doesn't help where the servers are as long as the company is in the US.
- bifrost 10y agoIt does somewhat, Google transferred the data to the US.
- dibstern 10y agoUS companies and the data they control is obviously going to be under the jurisdiction of law enforcement where the company is located, in the US. Especially if the data storage location is, for all user purposes, arbitrary.
- guax 10y agoBut how do you define location of the company if it have offices on other countries where the users are from? Would US assume that the rest of the world doesnt count as long as any representation of the company is physically located in the country?
- the8472 10y agoThey are also under the jurisdiction of their foreign offices and have to adhere to privacy laws abroad. Which means it may be illegal in other countries for google to execute that order on foreign soil. And that is why we have separate jurisdictions in the first place, to avoid such irreconcilable conflicts.
- hadfgdasf 10y agoThe company, or a subsidiary, office, or even an officer for that matter.
- deleted 10y ago[deleted]
- mtgx 10y ago> Indeed, according to the Stipulation entered into by Google and the Government, Google regularly transfers user data from one data center to another without the customer’s knowledge Seems like this one is completely on Google. So if you want to be protected against this type of seizure, stop using Google, or any other American service that brings its data from its EU servers over to the U.S. EDIT: And why is this an "opinion post"? It didn't have to be one. I thought the Washington Post was using its recent surge in profits from covering Trump non-stop to hire more investigative journalists, not pay for more biased opinion pieces? Orin Kerr is one of the original proponents of a "golden key" for encryption, so I would at least take his suggestions with a pretty big grain of salt.
- pcl 10y agoI haven't read the Google ToS, but I wonder if it would matter to the USG if the Google ToS made stipulations about transparently moving data within a region versus between regions.
- electic 10y agoEmails aside, this is more about using cloud in services in general. If you use Google Compute or AWS, you are in this boat. This is why U.S. tech can't be trusted.
- pwelch 10y agoAre there any good options for cloud services outside of the US?
- skylark 10y agoCurious: Why would you trust a cloud service operating outside the US more than one operating within? If you use Google, your data is basically guaranteed to be secure - the biggest vulnerability is search warrants from the US government. If you use some provider in another country, the attack vector has to be way larger, right? This is an honest question - people always talk about using their own servers or non-mainstream providers, but I don't see how they necessarily reduce your risk.
- moxious 10y agoGuaranteed to be secure? Are you joking? Aside from the fact that nothing is guaranteed to be anything in the security world, if you go read the documents put out by Snowden there just no way you'd say that. More like it is that there are any number of zero days floating around at all times many of which Google doesn't know, and the government itself is regularly taking data from these companies and then gagging them, and when that doesn't work, rooting them directly. Outside countries are just as susceptible to hacking, but they can't be as easily made into gagged cooperators. And google may have a lot of smart people but they have a collossal attack surface due to sheer size and product offerings. And they're made of humans. They run hackathons soliciting bugs and regularly find them. No one is perfect, definitely not google. The overall security picture out there is grim, and it's very rational for people to control the risks they can and part of that is using outside of the US services
- deleted 10y ago[deleted]
- rl3 10y ago>The court also argued that this outcome was needed to avoid absurd results. Sometimes it feels like the law is just a means to an end. USG wants access to data regardless of jursidiction, so that's what it gets.
- deleted 10y ago[deleted]
- deleted 10y ago[deleted]
- dibstern 10y agoI don't understand why this is bad. The argument makes sense. If you are conducting your business via email using an American provider, expect it to be subject to American law. I don't see how this could be unusual or a shock to anyone.
- jbmorgado 10y agoI think the shock here is exactly that american law allows for this.
- pyrale 10y agoIf you start behaving like that, expect foreign governments/clients to ban/boycott american providers. Jurisdiction is an important concept, and if the american justice starts using the good economic position of its companies to bypass or expand its jurisdiction, it should be expected that the feedback will effect said economic position. While this case seems to be a bit different from the Ms case, the court essentially orders a private entity to take action in a foreign country, something which it could not do itself. This seems wrong to me. Instead, the issue is probably that this info should probably not be foreign if the producers were domestic.
- WildUtah 10y agoIf you start behaving like that, expect foreign governments/clients to ban/boycott american providers. If it were a real concern to anyone, the EU countries would have simply used their big stick and started banning Google and Microsoft from doing business until they cleaned up their acts. And they'd have done it years ago. As long as it's the US government violating your privacy, those EU countries are perfectly happy to see their data privacy laws neutered.
- pyrale 10y agoThe situation is not immune to change. E.g. the election of Trump, and more specifically the executive order he passed calling for the stripping of any expectation of privacy for all foreigners may spur europeans to action. At least currently, there seems to be a trend in the EU pleading to shield ourselves from US interference, and the tech cos are probably the obvious first target.
- drakenot 10y ago> Electronically transferring data from a server in a foreign country to Google’s data center in California does not amount to a “seizure” because there is no meaningful interference with the account holder’s possessory interest in the user data. So, because data can be copied and doesn't deprive the original account holder of their data, this doesn't count as a seizure? > the electronic data disclosed by Google pursuant to the warrants will occur in the United States when the FBI reviews the copies of the requested data in Pennsylvania. And because law enforcement will review the documents in the United States, this doesn't count as a "search" outside the US. This line of reasoning seems really crazy to me. What if these had been physical documents? Would this have been ruled in the same way? Say that the US government photocopied a set of files outside the United States and planned to only review them in the US.
- Spivak 10y agoOn the upside, I can't wait to cite this case whenever someone says that piracy is theft.
- segmondy 10y agoThey said it's not seizure, they didn't say it's theft. Argument for piracy has been that it's not depriving the original owner of the content, but that has been argued against. So I'm not sure your argument will hold.
- TazeTSchnitzel 10y agoYes, the crime is copyright infringement, not theft, even if movie studios like to spin the former as a form of the latter.
- ezoe 10y agoSurely, the content of almost all emails express human philosophy enough to be accounted the copyright.
- 10y ago
- israrkhan 10y agoMicrosoft was in similar boat a while ago. They refused[1] to handover foreign data, and court ruled in their favor[2]. Why does Google has to be treated differently? This type of decisions pose serious threat to competitiveness of US companies in a global market. [1] http://www.zdnet.com/article/microsoft-refuses-to-hand-over-foreign-data-held-in-contempt-of-court/ http://www.zdnet.com/article/microsoft-refuses-to-hand-over-... [2] http://www.zdnet.com/article/microsoft-scores-privacy-win-after-appeals-court-decision/ http://www.zdnet.com/article/microsoft-scores-privacy-win-af...
- DrScump 10y agoI suspect that it's because the data was produced outside the USA in the Microsoft case but inside the USA in the Google case.
- mynameisvlad 10y agoThe real answer to your question is: Because the court system. Specifically, because the magistrate that heard Google's case disagreed with the other judge's ruling. It's specifically mentioned in the first paragraph of the article, linking to the article as well as another one stating that a rehearing on the Microsoft case was denied. Judges seem to be very split on the issue, so it's a matter of who you get.
- fennecfoxen 10y ago> Judges seem to be very split on the issue, so it's a matter of who you get. This is generally when the Supreme Court starts to consider getting involved: it is the venue to resolve discrepancies between lower courts.
- ww520 10y agoEncryption all the way.
- emptybits 10y agoSo should we soon expect courts to reject copyright infringement or piracy claims? So says the court in the article: "Electronically transferring data from a server in a foreign country to Google’s data center in California does not amount to a “seizure” because there is no meaningful interference with the account holder’s possessory interest in the user data." My point is there could be analogies drawn. If taking copies of an email without the email owner's permission doesn't violate the owner's interest, then perhaps taking copies of media works without the owner's permission doesn't violate the owner's interest either? I'm suggesting strictly viewing, non-commercial use.
- dragonwriter 10y agoCopyright infringements is not, even in principle, about seizure or possessory interest, so there is no relation between your question and the quote it is supposedly based o .
- emptybits 10y agoThank you. I'm saying the above somewhat tongue-in-cheek, because my gut feeling is that some aspect of interest has been violated in the case of the email owner or related parties. Of course, "gut feeling" is not a legal principle. So I'll go back to being Definitely Not A Lawyer.
- WildUtah 10y agoNeither is search and seizure about a possessory interest. It's about privacy and security. Even in the eighteenth century it was about "persons, papers, and effects." It was always an information security question.
- dragonwriter 10y agoA seizure is defined, basically, as something that harms a liberty (if a person is the subject) or possessory (if the subject is not a person) interest; without that there is no seizure, reasonable or unreasonable. Likewise a search is something that harms a privacy interest.
- linkregister 10y agoI wonder what effect this has on international relations and treaties. How will the U.S. government respond when a European Union country's authorities furnish a warrant to Google for information about U.S. persons, using the same precedent? I find it hard to believe this doesn't conflict with at least one of the treaties the U.S. has signed with the EU.
- electic 10y agoDoesn't work that way. The thing is as long as the people in the Justice Department get what they want, they are happy. They don't care about you. Just like the NSA. Once they figure out a 0-day, they use it to hack foreign entities. They won't help fix it by telling the U.S. software company. In other words, they don't care if you get hacked.
- linkregister 10y agoNone of what you said addresses what I wrote. U.S. courts are constrained by existing treaties, as long as they are ratified by the U.S. Senate.
- hadfgdasf 10y agoPlease name a data privacy treaty the U.S. has ratified.
- nsight 10y agoThere seems to be confusion around what this specific decision is for. This is not about foreign emails stored in foreign servers by Google. This is about US emails that Google decided to store outside the US. Why do that? I'm guessing Google has developed technologies like Spanner [1] that distribute data on a global scale, to help with capacity, disaster recovery etc. Even for data generated in the US and accessed in the US by US persons. So if you have a US person's emails shipped outside the US by Google for no other reason other than Google's convenience, do US warrants still apply to the foreign-stored data? It's not a simple question. The Microsoft Ireland case doesn't seem relevant as the person in that case was a non US person. Or, to be more specific, the Ireland datacenter that MSFT was running was meant for non US email accounts. Overall, the US law seems to offer sufficient protection to non-US person with data stored outside the US. This specific decision is not about that. If I am missing something please let me know. [1] https://en.wikipedia.org/wiki/Spanner_(database) https://en.wikipedia.org/wiki/Spanner_(database)
- magicalist 10y agoNo, I don't believe this is correct. The source of the emails seems to never be brought up. The discussion in the decision is pretty readable. Essentially the argument seems to be because Google transfers data from country to country in normal operations, the data currently stored outside of the US is somehow different than the data Microsoft was permanently storing in Ireland. As a result, Google could just transfer the data back to the US and then the search is just a normal domestic search with a warrant: > Under the facts before this court, the conduct relevant to the SCA's focus will occur in the United States. That is, the invasions of privacy will occur in the United States; the searches of the electronic data disclosed by Google pursuant to the warrants will occur in the United States when the FBI reviews the copies of the requested data in Pennsylvania. Seems like the judge's argument would apply to any user of a service with multiple data centers that regularly replicate (or transfer) data between them.
- joatmon-snoo 10y agoYou're right with respect to the point about the source of the emails. > Seems like the judge's argument would apply to any user of a service with multiple data centers that regularly replicate (or transfer) data between them. I find this decision even more onerous than that, which is disturbing on a number of levels, specifically, this excerpt from the conclusion: under this court's interpretation, Google will gather the requested undisclosed data on its computers in California, copy the data in California, and send the data to law enforcement agents in the United States, who will then conduct their searches in the United States. An important note is that this is not simply because the data in question is sharded (and therefore cannot be guaranteed to be wholly present in some single sovereign's jurisdiction - this conclusion is considered ancillary to the SCA warrant extraterritoriality question).
- throw2016 10y agoI think democratic states who set themselves up as models of free societies have a higher responsibilty to live up to these values. The fact that fascist or authoritarian states passed laws to support their excess does not change our perception of them or make anything 'legal'. Authoritarianism couched in legalese is still authoritarianism. We are now 10 years into using the legal system to set extremely dangerous precedents and are guilty of insidiously corrupting and trivializing the democratic movement set up after the second world war. Our evangelism of free and democratic values will now lack authenticity and will inevitably be perceived as self serving posturing and hyprocrisy. This loss of the moral high ground is a high price to pay for some generational politicians and NSA bureaucrats tinpot tendencies. The system is not working.
- ComodoHacker 10y agoI find WP's new "subscribe to read" policy extremely abusive. It will result in some random unfortunate people receiving unsolicited crap into their inboxes. I hope someone will collect their complaints and sue WP for this.
- k-mcgrady 10y agoCould someone explain whether this has an impact on the EU Privacy Shield law? Is this a workaround those? Does it only apply to data of US citizens held outside the US or can the FBI now seize data of non-US citizens, held abroad, without going through local (non-US) authorities? If this is a workaround for EU privacy laws it'll be the final straw for me and I'll be moving my data from Google but it's a complicated area so some clarification would be nice.
- herbst 10y agoI mean it does not surprise me at all. But pretty sure that is theoretically illegal from my POV.