10 ms·
Court rules search warrant applies to US emails stored on foreign servers
- gettingreadyhn 10y agothese articles push me more and more to drop using gmail in favor of "self hosted email". i really do not understand why we do not think and give it all up for free to google (and compromise our personal security in the mean time).
- Navarr 10y agoI think Google fought very hard for it's case. "Self Hosted" is certainly not going to fare much easier in this same situation. I do not think that the same result would be had if Google was refusing to deliver data on a non-US server for a non-US citizen.
- solotronics 10y agoI think that in this specific case Google was able to push back much harder than a typical individual would. Who can afford a team of world class lawyers to go up against the fed?
- SEJeff 10y agoAnd they can still appeal potentially up to SCOTUS.
- Spivak 10y agoSelf-hosted would absolutely fare better in this situation. It's not perfect, but at least you would know you're being investigated. This whole mess is predicated on the fact the government is allowed to request your data from Google without much fanfare because they are technically in possession of it. The DOJ was able to successfully argue that user emails are actually business documents owned by the email provider. This breaks down when the person they are investigating is also the email provider.
- Navarr 10y agoYou'd have to own the server too, at that point. If you were a VPS or even a dedicated lease, or shared - I think the fed would be able to pull the same thing.
- donald123 10y agoDoesn't matter if you encrypt your emails, since you have control of your server. Let the fed have the encrypted data.
- deleted 10y ago[deleted]
- fixermark 10y ago... at which point you might get to rot in jail for contempt until you fork over the decryption key. I don't have a convenient link to the xkcd comic right now that talks about the difference between theoretical and practical security. ;)
- Roujo 10y agoTo quote Spivak higher up in the comment chain: > It's not perfect, but at least you would know you're being investigated.
- donald123 10y agoAm I gonna be jailed for refusing to decrypt my files?
- fixermark 10y agoIANAL, but my understanding of current American law is that if the material is deemed by a judge to be evidence, and you can decrypt it, and you won't decrypt it, you can be held in contempt of court.
- stuckagain 10y agoIf the feds want your "self hosted" emails they will break down your door, shoot your dog, and take every computer-resembling object on the premises.
- wyager 10y agoIt's a lot more effort than just asking google. The goal behind practical security is to make things expensive, not impossible.
- derefr 10y agoYou could "self-host" on a cloud server in, say, China, or Russia, or Iran (if they have any hosting services.) I mean, the governments of those places will probably snoop your emails, but if their contents have nothing to do with them, they won't care. And they have no treaties with the US to force their hand to turn anything over. Think of your server as Edward Snowden. What country should it hide in, so the US can't legally get to it?
- confounded 10y agoIceland.
- st3v3r 10y ago"I mean, the governments of those places will probably snoop your emails, but if their contents have nothing to do with them, they won't care." Can't you say the exact same thing about the US government?
- usernametbd 10y ago> they have no treaties with the US to force their hand to turn anything over Sure, but that doesn't mean they won't happily exchange that info as part of a deal with the US, assuming your data is valuable enough.
- sfifs 10y agoYou're forgetting the possibility of rubber hose cryptanalysis applied on you. In fact just by hosting in such places, you're probably inviting more attention.
- derefr 10y ago* Gmail's search and spam-filtering are both very good, trained and tuned on datasets no self-hosted product could ever match (and harnessing parallel algorithms across large clusters that'd be quite costly on one machine) * Google doesn't lose my email; I probably will lose my email, because an email server is backed by a database and doing database backups right is hard if that is not your day-job. * You can get a good email-receiving experience, but email-sending is very difficult these days if you're a nobody, because a lot of first-stage network-level spam filtering has come down to reputation, and your server IP won't have any (or, if it's a cloud provider IP, will have very likely been used at least once to send spam in the past.) And residential ranges get dinged, too, from the heuristic (stereotype) that the most likely reason to get an SMTP connection from a residential IP is that it's a member of a botnet.
- SomeCallMeTim 10y ago> Google doesn't lose my email; I probably will lose my email, because an email server is backed by a database and doing database backups right is hard if that is not your day-job. I use IMAP email. My email is simultaneously stored on my server and on every client. If the server is nuked, I can set up a new IMAP server elsewhere and sync my email client to it; I'd want to do this from work where I have gigabit internet, or this would take a while, but it can re-upload all the data to the server. That said, I'm using a managed account. I'm not communicating about anything that I care if the government subpoenas, and I have no plans to. Unless we end up in a totalitarian state where constructive criticism of the government becomes an offense. But in that case my public posts would be more than enough to convict me without looking at my emails.
- djsumdog 10y ago> Gmail's search and spam-filtering are both very good Google/Microsoft's spam filtering makes it impossible to send e-mail from a self-hosted solution. http://penguindreams.org/blog/how-google-and-microsoft-made-email-unreliable/ http://penguindreams.org/blog/how-google-and-microsoft-made-... Unless you're sending out thousands of e-mails per day and build your reputation with their magic-goo trust filter algorithm, you cannot run your own e-mail server and run with the big players. They have made self-hosted e-mail totally unreliable. I think what you meant by "very good" is "piss fucking terrible."
- uladzislau 10y agoEspecially when Gmail is not as reliable as we used to think. Gmail DOES loose emails. http://uladzislau.com/gmail-emails-missing/ http://uladzislau.com/gmail-emails-missing/
- pklausler 10y ago> Gmail DOES loose emails. Sounds like a tagline for an erotic movie, that does. I think you meant "lose".
- frogpelt 10y agoTo be fair, English is difficult. Lose could rhyme with rose or close. But it doesn't. Instead it rhymes with cruise, clues, two's, moos, and choose (almost).
- stuckagain 10y agoLunatic conspiracy theories about what Google does with email abound. There are several likely and reasonable explanations for why you can't find the mails you expect. Two of the most likely being 1) the messages were never acknowledged with a 220 response from gmail's smtp protocol translators to begin with; 2) the messages were accepted but are still in flight for some reason. Gmail does not accept and then silently drop messages. If they are accepted, they will be delivered.
- wyager 10y agoI recently switched from gmail to ProtonMail. Not self-hosted, but (theoretically) encrypted while at rest using a GPG key derived from my password. Definitely an improvement. If you really want SMTP, as I understand it they have an "SMTP bridge" software that you host yourself that uses ProtonMail as a backend. Seems like a good compromise. You don't have to worry about constant uptime or disk failure, but your data is still fairly well protected.
- megous 10y agoYou probably don't need constant uptime. Sending server will try to deliver for a day or two, usually. Legitimate servers use sending queues.
- deleted 10y ago[deleted]
- mschuster91 10y agoSo what MS, Apple and Google need to do is basically to set up a "hosting provider" company in a country with strong data protection laws (Switzerland? Iceland?) and delegate all their hosting operations to this company... that could work to really prevent this sort of espionage via court, imho.
- skrause 10y agoMicrosoft is already doing that: https://azure.microsoft.com/en-us/overview/clouds/germany/ https://azure.microsoft.com/en-us/overview/clouds/germany/ They're using T-Systems (a subsidiary of Deutsche Telekom) as a trustee. It's about 25% more expensive than the normal Azure.
- mschuster91 10y agoPersonal opinion on the quote from the Azure page... they quote T-Systems as "well-respected IT provider". Anyone who had ever to do business with them will respectfully disagree on this one. They were involved in Toll Collect and supplied the software and hardware infrastructure for Munich schools. The scandals surrounding Toll Collect speak for themselves, and a couple of years back when I still was at school I had enough fun hacking their cr.p to pieces to never ever trust anything with T-Systems involved. My personal favorite was "www-data ALL=NOPASSWD: ALL" in /etc/sudoers, and students were allowed to upload PHP scripts to their personal web space. You can guess what my entrypoint was, and I believe it wasn't fixed despite multiple warnings for over eight years (the reason was that they employed a PHP-written framework whose name I've long since forgotten, it was well known at the time and was a bit similar to Webmin...) That said, the Azure Cloud seems to be quite stable, but I guess that all operating experience as well as the software stack comes from MS and T-Systems only has to keep the servers up and running.
- AJ007 10y agoMy guess is more along the lines of subsidiaries or licensees being set up within the political boundaries in which their users exist. That means some users will have to receive lower quality or higher priced service depending on local infrastructure.
- bheesham 10y agoInstead of self-hosting your email, why not just delete them after you're done reading them?
- dagenleg 10y agoBut if you never hosted them in the first place, how can you be sure they are deleted?
- Spivak 10y agoThere is no reason a warrant couldn't request a search of the backups.
- wyager 10y agoAs I recall, google is required to keep certain records of emails for years (someone please correct me if I'm wrong here, this came up in conversation with some people working on gmail so I may mis-remember). So even if you delete your email, it might be sitting in a tape archive somewhere until google can (legally) get rid of it.
- Spooky23 10y agoThat means you're under active investigation and there's already a subpoena or warrant in place. If you don't want somebody reading your steamy emails or social media postings in the future, you have options... don't create them, delete, or store on physical media in your home.
- wyager 10y agoThis sounds awfully close to "don't worry if you have nothing to hide". How about this; I'll create whatever steamy emails I feel like, and I'll use services that preserve my privacy while I do it.
- Spooky23 10y agoNo, it is more "manage risk". If you are a cop, teacher, etc where your employer will demand to inspect your social media, you need to act appropriately. If you are generally concerned about privacy -- US Mail.
- lostinthought2 10y agoTodays' reality: !g sovereignty - HTTP 404
- JBReefer 10y agoThis seems reasonable, they have a warrant and the judge seems to have considered the case fully. I don't get why so many people are advocating a world where the government can't do this. Why should your email hosting provider have the ability to make law enforcement decisions? Why should email be treated differently from something like my bank account or diary? This seems like the optimal outcome.
- deleted 10y ago[deleted]
- Spooky23 10y agoThere's a lot of libertarian fantasyland stuff in tech forums. In reality, there's a built in tension between what a prosecutor or regulator wants and the interest of the individual. 200 years of law in the US was built around your "papers", mostly held in your home or on your person. Now you have this new world where your "papers" may be a detailed diary of every place you've been for most of your life. My wife's phone has immediate access to 60,000 pictures with date and geo-stamps dating back to 2003. Oh, and by the way the storage of this stuff may be on a phone or computer in your possession, or in the hands of a 3rd party like iCloud, Google, etc. The law is behind in it's understanding, and the various authorities want to have the ability to have total information awareness.
- deleted 10y ago[deleted]
- JoshTriplett 10y agoIt's a question of jurisdiction. A company with subsidiaries in multiple countries necessarily needs to ensure that the subsidiary in a country complies with all the laws of that country. However, that doesn't mean that, for instance, it should be possible to serve a warrant in one country to obtain data controlled by a subsidiary in another. It's entirely possible to compartmentalize hosting and authorized access, such that one subsidiary has no access to the data stored by another. That's critical if, for instance, you need to meet regulatory requirements such as the "data protection" laws in the EU. Rulings like this one, if not successfully appealed, will make it nearly impossible for any company with subsidiaries in multiple countries to meet such regulatory requirements.
- mjrider 10y agotl;dr: Gmail(USA) required to provide data of persons in the USA, of communications between people in the USA orded by a USA judge. Sounds fine with me, even when Google has it hosted in some other country, this seems to me a fine example of correct usage of the law and jurisdiction
- simplicio 10y agoYea, it seems like if they found the other way, every sizable corporation, or really any sizable group, would host all their data in the Cayman Islandsor wherever, making them more or less immune from US subpoenas. Which would be bad for any attempt to hold them legally accountable (and, relevant to the HN crowd, bad for Tech workers in the US as storage providers move their facilities over-seas).
- Sir_Substance 10y ago>bad for Tech workers in the US as storage providers move their facilities over-seas Great for the rest of the world's rights though!
- kevindqc 10y agoWhy are they even storing this USA data outside of the USA? Seems weird to me, no?
- taormina 10y agoI'd bet its cheaper.
- officelineback 10y agoCan someone explain why Microsoft doesn't have to but Google does?
- matmo 10y agoI think I read briefly somewhere that Microsoft already stores foreign emails in foreign data-centers in order to comply with foreign laws better since they target enterprise customers that have those types of absolute requirements. I guess Google might be having their foreign emails pass through US servers at some point? I'm sure someone else has more detailed/informed answer.
- stuckagain 10y agoThis decision is basically saying that the Microsoft decision was wrong, setting up the possibility of resolution by the Supreme Court.
- officelineback 10y agoSo two different Districts, basically?
- ocdtrekkie 10y agoThis article seems to include the explanation: https://www.techdirt.com/articles/20170204/06524836631/pennsylvania-court-shrugs-off-microsoft-decision-says-google-must-turn-over-emails-stored-overseas-data-centers.shtml https://www.techdirt.com/articles/20170204/06524836631/penns... Essentially, Google doesn't claim to be able to definitively segregate what is or isn't in the US at any given time. Including the possibility that the location differs between when the request is made and when the retrieval is done.
- fankhawk 10y agoAsk any divorce attorney what happens if you refuse to turn over assets in a foreign account. The judge may not have jurisdiction over property in another country, but she does have the power to toss you in jail for contempt.
- ommunist 10y agoHmm, time to move to Fastmail completely.
- doodlebugging 10y agoI wonder if it would be legal/practical for the email hosting company, Google in this case, to provide the data satisfying the subpoena in the form of a word cloud. Once the law enforcement party has that information in hand they can search the word cloud for interesting words and potential phrases and make a secondary request for the email provider to surrender all occurrences of the suspicious words and phrases in order to establish the context of their use in the subpoenaed communications. This would provide an enhanced degree of privacy to the user since there would not be a bulk surrender of every conversation they've had during the time period covered by the subpoena. I have a hard time seeing why it is important for the government to grab everything when their target is well known to them and the medium they are searching is likely to be text-based and therefore all targeted communications are easily separable at the email provider end.
- dmix 10y agoThis didn't work for lavabit who tried to print out the requested data on paper and it won't work for Google.
- nemoniac 10y agoAs an EU citizen, I wonder how this conflicts with EU legislation. As I understand it, if Google holds data in the EU, then EU law says that they may not move the data outside the EU without the data owner's permission. Now the USA insists that Google move data from (among other places) the EU to the USA based on a USA warrant. This could make gmail pretty much a non-starter for many uses in the EU and may possibly even make it problematic for some email users to correspond with a gmail address.
- aanm1988 10y ago> Each account holder resides in the United States, the crimes they are suspected of committing occurred solely in the United States, and the electronic data at issue was exchanged between persons located in the United States. I don't feel like this is a bad call. Wasn't there a judgement recently that non-US residents can't have their stuff searched just based on a US warrant?
- mdekkers 10y agoWasn't there a judgement recently that non-US residents can't have their stuff searched just based on a US warrant? Ha! Somebody forgot to tell the Kim Dotcom cops!
- neom 10y agoI'm pretty sure it's all covered in here: https://www.state.gov/documents/organization/180815.pdf https://www.state.gov/documents/organization/180815.pdf
- shubb 10y agoI wonder how it will effect other vendors - ms is hosting email and storage for lots of UK.gov and health stuff, also amazon.
- filoleg 10y agoI don't know about amazon, but MSFT seems to have this issue covered with a completely separate non-public Azure Germany region. https://azure.microsoft.com/en-us/overview/clouds/germany/ https://azure.microsoft.com/en-us/overview/clouds/germany/
- dmix 10y agoPersonally, while it's sad this didn't work from a privacy perspective we really shouldn't be betting such important moral concepts such as privacy on minor legal technicalities. That's a losing battle even before you start. As long as the warrant is specific and limited I also don't really see this as a problem. The bigger and real fight is with NSLs and FISA courts.