6 ms·

I don't understand how it can possibly be the case that google doesn't have to produce data under a valid court order because, well, they don't feel like it. I

by x0x0 9y ago

I don't understand how it can possibly be the case that google doesn't have to produce data under a valid court order because, well, they don't feel like it. If the data is in google's possession -- which it is -- then google needs to produce it. I understand this is not necessarily great for google's businesses abroad... but it remains ludicrous for a US corp to tell a US court to piss off.

pjc50 9y ago
If it was illegal in the other country to do this, then what?
- x0x0 9y ago
  Too bad? X laws don't actually trump American laws.
  - deleted 9y ago
    [deleted]
pedrocr 9y ago
>but it remains ludicrous for a US corp to tell a US court to piss off. Assume I build a storage box business with headquarters in the US. After a few years of good business I decide to expand and open a subsidiary in Ireland with a local CEO in charge. I now get an order from a US court saying I need to hand over the contents of box #371 that's sitting in Ireland. I consult my lawyers in Ireland who tell me handing over those contents will be a breach of Irish law and very likely to be prosecuted. As the US based CEO do you think I should go to jail or I should send my Irish CEO to jail?
- Eridrus 9y ago
  I do not think this is an accurate analogy, specifically I do not think an Irish CEO would be violating the law, but in any case, most jurisdictions do not care if you have placed yourself between a rock and a hard place legally and will operate as if no other jurisdictions exist; the main question is usually "can the US entity do what is being demanded"
  - kobeya 9y ago
    The Irish company would be violating Irish and/or EU law in this example. This is a reasonable analogy for what is happening in this Google case.
  - yxhuvud 9y ago
    The EU is not most jurisdictions and have put pretty hard rules in place. What you are saying is that you think that it is OK for a lowly judge to force all companies that deal in personal data to choose to either operate in the EU or in the USA. That is clearly not an optimal situation and will clearly have to be resolved, either by one side changing their rules or by a common agreement that voids GDPR for American courts.
    - Eridrus 9y ago
      This is not an optimal solution, which would be a negotiated agreement between the US and EU on how to reconcile the laws, but saying that doing what the court demands would put you in a hard spot of your own making isn't really a defense. On the off chance an agreement is reached with the EU I fully expect that they will allow law enforcement access from both jurisdictions; None of the EU laws restrain law enforcement in this regard. You can try and denigrate the judge all you want, but they have the authority to make these demands, and your only recourse is the supreme court or congress. Laws are a cost of doing business in the US.
- closeparen 9y ago
  Tech company backend systems aren't independently owned/operated/engineered silos like a storage company's subsidiaries. Any notion of data having a geographic home, unless specifically created to address a regulatory requirement, is a performance optimization. In any realistic architecture, there are are a million exceptions to "this Irish user's data is stored in Ireland": offsite backups, cross-datacenter requests within backend systems, offline analytical stores, queries, derived tables, etc. The same engineers who build and operate code for the US would build and operate code for Ireland, and in fact the developer platforms would be designed to hide differences between datacenters as much as possible. If an Irish citizen logs into GMail in the US, they're not going to hit a frontend proxy in Ireland. Their data is going to be processed, and at least cached, by Google servers in the US. Data having a geographical location is an incoherent concept in the context of the architectures of modern multinational tech companies. That much is obvious from simply reading their engineering blogs and whitepapers. It would be a coherent legal standard (and one I favor) to say that an EU citizen's data is subject to EU protections regardless of where it's stored. It would also be coherent (and the one we unfortunately seem headed for) to say that anything an American employee can get over any remote access tool, he's required to hand over in response to a valid court order. But pretending that data has a location is a weird hack, nowhere near as clear cut as your analogy suggests. Can you imagine, arguing in the courtroom over which member of a trans-continental Paxos group was master at the time a warrant was processed?
  - pedrocr 9y ago
    I know the case was a massive simplification on the technical side, that was on purpose. It wasn't a simplification on the jurisdiction side though. Google does have a subsidiary in Ireland and so handing over the EU data does put you in that conundrum as you definitely are subject to Irish law when dealing with the data of Irish users. That you decided to architect your systems so that data is not geographically separate is your own problem.
    - closeparen 9y ago
      To my understanding, neither US nor EU law give a crap about the data's geography. And rightly so, because data doesn't have geography. EU privacy laws apply to all EU citizens, and US warrants apply to all US persons capable of facilitating them. The exception for US-owned databases in European datacenters was a bizarre, short-lived loophole created by case law which maps poorly onto the realities of the situations. I'd say it's the companies which have twisted themselves into knots to take advantage of this loophole, and expected that to be an enduring investment, which are having a problem.
joatmon-snoo 9y ago
Google said it wasn't complying with the order because it was on appeal. Never presume to understand the legal situation in its entirety without being privy to all the facts.
rgbrenner 9y ago
So x0x0... Google China (which is a Chinese company) should hand over your data to the Chinese if they ask.. right? I bet the Russians would like to take a look too. And India, South Africa, Israel, Turkey, ... (Google has a company that operates in each of these, and many others) Why would you want to go down this road?
- Eridrus 9y ago
  Reality allows more complicated trade-offs than we'll let no-one look at any data/we'll let everyone look at as much data as they want. Law enforcement agencies are generally (though not always) interested in domestic matters, so there isn't usually any real conflict here; China primarily wants data on their own citizens; some people take issue with a US company being complicit in Chinese surveillance, but this should not bring US citizens interests being affected by Chinese requests. In practice, it's really not an all or nothing proposition, companies do decide how to respond on a case by case basis, sometimes even pulling out of countries, e.g. Google from China.
  - yxhuvud 9y ago
    But sometimes there will be border cutting concerns. The case in OP is a clear example of this.
  - bonesss 9y ago
    > Reality allows more complicated trade-offs than we'll let no-one look at any data/we'll let everyone look at as much data as they want. We're talking about legal precedent for a country to force a multinational to carry out acts in other countries because of their local laws... If Google can be compelled by the US to violate EU law, the EU can force Google to violate US law. Reality may allow for nuance and shades of grey, but the ability of a legal system to force compliance regardless of local law is a binary proposition. > ...companies do decide how to respond on a case by case basis, sometimes even pulling out of countries, e.g. Google from China. If a company is legally compelled to do something, it is legally compelled. From an investment point of view it is irrelevant that Google might cut some business in China if it were compelled to provide my trade secrets to the Chinese government. It is essential to risk management that my trade secrets never reside somewhere where that legal compulsion might arise with no recourse, due process, or knowledge of the transgression. This is not about companies who host, this is about citizens and companies who have things hosted.

by x0x0 9y ago

pjc50 9y ago

If it was illegal in the other country to do this, then what?

x0x0 9y ago
Too bad? X laws don't actually trump American laws.
- deleted 9y ago
  [deleted]

pedrocr 9y ago

>but it remains ludicrous for a US corp to tell a US court to piss off. Assume I build a storage box business with headquarters in the US. After a few years of good business I decide to expand and open a subsidiary in Ireland with a local CEO in charge. I now get an order from a US court saying I need to hand over the contents of box #371 that's sitting in Ireland. I consult my lawyers in Ireland who tell me handing over those contents will be a breach of Irish law and very likely to be prosecuted. As the US based CEO do you think I should go to jail or I should send my Irish CEO to jail?

Eridrus 9y ago
I do not think this is an accurate analogy, specifically I do not think an Irish CEO would be violating the law, but in any case, most jurisdictions do not care if you have placed yourself between a rock and a hard place legally and will operate as if no other jurisdictions exist; the main question is usually "can the US entity do what is being demanded"
- kobeya 9y ago
  The Irish company would be violating Irish and/or EU law in this example. This is a reasonable analogy for what is happening in this Google case.
- yxhuvud 9y ago
  The EU is not most jurisdictions and have put pretty hard rules in place. What you are saying is that you think that it is OK for a lowly judge to force all companies that deal in personal data to choose to either operate in the EU or in the USA. That is clearly not an optimal situation and will clearly have to be resolved, either by one side changing their rules or by a common agreement that voids GDPR for American courts.
  - Eridrus 9y ago
    This is not an optimal solution, which would be a negotiated agreement between the US and EU on how to reconcile the laws, but saying that doing what the court demands would put you in a hard spot of your own making isn't really a defense. On the off chance an agreement is reached with the EU I fully expect that they will allow law enforcement access from both jurisdictions; None of the EU laws restrain law enforcement in this regard. You can try and denigrate the judge all you want, but they have the authority to make these demands, and your only recourse is the supreme court or congress. Laws are a cost of doing business in the US.
closeparen 9y ago
Tech company backend systems aren't independently owned/operated/engineered silos like a storage company's subsidiaries. Any notion of data having a geographic home, unless specifically created to address a regulatory requirement, is a performance optimization. In any realistic architecture, there are are a million exceptions to "this Irish user's data is stored in Ireland": offsite backups, cross-datacenter requests within backend systems, offline analytical stores, queries, derived tables, etc. The same engineers who build and operate code for the US would build and operate code for Ireland, and in fact the developer platforms would be designed to hide differences between datacenters as much as possible. If an Irish citizen logs into GMail in the US, they're not going to hit a frontend proxy in Ireland. Their data is going to be processed, and at least cached, by Google servers in the US. Data having a geographical location is an incoherent concept in the context of the architectures of modern multinational tech companies. That much is obvious from simply reading their engineering blogs and whitepapers. It would be a coherent legal standard (and one I favor) to say that an EU citizen's data is subject to EU protections regardless of where it's stored. It would also be coherent (and the one we unfortunately seem headed for) to say that anything an American employee can get over any remote access tool, he's required to hand over in response to a valid court order. But pretending that data has a location is a weird hack, nowhere near as clear cut as your analogy suggests. Can you imagine, arguing in the courtroom over which member of a trans-continental Paxos group was master at the time a warrant was processed?
- pedrocr 9y ago
  I know the case was a massive simplification on the technical side, that was on purpose. It wasn't a simplification on the jurisdiction side though. Google does have a subsidiary in Ireland and so handing over the EU data does put you in that conundrum as you definitely are subject to Irish law when dealing with the data of Irish users. That you decided to architect your systems so that data is not geographically separate is your own problem.
  - closeparen 9y ago
    To my understanding, neither US nor EU law give a crap about the data's geography. And rightly so, because data doesn't have geography. EU privacy laws apply to all EU citizens, and US warrants apply to all US persons capable of facilitating them. The exception for US-owned databases in European datacenters was a bizarre, short-lived loophole created by case law which maps poorly onto the realities of the situations. I'd say it's the companies which have twisted themselves into knots to take advantage of this loophole, and expected that to be an enduring investment, which are having a problem.

joatmon-snoo 9y ago

Google said it wasn't complying with the order because it was on appeal. Never presume to understand the legal situation in its entirety without being privy to all the facts.

rgbrenner 9y ago

So x0x0... Google China (which is a Chinese company) should hand over your data to the Chinese if they ask.. right? I bet the Russians would like to take a look too. And India, South Africa, Israel, Turkey, ... (Google has a company that operates in each of these, and many others) Why would you want to go down this road?

Eridrus 9y ago
Reality allows more complicated trade-offs than we'll let no-one look at any data/we'll let everyone look at as much data as they want. Law enforcement agencies are generally (though not always) interested in domestic matters, so there isn't usually any real conflict here; China primarily wants data on their own citizens; some people take issue with a US company being complicit in Chinese surveillance, but this should not bring US citizens interests being affected by Chinese requests. In practice, it's really not an all or nothing proposition, companies do decide how to respond on a case by case basis, sometimes even pulling out of countries, e.g. Google from China.
- yxhuvud 9y ago
  But sometimes there will be border cutting concerns. The case in OP is a clear example of this.
- bonesss 9y ago
  > Reality allows more complicated trade-offs than we'll let no-one look at any data/we'll let everyone look at as much data as they want. We're talking about legal precedent for a country to force a multinational to carry out acts in other countries because of their local laws... If Google can be compelled by the US to violate EU law, the EU can force Google to violate US law. Reality may allow for nuance and shades of grey, but the ability of a legal system to force compliance regardless of local law is a binary proposition. > ...companies do decide how to respond on a case by case basis, sometimes even pulling out of countries, e.g. Google from China. If a company is legally compelled to do something, it is legally compelled. From an investment point of view it is irrelevant that Google might cut some business in China if it were compelled to provide my trade secrets to the Chinese government. It is essential to risk management that my trade secrets never reside somewhere where that legal compulsion might arise with no recourse, due process, or knowledge of the transgression. This is not about companies who host, this is about citizens and companies who have things hosted.