4 ms·

A judge "can simply simply a request compelling the company to turn over evidence" in what jurisdiction? My understanding of the majority of warrants are that

by ethbro 9y ago

A judge "can simply simply a request compelling the company to turn over evidence" in what jurisdiction? My understanding of the majority of warrants are that they have a nebulous grasp on transnational corporations. For example: if I (the police) have a French warrant and serve it on the Paris offices of Uber, but Uber has a pager service that performs whole disk encryption and sends the keys to a server in Panama, where does that leave me? The French government isn't going to raise a diplomatic ruckus over a taxi company operating illegally in Paris. And I'd strongly suspect a judge wouldn't be inclined to allow me to forceably repatriate the data (which data?) without further evidence (exactly why I was serving the warrant!). So essentially, I don't see it as being technologically hard to construct a system where I am enabled to operate illegally in a country, as a matter of corporately-sanctioned policy, while skirting around local technical ability and federal legal will to call me to account.

DanBC 9y ago
The warrant is to "make the data available". You can try saying "lol, the data is in Panama", but the judge is unlikely to care about that.
Consultant32452 9y ago
>For example: if I (the police) have a French warrant and serve it on the Paris offices of Uber, but Uber has a pager service that performs whole disk encryption and sends the keys to a server in Panama, where does that leave me? The court will simply order you to cease all business functions in France until the data is provided to the court.
- ethbro 9y ago
  It's not that simple. I am not a lawyer, but... At least for US law, there are split decisions. US v Microsoft (the Ireland case) [1] is currently pending a Supreme Court ruling. I'd hazard to say that I'd be surprised if they didn't rule in favor of national security concerns, except that Jesner v. Arab Bank [2] is coincidentally also pending. Given that the latter concerns the Alien Tort Statute [3], aka the ability of US law to be applied internationally, it will be an interesting pair of decisions. I'm not familiar with how things work in France (other than rough knowledge of EU data privacy directives), but at least in the US things aren't as simple as "what the legal system wants via warrant, the legal system gets." [1] https://en.m.wikipedia.org/wiki/Microsoft_Corp._v._United_States https://en.m.wikipedia.org/wiki/Microsoft_Corp._v._United_St... [2] https://www.oyez.org/cases/2017/16-499 https://www.oyez.org/cases/2017/16-499 [3] Subject of a fascinating episode of More Perfect, https://www.wnyc.org/story/enemy-of-mankind/ https://www.wnyc.org/story/enemy-of-mankind/
  - Consultant32452 9y ago
    For the Ireland case we're talking about data about a third party criminal whose data happens to be stored by MSFT exclusively in another country. That's not the case here with Uber. Uber itself, a Canadian company subject to Canadian law, is being compelled to provide data relevant to its own business within Canada. I would be very surprised if Canada allowed businesses to not provide relevant financial information to the tax man.
    - ethbro 9y ago
      Relevant known financial information, sure. But that's a small, well-defined subset of Uber's corporate footprint. What if the warrant was looking for memos on illegally circumventing local parking laws? Memos that may or may not exist? If Uber hosts that Canadian-focused data on servers outside of Canadian jurisdiction, good luck getting ahold of it unless the government's willing to play the "We'll bankrupt you unless you give us something" card. And my point is that kind of international leverage isn't available to, say, a suburb outside of Toledo. Which effectively means a company willing to play hardball with encryption (at great legal risk if they slip up) can have their cake (illegal corporate policies) and eat it too (not be held liable for illegal policies).
      - deleted 9y ago
        [deleted]

by ethbro 9y ago

DanBC 9y ago

The warrant is to "make the data available". You can try saying "lol, the data is in Panama", but the judge is unlikely to care about that.

Consultant32452 9y ago

>For example: if I (the police) have a French warrant and serve it on the Paris offices of Uber, but Uber has a pager service that performs whole disk encryption and sends the keys to a server in Panama, where does that leave me? The court will simply order you to cease all business functions in France until the data is provided to the court.

ethbro 9y ago
It's not that simple. I am not a lawyer, but... At least for US law, there are split decisions. US v Microsoft (the Ireland case) [1] is currently pending a Supreme Court ruling. I'd hazard to say that I'd be surprised if they didn't rule in favor of national security concerns, except that Jesner v. Arab Bank [2] is coincidentally also pending. Given that the latter concerns the Alien Tort Statute [3], aka the ability of US law to be applied internationally, it will be an interesting pair of decisions. I'm not familiar with how things work in France (other than rough knowledge of EU data privacy directives), but at least in the US things aren't as simple as "what the legal system wants via warrant, the legal system gets." [1] https://en.m.wikipedia.org/wiki/Microsoft_Corp._v._United_States https://en.m.wikipedia.org/wiki/Microsoft_Corp._v._United_St... [2] https://www.oyez.org/cases/2017/16-499 https://www.oyez.org/cases/2017/16-499 [3] Subject of a fascinating episode of More Perfect, https://www.wnyc.org/story/enemy-of-mankind/ https://www.wnyc.org/story/enemy-of-mankind/
- Consultant32452 9y ago
  For the Ireland case we're talking about data about a third party criminal whose data happens to be stored by MSFT exclusively in another country. That's not the case here with Uber. Uber itself, a Canadian company subject to Canadian law, is being compelled to provide data relevant to its own business within Canada. I would be very surprised if Canada allowed businesses to not provide relevant financial information to the tax man.
  - ethbro 9y ago
    Relevant known financial information, sure. But that's a small, well-defined subset of Uber's corporate footprint. What if the warrant was looking for memos on illegally circumventing local parking laws? Memos that may or may not exist? If Uber hosts that Canadian-focused data on servers outside of Canadian jurisdiction, good luck getting ahold of it unless the government's willing to play the "We'll bankrupt you unless you give us something" card. And my point is that kind of international leverage isn't available to, say, a suburb outside of Toledo. Which effectively means a company willing to play hardball with encryption (at great legal risk if they slip up) can have their cake (illegal corporate policies) and eat it too (not be held liable for illegal policies).
    - deleted 9y ago
      [deleted]