6 ms·

U.S. judge rules search warrants extend to overseas email accounts

64 points by nmjenkins 12y ago

mkempe 12y ago
Overall the US government acts as if other countries are not really sovereign entities, because software is eating the world. Hence the US is entitled to listen to everything non-US people say, read everything non-US people write, search data not stored on US soil, monitor non-US financial transactions, etc. All without having to respect any law of any other country. The EU data protection bans storage of data about EU citizens outside the EU. Eventually the ban may have to include storage of data by US companies, even if in the EU. This is going to end badly for American Internet companies. It's not just the NSA scandals. Americans need to realize that people outside the US have options, and at some point it will become a major handicap to be a US business -- seen as a conduit for US government power and spying. I don't see how the US could or will step back from these abuses of power.
- whatevsbro 12y ago
  > Hence the US is entitled to listen to everything non-US people say, read everything non-US people write, search data not stored on US soil, monitor non-US financial transactions, etc. All without having to respect any law of any other country. I hope you realize that the US most definitely does all of that inside the US too! The NSA's pretending to only target "Outsiders" only serves to make the all-encompassing surveillance more abstract, and thus somewhat more palatable to the local masses.
  - mkempe 12y ago
    Yes, but my point is that non-Americans have and will increasingly choose options that US residents don't have.
    - whatevsbro 12y ago
      You can rest assured that all governments monitor their citizens to the best of their abilities.
- mkempe 12y ago
  For context, the US population is currently less than 5% of the world. A danger for US companies is that their business will be cut off from 95% of markets, because of US government policies.
  - pavanred 12y ago
    Well, not really true. In fairness though the US population is less than 5% of the world, they amount to lot more than 5% of the market. The distinction is between the population and number of customers of internet/software based services/products.
    - mkempe 12y ago
      As of 2012, US Internet users represented about 10% of world-wide Internet users. [1] Internet usage is far from being an exclusively American thing. Given recent trends, US users will within a decade represent 5% of world-wide users, with relatively more expensive and narrower bandwidth at their disposal. [1] http://en.wikipedia.org/wiki/List_of_countries_by_number_of_Internet_users http://en.wikipedia.org/wiki/List_of_countries_by_number_of_...
  - lettergram 12y ago
    That's population not wealth, trust me I am sure most US businesses (technology based ones) currently don't have a strong foot hold in China. Which by your calculations make up ~15% of the world markets. If we however look by wealth and assume our allies are alright with our methods (given it also helps them spy on their citizens it's a fair assumption) we aren't risking that much, considering the countries we aren't in are the only ones who would oppose this. I'm not saying that it's good practice to do what the U.S. did and I am appalled. However, they will not lose 95% of the markets, at least not now. There is currently no country with the capacity to generate as many new ideas into businesses, and the U.S. is roughly 25% of the worlds entire economy. Hell, just California is the worlds 7th largest economy. Further, you don't think the other large nations (by economy), such as Japan, China, India, Russia, the U.K. are not doing/going to do the same thing (I omitted Germany and France since they seem to not wire tap.. Not necessarily true). Business wouldn't and wont be cut 95%, I am pretty sure most countries are grateful the U.S. is setting precedent and will request them to issue warrants on their citizens.
- rmthompson 12y ago
  They aren't, sovereignty is only a concept when each nation is capable of independence through economic, resource, and most importantly military. Since America spends more money on military than the next 9 largest spenders combined, America doesn't have to respect sovereignty. America's goal is to feed it's consumption, and ensure that nothing threatens the way of life for the wealthy at the cost of other nations. It frustrates me to no end because although I really hate this as a concept and practice, I really enjoy being given the opportunities that that this enables.
  - naterator 12y ago
    Yea, that's great and all but what happens when China and it's 1.4 billion people get their stuff together? It's astounding that it seems that few in the US government seem to acknowledge that we may not be on top always, and what goes around comes around. There will be real future costs for our moral corruptness.
    - w1ntermute 12y ago
      Regardless of what the US does now, China will do later what the US is doing now. So the US might as well do the same thing now.
    - Retric 12y ago
      China has a several thousand year history of not getting it's shit together so it might never happen.
      - rakoo 12y ago
        China is millenias old and has mostly kept their shit to themselves. That's an example everyone else should follow
        deleted 12y ago
        [deleted]
        Retric 12y ago
- thyroxo 12y ago
  Do other countries not get affected? What about India, the UK, and China? Many other countries have even more intrusive domestic spying programs.
  - Wilya 12y ago
    Looking at it from a B2B perspective, I can think of a lot of business situations where my own country spying on the data I store is acceptable, while any other country spying on it is not. Any sort of work with your local aerospace/nuclear/etc program falls into this case. Or any sort of work with a biggish company with ties to the power, really. It's fascinating to see how some people seem to find silly the idea that their domestic government could be on their side.
- javajosh 12y ago
  >This is going to end badly for American Internet companies. Agreed. Of course, it's going to end badly for Americans in general. The "undue burden on the government" reasoning has been used to weaken almost every right that we have. Police don't have to announce themselves before entering, or even have a warrant (if they get one later), because these things would constitute an "undue burden". It is a very strange loophole that the government uses, again and again, to break the law. My rights are worthless if they inconvenience a police officer. And in this case, a companies rights are worthless if they inconvenience law-enforcement. I think it's time we hang up the "undue burden" loophole once and for all. The constraints on behavior our laws represent should not be conditional on convenience, particularly not on the convenience of law-enforcement.
  - joesmo 12y ago
    I couldn't agree more. What an incredibly lame excuse. The problem with such wording as "undue burden," "probable cause," "reasonable suspicion," etc. is that the phrases themselves are so broad and ambiguous, they can and do end up being meaningless when interpreted in court. It's clear that the original intent of the authors is irrelevant when interpreting such phrases as is any semblance of reasoning or logic. The only thing left is the warring parties intentions and their rationalizations for intentional misinterpretation. What's wrong with undue burden on police and government? The constitution itself provides for many such burdens specifically to prevent an overzealous government from overstepping its power. The courts can and have applied such arguments to specific portions of the constitution, generally with great success. What gives law enforcement the right to be free of undue burden anyway?
higherpurpose 12y ago
This will embolden countries like Germany and Brazil even more to force Google and Microsoft to create local subsidiaries/different companies there and hold their citizens data only in those datacenters and with that specific company. And I don't blame them. As a response to this, and to avoid that, Google and Microsoft should be adopting end-to-end encryption in their services as soon as possible, because it's the only way they can now say with a straight face that EU citizen data is "safe" with them. Otherwise (hopefully) people will be using less and less American services over the next few years. Europeans (and others) can't and shouldn't feel safe with their data used by American companies now.
- arethuza 12y ago
  They presumably already have wholly owned subsidiaries in each country where they have any presence - the US government can then presumably say to the parent company in the US "tell your subsidiary in <country> to give us their data" and what can they do?
  - deleted 12y ago
    [deleted]
  - tomp 12y ago
    They would respond "We ordered the CEO of the local subsidiary to give us the data, and he refused, because that would be illegal in the country the subsidiary is based in. We then fired the CEO, now he's suing the subsidiary and we had to close it down. We made $50M loss this year because of the lawsuit. Thank you, honourable judge."
  - wmf 12y ago
    One wonders if having the parent company in, say, Switzerland would be better.
- bjelkeman-again 12y ago
  It is not enough that they are local subsidiaries. Microsoft said this already in 2011. A subsidiary on foreign soil, under foreign law is required by the patriot act to produce the data that a US authority is demanding, even if it breaks the law in the country it is in. http://www.zdnet.com/blog/igeneration/microsoft-admits-patriot-act-can-access-eu-based-cloud-data/11225 http://www.zdnet.com/blog/igeneration/microsoft-admits-patri...
brudgers 12y ago
the burden on the government would be substantial That was the idea embodied in the Bill of Rights.
kijin 12y ago
> "A U.S. prosecutor cannot obtain a U.S. warrant to search someone's home located in another country, just as another country's prosecutor cannot obtain a court order in her home country to conduct a search in the United States," the company said. Sure, the U.S. government cannot send agents to search Irish homes owned by U.S. citizens, but it can damn well order the citizen in question to retrieve and present a certain document that is known to be stored in the basement of that home, and threaten to hold him in contempt if he fails to have it shipped stateside within a few weeks. So according to Microsoft's own analogy, there's nothing surprising about this decision. What I'd really like to know is what happens if it is illegal in the country where the server is located for Microsoft to disclose the server's contents to the U.S. government. I don't know much about EU privacy laws, but surely some countries take issue with the personal information of their own citizens being shipped abroad? Could U.S. corporations (and/or their EU subsidiaries, if any) argue that it would be illegal for them to obey this U.S. judgment?
- mariuolo 12y ago
  > Sure, the U.S. government cannot send agents to search Irish homes owned by U.S. citizens, but it can damn well order the citizen in question to retrieve and present a certain document that is known to be stored in the basement of that home, and threaten to hold him in contempt if he fails to have it shipped stateside within a few weeks. Even when the document in question doesn't belong to said citizen? Can a US court compel you to commit theft abroad?
  - jellicle 12y ago
    U.S. courts (and all courts everywhere) can compel you to produce any document or item under your control, whether or not you actually "own" it. Your cousin Bob gave you a sealed letter to hold for him and the court says you have to hand it over? You must. And calling it "theft" is an attempt to prejudice the discussion. Theft is taking without due process of law. By definition, taking at the command of a court is with due process of law.
    - pedrocr 12y ago
deleted 12y ago
[deleted]
whoismua 12y ago
Devil's advocate: what if MS, Google et al had all the US persons' email and files stored in Canada or Germany...on purpose? You type your email in Washington DC and then it is stored in a server somewhere in Germany. No can do says Microsoft.
- tzs 12y ago
  Along similar lines, suppose you are GM, and you have known for over a decade that faulty ignition switches on your cars have been killing people, yet you have not applied the cheap fix for the problem, and that this is at least grossly negligent and possibly criminal. Can you just ship all the incriminating physical documents to a GM branch in another country so that US prosecutors and US plaintiff attorneys and US regulators cannot get them? It would be one hell of a loophole if a person or company in country X could put documents (electronic or physical) that they fully control completely out of the reach of prosecutors, plaintiffs, and regulators in country X simply by storing those documents in country Y but still fully in their control and easily in reach when it serves their interests to access them.
  - err4nt 12y ago
    Does that work with physical papers and reports? Moving them physically to a different country?
    - wmf 12y ago
      From the article: "Longstanding U.S. law holds that the recipient of a subpoena must provide the information sought, no matter where it is held, he said."
john-n 12y ago
What happens if/when another country (China? India?) introduces a similar law, requiring a company that operates there to make data on u.s citizens available even if its stored outside of the country. Will these companies stop operating in these markets?
Havoc 12y ago
EU based internet services are looking better and better each day - especially the German ones.
- mjn 12y ago
  My guess is that this worry is why Microsoft's opposing the order. The university I work at in Denmark uses Office 365 specifically because Microsoft was able to convince them that data will only be stored in the EU, and will only be accessed in accordance with EU data-protection law. If Microsoft can't credibly maintain that claim, European companies and universities may not be able to use their cloud services.
rurban 12y ago
Looks like doing business with US companies is now in severe trouble as the US does not care to obey foreign privacy laws. At least it's official now.
jackgavigan 12y ago
The EU has a track record of defying US extraterritoriality so I would be surprised if the data gets handed over. Also, this ruling was made by a magistrate judge, which is prett low down on the judicial totem pole. This ruling will be appealed, which means that it'll be reviewed by a judge who doesn't, in fact, have his head up his ass.

64 points by nmjenkins 12y ago

Overall the US government acts as if other countries are not really sovereign entities, because software is eating the world. Hence the US is entitled to listen to everything non-US people say, read everything non-US people write, search data not stored on US soil, monitor non-US financial transactions, etc. All without having to respect any law of any other country. The EU data protection bans storage of data about EU citizens outside the EU. Eventually the ban may have to include storage of data by US companies, even if in the EU. This is going to end badly for American Internet companies. It's not just the NSA scandals. Americans need to realize that people outside the US have options, and at some point it will become a major handicap to be a US business -- seen as a conduit for US government power and spying. I don't see how the US could or will step back from these abuses of power.

whatevsbro 12y ago
> Hence the US is entitled to listen to everything non-US people say, read everything non-US people write, search data not stored on US soil, monitor non-US financial transactions, etc. All without having to respect any law of any other country. I hope you realize that the US most definitely does all of that inside the US too! The NSA's pretending to only target "Outsiders" only serves to make the all-encompassing surveillance more abstract, and thus somewhat more palatable to the local masses.
- mkempe 12y ago
  Yes, but my point is that non-Americans have and will increasingly choose options that US residents don't have.
  - whatevsbro 12y ago
    You can rest assured that all governments monitor their citizens to the best of their abilities.
mkempe 12y ago
For context, the US population is currently less than 5% of the world. A danger for US companies is that their business will be cut off from 95% of markets, because of US government policies.
- pavanred 12y ago
  Well, not really true. In fairness though the US population is less than 5% of the world, they amount to lot more than 5% of the market. The distinction is between the population and number of customers of internet/software based services/products.
  - mkempe 12y ago
    As of 2012, US Internet users represented about 10% of world-wide Internet users. [1] Internet usage is far from being an exclusively American thing. Given recent trends, US users will within a decade represent 5% of world-wide users, with relatively more expensive and narrower bandwidth at their disposal. [1] http://en.wikipedia.org/wiki/List_of_countries_by_number_of_Internet_users http://en.wikipedia.org/wiki/List_of_countries_by_number_of_...
- lettergram 12y ago
  That's population not wealth, trust me I am sure most US businesses (technology based ones) currently don't have a strong foot hold in China. Which by your calculations make up ~15% of the world markets. If we however look by wealth and assume our allies are alright with our methods (given it also helps them spy on their citizens it's a fair assumption) we aren't risking that much, considering the countries we aren't in are the only ones who would oppose this. I'm not saying that it's good practice to do what the U.S. did and I am appalled. However, they will not lose 95% of the markets, at least not now. There is currently no country with the capacity to generate as many new ideas into businesses, and the U.S. is roughly 25% of the worlds entire economy. Hell, just California is the worlds 7th largest economy. Further, you don't think the other large nations (by economy), such as Japan, China, India, Russia, the U.K. are not doing/going to do the same thing (I omitted Germany and France since they seem to not wire tap.. Not necessarily true). Business wouldn't and wont be cut 95%, I am pretty sure most countries are grateful the U.S. is setting precedent and will request them to issue warrants on their citizens.
rmthompson 12y ago
They aren't, sovereignty is only a concept when each nation is capable of independence through economic, resource, and most importantly military. Since America spends more money on military than the next 9 largest spenders combined, America doesn't have to respect sovereignty. America's goal is to feed it's consumption, and ensure that nothing threatens the way of life for the wealthy at the cost of other nations. It frustrates me to no end because although I really hate this as a concept and practice, I really enjoy being given the opportunities that that this enables.
- naterator 12y ago
  Yea, that's great and all but what happens when China and it's 1.4 billion people get their stuff together? It's astounding that it seems that few in the US government seem to acknowledge that we may not be on top always, and what goes around comes around. There will be real future costs for our moral corruptness.
  - w1ntermute 12y ago
    Regardless of what the US does now, China will do later what the US is doing now. So the US might as well do the same thing now.
  - Retric 12y ago
    China has a several thousand year history of not getting it's shit together so it might never happen.
    - rakoo 12y ago
      China is millenias old and has mostly kept their shit to themselves. That's an example everyone else should follow
      - deleted 12y ago
        [deleted]
      - Retric 12y ago
thyroxo 12y ago
Do other countries not get affected? What about India, the UK, and China? Many other countries have even more intrusive domestic spying programs.
- Wilya 12y ago
  Looking at it from a B2B perspective, I can think of a lot of business situations where my own country spying on the data I store is acceptable, while any other country spying on it is not. Any sort of work with your local aerospace/nuclear/etc program falls into this case. Or any sort of work with a biggish company with ties to the power, really. It's fascinating to see how some people seem to find silly the idea that their domestic government could be on their side.
javajosh 12y ago
>This is going to end badly for American Internet companies. Agreed. Of course, it's going to end badly for Americans in general. The "undue burden on the government" reasoning has been used to weaken almost every right that we have. Police don't have to announce themselves before entering, or even have a warrant (if they get one later), because these things would constitute an "undue burden". It is a very strange loophole that the government uses, again and again, to break the law. My rights are worthless if they inconvenience a police officer. And in this case, a companies rights are worthless if they inconvenience law-enforcement. I think it's time we hang up the "undue burden" loophole once and for all. The constraints on behavior our laws represent should not be conditional on convenience, particularly not on the convenience of law-enforcement.
- joesmo 12y ago
  I couldn't agree more. What an incredibly lame excuse. The problem with such wording as "undue burden," "probable cause," "reasonable suspicion," etc. is that the phrases themselves are so broad and ambiguous, they can and do end up being meaningless when interpreted in court. It's clear that the original intent of the authors is irrelevant when interpreting such phrases as is any semblance of reasoning or logic. The only thing left is the warring parties intentions and their rationalizations for intentional misinterpretation. What's wrong with undue burden on police and government? The constitution itself provides for many such burdens specifically to prevent an overzealous government from overstepping its power. The courts can and have applied such arguments to specific portions of the constitution, generally with great success. What gives law enforcement the right to be free of undue burden anyway?

higherpurpose 12y ago

This will embolden countries like Germany and Brazil even more to force Google and Microsoft to create local subsidiaries/different companies there and hold their citizens data only in those datacenters and with that specific company. And I don't blame them. As a response to this, and to avoid that, Google and Microsoft should be adopting end-to-end encryption in their services as soon as possible, because it's the only way they can now say with a straight face that EU citizen data is "safe" with them. Otherwise (hopefully) people will be using less and less American services over the next few years. Europeans (and others) can't and shouldn't feel safe with their data used by American companies now.

arethuza 12y ago
They presumably already have wholly owned subsidiaries in each country where they have any presence - the US government can then presumably say to the parent company in the US "tell your subsidiary in <country> to give us their data" and what can they do?
- deleted 12y ago
  [deleted]
- tomp 12y ago
  They would respond "We ordered the CEO of the local subsidiary to give us the data, and he refused, because that would be illegal in the country the subsidiary is based in. We then fired the CEO, now he's suing the subsidiary and we had to close it down. We made $50M loss this year because of the lawsuit. Thank you, honourable judge."
- wmf 12y ago
  One wonders if having the parent company in, say, Switzerland would be better.
bjelkeman-again 12y ago
It is not enough that they are local subsidiaries. Microsoft said this already in 2011. A subsidiary on foreign soil, under foreign law is required by the patriot act to produce the data that a US authority is demanding, even if it breaks the law in the country it is in. http://www.zdnet.com/blog/igeneration/microsoft-admits-patriot-act-can-access-eu-based-cloud-data/11225 http://www.zdnet.com/blog/igeneration/microsoft-admits-patri...

brudgers 12y ago

the burden on the government would be substantial That was the idea embodied in the Bill of Rights.

kijin 12y ago

> "A U.S. prosecutor cannot obtain a U.S. warrant to search someone's home located in another country, just as another country's prosecutor cannot obtain a court order in her home country to conduct a search in the United States," the company said. Sure, the U.S. government cannot send agents to search Irish homes owned by U.S. citizens, but it can damn well order the citizen in question to retrieve and present a certain document that is known to be stored in the basement of that home, and threaten to hold him in contempt if he fails to have it shipped stateside within a few weeks. So according to Microsoft's own analogy, there's nothing surprising about this decision. What I'd really like to know is what happens if it is illegal in the country where the server is located for Microsoft to disclose the server's contents to the U.S. government. I don't know much about EU privacy laws, but surely some countries take issue with the personal information of their own citizens being shipped abroad? Could U.S. corporations (and/or their EU subsidiaries, if any) argue that it would be illegal for them to obey this U.S. judgment?

mariuolo 12y ago
> Sure, the U.S. government cannot send agents to search Irish homes owned by U.S. citizens, but it can damn well order the citizen in question to retrieve and present a certain document that is known to be stored in the basement of that home, and threaten to hold him in contempt if he fails to have it shipped stateside within a few weeks. Even when the document in question doesn't belong to said citizen? Can a US court compel you to commit theft abroad?
- jellicle 12y ago
  U.S. courts (and all courts everywhere) can compel you to produce any document or item under your control, whether or not you actually "own" it. Your cousin Bob gave you a sealed letter to hold for him and the court says you have to hand it over? You must. And calling it "theft" is an attempt to prejudice the discussion. Theft is taking without due process of law. By definition, taking at the command of a court is with due process of law.
  - pedrocr 12y ago

deleted 12y ago

[deleted]

whoismua 12y ago

Devil's advocate: what if MS, Google et al had all the US persons' email and files stored in Canada or Germany...on purpose? You type your email in Washington DC and then it is stored in a server somewhere in Germany. No can do says Microsoft.

tzs 12y ago
Along similar lines, suppose you are GM, and you have known for over a decade that faulty ignition switches on your cars have been killing people, yet you have not applied the cheap fix for the problem, and that this is at least grossly negligent and possibly criminal. Can you just ship all the incriminating physical documents to a GM branch in another country so that US prosecutors and US plaintiff attorneys and US regulators cannot get them? It would be one hell of a loophole if a person or company in country X could put documents (electronic or physical) that they fully control completely out of the reach of prosecutors, plaintiffs, and regulators in country X simply by storing those documents in country Y but still fully in their control and easily in reach when it serves their interests to access them.
- err4nt 12y ago
  Does that work with physical papers and reports? Moving them physically to a different country?
  - wmf 12y ago
    From the article: "Longstanding U.S. law holds that the recipient of a subpoena must provide the information sought, no matter where it is held, he said."

john-n 12y ago

What happens if/when another country (China? India?) introduces a similar law, requiring a company that operates there to make data on u.s citizens available even if its stored outside of the country. Will these companies stop operating in these markets?

Havoc 12y ago

EU based internet services are looking better and better each day - especially the German ones.

mjn 12y ago
My guess is that this worry is why Microsoft's opposing the order. The university I work at in Denmark uses Office 365 specifically because Microsoft was able to convince them that data will only be stored in the EU, and will only be accessed in accordance with EU data-protection law. If Microsoft can't credibly maintain that claim, European companies and universities may not be able to use their cloud services.

rurban 12y ago

Looks like doing business with US companies is now in severe trouble as the US does not care to obey foreign privacy laws. At least it's official now.

jackgavigan 12y ago

The EU has a track record of defying US extraterritoriality so I would be surprised if the data gets handed over. Also, this ruling was made by a magistrate judge, which is prett low down on the judicial totem pole. This ruling will be appealed, which means that it'll be reviewed by a judge who doesn't, in fact, have his head up his ass.