5 ms·
What are the legal consequences for Microsoft if the US government succeeds in forcing them to bring this data over from Ireland? Won't Microsoft then be in bre
by cjg 12y ago
What are the legal consequences for Microsoft if the US government succeeds in forcing them to bring this data over from Ireland? Won't Microsoft then be in breach of Irish law? What does a company do if forced to choose between breaking one of two legal instructions? Perhaps they can just choose?
Alternatively, the Irish Microsoft corporation could decide to prevent the US corporation from having access. It could be argued that they are legally required to do this. Then the US corporation can say they no longer have access. It doesn't matter that the US corporation is the only / majority shareholder because the shareholders cannot compel the company officers to do something illegal (i.e. provide access).
- scythe 12y agoSuppose the people working in the US are required to tell the people in Ireland to give over the data, and the people in Ireland are required to refuse. Maybe they'd just have to have a really long argument on the phone until the court got tired of it.
- nl 12y agoThen the people in the US would be sent to jail for contempt of court. Doesn't make sense, but that is how it works. The court's argument could be that MS should be required to design their systems to make it possible to comply with their requests.
- arethuza 12y agoSo Microsoft US would tell Microsoft Ireland to do something and the local management don't do it why would Microsoft US be in contempt of court?
- nl 12y agoThe US court orders something to be produced. If MS declines to produce it, then they are in contempt. MS's internal structure isn't of interest. (Assuming the US court claims jurisdiction, which is more or less what this case is about)
- datr 12y agoPresumably there is a way to challenge this though. If the court ordered Microsoft to produce a square circle could they still be found in contempt for failing to do so?
- arethuza 12y agoIs it really an "internal" structure though - Microsoft US and Microsoft Ireland will be different legal entities. Of course, Microsoft US as the owner of Microsoft Ireland can tell their subsidiary to do something - but that doesn't mean that the management there will do it if it is illegal.
- Silhouette 12y agoAnd if the people in the EU complied, they should similarly be held accountable under EU privacy and data protection rules. Either way, Microsoft and/or their employees personally wind up in serious legal trouble. This is why Microsoft are in a Catch-22 situation, and why the correct solution for Europe is probably to just stand their ground until the US realises it has gone too far in expecting its laws to apply to the whole world and is now asking the impossible at the expense of its own business community.
- thomasahle 12y agoI guess the US government will force the US based part of Microsoft to cooperate. No choice, possible in stealth. This might or might not be discovered by the Irish part/government, which must then sue. Basically there is no winning for Microsoft, except keeping it secret, having the US government pressure the Irish not to sue, or having the NSA pay possible fines.
- belorn 12y agoIts not really that simple, since Ireland is part of the European union. If Microsoft willingly break data protection laws, then the EU court would likely sue Microsoft again. Given the history of EU court vs Microsoft, and the market size of EU vs US, Microsoft has no easy solution to the problem. The US government might pressure the Irish, but would have a harder time against European union (which I suppose is part of its design).
- Tomte 12y agoThe "EU court"? What do you mean? The European Commission?
- arethuza 12y agoThe EU Commission brought the case against Microsoft in one of the EU courts: http://en.wikipedia.org/wiki/European_Union_Microsoft_competition_case http://en.wikipedia.org/wiki/European_Union_Microsoft_compet...
- yxhuvud 12y agoSadly, so far no company has been sued by EU for complying with american legal requests. I think the motivation is somewhat along the lines that the company didn't have a choice in the matter. Personally I wish that didn't matter and that the privacy breaches would have been prosecuted - I can think of nothing that makes legislative changes faster than companies having to choose where to do business because it would not be possible to do business both in USA and EU.
- pmorici 12y agoI would think Microsoft has the upper hand untimely. They could always take the nuclear option and stop selling the government windows or something drastic like that.
- higherpurpose 12y agoIf companies like Microsoft adopted end-to-end encryption wherever they can for their services, this would be less and less of an issue. The users from a certain country wouldn't need to "trust Microsoft" anymore then, because there would be nothing to trust them with. In the same fashion, governments wouldn't need to try and force Microsoft to build local datacenters to keep the data there. When the service is trust-less, such policies aren't necessary.
- Silhouette 12y agoThat strategy doesn't appear to work: see Lavabit.
- singlow 12y agoThe design of Lavabit allowed him to gain access to the data. It may have been encrypted at every point, but the keys were accessible by Lavabit.
- Silhouette 12y agoFair point. I was more meaning that arguments about how he couldn't comply (in that case for legal more than technical reasons) didn't cut much ice. The general view of the authorities appeared to be that the operator of the service was required to comply and if they hadn't left themselves a way to do so without violating some other obligation then that was their problem.
- singlow 12y agoBut if there was technically nothing they could do to access the data, they could not be forced to do it. If I encrypt data on my machine and upload it to s3, Amazon cannot be forced to do anything other than provide the encrypted data to the government. They can't be compelled to give my key because they do not have it. It is very hard to operate e-mail this way, because the server cannot send your e-mail other servers in the encrypted form, unless you limit correspondence to users that are using your encryption and key-exchange system. Not all cloud services have this limitation. However I suspect that there will always be some metadata that the government will be able to request from the cloud provider, and this legal question will still be relevant.