8 ms·

Judge orders Microsoft to turn over data held overseas

69 points by dreamdu5t 12y ago

dreamdu5t 12y ago
> Microsoft also argued that the United States would not be in a position to complain when foreign governments do the same and insist on access to e-mail content stored in the country.
davidgerard 12y ago
Well, that about wraps it up for US companies in Europe. Well done. I wonder if Ireland can prosecute Microsoft if they do hand over the data without a local warrant.
- fleitz 12y ago
  It's not so much a matter of can as will.
  - nness 12y ago
    How though? What laws are Microsoft breaking which the Government of Ireland can use to persecute Amazon, as opposed to the customers who own the data.
- toyg 12y ago
  Ireland suing one of their major trading partners and local employers, over something as ephemeral as privacy laws? Not going to happen.
  - davidgerard 12y ago
    Ireland is in fact just a bit pissed off, though: http://www.irishtimes.com/business/sectors/technology/microsoft-fights-us-request-for-irish-held-data-1.1884243 http://www.irishtimes.com/business/sectors/technology/micros...
    - toyg 12y ago
      That was filed in support of Microsoft in the case, by a former minister who is also a senior counsel. There is no indication whatsoever that the current Irish government would do anything to Microsoft over this matter; I bet Irish politicians would rather pay with their own money to find a convenient solution for everybody, rather than risk jeopardizing the relationship. Microsoft and the Irish establishment have been really close for decades now, they desperately need each other and this won't change because of some silly rule about helping US police or judiciary.
yread 12y ago
Holy shit! I work in a medical setting and our institute was considering using Azure to offload some HPC. Azure promises to be the only cloud that has georedundancy but all within EU (AMS and DUB) protected by EU data laws. If this goes through we won't be touching it. What is wrong with the US judges these days?
- anigbrowl 12y ago
  EU laws apply to data on EU residents. You can't dump your US-originated data into an EU jurisdiction and use EU law as a legal shield. Most developed countries have reciprocity arrangements with each other about access to data for legal proceedings in cross-border litigation, eg courts in one country will recognize properly-issued warrants/subpoenas from another. EDIT: I should have mentioned that the major international treaty about this is the Hague Convention (which also covers a bunch of other things). You can find all about the rules, which countries are signed up to it as regards evidence-sharing, and so on here: http://www.hcch.net/index_en.php?act=text.display&tid=23 http://www.hcch.net/index_en.php?act=text.display&tid=23
  - stdgy 12y ago
    It's my understanding that Microsoft's complaint is that the US Government isn't bothering going through the proper international channels setup through treaty arrangements in order to retrieve this data, and is instead relying entirely on domestic procedures. Is that not the case here?
    - guan 12y ago
      Yes, the government is arguing that going through Mutual Legal Assistance procedures would be too slow. https://cdt.org/insight/microsoft-ireland-case-can-a-us-warrant-compel-a-us-provider-to-disclose-data-stored-abroad/ https://cdt.org/insight/microsoft-ireland-case-can-a-us-warr...
      - serge2k 12y ago
        as opposed to a court case with multiple appeals?
click170 12y ago
This is fantastic news because I've recently been looking for a VPS with 0 ties to the United States and it can be tricky to determine who owns who. With this ruling, I expect more companies to be advertising the fact that they operate entirely outside of the US and thus are not subject to these data-grabs. This will make choosing a VPS provider much easier for me.
- thematt 12y ago
  Will it? As much as I disagree w/ this ruling, grabbing data isn't isolated to the US government. Don't you also have to be concerned that those countries may subpoena the VPS provider?
  - ChrisAntaki 12y ago
    Right, and that's assuming the hypothetical host country has the formality of subpoenas. Some countries would just send armed forces and demand access. I've heard firsthand stories of how Russia's tax collectors essentially hold businesses at gunpoint, by surprise.
    - waps 12y ago
      The tax ministry of the Netherlands is pretty famous for doing the same (and for being total assholes about it too, locking people up without explanation until months later. Destroying businesses by "safeguarding evidence", ... And yes, it's not without cause, but they do get things wrong every now and then). Generally speaking, every western country gives that right to it's tax service, although I hope not all of them actually do things this way.
    - atmosx 12y ago
      I think he was referring to countries like Norway, Switzerland, etc. who are a bit more pro-human/business rights than Russia.
  - click170 12y ago
    Do you have to be concerned that those countries may subpoena the VPS provider? You're right that data grabbing isn't isolated to the US but I argue no, not if the point of concern is specific to one government entity instead of all of them.
ivanca 12y ago
> The government’s position is that the warrant is more of a hybrid — part search warrant and part subpoena. That covers it, you can get any data you want as long as it is an "hybrid". Maybe Russia should do the same "hybrid" over the Microsoft representatives there and get the email of all US politicians.
ChrisAntaki 12y ago
Citizens should be able to nominate & disbar judges.
- fleitz 12y ago
  Ugh. No. The judicial branch is not a political one, as the Supreme Court wisely declared the other day it is not up to them to question the will of the people. If the people elect a congress that passes dumb laws (including those in the constitutions) it is not for the judges to overrule them. If you can't get the people to elect a congress to make suitable laws, how is electing judges going to help? I don't disagree that this ruling will hurt US businesses, it's just that that is a political question, and not a judicial one.
  - ChrisAntaki 12y ago
    The power to elect Senators and Representatives empowers the public to make their government reflect their will. The more positions are electable, the more accurately the will of the public can be reflected.
    - fleitz 12y ago
      It's almost as if the US uses juries for exactly this purpose.
      - ChrisAntaki 12y ago
        Correct, that is one example of how the public takes part in decision making in America.
    - penrod 12y ago
      The more positions are elected, the more power the majority have to impose upon minorities. It is well known that pure democracy does not invariably promote liberal society, which is why the Founders of the US Constitution specifically rejected majoritarianism.
josephschmoe 12y ago
Why can't we just use the same laws we have for physical media for this? Because the government wants to use this as an excuse for a power grab.
- rayiner 12y ago
  If you printed out your emails and left them at a Microsoft data center in a box, the government would be able to use a subpoena duces tecum to get the emails, and you wouldn't be able to assert a 4th amendment claim over them. We are using the laws applicable to physical items. The problem is that in general, those laws say that unless there is a special situation (landlord-tenant, etc), you can't invoke an expectation of privacy over property that you leave in the hands of a third party.
  - X-Istence 12y ago
    Except that in this case the box was left in the hands of Microsoft Ireland, and Microsoft USA might have access to the property they don't have the right to touch Microsoft Irelands holdings...
diafygi 12y ago
I asked these questions on a previous thread but didn't get any answers. I'm seriously interested in actual responses (i.e. these aren't rhetorical). ----- If you use AWS, is all the data (S3, EC2 filesystems, RDS data+backups, etc.) now a business record of Amazon? What about renting dedicated servers at your local datacenter? You're basically renting bare hardware at that point, but the hard drives are still technically owned by the datacenter. Is the data on those hard drives business records of the datacenter? ----- Not being able separate the owner of the hardware and the owner of the data on the hardware seems like it would have a ton of modern consequences.
- rayiner 12y ago
  The legal status of something like AWS is up in the air. On one hand, you have what the law has been to date: http://www.abajournal.com/magazine/article/the_data_question_should_the_third-party_records_doctrine_be_revisited http://www.abajournal.com/magazine/article/the_data_question... ("In essence, the doctrine holds that information lawfully held by many third parties is treated differently from information held by the suspect himself. It can be obtained by subpoenaing the third party, by securing the third party’s consent or by any other means of legal discovery; the suspect has no role in the matter, and no search warrant is required.") On the other hand, you have the recent decision in California v. Riley: "The United States concedes that the search incident to arrest exception may not be stretched to cover a search of files accessed remotely—that is, a search of files stored in the cloud. See Brief for United States in No. 13–212, at 43–44. Such a search would be like finding a key in a suspect’s pocket and arguing that it allowed law enforce- ment to unlock and search a house." Slip. Op. at 21. It's difficult to reconcile the Third Party doctrine with Riley. Under the third party doctrine, storing a document in the cloud is like leaving a box of papers in your friend's garage--not protected under the 4th amendment. But under Riley, storing a document in the cloud is like storing it locally on your phone--protected under the 4th amendment. How the two will be reconciled is something that has yet to shake out. Note that Microsoft has already decided to appeal this: “We will appeal promptly and continue to advocate that people’s e-mail deserves strong privacy protection in the U.S. and around the world.” What the Second Circuit ultimately says on this case will go towards figuring out how this will shake out.
blisterpeanuts 12y ago
The fight's not over yet. Microsoft is appealing and it remains to be seen whether this decision will be upheld. In the meantime the order to turn over the data has been suspended.
vaadu 12y ago
What if the Irish government seized the data?
McUsr 12y ago
I have no problems with getting emails by a search warrant from an overseas server. Drug trafficking is global, so should the law enforcement be. I know, I am addressing this particular case, I am not saying "go" on a general basis. But I cases like this, with a search warrant, that turns up during an ongoing investigation, I really have no problem. By the way, in Norway, blood samples are taken from murderers. 23% of all murderers had thc in their veins.
DomreiRoam 12y ago
Since Microsoft US and Microsoft Ireland are to two different entities. The former is a 100% shareholder of the second but technically there is an Irish CEO that is report to Irish board representing the owner of the Irish Microsoft company. The Irish company doesn't operate in the US. Should the US judge send a letter rogatory to an Irish court to get the evidence?
secfirstmd 12y ago
As an Irish person, I find this violation of my country's sovereignty disgraceful. It's bad enough that GCHQ has violated our communications systems for decades (and the NSA no doubt also) but now the US is trying to do this through legal methods? Our forefathers didn't fight for the right to hold our own courts so that we could be bullied by another large country (this time US not Britain). Only when the Irish people have voted in referendums to release sovereignty (like during EU Treaties involving European Courts) should this ever be allowed. If any of our politicians had a backbone they should come out and say that US Laws have the same power in Irish Courts as those of a Golf Club - absolutely nothing...If the US wants the data it should go the normal route and through various inter-government treaties...Unfortunately the words spine and Irish politician don't go in the same sentence. Lets just see what happens when a Chinese or Russian company does the same to data stored in the USA.

69 points by dreamdu5t 12y ago

> Microsoft also argued that the United States would not be in a position to complain when foreign governments do the same and insist on access to e-mail content stored in the country.

davidgerard 12y ago

Well, that about wraps it up for US companies in Europe. Well done. I wonder if Ireland can prosecute Microsoft if they do hand over the data without a local warrant.

fleitz 12y ago
It's not so much a matter of can as will.
- nness 12y ago
  How though? What laws are Microsoft breaking which the Government of Ireland can use to persecute Amazon, as opposed to the customers who own the data.
toyg 12y ago
Ireland suing one of their major trading partners and local employers, over something as ephemeral as privacy laws? Not going to happen.
- davidgerard 12y ago
  Ireland is in fact just a bit pissed off, though: http://www.irishtimes.com/business/sectors/technology/microsoft-fights-us-request-for-irish-held-data-1.1884243 http://www.irishtimes.com/business/sectors/technology/micros...
  - toyg 12y ago
    That was filed in support of Microsoft in the case, by a former minister who is also a senior counsel. There is no indication whatsoever that the current Irish government would do anything to Microsoft over this matter; I bet Irish politicians would rather pay with their own money to find a convenient solution for everybody, rather than risk jeopardizing the relationship. Microsoft and the Irish establishment have been really close for decades now, they desperately need each other and this won't change because of some silly rule about helping US police or judiciary.

yread 12y ago

Holy shit! I work in a medical setting and our institute was considering using Azure to offload some HPC. Azure promises to be the only cloud that has georedundancy but all within EU (AMS and DUB) protected by EU data laws. If this goes through we won't be touching it. What is wrong with the US judges these days?

anigbrowl 12y ago
EU laws apply to data on EU residents. You can't dump your US-originated data into an EU jurisdiction and use EU law as a legal shield. Most developed countries have reciprocity arrangements with each other about access to data for legal proceedings in cross-border litigation, eg courts in one country will recognize properly-issued warrants/subpoenas from another. EDIT: I should have mentioned that the major international treaty about this is the Hague Convention (which also covers a bunch of other things). You can find all about the rules, which countries are signed up to it as regards evidence-sharing, and so on here: http://www.hcch.net/index_en.php?act=text.display&tid=23 http://www.hcch.net/index_en.php?act=text.display&tid=23
- stdgy 12y ago
  It's my understanding that Microsoft's complaint is that the US Government isn't bothering going through the proper international channels setup through treaty arrangements in order to retrieve this data, and is instead relying entirely on domestic procedures. Is that not the case here?
  - guan 12y ago
    Yes, the government is arguing that going through Mutual Legal Assistance procedures would be too slow. https://cdt.org/insight/microsoft-ireland-case-can-a-us-warrant-compel-a-us-provider-to-disclose-data-stored-abroad/ https://cdt.org/insight/microsoft-ireland-case-can-a-us-warr...
    - serge2k 12y ago
      as opposed to a court case with multiple appeals?

click170 12y ago

This is fantastic news because I've recently been looking for a VPS with 0 ties to the United States and it can be tricky to determine who owns who. With this ruling, I expect more companies to be advertising the fact that they operate entirely outside of the US and thus are not subject to these data-grabs. This will make choosing a VPS provider much easier for me.

thematt 12y ago
Will it? As much as I disagree w/ this ruling, grabbing data isn't isolated to the US government. Don't you also have to be concerned that those countries may subpoena the VPS provider?
- ChrisAntaki 12y ago
  Right, and that's assuming the hypothetical host country has the formality of subpoenas. Some countries would just send armed forces and demand access. I've heard firsthand stories of how Russia's tax collectors essentially hold businesses at gunpoint, by surprise.
  - waps 12y ago
    The tax ministry of the Netherlands is pretty famous for doing the same (and for being total assholes about it too, locking people up without explanation until months later. Destroying businesses by "safeguarding evidence", ... And yes, it's not without cause, but they do get things wrong every now and then). Generally speaking, every western country gives that right to it's tax service, although I hope not all of them actually do things this way.
  - atmosx 12y ago
    I think he was referring to countries like Norway, Switzerland, etc. who are a bit more pro-human/business rights than Russia.
- click170 12y ago
  Do you have to be concerned that those countries may subpoena the VPS provider? You're right that data grabbing isn't isolated to the US but I argue no, not if the point of concern is specific to one government entity instead of all of them.

ivanca 12y ago

> The government’s position is that the warrant is more of a hybrid — part search warrant and part subpoena. That covers it, you can get any data you want as long as it is an "hybrid". Maybe Russia should do the same "hybrid" over the Microsoft representatives there and get the email of all US politicians.

ChrisAntaki 12y ago

Citizens should be able to nominate & disbar judges.

fleitz 12y ago
Ugh. No. The judicial branch is not a political one, as the Supreme Court wisely declared the other day it is not up to them to question the will of the people. If the people elect a congress that passes dumb laws (including those in the constitutions) it is not for the judges to overrule them. If you can't get the people to elect a congress to make suitable laws, how is electing judges going to help? I don't disagree that this ruling will hurt US businesses, it's just that that is a political question, and not a judicial one.
- ChrisAntaki 12y ago
  The power to elect Senators and Representatives empowers the public to make their government reflect their will. The more positions are electable, the more accurately the will of the public can be reflected.
  - fleitz 12y ago
    It's almost as if the US uses juries for exactly this purpose.
    - ChrisAntaki 12y ago
      Correct, that is one example of how the public takes part in decision making in America.
  - penrod 12y ago
    The more positions are elected, the more power the majority have to impose upon minorities. It is well known that pure democracy does not invariably promote liberal society, which is why the Founders of the US Constitution specifically rejected majoritarianism.

josephschmoe 12y ago

Why can't we just use the same laws we have for physical media for this? Because the government wants to use this as an excuse for a power grab.

rayiner 12y ago
If you printed out your emails and left them at a Microsoft data center in a box, the government would be able to use a subpoena duces tecum to get the emails, and you wouldn't be able to assert a 4th amendment claim over them. We are using the laws applicable to physical items. The problem is that in general, those laws say that unless there is a special situation (landlord-tenant, etc), you can't invoke an expectation of privacy over property that you leave in the hands of a third party.
- X-Istence 12y ago
  Except that in this case the box was left in the hands of Microsoft Ireland, and Microsoft USA might have access to the property they don't have the right to touch Microsoft Irelands holdings...

diafygi 12y ago

I asked these questions on a previous thread but didn't get any answers. I'm seriously interested in actual responses (i.e. these aren't rhetorical). ----- If you use AWS, is all the data (S3, EC2 filesystems, RDS data+backups, etc.) now a business record of Amazon? What about renting dedicated servers at your local datacenter? You're basically renting bare hardware at that point, but the hard drives are still technically owned by the datacenter. Is the data on those hard drives business records of the datacenter? ----- Not being able separate the owner of the hardware and the owner of the data on the hardware seems like it would have a ton of modern consequences.

rayiner 12y ago
The legal status of something like AWS is up in the air. On one hand, you have what the law has been to date: http://www.abajournal.com/magazine/article/the_data_question_should_the_third-party_records_doctrine_be_revisited http://www.abajournal.com/magazine/article/the_data_question... ("In essence, the doctrine holds that information lawfully held by many third parties is treated differently from information held by the suspect himself. It can be obtained by subpoenaing the third party, by securing the third party’s consent or by any other means of legal discovery; the suspect has no role in the matter, and no search warrant is required.") On the other hand, you have the recent decision in California v. Riley: "The United States concedes that the search incident to arrest exception may not be stretched to cover a search of files accessed remotely—that is, a search of files stored in the cloud. See Brief for United States in No. 13–212, at 43–44. Such a search would be like finding a key in a suspect’s pocket and arguing that it allowed law enforce- ment to unlock and search a house." Slip. Op. at 21. It's difficult to reconcile the Third Party doctrine with Riley. Under the third party doctrine, storing a document in the cloud is like leaving a box of papers in your friend's garage--not protected under the 4th amendment. But under Riley, storing a document in the cloud is like storing it locally on your phone--protected under the 4th amendment. How the two will be reconciled is something that has yet to shake out. Note that Microsoft has already decided to appeal this: “We will appeal promptly and continue to advocate that people’s e-mail deserves strong privacy protection in the U.S. and around the world.” What the Second Circuit ultimately says on this case will go towards figuring out how this will shake out.

blisterpeanuts 12y ago

The fight's not over yet. Microsoft is appealing and it remains to be seen whether this decision will be upheld. In the meantime the order to turn over the data has been suspended.

vaadu 12y ago

What if the Irish government seized the data?

McUsr 12y ago

I have no problems with getting emails by a search warrant from an overseas server. Drug trafficking is global, so should the law enforcement be. I know, I am addressing this particular case, I am not saying "go" on a general basis. But I cases like this, with a search warrant, that turns up during an ongoing investigation, I really have no problem. By the way, in Norway, blood samples are taken from murderers. 23% of all murderers had thc in their veins.

DomreiRoam 12y ago

Since Microsoft US and Microsoft Ireland are to two different entities. The former is a 100% shareholder of the second but technically there is an Irish CEO that is report to Irish board representing the owner of the Irish Microsoft company. The Irish company doesn't operate in the US. Should the US judge send a letter rogatory to an Irish court to get the evidence?

secfirstmd 12y ago

As an Irish person, I find this violation of my country's sovereignty disgraceful. It's bad enough that GCHQ has violated our communications systems for decades (and the NSA no doubt also) but now the US is trying to do this through legal methods? Our forefathers didn't fight for the right to hold our own courts so that we could be bullied by another large country (this time US not Britain). Only when the Irish people have voted in referendums to release sovereignty (like during EU Treaties involving European Courts) should this ever be allowed. If any of our politicians had a backbone they should come out and say that US Laws have the same power in Irish Courts as those of a Golf Club - absolutely nothing...If the US wants the data it should go the normal route and through various inter-government treaties...Unfortunately the words spine and Irish politician don't go in the same sentence. Lets just see what happens when a Chinese or Russian company does the same to data stored in the USA.