US Judge orders Microsoft to hand over data stored in Ireland

[Lynx-lynx]

Yep, apparently no matter what country you live in the US deems that they can issue a warrant for data that Microsoft 'controls', irrespective that the data is not in the US. The data in question are emails.

The Judge in this case has determined that it's 'a question of control, not a question of the location of that information'.

Note that 'also on Thursday, Twitter released a transparency report showing a steady rise in government requests for information from the social media platform.'

Apparently a precedent is the fact that 'US banks have long been required to provide records in response to subpoenas, even when stored overseas'.

The first part of the Article:

Spoiler:

New York: Microsoft must turn over a customer's emails stored in a data centre in Ireland to the US government, a US judge has ruled, in a case that has drawn concern from privacy groups and major technology companies.

Microsoft and other US companies had challenged a criminal search warrant for the emails, arguing federal prosecutors cannot seize customer information held in foreign countries.

But following a two-hour court hearing in New York, US District Judge Loretta Preska said the warrant lawfully required the company to hand over any data it controlled, regardless of where it was stored.

"It is a question of control, not a question of the location of that information," she said.

The judge said she would temporarily suspend her order from taking effect to allow Microsoft to appeal to the 2nd US Circuit Court of Appeals.

The case appears to be the first in which a corporation has challenged a US search warrant seeking data held abroad.

It comes amid a debate over privacy and technology that erupted last year when former US National Security Agency contractor Edward Snowden revealed the government's efforts to collect huge amounts of consumer data around the world.

Also on Thursday, Twitter released a transparency report showing a steady rise in government requests for information from the social media platform.

Article located in Saturday's Sydney Morning Herald
(Article originated Reuters, AFP)

[darryl]

This ruling is unremarkable in common law jurisdictions where the criteria is usually possession, custody or control, with a pretty wide interpretation of the latter. Having said this, I share your concerns. Governments of all sorts of nations seem to believe they are entitled to more and more information with less and less due process. Whilst I think the US Federal Government probably tops the list after September 11, the Australian Government is also a major offender, as is the UK Government.

[Lynx-lynx]

RE the ruling being unremarkable .... not sure that's the case here .... this appears to be a first in the US Courts.

I reckon that the Irish courts need to take an interest in the matter .... the property is within their jurisdiction, irrespective of who owns it and where they reside, the data is in Ireland.

PS: I'm quite surprised that none of the US members have commented .....

[tubemonkey]

From the article, it's unclear who the subject of this request is - a person living in Ireland emailing from Ireland with emails stored in Ireland or a person living in the US emailing from the US with emails stored in Ireland.

But Serrin Turner, a prosecutor from the office of Manhattan US Attorney Preet Bharara, said the warrant did not involve a search in Ireland but simply required Microsoft to provide documents it controls.

"It makes no sense for Congress to make the government go on a wild-goose chase...when the provider is sitting here in this country and can access the data at the touch of a button," he said.

But it is a search in Ireland. That's where the data is stored.

Does international law allow this?

Personally, I disagree with this ruling. If the US wants this info, then it needs to go to Ireland and get a search warrant from an Irish court. But since it's the 800 pound gorilla in the room, it can do anything it damn well pleases.

[Little.Egret]

Originally Posted by tubemonkey

But it is a search in Ireland. That's where the data is stored.

And the Microsoft administration of the data may be done in South Korea.

And what if whoever obeys the court order never dares visit Ireland again ?

[HarryT]

Originally Posted by Little.Egret

And the Microsoft administration of the data may be done in South Korea.

And what if whoever obeys the court order never dares visit Ireland again ?

The alternative would be to say that a company or individual could evade the law simply by storing its data on a server in a different country. This seems a reasonable ruling to me.

Why do you think that anyone would "never dare visit Ireland again"?

[tubemonkey]

Originally Posted by HarryT

The alternative would be to say that a company or individual could evade the law simply by storing its data on a server in a different country. This seems a reasonable ruling to me.

Then get a search warrant from that country.

[HarryT]

Originally Posted by tubemonkey

Then get a search warrant from that country.

I respectfully disagree. A US company should be subject to US law, just as a UK company should be subject to British law. They shouldn't be able to evade the law simply by stashing their data off-shore.

[tubemonkey]

Originally Posted by HarryT

I respectfully disagree. A US company should be subject to US law, just as a UK company should be subject to British law. They shouldn't be able to evade the law simply by stashing their data off-shore.

Who said anything about evading the law? How about respecting the laws of the country where the data is stored?

[Lynx-lynx]

Originally Posted by HarryT

The alternative would be to say that a company or individual could evade the law simply by storing its data on a server in a different country. This seems a reasonable ruling to me.

Why do you think that anyone would "never dare visit Ireland again"?

The issue here isn't about evading the law (not from my perspective), it's about legal procedure and practice. If a person 'held' the data required then the person and the data would be subject to legal procedures, eg extradition (or whatever).

In this case the data is being stored in Ireland by a non-Irish company (Microsoft) who is subject to Irish laws in Ireland. (And if Microsoft has this data stored in an Irish registered Microsoft company then that is another aspect that is not indicated in the Article, but could be the case.)

It would seem that the US considers that it can circumvent extradition procedures because what they require is 'data'; and that obtaining an Irish search warrant is not required.

The Irish point of view would be interesting .....

[Lynx-lynx]

I seem to recall the matter in New Zealand a few years ago where the US government stuffed up search warrant information for the German chap (name escapes me) who had NZ Residency or citizenship. They searched the chap's NZ house and took a lot of his belongings and then some great time later the whole thing was found to be an improperly worded and enacted search warrant and legal procedure. From memory the chap also got jailed in NZ but was later released because the NZ Gov't said that no crime had been committed there. (The chap ran a data share website which was based in the US)

Was his name Dot.com?

[tubemonkey]

Suppose the tables were turned. What if Ireland wanted emails from Microsoft that were stored on US servers? After all, Microsoft is registered to do business in Ireland and must obey their laws.

But Serrin Turner, a prosecutor from the office of Manhattan US Attorney Preet Bharara, (Ireland) said the warrant did not involve a search in Ireland (the US) but simply required Microsoft to provide documents it controls.

"It makes no sense for Congress to make the government (Ireland to) go on a wild-goose chase...when the provider is sitting here in this country and can access the data at the touch of a button," he said.

[tubemonkey]

Just picture the headlines from Fox News:

Irish Courts Challenge US Sovereignty by Demanding Records Stored on US Computers

Our right-wing would go ballistic!

[SteveEisenberg]

I'm surprised the data is stored in Ireland. What are their electricity rates?

I would have thought it would be stored someplace that has cheap hydroelectric power, such as Quebec or Idaho.

One problem I see with going by where it is stored is that all such data is stored redundantly, and so could be stored in different countries. Anyone know how common that is?

[Lynx-lynx]

If the email data was say in a hotmail account or outlook account established with an Irish address, '.ie', then maybe it's auto stored in Ireland.

The limited information in the Article really leaves the facts wide open to conjecture, eh.