US Judge orders Microsoft to hand over data stored in Ireland

[shalym]

Originally Posted by eschwartz

Sounds reasonable to me. Either obey the laws of the country you are in or don't do business there. Don't tell me you can brazenly violate the law of the land becaus you also do business in another country with different laws. While operating in one country you must obey the law in that country. You can access that data from the US and you use that data within the US, and in order to do so you must agree that that data falls under US law.

If it conflicts with other laws in other countries, too bad. You shouldn't get yourself into holes like that, it isn't any country's fault.

No I am not saying the US can demand Irish data used in Ireland for Irish citizens. That has never been to the US and does not fall under US jurisdiction.

When I read all of the articles about this, it looks to me as if Microsoft was ordered to turn over the emails of one of its customers, not one of its employees. As far as I can see, the only "law" Microsoft broke was failing to turn over data that could possibly be able to be used as evidence against one of its customers.

Another point is that if Microsoft does turn over this data to the US court, it will be breaking the law in the country where the data is stored. In other words, they either defy the US court or break Irish Law.

Shari

[CWatkinsNash]

Originally Posted by eschwartz

Sounds reasonable to me. Either obey the laws of the country you are in or don't do business there. Don't tell me you can brazenly violate the law of the land becaus you also do business in another country with different laws...

(quote snipped for brevity but the entire post is relevant.)

I essentially agree. For me, it's like this:

If the company is operating within jurisdiction,
and
the individual is within jurisdiction,
and
The business relationship between them takes place within jurisdiction,
and
the basis for the data request is within jurisdiction,
then
the data should be considered to be within jurisdiction.

Obviously, that's a bit simplified as many business relationships aren't so easily defined, but a company choosing to store customer data on any given server shouldn't automatically place that data outside jurisdiction if everything that allowed that data to be created falls within jurisdiction.

At the same time, without laws that set parameters for such, MS is certainly in a rock / hard place situation (especially factoring in EU laws), and right now we don't have enough information to determine if this particular case even falls into the if / then scenario above. But this isn't the last time this is going to come up, so it needs to be addressed.

[SleepyBob]

Originally Posted by eschwartz

Sounds reasonable to me. Either obey the laws of the country you are in or don't do business there. Don't tell me you can brazenly violate the law of the land becaus you also do business in another country with different laws. While operating in one country you must obey the law in that country. You can access that data from the US and you use that data within the US, and in order to do so you must agree that that data falls under US law.

If it conflicts with other laws in other countries, too bad. You shouldn't get yourself into holes like that, it isn't any country's fault.

No I am not saying the US can demand Irish data used in Ireland for Irish citizens. That has never been to the US and does not fall under US jurisdiction.

But doesn't that argument go the exact same way in the other direction? They are "in" both countries, and so have to obey both countries' laws, but no matter what action they take, it will be in conflict with one of them.

[eschwartz]

Originally Posted by SleepyBob

But doesn't that argument go the exact same way in the other direction? They are "in" both countries, and so have to obey both countries' laws, but no matter what action they take, it will be in conflict with one of them.

To put it another way...

See @CWatkinsNash above (thanks CWatkinsNash )

You are arguing for something totally different -- I interpret your objection as also meaning that Google can be forced to censor US web searches if the Chinese government says so. Because they are "subject to Chinese law too".

[shalym]

Originally Posted by eschwartz

To put it another way...

See @CWatkinsNash above (thanks CWatkinsNash )

You are arguing for something totally different -- I interpret your objection as also meaning that Google can be forced to censor US web searches if the Chinese government says so. Because they are "subject to Chinese law too".

No...it would be the same as the Chinese government forcing google to give them access to the gmail/google drive account of a person that they were trying to prosecute in China.

Shari

[eschwartz]

Originally Posted by shalym

No...it would be the same as the Chinese government forcing google to give them access to the gmail/google drive account of a person that they were trying to prosecute in China.

Shari

And if the data was created in China, to go with the account owner who is Chinese and lives in China, and is accessible by Google's servers in China (despite being saved to disk in the US), using their Chinese department of Conforming To Weird Things Like Laws, I fail to see what the problem is.

What US law stops Chinese employees of Google from accessing Chinese data from their Chinese domains (but powered by and permanently cached in their US machines), using Chinese computers connected to the Google Machine, in order to give it to the Chinese government, conforming to Chinese law, in order to aid a Chinese prosecution?

[taustin]

Originally Posted by eschwartz

And if the data was created in China, to go with the account owner who is Chinese and lives in China, and is accessible by Google's servers in China (despite being saved to disk in the US), using their Chinese department of Conforming To Weird Things Like Laws, I fail to see what the problem is.

What US law stops Chinese employees of Google from accessing Chinese data from their Chinese domains (but powered by and permanently cached in their US machines), using Chinese computers connected to the Google Machine, in order to give it to the Chinese government, conforming to Chinese law, in order to aid a Chinese prosecution?

The easiest analogy might be if the data in question were medical history protected by HIPAA regulations. Something required by Chinese law, but prohibited by US law. And that appears to be what the situation is with Microsoft and Ireland, or so Microsoft says. It is a very unresolved issue, and one that threatens to have a big effect (almost certainly negative, no matter how it turns out) on international businesses.

[goldilocks]

I tried to find some additional information on this since I found it interesting.

Ireland's minister for data protection, Dara Murphy, said the country would be open to a request for the emails under the 2001 Mutual Legal Assistance Treaty, which governs the transfer of information in criminal cases

from
http://www.reuters.com/article/2014/...0R529J20140904

SAN FRANCISCO –Microsoft must hand over email stored on servers in Ireland to comply with a U.S. warrant in a narcotics case, a federal judge ruled Thursday.

from
http://www.usatoday.com/story/tech/2...land/13423467/

I also found the 2001 Mutual Legal Assistance Treaty
http://www.statewatch.org/news/2005/...d-usa-mlat.pdf

So this appears to be a narcotics case. It looks like there are agreements in place and maybe the procedures have not been followed properly.

[CommonReader]

I tried to find more information on this case and according to the information I found the US authorities have never claimed that the owner of the data is either a US citizen or resides in the US.
Therefore it could indeed be data of someone who lives in Ireland or somewhere else in Europe.
This doesn't only look like a violation of Irish sovereignty, it is also a nightmare for US tech companies.
They are seen as data feeders for US intelligence agencies already. If they also expose their clients to the unpredictable US legal system, then no reasonable person or company outside of the US can justify to use their data-storage services.

[Sil_liS]

Originally Posted by taustin

This isn't as simple a case a many would believe. The court order is not against the data in Ireland, it's against the company in the US. It is not the same as ordering Microsoft to turn over data in a safe deposit box in Ireland, because the data, in this case, can be accessed without going to Ireland. The issues in this are purely political, with both sides working towards something that is not really to the benefit of the average person. One side wants the US to govern the entire world, the other side wants to make international corporations sovereign in their own right. There are no good guys, there are no bad guys, there's only greed and corruption on all sides.

By this logic there should be no geographical restrictions on the internet.

[joblack]

Yeah, the US IT companies like CISCO and Microsoft are shooting themselves in the foot.

Great for Europe's IT companies.

[taustin]

Originally Posted by Sil_liS

By this logic there should be no geographical restrictions on the internet.

That is correct. There is a conflict between the laws of different sovereign nations that has not yet been resolved, and will not be resolved easily. The only logical solution is a world government, which is not possible, and not a particularly good idea, to boot.

All this means that Microsoft is in an untenable position, and their primary goal seems to be to force the US government to admit it publicly.

[tubemonkey]

I fail to see a conflict. We're talking about data stored on servers located in a foreign nation. If the US wants this data so badly, why don't they petition the Irish courts for it?

[taustin]

Originally Posted by tubemonkey

I fail to see a conflict.

Microsoft has the choice of either defying a US court order (breaking US law) or breaking Irish law. If you don't see that as a conflict, you are not looking.

Originally Posted by tubemonkey

We're talking about data stored on servers located in a foreign nation. If the US wants this data so badly, why don't they petition the Irish courts for it?

That would be the obvious route, perhaps, but with the possibility that what they are entitled to under US law, they are not entitled to under Irish law. So they try to coerce Microsoft in to doing their dirty work for them, in violation of Irish law.

But the court order isn't against the data, it is against Microsoft, and Microsoft is certainly subject to US law. And the US government is not subject to Irish law.

The real conflict is between the US government and the Irish (and European Union) government(s). Microsoft is caught in the middle, with no clear way out. Their best option is to make it clear to the public that this is not a legal conflict, it is a political conflict, in hopes that the public reaction to that revelation will pressure the two governments to resolve the conflict between them, rather than both demanding that Microsoft break the other's law. They haven't done a very good job of it yet, but then, Microsoft has never been very good at political, international or domestic.

[tubemonkey]

Originally Posted by taustin

Microsoft has the choice of either defying a US court order (breaking US law) or breaking Irish law. If you don't see that as a conflict, you are not looking.

Since the US isn't entitled to the data, MS has no choice but to refuse and appeal to a higher court.