Google Admits Handing over European User Data to US Intelligence Agencies

http://news.softpedia.com/news/Google-Admits-Handing-over-European-User-Data-to-US-Intelligence-Agencies-215740.shtml

by itg • 15 years ago

255 86 15 years ago

news.softpedia.com

ditojim3• 15 years ago

The first sentence of the article also mentions that Microsoft has been forced to do the same thing.

ZoFreX3• 15 years ago

No it doesn't:

> Gordon Frazer, Microsoft UK's managing director, made news headlines some weeks ago when he admitted that Microsoft can be compelled to share data with the US government regardless of where it is hosted in the world.

ditojim3• 15 years ago

Read between the lines. Don't be naive.

rjd2• 15 years ago

I went to a talk years ago by Microsoft just after they had opened some new data centres. The MS presenter showed a government data centre dab smack in-between MS, Google, and Yahoo!. I can't remember the complex name, it was near a hydro dam, sure it had Rose in the name. Basically the data centres where they for access to the higher quality grid and cheaper rates.

He was pitching Singapore data centres and made the joke that US could just tap into any of the data centres with a warrant just like that. Then his laugh died in dry painful way leading more or less everyone in the audience to assume that the warrants had already been issued.

yanw4• 15 years ago

Corporations based and operating in the US are subject to the PATRIOT Act, it's a shitty law but it's still the law. At least they are transparent about it.

Edit: here is the article in question: http://www.wiwo.de/politik-weltwirtschaft/google-server-in-e...

They asked if their EU based dataceters are also subject to US warrants and they answered that they are.

StrawberryFrog7• 15 years ago

"European Union legislation requires companies to protect the personal information of EU citizens"

It's the law. What's more, it's a good law. I am concerned that they broke it, and seem to have tried to hide this.

yanw4• 15 years ago

The Patriot Act seems to trump EU law in many cases, as security fears oft trump privacy concerns. It's a good discussion to be had for sure, am I'm sure EU parliament members will debate it in length:

They don't seem to have tried to hide anything. From another report: http://www.h-online.com/security/news/item/Google-also-passe...

The previous Microsoft admission that sparked this line of questioning: http://www.h-online.com/news/item/US-authorities-have-access...

Relevant: the Google Transparency Report: http://www.google.com/transparencyreport/

davidw• 15 years ago

> I am concerned that they broke it, and seem to have tried to hide this.

By, uh, mentioning it to journalists? There's a difference between hiding something and simply not announcing it loudly to the world.

christkv• 15 years ago

I would expect my EU government to impose sanctions on google forcing them to put a banner on all pages they serve to inside EU advertising that your information might be handed over to us intelligence services.

darklajid3• 15 years ago

'Being transparent' about it is not what comes to my mind if we're including these gag orders.

I won't comment on the law in general for the discussion's sake, but not being allowed (or: required) to be transparent about the disclosure of data is just evil in my world.

ZoFreX3• 15 years ago

And corporations based and operating in Europe are subject to our data protection laws. Microsoft and Google (and plenty others) have fully fledged companies in Europe. This raises an interesting question - what should companies do when they are subject to mutually exclusive laws like that?

My opinion is that they need to comply with the laws, which might require not having overseas companies in this case. Could they operate without them? Do they only exist for dodging huge amounts of taxes? (If yes, then this means that Google decided to "do evil" in return for a 20% boost in earnings)

nkassis2• 15 years ago

It's not about earnings. Having datacenters in europe would still require them to respect the laws in europe. They need those datacenters for latency and plenty of other reasons. If they were forced to only reside in the US or in Europe it would make for a shitty experience for where they are not.

And going to europe isn't really feasible when most of the developers they hire come from the US. They could come to Canada if they want (they already have offices but they could just move the head office.) :)

Basically this is another law that fails to face the reality of globalization and is a strong overreach of the US Gov. It's potentially also destroying jobs if companies as you say must choose a place to be in.

yanw4• 15 years ago

I'm merely guessing, but seeing how the law takes a backseat when security and anti-terror are involved I suppose that EU governments and the US have reached some sort of agreement about which set of laws to enforce in certain cases.

notatoad• 15 years ago

what should companies do when they are subject to two mutually exclusive laws? they don't really have a choice: they need to break one of the laws, and pay the penalty for that. the only question is which law to break, and the answer to that is the one with fewer consequences.

The EU must enact sanctions against google for this, if they don't they are essentially letting all multinationals know that EU laws are less important than American laws.

napierzaza• 15 years ago

Yes, Google is such an innovative and constructive company. I imagine that they will make it up to us with a brand new innovative product that we can use while on the toilet.

natmaster• 15 years ago

If you think the law's so shitty, why do you keep electing people like Obama and Bush who push for these things?

magicalist2• 15 years ago

I don't have any expertise in this area, but the first comment on that article claims that the quote they have wasn't given specifically to that paper, and the original quote is kind of dodgy:

"As a law abiding company, we comply with valid legal process, and that - as for any US based company - means the data stored outside of the U.S. may be subject to lawful access by the U.S. government. That said, we are committed to protecting user privacy when faced with law enforcement requests. We have a long track record of advocating on behalf of user privacy in the face of such requests and we scrutinize requests carefully to ensure that they adhere to both the letter and the spirit of the law before complying."

From that, it sounds like the data is subject to subpoena, but it would be nice to not have speculation three layers thick on this point and just get a straight answer.

aik3• 15 years ago

"Do no evil" -- What do you think? Does this qualify as a breach of their motto? Or is it only a clear message to those who may have thought their Google data is private?

watty• 15 years ago

When the government (that your business operates) is requiring you to hand over data what do you do? Is it Google's fault or the US government? I certainly don't think complying with the law is "evil". If the law is bad, fix the law.

aik3• 15 years ago

I agree it's a very tough place to be.

About fixing the law -- In that case I would expect Google to fight the government on this point. I wonder if they are/will?

rjd2• 15 years ago

While I'm an open critic of Google I don't think in this case its a breach of that motto. Maybe a failure to disclose obligations to users.

Most people would understand the real culprit is the government. Microsoft and Amazon space there data centres geo graphically for a few reasons, and this is one of them.

darklajid3• 15 years ago

I think the 'evil' part here is in this case the failure to disclose the fact(s).

The law's evil as well, agreed. The government did evil things passing it, in my world. But that doesn't seem to be the reason for the 'Google did evil' claim here.

dpatru• 15 years ago

One solution might be for Google to spin off its EU datacenter operations into a company incorporated outside of US jurisdiction. The Patriot Act would then no longer apply and Google would not be force to break EU law.

arethuza3• 15 years ago

They almost certainly have local operating companies that are wholly owned subsidiaries of the US parent company - just having a separate company isn't enough I suspect that separate ownership would also be requried.

wisty3• 15 years ago

They could set up special purpose vehicles, with very clear operating rules. That way, if the US asks, Google can say that they have no control over the subsidiary.

omh4• 15 years ago

Under some interpretations of the laws, Google would need to ensure that nobody under US jurisdiction has any access to the data. A full "split" would be difficult, and seemingly break a lot of the large-scale load-balancing and redundancy of Google. And what happens when a new, separate, jurisdiction arises?

While it would be technically possible, I think Google are probably happier just not dealing with the more paranoid businesses that are worried about this. That's the impression I got when discussing similar issues with their sales staff.

hollerith• 15 years ago

Two companies competing with each other are less valuable than one company, though.

eis• 15 years ago

Corporations operating in the EU are subject to EU data protection laws. It does not matter if the PATRIOT Act forces them to hand this data over. They are breaking the law in the EU.

Google had two choices:

  1. Don't hand over the data => they break the US law
  2. Hand over the data => they break EU law plus hand over personal data of users who might not want that

To me choice number one would be the lesser "evil" thing to do.

The solution is to have completely separate entities of the company in the local jurisdictions. Those follow local law and only share data with their foreign sister companies in a lawful manner and otherwise can ignore foreign law. Of course this creates some complexities but it's the right way to do, everything else gets you into trouble and even huge companies as Google can't get around colliding laws from different jurisdictions.

Handing over data to intelligence agencies is just one example of mutually exclusive laws. There are actually many more like data retention laws. The internet is probably the biggest challenge to international laws and treaties ever.

wisty3• 15 years ago

Well, let's hope that legislators drag their feet on this, until good practices have been bedded down for them to codify.

caf• 15 years ago

The PATRIOT Act is already surfacing as a competitive disadvantage for US-headquartered companies in foreign markets.

iamelgringo• 15 years ago

Weren't we just talking about this yesterday?.... http://news.ycombinator.com/item?id=2855764

Okay, not about this issue exactly, but the amount of data that Google collects on individuals is Law Enforcement's dream.

nopinsight• 15 years ago

This is a clear example why China does not welcome US internet behemoths in their country. Who would want to give competitors easy access to their internal data?

iwwr2• 15 years ago

It's not as if EU governments have any more qualms about the privacy of their citizens.

iwwr2• 15 years ago

The only difference is the greater bureaucratic procedures in handling this data, but there is technically nothing off-limits (information-wise) to law-enforcement or security agencies. This is especially true in the wake of anti-terror legislation all across the EU. This will become more apparent as copyright lobbies are pushing for greater surveillance of internet users.

The old adage that 'if you have nothing to hide, you have nothing to fear' has been thoroughly incorporated into modern state doctrine.

So downvote at will, but it would be nice to do so with some counter-arguments.

meow• 15 years ago

I think the requirement to be silent about handing over data is more for the corporations than the government. No wonder this remained secret for so long.

omh4• 15 years ago

The article doesn't mention the "Safe Harbor" provisions. This is a negotiated exception to EU Data Protection - roughly speaking, US companies can export the data to the US, as long as they promise to give equivalent protection. Google uses this to allow it to operate with personal data in the EU.

If Google have exported the data to a US jurisdiction under Safe Harbor, then a subsequent PATRIOT Act request wouldn't need to involve any EU-stored data or EU companies.

This seems like a much more general issue with exceptions like Safe Harbor, and something that people/companies should bear in mind. Promises like "equivalent" protection don't help with new local laws which can always trump anything.

mattmanser• 15 years ago

That doesn't make one jot of sense.

By complying with the request they immediately violated the safe harbor provision.

omh4• 15 years ago

They certainly violated the spirit, but may not have violated any actual rules. I could imagine that there's some exclusion in the safe harbor rules for "national security".

It's not clear whether the Data Protection laws were ever designed to guard against national governments. I imagine that those who wrote them were really thinking about avoiding disclosure to private individuals or other companies.

balpha2• 15 years ago

> According to German-language magazine WirtschaftsWoche, a Google spokesperson confirmed that the company has complied with requests from US intelligence agencies for data stored in its European data centers.

This isn't true; the WirtschaftsWoche article doesn't claim this. It says this could happen, but the claim that this article says it already did happen is a lie.

Not that this means it hasn't happened or is unlikely.

darklajid3• 15 years ago

From the 'WirtschaftsWoche' article:

Die US-Regierung könne "auf außerhalb der USA gespeicherte Daten zugreifen". Der Konzern habe schon viele solche Abfragen erhalten, schreibt ein Sprecher des Unternehmens.

-- Rough, sorry: --

The US government is able to to access 'data stored outside the USA'. The company already got a large number of these requests, comments a spokesperson of the corporation.

Put like this, next to each other, is a strong indicator (yeah, it's still on the edge) that they did, in fact, already comply in the past.

First part is 'would/could/in theory' style, but the following sentence says they got these requests in the past and 'diese' (these) builds a rather strong link to the sentence before.

So - I'm not 100% sure, but let's error on the side of caution: They did it in the past.

balpha2• 15 years ago

"outside the USA" != "in Europe"

I assume that WW would have used a much stronger phrasing, had the "Google spokesperson" actually said that. And a Google spokesperson is obviously careful when talking to the press.

Yes, it's not unlikely that they did -- but Softpedia is blatantly misquoting here. They base their writing solely on the WW article, and that one doesn't include anything to back up the claim.

paganel• 15 years ago

How to kill the President of the United States: http://www.youtube.com/watch?v=HDZ574eh9Yw

antr• 15 years ago

If this had been the other way round, I can easily imagine this issue going to U.S. Congress, leading to hearings, etc.

mattvot• 15 years ago

Hypothetical question that would never happen: What's to stop Google moving to Switzerland?

d0ne2• 15 years ago

This is a very real problem and provides case in point as to why everyone needs to start using client-side encryption for their data and communications.

In some cases this is still currently impractical to do on a day to day basis but in others such as Email, Social Networking or Instant Messaging it is not[1][2].

[1] I'm involved with a company that recently launched a free tool that provides transparent client-side AES256 encryption for Facebook, Google+, Major Email apps among others.

[2] https://www.socialfortress.com/

solid• 15 years ago

The Chrome extension is not working for me on Mac. When I click "options" nothing happens, and there's no confirmation that it's working.

d0ne2• 15 years ago

What site are you visiting? There is no "options" option in Social Fortress. If you can email a detailed explanation to support@socialfortress.com and we will get back to you promptly.

brudgers• 15 years ago

I think there is a misunderstanding of the intent of this provision of the PATRIOT act. It's primary purpose is to serve US based companies by providing cover from shareholder activism and negative press when they are outed for providing such information; and to streamline the process of dealing with such requests because there is little to be gained from resistance through litigation.

In other words, the PATRIOT act provides corporations with the least expensive option for providing user data and provides them with political and legal cover when they do so.

amatus• 15 years ago

It's not clear to me that these laws are mutually exclusive. 1. "the USA PATRIOT ACT, which states that companies incorporated in the United States must hand over data administered by their foreign subsidiaries if requested." 2. "European Union legislation requires companies to protect the personal information of EU citizens" It could be that the US gov't requested data on non-EU citizens which happened to be stored in EU data-centers.

mikecaron• 15 years ago

We can't get Diaspora soon enough!

dendory• 15 years ago

There's a huge need for people to start drifting to non-US based companies for everything that has to do with cloud storage or data, either that or force Google and such to offer solutions with end to end encryption that they have no access to.

runjake• 15 years ago

Key internet traffic choke points on US soil are monitored by the National Security Agency and people are surprised by this?

http://en.wikipedia.org/wiki/The_Shadow_Factory

http://en.wikipedia.org/wiki/NSA_warrantless_surveillance_co...

http://en.wikipedia.org/wiki/Mark_Klein

http://en.wikipedia.org/wiki/Hepting_v._AT%26T

Google Admits Handing over European User Data to US Intelligence Agencies

Related Stories