Microsoft fights U.S. warrant for customer e-mails held in overseas server

http://m.washingtonpost.com/world/national-security/microsoft-fights-us-search-warrant-for-customer-e-mails-held-in-overseas-server/2014/06/10/6b8416ae-f0a7-11e3-914c-1fbd0614e2d4_story.html

by kenjackson • 12 years ago

225 93 12 years ago

m.washingtonpost.com

hadoukenio3• 12 years ago

"Microsoft, one of the world’s largest e-mail providers, is resisting a government search warrants blah blah blah"

http://en.wikipedia.org/wiki/NSAKEY

Edit: Why the downvotes?

pling2• 12 years ago

Because it's bollocks?

To be honest I'm more worried that the crypto service providers as supplied aren't available in their shared source license.

hadoukenio3• 12 years ago

Crypto? My favourite red herring:

"I love crypto, it tells me what part of the system not to bother attacking" -- Drew Gross, forensic scientist

dude32• 12 years ago

For show and press. Microsoft was the first company to cave in giving the NSA total unrestricted access to user information.

stinos2• 12 years ago

The first? Source?

adventured• 12 years ago

I assume the parent is referring to this:

http://upload.wikimedia.org/wikipedia/commons/c/c7/Prism_sli...

thomasahle2• 12 years ago

This particular part of the surveillance is what really hurts the bottom line.

EdSharkey• 12 years ago

Dear Microsoft,

I love it when you play rough, you sexy beast! DO NOT FORGET WHO OWNS YOU, SLAVE! YOU ARE MINE!

Love, Obama and the NSA Spooks

P.S. I left you a little something extra on the nightstand, get yourself some makeup.

sschueller2• 12 years ago

A little off topic.

How does it work for companies that are separately incorporated in another country?

For example: I had a argument with someone from Goldman Sachs Switzerland. They are claiming that their data is out of reach from the US dept. of justice because they are a separate entity incorporated in Switzerland. I have also heard that as an argument from a datacenter provider (Equinix).

Don't profits from these Swiss corporation still somehow make it to the parent company?

What does the parent company do when served with an NSL for data located in the Swiss company?

BTW the funniest thing about Goldman Sachs Switzerland is that they do not accept US customers as they are considered 'toxic'.

colechristensen• 12 years ago

The Swiss banks which have been getting in trouble and paying billions in fines have been doing so because they were conducting business in America with Americans in order to break American laws.

If Microsoft or any company does foreign business and that specific business stays out of America, the American justice system has no business at all trying to reach it's fingers into it except by established treaty and/or cooperation with foreign governments.

CaptainZapp2• 12 years ago

  BTW the funniest thing about Goldman Sachs Switzerland is that they do not accept US customers as they are considered 'toxic'.

Practically no Swiss bank accepts US customers at this time. This can be quite a hardship for US citizens living in Switzerland. But they deem the risk just too high and rather forgo the business.

To clarify what your Goldman friend meant.

Swiss banks are obliged to keep customer identifiable data ring fenced and within the country. That is, it can't even be processed offshore. It has nothing to do how the entity is setup legally.

For example (I work for a Swiss bank). I can easily remote access my desktop from home, or, if I have my laptop and token with me, from any other location in Switzerland.

There is no way to access the systems from outside Switzerland.

Singapore, btw, has comparable laws and also ring fences data for use only in Singapore.

sschueller2• 12 years ago

There may be a technical restriction but what prevents a top US executive from Goldman from traveling to Switzerland an accessing the data?

What about IT people? Such companies generally bring in IT professionals for projects from other entities such as the US headquarters.

ryanjshaw• 12 years ago

For example (I work for a Swiss bank). I can easily remote access my desktop from home, or, if I have my laptop and token with me, from any other location in Switzerland. There is no way to access the systems from outside Switzerland.

Can you remote access your home desktop from outside Switzerland? :)

vidarh• 12 years ago

US customers are "toxic" to many banks internationally, not just the Swiss, because the IRS claims authority to access a lot of data for the prevention of tax evasion that either makes US customers wildly inconvenient, or that is actually illegal for the banks to disclose to anyone but their own authorities (if that).

comex• 12 years ago

The link to the filing in the article is currently broken. I think this is it:

https://archive.org/download/gov.uscourts.nysd.427456/gov.us...

Ihmahr• 12 years ago

Is there some NSA influencing online discussion in this thread? I mean seriously, why the down votes?

sz4kerto2• 12 years ago

I don't think so :), we're not that important. So far only 3 comments have been seriously downvoted -- one of them presented seemingly unfounded information, the other one was simply unfunny trolling that should not be on HN, the third one was mostly off-topic.

Because of - to some extent understandable - reasons MS hate is still quite strong among this community but destroying an MS-related thread is unnecessary.

dangero2• 12 years ago

Do you really think a site has to be "important" to be targeted? To influence public opinion it seems like you'd just want to blanket influence as many popular websites as possible. It wouldn't take that large a team to do it given the right software.

dangero2• 12 years ago

I've suspected for a while that the NSA has some kind of software like google alerts that monitors the top 1000 relevant sites and detects when they are being talked about so they can turn the discussion. We know from Snowden leaks that they are attempting to influence public opinion online, so that seems like how I would do it. Also I've noticed that previous threads like this are particularly full of naysayers.

ianstallings• 12 years ago

Your opinion doesn't matter I thought they made that clear.

jmnicolas2• 12 years ago

What is harmful to cloud providers is secret warrants and intelligence gathering, not an open warrant for drug trafficking.

MS is fighting the wrong battle here.

hrrsn• 12 years ago

So because the accused are in the middle of a drug case, that makes this okay?

jmnicolas2• 12 years ago

No it makes it OK because everything is in the open.

When you're in a middle of a drug case it's pretty normal that they read your emails.

It's not normal that they read secretly my emails when they have nothing against me.

mercurial• 12 years ago

How are they fighting the "wrong battle" when complying would be a breach of Irish law? If the US DOJ is so keen on this data, they should get the Irish law enforcement in the loop.

cjg• 12 years ago

What are the legal consequences for Microsoft if the US government succeeds in forcing them to bring this data over from Ireland? Won't Microsoft then be in breach of Irish law? What does a company do if forced to choose between breaking one of two legal instructions? Perhaps they can just choose?

Alternatively, the Irish Microsoft corporation could decide to prevent the US corporation from having access. It could be argued that they are legally required to do this. Then the US corporation can say they no longer have access. It doesn't matter that the US corporation is the only / majority shareholder because the shareholders cannot compel the company officers to do something illegal (i.e. provide access).

scythe• 12 years ago

Suppose the people working in the US are required to tell the people in Ireland to give over the data, and the people in Ireland are required to refuse. Maybe they'd just have to have a really long argument on the phone until the court got tired of it.

nl2• 12 years ago

Then the people in the US would be sent to jail for contempt of court. Doesn't make sense, but that is how it works.

The court's argument could be that MS should be required to design their systems to make it possible to comply with their requests.

thomasahle2• 12 years ago

I guess the US government will force the US based part of Microsoft to cooperate. No choice, possible in stealth. This might or might not be discovered by the Irish part/government, which must then sue.

Basically there is no winning for Microsoft, except keeping it secret, having the US government pressure the Irish not to sue, or having the NSA pay possible fines.

belorn• 12 years ago

Its not really that simple, since Ireland is part of the European union. If Microsoft willingly break data protection laws, then the EU court would likely sue Microsoft again.

Given the history of EU court vs Microsoft, and the market size of EU vs US, Microsoft has no easy solution to the problem. The US government might pressure the Irish, but would have a harder time against European union (which I suppose is part of its design).

wahsd• 12 years ago

That is an important point. The ironically named Patriot Act contains a deeper, clandestine layer a Treason Act, if you will, that can compel American companies to act in ways that are illegal in other jurisdiction. It is kept secret and any business costs and consequences for those actions are compensated, also clandestinely; which is also the biggest reason why it is actually quite crucial that American companies are not trusted by other people around the world.

If, e.g., Europe, is serious about protecting and defending against the demons that are quickly consuming the USA; they need to put in place meaningful, positive controls in place.

We really need to start coming to terms with the fact that we, the USA, are quickly becoming or maybe even are the most dangerous force humanity has ever seen. Sure, we are not "doing anything wrong" other than killing civilians and even out own people against our own laws by rationalizing ways and reasons to sidestep our most core fundamentals; but we will all rue the day that the force canalizes and stripps off its mask to reveal something far more sinister than most people could even imagine.

You have to remember, no horrible regime took power by saying they will graduate to brutalizing their own people. Put it this way, we are well into several meth highs, still insisting that we will be able to stop when we want to and control any addiction that may arise.

pmorici• 12 years ago

I would think Microsoft has the upper hand untimely. They could always take the nuclear option and stop selling the government windows or something drastic like that.

higherpurpose• 12 years ago

If companies like Microsoft adopted end-to-end encryption wherever they can for their services, this would be less and less of an issue. The users from a certain country wouldn't need to "trust Microsoft" anymore then, because there would be nothing to trust them with. In the same fashion, governments wouldn't need to try and force Microsoft to build local datacenters to keep the data there. When the service is trust-less, such policies aren't necessary.

Silhouette6• 12 years ago

That strategy doesn't appear to work: see Lavabit.

contingencies• 12 years ago

In finance, the US pressuring people in arbitrary jurisdictions is considered completely normal, though they've been overstepping themselves of late by wholesale interference with intra-EU transactions conducted by European private citizens, by collaborating with Israel to pressure Europe to block Iran entirely from SWIFT, and by showing their cards by financially blockading Wikileaks without any form of trial or due legal process whatsoever.

With the news here confirming that communications area resistance is beginning on commercial grounds... and from well funded pockets like Microsoft's... a ray of hope exists that the whole tide may be beginning to turn. The truth, ladies and gentlemen, is that we can choose freedom - the natural result of decentralization, encouraged by the jurisdiction-hopping internet - or we can have a feel-good, artificial, dangerous kind of centralized-power-billed-as-safety: one, or the other. It is pertinent to remember what Benjamin Franklin said: Those who would give up essential liberty to purchase a little temporary safety deserve neither liberty nor safety.

Julian Assange's strong statement in Cypherpunks that we are galloping in to a new transnational dystopia is certainly correct. Yet it is also true to say that, with massive transnational corporations even so blindly led as by the profit motive, commercial interest in reaping the custom of the decentralized masses actually aligns with the disempowerment of rogue nations acting continually in defiance of international law and other jurisdictions' right to self determination (such as the US) and instead acts to benefit the preservation of basic digital freedoms for the many.

It's far too early to see what kind of world we will pass on to the next generation, but we are at least blessed to live in interesting times.

jonchang• 12 years ago

As far as I can tell, the main issue here (ignoring jabs about the NSA, M$, etc.) is the difference between a warrant and a subpoena. US law enforcement would like to have their cake and eat it too, using a novel warrant-subpoena hybrid. With a warrant, law enforcement officers are the ones that search and seize the documents or data outlined in the search warrant. In a subpoena, the party being served is compelled to produce the documents themselves and testify in court.

In this particular case, it seems obvious that a warrant is inapplicable, since US law enforcement officers don't have the authority to seize Microsoft-controlled data located on servers in Ireland. If Microsoft had instead been served with a subpoena, they would be required to hand over any documents that they had access to, regardless of the data's physical location. However, there are strategic advantages (for law enforcement) to favor warrants, since they're much harder to challenge, and that treaty obligations with foreign countries might restrict the kinds of data that can be retrieved from overseas servers.

Fuxy• 12 years ago

This is probably one of the few situations where I think Microsoft is right and if they want the data they should abide by Irish law.

If it's that hard to get the necessary paperwork done for this they should fix their system not complain to the courts that it takes to long.

merrua• 12 years ago

Especially if they want to keep non-USA clients who have to obey different laws with their own businesses data.

Elhana2• 12 years ago

The issue here is what happens when China does the same and ask Microsoft to hand over data stored in US for US customer? I bet US Gov will be furious. What if every country starts doing this?

marincounty• 12 years ago

I think we will hear a lot of these stories, but they will be for show only. The American government has access to all the server files. Companies will act like they are fighting for our privacy, but the NSA will still be viewing the files. The NSA might not ever say they are using the information found on servers, but they will be looking for criminals and terrorists. When they find the perps, they will use illegial wire taps and other means to get whomever they want. I don't doubt for a second those Irish servers have back doors tied directly to the NSA. Oh, Microsoft, Facebook, Google, etc. will all put up a very public fight though. I have a guestion about cryptanalysis; In the ninties, a Hacker named Iceman was arrested for a Card Swap Forum. He thought he bricked his hard drives with encryption, but a eastern company broke the encrytpion--easily. What form of encryption was he using? Thanks-

oneandoneis2• 12 years ago

Anyone else remember Microsoft cheerfully getting a US judge to overrule a German court decision? Only to now insist that a US court can't compel them to hand over an Irish server. Their views on jurisdiction matters seem to be remarkably flexible...

motters• 12 years ago

"The judge opined that the search would take place only when the e-mails were opened and read"

That's a silly argument, because it's like saying I'm going to grab papers from your home, but I'm not searching your home because the papers will only be read back at the office.

namesakes• 12 years ago

Who cares whether it's subpoena or warrant, thats not the point. The point is, you can't compel international company to break law in another country, f. ex. suppose chinese court would order (subpoena?) microsoft to hand over emails and pictures of a known political dissident, that are kept on US server, what the hell do you expect microsoft do? comply? stop doing business in any country that has laws that conflict those of US? It's _very_ easy to imagine such scenarios, in all areas really, patent law, finance, whatever. I think the only real solution is those MLATs, or international agreements on handing over data. Or maybe, in future, an international court, that could issue subpoenas valid in all member nations, when investigating crimes with similar enough laws in member nations.

ig1• 12 years ago

The US government don't seem to realize that this could equally well be used against them, for example another country where MS operates could file a warrant requiring that Microsoft handover US government files.

Xylakant• 12 years ago

China immediately popped to my head: Large enough of a market to be interesting, eager to learn and a lot of US companies have operations there. Now that could turn out interesting...

rayiner• 12 years ago

No, the U.S. government understands the situation isn't symmetric. It spends $700 billion a year ensuring asymmetry.

jessaustin3• 12 years ago

That money would be better spent on any other purpose.

comrade1• 12 years ago

This is why my European clients are no longer using Amazon Web Services. For awhile they let us put their projects on AWS's ireland zones but even with that they were reluctant. After the NSA revelations (I know that this particular story is unrelated) they don't even allow that.

The projects were only content management system projects with minimal privacy concerns. One project did have some customer data but the others were mostly just marketing material.

Stories like this are just going to dry up the final remaining non-u.s. customers for u.s.-based cloud computing companies. It's almost like the u.s. government is trying to screw u.s. companies.

secfirstmd• 12 years ago

This is a ridiculous situation and as an Irish person I would say, a gross violation of our sovereignty. It's bad enough that GCHQ and the NSA do it on a daily basis anyway, now the US is trying to do it via the legal route.

Imagine the uproar if China or Russia decided to do the same to data held on US servers...

madaxe_again• 12 years ago

I guess this just goes to reinforce the fact that the US is a very hostile environment for business, particularly web based businesses. Incorporate in the EU!

tendom2• 12 years ago

America won the digital age, but the post-digital age will be won by whomever builds the most progressive laws into privacy and digital rights. America is at risk right now, and although momentum carries (hence why we even talk about Microsoft decades after any real innovation), but if America doesn't quickly course correct, they're soon going to find that the thing that made them great was freedom to innovate and thrive. In this new era, America is no longer the leader in freedom or the American dream. I hope whoever wins the next election is at least aware of this, as a country that focuses more and more on IP as a significant exportable product, if no one trusts or uses those products, and the natural resources have already been significantly exploited, this does not bode well for the long game.

gnopgnip• 12 years ago

Besides a no true Scotsman fallacy here why do you think Microsoft is not innovating?

tendom2• 12 years ago

Can you give an example where Microsoft has been innovating? Innovation mean 'novel change' and I've not seen anything outside Azure that was even the slightest bit novel. Balmer was not a risk taker, but the Azure and VS teams have been turning that ship, but it'll be years yet before I acknowledge anything as novel.

BTW a logical fallacy cannot apply to a personal value judgement.

Faust1985• 12 years ago

In Ireland a large momentum is gathering behind this, it's an insult to Irish Sovereignty and recognition of its right to make it's own laws.

Which in fairness the country has only had for a very short amount of time and takes very seriously.

IanDrake• 12 years ago

Moreover, they say, imposing limits sought by Microsoft would “lead to absurd results and severely undercut criminal investigations.”

The most dangerous argument made by government. There is no end to it. Someday the exact same argument will be used to ensure we all have a telescreen in every room of our homes because not having it would "severely undercut criminal investigations.”

Microsoft fights U.S. warrant for customer e-mails held in overseas server

Related Stories