I don't get why so many people are advocating a world where the government can't do this. Why should your email hosting provider have the ability to make law enforcement decisions? Why should email be treated differently from something like my bank account or diary? This seems like the optimal outcome.
Now the Russian government issues a warrant to demand data from the US subsidiary. Do you think that US jurisdiction should have no say in the matter?
If the Russians compelled their US subsidiary to hand over the data in violation of US law, how long do you think they'd be allowed to operate in the US?
The end result of this US overreach will be trade wars and the further rise of national enclaves of the Internet. I'd argue that that's not in anyone's long term interests, least alone the US's.
It isn't in certain corporations' interests though, because the whole cloud provider thing hinges on shoving everyone's data into a small number of datacenters globally. I think this is an example of the quite common situation where corporate interests and individual interests are not aligned.
Link: http://www.scion-architecture.net/
This is already "live" in the sense that it is implemented and there are 14 router nodes active, and it is meant to be incrementally deployed. I haven't gotten around to hooking up a client myself, that will be an interesting weekend project someday. Any interested ISP can set up their own node and join this project.
Some cool things about SCION and its extensions:
* Isolation domains: can be used to enforce traffic to never leave a given routing sub-plane, for instance a country or a state
* SIBRA: volumetric DDoS mitigation and enablement of the creation of "dynamic interdomain leased lines"
* HORNET: high-speed onion routing
A lot of the "cloud" is an obfuscation. At the end of the day, our data lives on hard drives on servers that are physically somewhere. We should know where that is, and what laws apply to it. When I selected a web hosting provider, I picked the one that disclosed it's datacenter location, the physical security and environmental protection measures, etc. I know the physical place I am entrusting my data to.
Global companies cannot always guarantee that because they operate under a large number of sometimes contradictory laws that keep changing all the time.
Also, if you consider a web app that lets users communicate with each other then the jurisdictions involved might be all of the following:
1) The web site owner's jurisdiction.
2) The hosting firm's jurisdiction.
3) The jursidiction of every single user.
And all of these jurisdictions may have agreements governing data exchange and law enforcement.
This is bound to be extremely complicated.
What you're really saying in the first part of your comment is that there would need to be 'an independent google' for every jurisdiction. That isn't going to happen.
The current situation is a little different since:
"Each account holder resides in the United States, the crimes they are suspected of committing occurred solely in the United States, and the electronic data at issue was exchanged between persons located in the United States."
In this case it does seem reasonable that the company should comply.
Whilst this case my seem straightforward, the precedent (that data held in other countries can be requested by a court in the US based on the fact that Google is a US corp) would lead them necessarily to establish legal entities to prevent that spreading.
They already have multiple legal entities. And there are two different things being conflated here.
1. Info/data that was generated and pertains to people in one jurisdiction that just 'happens' to be shipped to a datacenter elsewhere, just because Google can. This seems to be the current story.
2. Info/data that was generated and pertains to people in one jurisdiction that a legal system in a different jurisdiction tries to claim rights to. This is also happening and has implications for service users, privacy law, etc.
The analogy is an American coffee shop opening a branch in Russia, filming Russians, storing that data in America and then refusing to turn it over to Russian authorities. Practically speaking, you surrender as collateral your property and people in a country's jurisdiction when you choose to do business there.
Should the reverse be true, i.e. should a UK court be able to compel google to produce data on from one of their US customers if that customer had done business in the UK?...
it's a very sticky area, personally I think it will lead down the path that Microsoft have started on which is that the cloud providers will end up with partially independent companies running in major legal jurisdictions and the data will be held in those countries.
The reason why it is a non-problem is that there is an established procedure for this that works quite well. Take the warrant from a US court to a court in the other country, cite the appropriate international treaty we have with them, and then access the information in that other country in accord with local law.
This is how we have to go about getting access to foreign bank accounts. Or getting your personal papers searched if you lie abroad. The same standard should apply to emails.
But US courts wish to apply US law to emails and people who do not live in the USA. Why should US law apply to them? What are the limits of a government of one place applying its laws elsewhere? Do you wish France to be able to access your emails? How about Iran?
Furthermore complying with US decisions like this puts Google in conflict with foreign laws about data privacy. This issue is already costing them a lot of lost business. What penalties are appropriate for their violations of local law?
Apparently Google has moved the data abroad so it is no longer on US servers. Google regularly does this - they try to place information close to where it gets requested for reasons of efficiency. On the other hand this fact is something that nobody outside of Google can verify. Are we sure that there are no copies left in the USA? Did you look in your backups? Are you sure?
So on a physical analogy, it is like a warrant for documents that were purportedly carried out of the country. If they really were, then you would appropriately have to deal with that other country. If they weren't, then Google should produce the documents.
The court doesn't want to debate Google on unverifiable facts. The crime took place in the USA. Google can easily produce the documents. We only have Google's word that this requires accessing data from abroad.
I can make arguments for this on both sides.
First, Google's architecture supposedly constantly moves data from place to place, so US law enforcement could spend considerable effort going to a court in France and convincing them they should hand over the data, only to hear, oops, while you were doing that we moved it to Canada. It also potentially splits data into many parts, requiring the US to go to several different courts. (Google also didn't even say which country or countries the data is stored in, though I suppose the US could probably subpoena that information.)
Second, Google says that the only system they have for giving data to law enforcement requires going through employees in the US, regardless of where the servers to be accessed are located. Makes sense, since their architecture is location-agnostic by default, and handling law enforcement requests is a specialized job. But a decision from a foreign court is not binding on those employees! US law enforcement would have to try to get the country hosting the data to go and physically seize Google's servers, and manually search through their hard drives. Admittedly, they'd probably only have to pull a stunt like that once before Google decided to get more cooperative, but it's still a messy situation.
FWIW, I agree with your concerns about foreign data privacy laws, but the solution can't be to effectively make certain data immune to court-ordered access of any kind. (Well, at any rate, such a solution would be contrary to political orthodoxy even in the EU, though cypherpunk types might be happy with it - a category I count myself in to some extent. :) Maybe the US needs to pass laws explicitly addressing this situation, but considering the current political situation, I wouldn't expect that to happen anytime soon…
In reality, there's a built in tension between what a prosecutor or regulator wants and the interest of the individual. 200 years of law in the US was built around your "papers", mostly held in your home or on your person.
Now you have this new world where your "papers" may be a detailed diary of every place you've been for most of your life. My wife's phone has immediate access to 60,000 pictures with date and geo-stamps dating back to 2003. Oh, and by the way the storage of this stuff may be on a phone or computer in your possession, or in the hands of a 3rd party like iCloud, Google, etc.
The law is behind in it's understanding, and the various authorities want to have the ability to have total information awareness.
It's entirely possible to compartmentalize hosting and authorized access, such that one subsidiary has no access to the data stored by another. That's critical if, for instance, you need to meet regulatory requirements such as the "data protection" laws in the EU. Rulings like this one, if not successfully appealed, will make it nearly impossible for any company with subsidiaries in multiple countries to meet such regulatory requirements.
US corps like Google want to be able to provide services to people all around the world. If they can be compelled by a judge in any country to provide data on any user, that could cause a lot of problems.
for example say a user in Germany makes a deal with a user in the USA which then goes bad and the case is heard in the US. In Germany the privacy laws are different and could prevent the data from being used in the case. Can a US judge require that data to be produced?
Next step in the chain, a russian user and a US user have a deal, which goes bad, and a russian court requires the data from the US user to be provided. Should it?
Now the obvious argument here is one of american exceptionalism, that google is a US company and therefore needs only concern itself with US law. Unfortunately that leads down the line of companies in other countries not making use of Google's services as they can't legally allow data they process to be subject to US laws...
Google turns over data like this all the time. In fact, ever thing seems reasonable about the warrant, so why are they fighting this? It's right there.
I suspect somewhere within either the Google corporate structure or structures of one of their trusted partners are individuals that have done some thing that could potentially put Google in hot water. It's just a theory, but I think it's plausible.
Now if you have shown consistently that you had opportunities to cheat me but haven't, I might trust you on this one. The US government? Fuck no.
The whole point of keeping data in a different country is to keep it inside the jurisdiction of that country. This makes American companies less competitive. US government already treats non-Americans like shit, they might want to access all emails of all non-American people using Gmail where the data is stored in EU or India.
I think American companies must lobby with foreign governments to put an end to this.