Microsoft Defies Court Order, Will Not Give Emails to US Government
windowsitpro.com
windowsitpro.com
The U.S. Gov has gone mad with power.
And for perhaps the first time ever: bravo Microsoft! I don't even care if you did if for the PR, it's still a brave stand.
That said, why would you be surprised that the same governments happily collaborating with the NSA wouldn't do anything about privacy? We're pretty lucky as it is to have a privacy protection law at all.
In this case, EU data-privacy laws emerged as a way to harmonize EU trade and law enforcement practices. They were then made compatible with US laws through various international agreements and treaties. Things were working, more or less.
Then the US Congress passed the PATRIOT Act in haste, and broke everything. It took years to sketch out a way to make these incompatible laws work together, sort of. Grey areas were swept under the carpet, in hope that particular circumstances they covered "would never happen". Now they are happening, due to a combination of factors (the emergence of cloud computing, NSA revelations, differences in foreign policy stances, etc).
Until Microsoft keeps this stance and the US legal landscape allows them to, EU governments simply don't have to do anything - the Data Protection Directive holds, US law enforcement yields. If MS is actually forced to hand over the data, then a response will be required from our side of the pond.
That may change more swiftly than you imagine. It seems like the US is already far more reluctant than ten years ago to go rushing in.
In the grand scheme of things, EU defense relies immensely on US forces and there are no signs that this is going to change anytime soon. The UK is struggling to just maintain capability, let alone expand it to replace allied resources. The French are now 100% integrated in NATO and have enough on their plate by caring for their African ex-colonies anyway. Italy and Spain can't pay state pensions, let alone expanding their military. The only country with some spare capacity would be Germany, which cannot do it for historical and political reasons.
In fact, what the Ukraine crisis is showing is how Europe still cannot say no to the US in security matters: it was the US administration that pushed for escalating Maidan (remember "fuck the EU"?), it was the US administration that pushed for sanctions (with Europeans going along grudgingly) and it's the closest US allies (UK, Poland) who are now leading the charge for further escalation... and finding no formal opposition, despite plenty of grumbling across the continent. Because in practice, nobody can afford to lose their US umbrella.
Why not? Surely Europe doesn't want to set a precedent that Russia can foment and fund an "opposition", claim the existence of such an opposition means that the territory it is in should be annexed, and then annex it. I would have expected that Germany of all countries would recognize these tactics for exactly what they are: almost a direct replay of Hitler's pre-WWII tactics. It should be all the more galling because the proximal cause was that Ukraine was too "pro-EU". Yet the EU doesn't lift a finger. AFAICT, Obama doesn't do much because he is more concerned about ISIS, and sees Ukraine as a European problem.
This is what judges are always complaining about. Congress/parliament wants to look good and votes stuff in with utter disregard to the legal implications and how it interacts with other laws.
There is still a big fight in EU law about equality between men and women interaction with divorce proceedings (you can imagine how long this has been going on). Before the equality vote is was okay to treat women differently when it comes to infidelity. Why ? Because in practice, offspring resulting from infidelity has rights (ie. inheritance + money) from both partners in a marriage. If a man has extramarital offspring, he can choose to not be known and he can choose not to be the legal parent. But men and women are equal, it's in the law.
So ... what do we do ?
a) can women deny legal parentage for kids (this would be a disaster for those kids) after giving birth ? The answer is no. Men, of course, can do this for obvious reasons.
b) will we force natural parentage to be registered ? (problem here is, of course, that in many cases it's simply not known. And if the woman doesn't know, gets it wrong (unintentionally or otherwise) or isn't talking, what are you going to do ?)
c) do you revise legal parentage during divorce proceedings (again, in many cases a disaster for the kids)
For obvious reasons, parliaments are not touching this with a 10-foot pole.
> In this case, EU data-privacy laws emerged as a way to harmonize EU trade and law enforcement practices. They were then made compatible with US laws through various international agreements and treaties. Things were working, more or less.
I wonder why this even needs to be stated, but of course EU privacy laws do not protect against search and seizure as part of a criminal investigation.
Which they wouldn't do, because what they would ask would be against the law.
1) Many companies have pulled their data from US-based data centers for fear of government intrusion after the Snowden revelations.
2) The future of Microsoft's server business is in the cloud and they have (likely) told customers their data is safe if stored in the EU
Thus it stands to reason that in order to keep customers and make money, they are motivated to win this case.
Also it would be interesting to see if someone would be criminally liable in Ireland.
That's the most principally interesting thing here IMHO... Can the government of one country compel a citizen to commit a crime in another country? At least in Sweden it could easily be considered a form of espionage to hand over emails to a foreign government.
A few years ago I would have ended that question with !?!?!?, now I'm not so sure... :(
What I'm saying is that there are companies that care about your data for it is their strategy, and then there are companies like Microsoft that will happily steer the ship given whatever wind is blowing at them on any given day.
It would destroy an entire business of theirs. It's vital to their very survival to stop it. It's not even a question, this is as large of an attack on their business as there could be.
Why can't it be all three?
Sticking to principles can be quite profitable, but it still needs balls.
You can't have people unlearn what they have learned. If your wife cheats on you, even if she manifestly passes on an opportunity to do it again in a well publicized display, you are going to have a hard time trusting her from then on and if fidelity is important to you, you may start to examine your options...
Microsoft isn't going anywhere soon. They are embedded. But they are not going to be generally trusted again by many, and I don't believe this can be fixed by a couple of high profile PR schemes. This isn't MS hatred nor NSA rejection. Just stating the reality of the situation. Alternatives are going to be looked for and this case won't change that.
Agreed. Hopefully this encourages more people to stand up to unreasonable violations of privacy from our government.
> And for perhaps the first time ever: bravo Microsoft! I don't even care if you did if for the PR, it's still a brave stand.
The question of whether a company is following principles or motivated by profit/PR is so strange to me. The question is nonsense and the answer irrelevant.
Microsoft is not a person with principles. It's 90,000ish people with different principles. I'm sure some people really believe in the right to privacy, some want to avoid angering customers, some don't care, etc. The reasons and motivations behind a company's actions are as diverse as the actors involved.
We could argue about motivations all day, like the responses to your comment are doing, but it's pointless and irrelevant. Unless you want to hone in and talk about individual people there's no answer to the question, and we're just trading vague meaningless opinions. It's like arguing whether a mountain is rocky or sandy. Chances are that I can find both, so we should either get more specific or talk about averaging via a survey. It happened, and the results are the same.
If a company I liked did this would I think it's a good thing?If so, it's probably a good thing.
No, they really aren't. It's not even true for a democracy, where "we the people" get to vote for a small elite, which in turns will enact laws taking into account lobbying pressure, pressure from political allies, personal interests, likelihood of being re-elected, and occasionally the interest of the people and personal convictions.
A company, especially at this size, is not a democracy. Maybe the janitor believes in privacy, and the clerk trusts the government, but at the end of the day, strategic decisions like this one rest in the hand of a small group at the top. Some of them may occasionally put their principles before "shareholder value" or "next week's bonus", but it looks pretty rare in practice.
Are we truly that insane ?
Wasn't the whole problem with "spying" that there wasn't judicial oversight ? Here we have a case where federal prosecutors went for judicial oversight, were put in the right by a judge. Isn't that exactly what you'd want ?
Laughable comment in the article:
> Let there be no doubt that Microsoft's actions in this controversial case are customer-centric.
Really ? Have we truly forgotten this quickly what happened ?
http://thehackernews.com/2014/03/microsoft-admits-spying-on-...
Btw : keep in mind that this case is also about setting precedent. That is why both parties want it to go to appeal, and don't care about the outcome of this particular trial. It is beside the point. Both the US federal police and Microsoft want the American justice system to decide this issue, and well, the current judge can't make that decision (well, technically it wouldn't be final).
So keep in mind this judge is mostly doing the minimum her job requires and trying to be home in time for dinner here. There is no decision made, nothing like what the article claims has happened, legally speaking.
There was judical oversight... the FISC... aka the rubber stamp
That is the problem with the judiciary today, they have abandoned their responsibility to be a check on government power and instead take the government at their word and rubber stamp everything unless there some defense (which is often not even allowed as these orders are given ex parte in many cases) proves they should be denied
A company, as an organization, can be intelligent or stupid, creative or conservative; it can have social intelligence (Facebook), or it can never get it right with people, but be an excellent engineer (Google). So I don't see why we shouldn't treat an organization as being moral, or immoral, humane or inhumane. By these lines, it's certainly a valid question whether Microsoft is showing character, and high moral standards, or is it simply doing it for personal gain.
I work for a company very similar to Microsoft. If this happened to us, we would do the same thing, for the very same reason.
We would lose every Cloud customer from another country immediately if this was followed. All our work investing and building data centers in the world would be wasted. Companies would pull away all contracts for Cloud work, and we would gain no new ones. It would be the end of the Enterprise Cloud.
That being said, have Microsoft's past mistakes been too big that (what some consider) the good behavior exhibited lately regarding privacy issues is a drop of pure water in an ocean of oil? I'm not implying anything, just asking to provoke thinking.
Can people change? Can large companies change their character? Is Microsoft changing or we are seeing some schizophrenic good actions lately? Food for thought :)
Congress, and to a lesser extent POTUS, are the parties that have voted in these laws and are controlling the agencies doing this, and have the power to change them. Judges should NOT attempt to do so. That is the very definition of what a judge does.
Both parties have mastered using presidential appointments to the supreme court to "change" the law. This is very bad, as they're not supposed to be in control of that. The judiciary's "check and balances" check is mostly to prevent congress from going against the constitution (ridiculous example: voting slavery back in with 51% of votes). That is their function.
I find this bit very interesting. As opposed to Microsoft being a US company, it is that it's operations are located in the US. I wonder what effects this decision could have on the US labor market if companies relocate operations in the same way they relocate certain things for tax avoidance.
They already do. Umpteen companies run servers in this or that country for specific legal reason which are not necessarily related to taxation. Classic case: companies with dubious stands in regard to copyright law.
The PATRIOT Act already forced a number of companies to open European datacentres to satisfy particularly-picky customers; it's just that this particular threat was considered mostly theoretical... until Edward Snowden proved the opposite. Now all cloud-services providers must prove their virginity or risk losing sizeable chunks of lucrative European markets, hence why Microsoft is making a stand (on this case, at least).
I do applaud them: if anything, once this process is over, we'll have a clearer picture of what exactly the US government can or cannot ask from US-based cloud companies. We're currently in a fog where the law says certain things but practical experience says another. A realignment in one way or the other would be most welcome.
It's not picky customers, it's everyone. It's literally the first discussion that occurs. Any company in any part of the world wants their data in a datacenter near them, that follows rules they are comfortable with.
It cannot be overstated just how important this issue is to foreign companies.
In my experience that often wasn't the case until Snowden came about, but I guess it might depend on specific sectors.
I agree that now it's absolutely everyone.
That's a VERY US centric view...
> Let there be no doubt that Microsoft's actions in this controversial case are customer-centric. The firm isn't just standing up to the US government on moral principles. It's now defying a federal court order.
Whoever wrote this clearly didn't bother wondering if, just maybe, handing out customer data "overseas" ("overseas" apparently means Ireland) would be illegal under EU and Irish law. But let's not minor details like this get in the way of good PR.
We get in so much trouble trying to understand companies as if they're individual humans. Evolutionary biology for corporations needs to be taught.
As for Microsoft, they have demonstrated time and time again they are not aligned with the user but with Big Brother. They are lawful evil, to use D&D parlance.
there is an amazing tax already on these services having to implement per government specific retention policies based on where they do business. for example in ireland, by law you need to be able to produce up to a year of content even if an account has been deleted. in the u.s. the period is much shorter. so if other countries create similar legislation after seeing a u.s. version of this law stick, everyone will have to implement a myriad of retention policies, or worst case retention, in every datacenter they operate. it drives up cost and complexity in the services.
this might not be popular to say, but microsoft taking a stand here is an amazingly good thing for our industry.
MS is stuck between a rock and a hard place here, no doubt, and I think it's important for this stand to be made. Hopefully sanity will prevail here...
I don't think the U.S. government would appreciate if Google were forced to turn over the Google Apps data of scientific universities to China because of a court order there.
Its an american owned and operated data center in Irelend (where I live). Presumably the email is 'owned' by an american and the case involves all american actors(cant really make that assumption I guess) so there dosn't seem to be anything to spark the interest of the Irish legislature. Unless you make the leap to the point that now america can just demand ALL the data in that data center which you certainly could.
This isn't really the same as a warrant either is it? They are not demanding to be allowed access to or to search the data center. Microsoft in America is being ordered to hand over a document that they have access to, where that document is seems irrelevant (just playing devils advocate).
Also the chances of any small to medium sized nation (particularly Ireland) getting on their high horses about this is quite unlikely due to the amount of money these large multi-nationals bring here. In fact if this is upheld I imagine it would be another boon for Ireland as the american companies will have to set up even more infrastructure so that they can argue that its a completely separate entity that they simply funnel customers to or whatever. If the companies act first they could even get favorable Irish legislation passed to prevent the type of treaty talked about in the article (although this would be a pretty ballsy move for Ireland)
Indeed, sounds like a dubious assumption to me.
That's why my company is putting datacenters everywhere. Chinese demand a Chinese data center for Cloud computing. This happens all over the world, and our strategy is all about that.
This is a very real issue, and if the US states that any US company has to turn over data, you can kiss every customer from another country goodbye.
It's an extremely serious situation in my view.
It's not as if Microsoft is selling access to the highest bidder, or considering a request from another company or a charity. Turning over specific data in the face of a court order is not going to drive every customer away, many will see that as acceptable, low risk, reasonable behaviour.
I've worked on many bid (on both sides of the table) where US based hosting was forbidden either by the bid process or by law (the new Australian privacy legislation makes it much simpler to keep data on-shore).
At the moment many companies just resort to using the Australian Amazon data centre, and everyone is ok.
If MS loses this case, I'd say 70% of those (enterprise) contracts using Amazon will use a non-US-owned provider simply because the risk is yet another things that has to be overcome.
Take a company from Qatar. Perhaps they are comfortable with any datacenter in the middle east for Cloud Computing with a US company. If this becomes standard US law, they won't accept a US company for any reason. Thus every US company loses the customer, the profit, the business and it's replaced by others.
It's that simple. And what about companies that are from another country, but have US entities?
It's just a massive issue that could destroy corporate cloud computing.
Microsoft will eventually roll over.
As I see it, the judge had no choice but to issue the order, and Microsoft has no rational alternative but to defy it if they want to conduct business as an international provider of cloud services. The real problem is with Congress, not the courts. When they permitted intelligence agencies to run amok with absolutely no Constitutional boundaries, they thought very little about the long term consequences and cared even less.
I don't see any claim that it was ever in the US.
I don't think intelligence agencies are involved here at all. In fact, them "running amok" would be easier in this case: they would have those emails already, process be damned.
In truth, this particular process would have happened at one point or another regardless of intelligence services, it's just a function of global internet services existing and laws having emerged to deal with them. Back before EU privacy laws were introduced, Microsoft would have just handed out anything they had to the FBI without really a second thought. Now they have to comply with two conflicting sets of laws.
It's not just a problem with the US Congress: it's a transatlantic (or rather global) conflict between incompatible laws.
It's like France had a law prohibiting a company from selling widgets at price X worldwide, and the US had a law forcing them to sell the same widgets at price X worldwide: you just couldn't obey both laws, since they both claim the same jurisdiction while mandating conflicting behaviour. You would need an international treaty to harmonize this, or one country to drop their law.
The data was never in the US of A to begin with, and if Microsoft USA forces Microsoft Ireland to retrieve the file Microsoft USA can kiss their entire cloud offering Goodbye in Europe since no-one will use them because the data could potentially be accessed by the US government with no regard for EU laws.
[1] Instead of what? Saying "Yes sir" at the first request?
I assert that the answer is clearly a big No....anyone else agree with me??
> The removal of the suspension legally requires Microsoft to hand over the email immediately
vs
> The judge has now ordered both Microsoft and federal prosecutors to advise her how to proceed by next Friday, September 5
Paul Thurrott is of course a relentlessly pro-Microsoft writer, and I can't help but get the feeling he's trying to take advantage of strategic ambiguity to put out a positive story here. I will stay tuned to see if indeed there is some kind of punishment meted out to Miscrosoft - otherwise my assumption would be that this is much less of a story than it sounds.
Which brings up another question. Instead of proposing that the officers be held in contempt, could the judge instead rule that the corporate charter get suspended? It seems like that would be more analogous to imprisoning a "person".
[1] - http://www.millerjohnson.com/pubs/xprPubDetail.aspx?xpST=Pub...
The sticky point may be that the locality of data is impermanent and ambiguous. In the MS case, though the data is said to be stored on a server in Ireland, it could just as well be distributed, moved or duplicated anywhere, and for all we know it already has been.
Eventually laws will have to come to terms with the implications of the Internet: data, like a flock of migratory birds, for its own reasons goes one place to another and knows nothing about national boundaries.
Predictions are dangerous, but probably the forecast for the future is that it will be even more "cloudy", whether we like it or not. Of course, can't do much about the weather anyway...
This is a joke only up to a point. The current legal landscape emerged throughout the last few centuries mostly in response to commercial pressures: as commerce grew in range, volume and needs, so did laws, agreements and conflicts.
We now have a situation where global commerce is real, both in a physical and logical sense. The law, both at national and international level, just doesn't know how to deal with it. Companies design hardware in Massachusetts, produce it in China, sell it in Europe, and file their accounts in Caribbean islands. They develop software in Romania, run it on servers in Texas, sell it to the Brazilian market, support it from India, and file accounts in Luxembourg. This stuff could only be done by a handful of players back in the '70s, and we could deal with it on ad-hoc basis ("dude, we know your money is in Switzerland, just open a token factory in my constituency and we'll call it even"). Now it's just how business works everywhere, and we need real processes to scale up.
What rules can be defined and applied? How are they going to be enforced? Who is responsible for amending them? These big questions are the real challenge of this century for us "First World", and some harmonization will eventually have to emerge one way or the other.
Bravo Microsoft.
But then again even Microsoft has been complicit with PRISM along with Apple and many other Silicon Valley companies. (Yes I know Microsoft is not Silicon Valley)
I personally would have enjoyed listening to more of Tim Cook on this topic if Apple and MS swapped places. Earlier this year, he said the USG needed to cart employees out in a box before they can get access to Apple servers. Interesting quote for sure.
What if the data is striped among all the countries where Microsoft has datacenters? Do you get the union of all possible data protections? Or the intersection?
There are actual legal questions here and Microsoft's position is not neutrally good.
Are they? Where did you read that? As far as I know, the nationality of the Microsoft customer hasn't been released.
And that is assuming this is more than a choreographed piece of theater attempting to restore trust in US cloud services. Which maybe it is. And.... maybe it isn't.
This is criminal case and the question is the limits of legal discovery.
[1] https://www.eff.org/deeplinks/2013/08/dea-and-nsa-team-intel...
Anyway, it always freaks me out a bit when people cheer a megacorp like MS. They're not fighting for you, they're fighting for your perception of them. The faster you cheer, the less they'll do.
Still it is nice to see MS take a stand.