MPA Gets Ireland To Crack Open The Site-Blocking Door It Plans To Bust Through

from the block-party dept

Give an inch and they will take a mile, as the saying goes. This mantra applies quite nicely to the recent spate of site-blocking efforts that have taken place around the world. Once content owners, chiefly Hollywood and music groups based in America, manage to slightly open the door to having entire sites blocked by order of government, they then barge through and expand the scope of the site-blocking exponentially.

And the groups doing this barging don't even bother to hide their plans. In Ireland, one can see this in the recent news of the Motion Picture Association submitting an order to have several websites blocked by ISPs there.

On behalf of several major Hollywood studios, the group requested Irish Internet providers to block access to three popular streaming sites; movie4k.to, primewire.ag, and onwatchseries.to. In their complaint, the movie studios, including Disney, Twentieth Century Fox, and Warner Bros, described the sites as massive copyright infringement hubs, with each offering thousands of infringing movies.

Monday evening the court approved the request. This means that the three websites will soon be rendered unavailable by Eircom, Sky Ireland, Vodafone Ireland, Virgin Media Ireland, Three Ireland, Digiweb, Imagine Telecommunications, and Magnet Networks.

The blocking of entire websites on the basis of industry complaints should be seen as no small thing. Given how often sites that Hollywood claims are "pirate sites" in fact have completely legitimate uses, wary eyes should be cast at this sort of censorship. These three sites may not fall under that falsely accused designation. The problem is that in the immediate aftermath of the court's decision, the MPA is licking its chops to go after many, many more sites.

The ISP asked the court to put a cap on the number of notifications, limiting it to 50 per month. However, the movie studios objected to a blocking cap, and the judge decided not to add any limitations for now.

No caps, because as we've seen in other European countries, these blocking requests will now be vastly expanded to include all kinds of websites. With that volume increase will come mistakes, overreach, and false accusations. It's what always happens. And at that point, Irish citizens, and perhaps the courts, will realize exactly what kind of Pandora's box has been opened to satiate the folks in Hollywood. The ISPs in Ireland already know this, as they are hedging their support for these blocking efforts in the future.

Irish Times reports that none of the ISPs opposed the blocking request. However, Eir said that the costs involved could become an issue if the number of blocked websites increases drastically in the future.

It's easy money to bet that those drastic increases will come about quite quickly. Hollywood can't seem to keep from barging through a door like this once it's been cracked open.

Filed Under: copyright, ireland, movies, site blocking
Companies: mpa

Appeals Court Upholds Its Denial Of DOJ's Demand For Microsoft's Overseas Data

from the go-bother-some-legislators,-kid dept

After being handed a loss in its judicial quest to force Microsoft to hand over data held in Ireland, the DOJ asked the Second Circuit for a rehearing of its July decision. At the center of the case is the DOJ's belief that it should be able to force US companies to turn over data/communications contained in overseas servers.

The government wants to have it both ways with its warrants for electronic data. On one hand, it analogizes data demands as being no different than digging through a filing cabinet found in a house it's searching. It argues that data held in servers/devices should be treated no differently than the personal papers the founding fathers tried to protect with the Fourth Amendment.

Then it argues that even if the "filing cabinet" isn't located on the premises it has a warrant to search, it should be able to access the contents of that cabinet. This, from Microsoft's motion to dismiss, explains what the government is truly asking for, using the sort of physical world comparisons the DOJ understands.

The Government cannot seek and a court cannot issue a warrant allowing federal agents to break down the doors of Microsoft's Dublin facility. Likewise, the Government cannot conscript Microsoft to do what it has no authority itself to do -- i.e., execute a warranted search abroad.

In its original decision, the Appeals Court pointed out that Congress clearly didn't intend the wording of the Stored Communications Act to cover foreign data centers, no matter what sort of twisted, hybrid paperwork the feds served Microsoft in hopes of routing around territorial limitations. The court noted, as it often does, that if the DOJ wanted its half-warrant/half-subpoena to both skirt mutual assistance treaties and the court's interpretation of the SCA, then it needed to approach Congress directly and get the SCA updated/amended.

And, indeed, the DOJ has done exactly that. It's seeking legislation specifically targeting the terroritorial limitations in the SCA that prevent it from doing what it wants to. But in the meantime, the DOJ thought the court should take another swing at it. The Second Circuit has decided to pass on this opportunity. But it has issued an affirmation [PDF] of its original ruling, with some additional dissenting voices appended.

An equally divided federal appeals court refused to reconsider its landmark decision forbidding the U.S. government from forcing Microsoft Corp and other companies to turn over customer emails stored on servers outside the United States.

Tuesday's 4-4 vote by the 2nd U.S. Circuit Court of Appeals in Manhattan let stand a July 14 decision that was seen as a victory for privacy advocates, and for technology companies offering cloud computing and other services worldwide.

But the dissenting judges said that decision by a three-judge panel could hamstring law enforcement, and called on the U.S. Supreme Court or Congress to reverse it.

"The panel majority's decision does not serve any serious, legitimate, or substantial privacy interest," Circuit Judge Jose Cabranes wrote in dissent.

The opinion doesn't tell the DOJ anything it didn't tell it previously, other than that the court is evenly divided. The decision reiterates points the DOJ didn't like the first time around. And, once again, it directs the DOJ's efforts at legislators, while also pointing out the dissent's similar willingness to interpret the law in ways Congress never intended.

The position of the government and the dissenters necessarily ignores situations in which the effects outside the United States are less readily dismissed, whichever label is chosen to describe the “focus” of the statute. For example, under the dissents’ reasoning (as we understand it), the SCA warrant is valid when (1) it is served in the United States on a branch office of an Irish service provider, (2) it seeks content stored in Ireland but accessible at the U.S. branch, (3) the account holding that content was opened and established in Ireland by an Irish citizen, (4) the disclosure demanded by the warrant would breach Irish law, and (5) U.S. law enforcement could request the content through the MLAT process. This hardly seems like a “domestic application” of the SCA.

Rather, we find it difficult to imagine that the Congress enacting the SCA envisioned such an application, much less that it would not constitute the type of extraterritorial application with which Morrison was concerned. Indeed, calling such an application “domestic” runs roughshod over the concerns that undergird the Supreme Court’s strong presumption against extraterritoriality, and suggests the flaw in an approach to the SCA that considers only disclosure.

The DOJ's flawed approach is also its most common approach. It seems genuinely baffled/irritated when its requests -- and its interpretation of the law -- are challenged. It views laws that don't allow it to do what it wants to do as broken. Rather than view limits in laws as guidance to help keep it aligned with Constitutional rights, it tends to do what it wants and let the courts sort it out.

Sure, the judicial process isn't exactly speedy, but it has better odds and a faster turnaround time than guiding legislation through multiple Congressional hoops. And it will continue to play the odds because not every service provider has the resources or legal acumen to fight back against unlawful demands.

Filed Under: data, doj, ireland, overseas, privacy, second circuit, subpoena, warrant
Companies: microsoft

Government Seeks Do-Over On Win For Microsoft And Its Overseas Data

from the please-please-please-let-me-get-what-I-want dept

The DOJ wants the Second Circuit Court of Appeals to revisit the decision it handed down in July -- the one that's preventing it from forcing Microsoft to hand over data stored on its servers in Ireland. The DOJ hoped the court would read the Stored Communications Act as applying to the location of the company served with the data request, rather than the actual location of the data. The Appeals Court disagreed with the lower court's finding -- one that dragged in the Patriot Act for some reason -- pointing out that the purpose of the SCA was to protect the privacy of communications, not to facilitate the government in obtaining them.

The government has filed a petition [PDF] for a rehearing of the case, obviously in hopes of a reversal. Jennifer Daskal of Just Security has posted several reasons why the DOJ's desired interpretation of the Stored Communications Act is dangerous, along with other problems arising from this decision.

To begin with, the decision raises new logistical issues, both for the government and the private companies served with these warrants.

According to the government, companies like Google and Yahoo! now need to ascertain the location of sought-after data “at the moment the warrant is served.” If the content is stored abroad, it is now “beyond the reach of a Section 2703 warrant, even when the account owner resides in the United States and the crime under investigation is entirely domestic.”

The court's interpretation of the SCA theoretically means Google will never again have to turn over requested emails to law enforcement.

Moreover, in the case of Google, this data is also outside the reach of a MLA request “because only Google’s US-based employees can access customer email accounts, regardless of where they are stored.” (p.6) In other words, US law enforcement cannot access the data because it is outside the reach of the US warrant authority. And foreign governments cannot because they lack jurisdiction over the US-based employees that control the data. No law enforcement official can access it anywhere.

That being said, Daskal points out that the government also feels that just because it has a warrant, it should be able to demand the production of communications wherever, whenever. This flat assertion that warrants trump privacy in every case is every bit as one-sided as the DOJ's theory that Google now has the option to rebuff warrants at its sole discretion.

The DOJ's fears aren't entirely unfeasible. Companies that sell their communications tools with privacy-heavy sales pitches could simply offshore their data storage to put it out of reach of SCA-citing warrants, turning the 2nd Circuit's ruling into a middle finger to US law enforcement.

If this is going to be fixed in any sort of way that doesn't turn this into a one-sided victory for service providers or the government, it's probably going to need to be through legislation. The court's revisitation of the issue (courts have generally been favorable to rehearing requests from the US government) may come to that very conclusion.

Indeed, the DOJ has already begun pushing for a legislative solution, albeit one that heavily favors the government. The DOJ wants existing Mutual Legal Assistance Treaties (MLATs) modified so the FBI, etc. can continue to compel the production of communications stored overseas without tripping over reluctant US service providers or statutory limitations built into the SCA.

As Daskal notes, Congress is better off addressing this issue sooner rather than later. Should the court reverse its decision and allow the FBI to demand communications from foreign data centers using nothing more than a warrant issued by a local magistrate, other countries far less concerned about US privacy protections will be sure to utilize the same tactics.

Yet I continue to have concerns about the result of a governmental win: the government gets free rein to compel any US-based provider to disclose any user’s data, without any constraint based on things like the location or nationality of the target. This is a rule that will be watched, and likely mimicked, by others.

Consider the broader implications: The United States would (or at least should) be concerned if foreign governments unilaterally demanded the unilateral production of US citizens and residents data. And in fact current US law prohibits US-based providers from responding to those demands—requiring that the foreign governments instead employ the MLA process and ultimately obtain a US warrant based on the US standard of probable cause. Foreign government also have an interest in controlling access to their residents data. Those interests ought to be taken into account.

Unfortunately, Congress doesn't really have a great track record when it comes to legislative fixes for tech issues. We have a more technologically-adept set of legislators than we've ever had previously, but there are still many who won't see the forest of implications for the law enforcement trees. But the situation may become much, much worse if left unattended.

Filed Under: doj, electronic surveillance, ireland, jurisdiction, stored communications, warrant
Companies: microsoft

Rather Than Coming Up With Brand New Taxes For Tech Companies, The EU Just Issues A Massive Fine On Apple

from the double-irish-with-a-dutch-sandwich dept

For quite some time now, we've seen EU regulators talk fairly openly about their desires to harm American internet companies, mostly in a misguided attempt to boost local European companies (and to collect more money). It's why we keep hearing about weird, carefully targeted regulations designed to pump up how much money companies like Google, Apple and others pay.

At the same time, parts of Europe (Ireland, in particular) have been doing basically everything they can think of to woo American tech companies. Ireland has successfully offered ridiculously friendly policies, leading many large internet companies to set up offices in Dublin, and then use that as the place where they "recognize" all their revenue. There are a variety of tax dodges employed here, which go by fun names like Dutch Sandwich and Double Irish.

US Companies have been doing this for many years, and while it (frankly) looks pretty sleazy, they do seem to mostly play by the rules. We can argue over whether or not the tax breaks they get are worth it, but the whole thing just feels sketchy in that it's clearly playing some jurisdictional games to get lower tax rates. Of course, there's also been another looming issue on all of this, which is that these giant internet companies have been pushing heavily to be able to get the cash that they've been accumulating in Ireland back into the US, without then having to pay all those taxes on it. So they've been pushing for some sort of "amnesty" period or "holiday" where they can bring the cash back in.

Frankly, the whole thing is a little ridiculous. With so much money on the line, you can see why these companies play games, but that still doesn't make it right. The internet giants often seem to put this issue at the top of their lobbying priority list, and that's unfortunate. The thing that I like about Silicon Valley is that much of the industry comes from actually creating new and useful things and building stuff up. Playing tax dodging games is the opposite of that. It's playing political games and it feels super counterproductive.

Now, add on top of that the fact that the EU has realized that rather than just create new laws that will tax internet giants, it can just go ahead and hit Apple with a massive tax increase all by itself.

Apple Inc. was ordered to pay as much as 13 billion euros ($14.5 billion) plus interest after the European Commission said Ireland illegally slashed the iPhone maker’s tax bill, in a record crackdown on fiscal loopholes that also risks inflaming tensions with the U.S.

The world’s richest company benefited from selective tax treatment that gave it an unfair advantage over other businesses, the European Union regulator said Tuesday. It’s the largest tax penalty in a three-year campaign against corporate tax avoidance. Apple and Ireland both vowed to fight the decision in the EU courts.

No one comes out of this looking very good. The tech companies playing tax haven games look bad -- even if you think the tax rate is too high and they should be trying to get it lowered. The EU government looks typically jealous and petty towards American companies. And of course, people are already talking about a possible trade war over this issue.

Frankly, I'd much rather tech companies be focused on innovation in their products, rather than in their tax strategies.

Filed Under: eu, ireland, tax, tax avoidance, tech companies
Companies: apple

DOJ Pushes Out Legislation Proposal To Undercut Microsoft Case Decision About Overseas Searches

from the please-please-please-let-us-get-what-we-want dept

No sooner had the ink dried on the Second Circuit Appeals Court decision regarding Microsoft and its overseas servers than new legislation designed to undercut the court's finding has been printed up by the DOJ and presented to the administration.

Microsoft successfully argued that the US government couldn't force it to unlock a server in Dublin, Ireland, so it could rummage around for evidence. Nor could the DOJ force the company to act on its behalf, performing a search of its overseas servers for documents the US government couldn't access otherwise.

Since that decision obviously just won't do, the DOJ has presented proposed legislation [PDF] that would alter existing Mutual Legal Assistance Treaties (MLATs) so the agency can do the very thing a court just said it couldn't do.

The details are discussed in, um, detail over at the Lawfare blog by none other than a former DOJ lawyer (David Kris). Needless to say, the post skews towards "supportive," but the analysis is thorough and offers some excellent insight on what the DOJ hopes to open up -- and what it's willing to concede in return for this new power.

The law would limit searches to communications from non-US citizens located abroad and only for criminal investigations. This would prevent the altered MLATs from being used by US agencies to gather intelligence, restricting them only to gathering evidence of criminal activity. That being said, for every concession made, there's a DOJ land grab.

The heart of the proposed legislation is section 4, which allows for executive agreements between the U.S. and foreign governments. Where a satisfactory agreement is in place, the barriers to access in the Wiretap Act, Stored Communications Act, and criminal Pen Register statute are removed (by section 3).

Of all the places to remove existing limits, the DOJ has chosen three of its most-abused laws/statutes. The Wiretap Act has been rendered toothless by the DEA's collusion with a judicial rubber stamp in California and used by the DOJ to push American telcos into doing its spying for it. The Stored Communications Act was just another (failed) angle of attack for the DOJ in its fight against Microsoft. And the Pen Register Act has been used as a cover for Stingray deployments by multiple law enforcement agencies, all with the tacit approval of the FBI, which still acts as a middleman in every IMSI catcher purchase by local PDs.

From there, the DOJ offers a melange of legal authorities to govern its searches of foreign servers.

The foreign orders authorized by the agreement must meet several specific requirements. First, they must pertain to the “prevention, detection, investigation, or prosecution of serious crime, including terrorism.” This means that affirmative foreign intelligence gathering is out of bounds. Conceptually, the idea here seems similar to the split in FISA’s two definitions of “foreign intelligence information,” 50 U.S.C. 1801(e)(1)-(2).

[...]

Second, the foreign orders must use a “specific” identifier such as a name or account as the “object of the order.” This comes from the USA Freedom Act’s amendments to FISA, designed to prevent bulk collection, 50 U.S.C. 1841, 1861.

[...]

Third, the orders must be “based on requirements for a reasonable justification based on articulable and credible facts, particularity, legality, and severity regarding the conduct under investigation,” and must be subject to “review or oversight” by a judge or other “independent authority.” These elements seem to be derived in part from several U.S. constitutional requirements—e.g., those governing a stop and frisk (Terry v. Ohio, 392 U.S. 1 (1967)), the definition of probable cause (Illinois v. Gates, 462 U.S. 213 (1983)), the requirements for a search warrant (including particularity and a neutral and detached magistrate, see Maryland v. Garrison, 480 U.S. 79 (1987)), and a proportionality requirement.

At first blush, these would seem to subject DOJ requests to multiple forms of oversight. But it most likely won't. The self-written loopholes allow for plenty of "search first, ask permission later" action.

Of course, the requirements are not exactly the same as those the Fourth Amendment would compel—for example, the reference to “review or oversight” by a judge or other “independent authority” would seem to permit after-the-fact review by a Parliamentary body rather than advance review of orders by a judge.

On top of that, the folding in of FISA language allows the FBI, et al to interpret "criminal investigation" very loosely.

Note, however, that counter-intelligence, expressly including counter-terrorism but also probably including counter-espionage, is included, because the language refers not only to “investigation” and “prosecution,” but also to “prevention” and “detection” of crime.

So, despite saying the MLAT alterations would be limited to investigatory work, rather than intelligence gathering, the new agreements could be read as permitting both. And, despite restricting agencies from using foreign government to obtain data or communications they otherwise wouldn't be able to access, the proposal does allow these entities to provide US agencies with data and communications involving US persons. Sure, there are minimization procedures, but they're apparently tied to restrictions built into foreign governments' laws rather than our own, and auditing for abuses of this access is limited to a review every half-decade -- hardly the sort of thing that stops abuse in its tracks.

And the minimization procedures deployed by foreign governments when handing over info on US persons are tied to a bunch of exceptions -- the usual parade of horrors agencies use to justify intrusive surveillance.

[A] foreign government “may not disseminate the content of a communication of a U.S. person to U.S. authorities unless it is relevant to the “prevention, detection, investigation, or prosecution of serious crime, including terrorism, or necessary to protect against a threat of death or serious bodily harm to any person,” and also “relates to significant harm, or the threat thereof, to the United States or U.S. persons, including but not limited to crimes involving national security such as terrorism, significant violent crime, child exploitation, transnational organized crime, or significant financial fraud.”

So, it can't be used for anything not included on the "serious crimes" list, which doesn't leave much. There's not a whole lot of criminal activity that can't be squeezed into this laundry list. Moving violations? Jaywalking? Lord knows anything drug-related will still be considered "dangerous," even if most of the threat is composed of overreacting drug warriors lobbing flash bangs into cribs at 5 am.

Obviously, the DOJ wasn't just going to stand by and let the Second Circuit determine how it's going to operate. This bill may have been a long time in the works, but its public debut is impeccably timed.

Filed Under: doj, ireland, jurisdiction, legislation, subpoena, warrant
Companies: microsoft

Huge Win: Court Says Microsoft Does Not Need To Respond To US Warrant For Overseas Data

from the big-news dept

We've been following an important case for the past few years about whether or not the US can issue a warrant to an American company for data stored overseas. In this case, Microsoft refused to comply with the warrant for some information hosted in Ireland -- and two years ago a district court ruled against Microsoft and in favor of the US government. Thankfully, the 2nd Circuit appeals court today reversed that ruling and properly noted that US government warrants do not apply to overseas data. This is a hugely important case concerning the privacy and security of our data.

The key issue here is that the US government was basically on a fishing expedition for information hosted on Microsoft Outlook.com email servers. And there are a few really key issues, concerning jurisdiction, privacy and the all important difference between a subpoena and a warrant (something that many people seem to think are the same thing). Microsoft's own response to the lawsuit did a really good job explaining the issues and how the government wanted to pretend a warrant was a subpoena, and what that meant for the 4th Amendment:

The Government cannot seek and a court cannot issue a warrant allowing federal agents to break down the doors of Microsoft's Dublin facility. Likewise, the Government cannot conscript Microsoft to do what it has no authority itself to do -- i.e., execute a warranted search abroad. To end-run these points. the Government argues, and the Magistrate Judge held, that the warrant required by ECPA is not a "warrant" at all. They assert that Congress did not mean "warrant" when using that term, but instead meant some previously unheard of "hybrid" between a warrant and subpoena duces tecum. The Government takes the extraordinary position that by merely serving such a warrant on any U.S.-based email provider, it has the right to obtain the private emails of any subscriber, no matter where in the world the data may be located. and without the knowledge or consent of the subscriber or the relevant foreign government where the data is stored.

This interpretation not only blatantly rewrites the statute, it reads out of the Fourth Amendment the bedrock requirement that the Government must specify the place to be searched with particularity, effectively amending the Constitution for searches of communications held digitally. It would also authorize the Government (including state and local governments) to violate the territorial integrity of sovereign nations and circumvent the commitments made by the United States in mutual legal assistance treaties expressly designed to facilitate cross-border criminal investigations. If this is what Congress intended, it would have made its intent clear in the statute. But the language and the logic of the statute, as well as its legislative history, show that Congress used the word "warrant" in ECPA to mean "warrant," and not some super-powerful "hybrid subpoena." And Congress used the term "warrant" expecting that the Government would be bound by all the inherent limitations of warrants, including the limitation that warrants may not be issued to obtain evidence located in the territory of another sovereign nation.

The Government's interpretation ignores the profound and well established differences between a warrant and a subpoena. A warrant gives the Government the power to seize evidence without notice or affording an opportunity to challenge the seizure in advance. But it requires a specific description (supported by probable cause) of the thing to be seized and the place to be searched and that place must be in the United States. A subpoena duces tecum, on the other hand, does not authorize a search and seizure of the private communications of a third party. Rather. it gives the Government the power to require a person to collect items within her possession, custody, or control, regardless of location, and bring them to court at an appointed time. It also affords the recipient an opportunity to move in advance to quash. Here, the Government wants to exploit the power of a warrant and the sweeping geographic scope of a subpoena, without having to comply with fundamental protections provided by either. There is not a shred of support in the statute or its legislative history for the proposition that Congress intended to allow the Government to mix and match like this. In fact, Congress recognized the basic distinction between a warrant and a subpoena in ECPA when it authorized the Government to obtain certain types of data with a subpoena or a "court order," but required a warrant to obtain a person's most sensitive and constitutionally protected information -- the contents of emails less than 6 months old.

It was unfortunate that two judges at the district court level basically ignored this argument, so it's good to see the appeals court shoot it down completely.

For the reasons that follow, we think that Microsoft has the better of the argument. When, in 1986, Congress passed the Stored Communications Act as part of the broader Electronic Communications Privacy Act, its aim was to protect user privacy in the context of new technology that required a user’s interaction with a service provider. Neither explicitly nor implicitly does the statute envision the application of its warrant provisions overseas. Three decades ago, international boundaries were not so routinely crossed as they are today, when service providers rely on worldwide networks of hardware to satisfy users’ 21st–century demands for access and speed and their related, evolving expectations of privacy.

Rather, in keeping with the pressing needs of the day, Congress focused on providing basic safeguards for the privacy of domestic users. Accordingly, we think it employed the term “warrant” in the Act to require pre‐disclosure scrutiny of the requested search and seizure by a neutral third party, and thereby to afford heightened privacy protection in the United States. It did not abandon the instrument’s territorial limitations and other constitutional requirements. The application of the Act that the government proposes ― interpreting “warrant” to require a service provider to retrieve material from beyond the borders of the United States ―would require us to disregard the presumption against extraterritoriality that the Supreme Court re‐stated and emphasized in Morrison v. National Australian Bank Ltd., 561 U.S. 247 (2010) and, just recently, in RJR Nabisco, Inc. v. European Cmty., 579 U.S. __, 2016 WL 3369423 (June 20, 2016). We are not at liberty to do so.

In the full discussion, the court points out where the lower court went wrong, thinking that thanks to the PATRIOT Act, a warrant could apply to the location of the service provider rather than the location of the server. But the court says that's clearly wrong, and the Congressional record makes it pretty clear that it was looking to apply the law just to the United States. As for the idea that the warrant was really a subpoena in disguise, the court says that's not how it works:

Warrants and subpoenas are, and have long been, distinct legal instruments. Section 2703 of the SCA recognizes this distinction and, unsurprisingly, uses the “warrant” requirement to signal (and to provide) a greater level of protection to priority stored communications, and “subpoenas” to signal (and provide) a lesser level. 18 U.S.C. § 2703(a), (b)(1)(A). Section 2703 does not use the terms interchangeably. Id. Nor does it use the word “hybrid” to describe an SCA warrant. Indeed, § 2703 places priority stored communications entirely outside the reach of an SCA subpoena, absent compliance with the notice provisions. Id. The term “subpoena,” therefore, stands separately in the statute, as in ordinary usage, from the term “warrant.” We see no reasonable basis in the statute from which to infer that Congress used “warrant” to mean “subpoena.”

[....] We see no reason to believe that Congress intended to jettison the centuries of law requiring the issuance and performance of warrants in specified, domestic locations, or to replace the traditional warrant with a novel instrument of international application.

There is, of course, the further issue of Microsoft being a US company, but the court says that doesn't magically make its overseas data subject to these kinds of warrants, because the intent of the law is to protect the privacy of users' communications, not to make it easier for the government to snoop.

The reader will recall the SCA’s provisions regarding the production of electronic communication content: In sum, for priority stored communications, “a governmental entity may require the disclosure . . . of the contents of a wire or electronic communication . . . only pursuant to a warrant issued using the rules described in the Federal Rules of Criminal Procedure,” except (in certain cases) if notice is given to the user....

In our view, the most natural reading of this language in the context of the Act suggests a legislative focus on the privacy of stored communications. Warrants under § 2703 must issue under the Federal Rules of Criminal Procedure, whose Rule 41 is undergirded by the Constitution’s protections of citizens’ privacy against unlawful searches and seizures. And more generally, § 2703’s warrant language appears in a statute entitled the Electronic Communications Privacy Act, suggesting privacy as a key concern.

The overall effect is the embodiment of an expectation of privacy in those communications, notwithstanding the role of service providers in their transmission and storage, and the imposition of procedural restrictions on the government’s (and other third party) access to priority stored communications. The circumstances in which the communications have been stored serve as a proxy for the intensity of the user’s privacy interests, dictating the stringency of the procedural protection they receive—in particular whether the Act’s warrant provisions, subpoena provisions, or its § 2703(d) court order provisions govern a disclosure desired by the government. Accordingly, we think it fair to conclude based on the plain meaning of the text that the privacy of the stored communications is the “object[] of the statute’s solicitude,” and the focus of its provisions.

The court goes on at length arguing that the Stored Communications Act's default is that communication privacy must be protected, and the exceptions are narrow.

All three judges on the panel agreed, but one -- Judge Gerard Lynch -- wrote a concurrence that tries to undercut the strong 4th Amendment/privacy arguments in the overall opinion, basically noting that he believes the decision doesn't come down to 4th Amendment issues or privacy protection, but merely how Congress drew up the law in the Stored Communications Act -- and basically argues that if Congress doesn't like this result, it can just rewrite the law.

It's also important to note that Rule 41 is the underpinning of much of this case, and that's the rule that the courts recently agreed to change to allow the DOJ more power to simply hack overseas servers. That shouldn't directly impact this particular case or similar situations, but does show how the DOJ is looking for ways to create endruns around limitations on domestic laws to try to get international data.

Still, for now, this ruling is a surprisingly good one, reinforcing privacy protections in overseas data. Kudos to Microsoft for going to court over this when it would have been quite easy for it to just give in and hand over the data. I assume that the US government will seek to get this ruling overturned, either via an en banc hearing on the 2nd Circuit or going to the Supreme Court, so the case isn't over yet. But, as for right now, it's in a good position.

Filed Under: 2nd circuit, 4th amendment, communications, doj, ecpa, email, ireland, jurisdiction, privacy, sca, subpoena, warrant
Companies: microsoft

Irish Airport Security Bravely Defends Plane From Toddler's Fart-Gun

from the heroes dept

Here at Techdirt, we've had a great deal of fun at the expense of the TSA and the agency's wonderful brand of security theater masquerading as actual airport security. Yes, the government putting on a kind of clinic in the simultaneous overreach into civil liberties for false security and the kind of wasteful government spending that makes the conservative talkshow hosts of the world dip back into the Oxy has been an ongoing source of entertainment. But the TSA can take the same kind of heart that thousands of purported UFO abductees do: you are not alone.

No, as it turns out, foreign airport security agencies can be just as laughable as we can be. Witness the Irish, for instance, and the way they bravely disarmed a three year old of a toy fart-gun.

Can't believe that a minion fart gun was taken from friends toddler, security felt it posed a threat @UniversalPics pic.twitter.com/iAPLlmdTv3 — Paula (@NursepollyRgn) August 16, 2015

As Paula pointed out, this is a replica of the "Fart Blaster" wielded by the minions in "Despicable Me." So I guess it does have a track record of being used for evil purposes. But in real life it doesn't do anything except make noise and apparently emit an odor that thankfully is said to be banana-scented. Do I want a kid to wield one of these on a plane? No. Does it need to be confiscated by security personnel? No.

Well, I do want a kid wielding one of these delightful toys on an airplane, sirs. The very idea of a three year old tumbling down the aisle spraying a bunch of uptight, too-stiff adults with insufficient senses of humor in the face with banana-farts is exactly the kind of life, liberty and happiness no government ought be denying my right to pursue. What's far less funny - kind of - was the Irish authorities' insistence that they confiscated the "weapon" because it violated the rules against replica guns. Replica guns typically refer to realistic representations of actual firearms that don't work. The fart gun is not a representation of a real gun at all. And it most certainly works as intended.

The spokesperson noted that the toy was "being kept safe at the airport" so the child can get it back when the family returns, so that's nice.

It's not nice; it's exceptionally stupid. The Irish authorities are sitting on a children's toy that they absolutely know is not a weapon over a ham-fisted attempt to play by bureaucratic rules. I think it's time these lads went and had a Guinness and let the kid have his toy back.

Filed Under: airport security, fart gun, ireland, minions, security theater, tsa

Irish Businessman Denis O'Brien Sues Parliament, Sends Legal Threat To Satirical Newspaper

from the and-we'll-cover-all-of-it dept

Remember Denis O'Brien? He's apparently an Irish media bigwig that we'd never heard of until earlier this year when he received a ridiculous injunction barring the media from reporting on a speech given in the Irish Parliament by a member, Catherine Murphy, in which she outlined some questionable loans that were given by the Irish Bank Resolution Corporation to O'Brien. Here was the crux of that speech:

We are now aware, for example, that the former CEO of IBRC made verbal agreements with Denis O'Brien to allow him to extend the terms of his already expired loans. We also know that the verbal agreement was never escalated to the credit committee for approval. I am led to believe and would welcome clarification by the Minister that the rates applicable to the extension were extremely favourable. I understand that Mr. O'Brien was enjoying a rate of approximately 1.25% when IBRC could, and arguably should, have been charging 7.5%. Given that we are talking about outstanding sums of upwards of €500 million, the interest rate applied is not an insignificant issue for the public interest. We also know that Denis O'Brien felt confident enough in his dealings with IBRC that he could write to Kieran Wallace, the special liquidator, to demand that the same favourable terms extended to him by way of a verbal agreement be continued. We now have Kieran Wallace, who has been appointed by the Government to conduct the IBRC review, joining with IBRC and Denis O'Brien in the High Court to seek to injunct the information I have outlined from coming into the public domain. Surely, that alone represents a conflict.

In documents released to me under freedom of information, the Minister, his officials, the Central Bank and even the troika acknowledge that IBRC - the former Anglo Irish Bank - is no ordinary bank and that there is a significant public interest as the bank was fully nationalised and was in wind-down mode. They all accept that this is the people's money we are dealing with and that there can be no dispute regarding the public interest in this.

And then, just a few days ago, O'Brien sued an entire committee of the Parliament (called the Dáil) after the committee decided that Murphy did not abuse her parliamentary privilege in making that speech.

But, that's not all that is keeping O'Brien's lawyers busy. He also had them send a ridiculous takedown letter to a satirical publication, called Waterford Whispers News. That entire publication is satirical, in the nature of the Onion, but apparently O'Brien is too thin-skinned to handle that and his lawyers went ballistic. From the letter:

On your website you published an article entitled "Denis O'Brien receives 20 year jail sentence for mobile phone licence bribe in parallel universe". This has also been posted on your Facebook and Twitter pages.

The article claims that in a "parallel universe", which "operates the same as the one lived in Ireland today, only the Director of Public Prosecutions more stridently pursues white collar crime", our client has been found guilty of making two payments to Michael Lowry in connection with the award of the State's second mobile phone licence to Esat Digifone and that the "Moriarty Tribunal found [him] guilty" of bribery. The article features a photo-shopped picture of our client, super-imposed on the body of what appears to be notorious criminal John Gilligan, being led away in handcuffs by a member of the prison service.

The reference to a 'parallel universe' are a sham. The clear meaning and innuendo of this article is that our client is a criminal who has managed to evade prosecution to date. This is a malicious and deliberate defamation of the most serious kind.

I have to admit the line "the reference to a 'parallel universe' are a sham" may be one of the funniest lines I've seen in a bullshit cease-and-desist threat letter in a long time. It doesn't seem like a sham at all. After all, O'Brien has not yet been convicted or sentenced, and thus it would have to be in a parallel universe.

Either way, the threat "worked" in that Waterford Whisper News did, in fact, remove the article, but its Editor in Chief, Colm Williamson, posted the threat letter instead, getting all of this a hell of a lot more attention. The site also posted an "apology" to John Gilligan for using his photo in that way:

ON Wednesday the 5th of August 2015 WWN published a mock photo using the body of notorious criminal John Gilligan. This was an error. It is the intention of the WWN editorial team to offer its sincere apologies for any offence caused to Mr. Gilligan for this mistake.

To associate him with another individual and any widely circulated public utterances relating to that individual must have been an unpleasant experience for Mr. Gilligan, and we deeply regret this.

That "apology" goes on to discuss reporter Veronica Guerin who was threatened by Galligan and eventually murdered for writing about Irish criminal gang members. It isn't difficult to get the point that Wateford Whisper News is making with the following:

Guerin, in her profession as a journalist, suffered greatly in the face of Ireland’s draconian libel laws in the 1990s as lawyers repeatedly warned her of impending libel suits were she to publish accusations against criminals.

Deeming it in the public interest to learn of Dublin’s crime epidemic, Guerin was left with little choice but to directly confront notorious gangland figures for comments relating to allegations against them.

Had she not done so her stories could be prevented from making it to print as criminals could make use of libel laws to suppress the freedom of the press.

WWN is thankful that some 19 years later such tasking, restrictive and wile measures are not taken by individuals to suppress free speech in Ireland.

Either way, when you're at the point in which you have lawyers threatening people making jokes about you, you've gone off the deep end, far away from the pool of "rational thought." But, of course, as a side benefit, the ridiculous ham-fisted efforts of O'Brien's lawyers at Meagher Solicitors is now getting much more attention to the original story -- and leading many more people to learn about the kinds of things Denis O'Brien really, really wishes no one would talk about (and I won't even get into the fact that the "signature" on the legal threat letter is of the name of the firm, rather than any individual there).

Filed Under: catherine murphy, dail, denis o'brien, free speech, ireland, parallel universe, satire, streisand effect
Companies: waterford whispers news

Ireland Becoming The Key Spot In Fights Over Data Privacy: Both Concerning Governments And Tech Companies

from the this-is-the-big-fight dept

There's a really big battle brewing concerning privacy protections online that involves some Silicon Valley tech companies, Ireland and the US government. And chances are this fight is going to get nasty. A few weeks ago, you might have heard that Twitter announced an interesting change in its privacy policy and terms of service, saying that all non-US users would technically now be managed under Twitter International Company, based in Dublin, Ireland. And, last week, Dropbox made a very similar announcement, noting that all non-North American users were now technically under Dropbox Ireland, while users in the US, Canada and Mexico remain under Dropbox in the US. Twitter's new terms go into effect on May 18th, and Dropbox's on June 1st (unless you're opening a new account before then, and the new terms apply immediately).

Over the last decade, Ireland has become a popular destination for US tech firms to set up international operations, in part because of Ireland setting itself up as sort of a tax haven for tech firms via its "Double Irish" tax dodge. A bunch of tech companies have been criticized for this, though the response of "we're following exactly what the law allows" is reasonable enough. Either way, that tax loophole is closing, though others may show up instead.

But this move doesn't seem predicated by that. Instead, there are two related elements that may be at work here. First: Ireland is also seen as having some of the most company-friendly privacy laws in the EU, though those are also coming under some amount of scrutiny. But, at the same time, by claiming that users are now under the Irish company, it gives Twitter and Dropbox at least some power to try to say no to US government requests for information. So, depending on if you're more afraid of government intrusions in your data than corporate intrusions (as I am), then these moves are probably good for your privacy.

Except... the US government still thinks that it can do whatever the hell it wants. First, in some ways, data inside the US has potentially more protections against the US government in a somewhat bizarre way. Whether you believe it or not, the NSA cannot "hack" its way into US computer systems. It can only use the various other processes it has to demand information from companies. Overseas, however, there are no such restrictions. The NSA has interpreted Executive Order 12333 to mean that it can hack into anything overseas, and this was the authority it used to break into the data centers of Google, Yahoo and likely more overseas (sneaking in via Level 3 and others).

But, that still requires hacking into stuff. If US tech companies believe they can successfully fend off such hacks, putting non-US users under Irish law does give them greater protection from the NSA. The NSA can no longer use its other authorities in the US to get the FISA Court to demand information (along with gag orders) from these companies. Or... maybe not. As we've been discussing, there's an ongoing court battle between the US Justice Department and Microsoft, over whether or not the DOJ can issue a warrant demanding Microsoft hand over information stored in Ireland. Microsoft has resisted, but the courts have so far sided with the DOJ. Ireland recognizes this is an important fight, and has asked for the EU to come out in support of Microsoft's position.

Meanwhile, with a new Attorney General in office, the DOJ has made it clear that it's going to continue this course of action:

US prosecutors will continue to seek data stored in Ireland using a federal search warrant, despite leadership changes at the Justice Department.

A spokesperson confirmed in an email that the department's position has "not changed," two weeks after Loretta Lynch, the Obama administration's choice to head up the federal agency, was confirmed by Congress as the new US attorney general.

This battle is going to be rather important for those other companies seeking to protect users under Irish law. Warrants aren't supposed to apply outside of the US. But the DOJ (and the courts) have been simply making up new laws, in arguing that if it's a US company, but the data is overseas, the warrant magically morphs into a quasi-warrant/subpoena hybrid. But that's ridiculous. Warrants and subpoenas have different purposes and different protections -- and the DOJ wants the best of both worlds. As Microsoft itself explained in one of its legal filings:

The Government's interpretation ignores the profound and well established differences between a warrant and a subpoena. A warrant gives the Government the power to seize evidence without notice or affording an opportunity to challenge the seizure in advance. But it requires a specific description (supported by probable cause) of the thing to be seized and the place to be searched and that place must be in the United States. A subpoena duces tecum, on the other hand, does not authorize a search and seizure of the private communications of a third party. Rather. it gives the Government the power to require a person to collect items within her possession, custody, or control, regardless of location, and bring them to court at an appointed time. It also affords the recipient an opportunity to move in advance to quash. Here, the Government wants to exploit the power of a warrant and the sweeping geographic scope of a subpoena, without having to comply with fundamental protections provided by either. There is not a shred of support in the statute or its legislative history for the proposition that Congress intended to allow the Government to mix and match like this.

This fight is far from over -- and with companies like Twitter and Dropbox now trying to shift more non-US users under Irish laws, the fight with Microsoft is going to become even more important.

And, that's not even getting into the discussion of how all of this is, effectively, driving US businesses overseas. The US's efforts to spy on everyone is, once again, harming the US economy, rather than helping it.

Filed Under: data protection, ireland, lawsuits, privacy, surveillance, terms of service
Companies: dropbox, microsoft, twitter

Irish Legislator Proposes Law That Would Make Annoying People Online A Criminal Act

from the because-snail-mail,-telephones-and-the-internet-are-all-the-same,-right? dept

Is Ireland looking to pass a law that would "outlaw ebooks and jail people for annoying others?" Well, no, not really, but that's the sort of unintended consequences that follow when laws are updated for the 21st century using little more than a word swap. (h/t Brian Sheehan)

Ireland has had long-standing laws against harassment via snail mail, telephones and (as of 2007) SMS messages. A 2014 report by the government's somewhat troublingly-named "Internet Content Governance Advisory Group" recommended updating this section of the law to cover email, social media and other internet-related transmissions. UPDATE APPLIED:

1. The Post Office (Amendment) Act 1951 is amended in section 13, as substituted by section 4 of and Schedule 1 to the Communications Regulation (Amendment) Act 2007, by the substitution of the following section:

“Offences in connection with public electronic communications networks

13. (1) A person who—

(a) sends or causes to be sent, by means of a public electronic communications network, a message or other matter that is grossly offensive or is indecent, obscene or menacing, or

(b) for the purpose of causing annoyance, inconvenience or needless anxiety to another—

(i) sends or causes to be sent, by means of a public electronic communications network, a message that the sender knows to be false, or

(ii) persistently and without reasonable cause makes use of a public electronic communications network, is guilty of an offence.

Violators are looking at sentences ranging from 1-5 years and fines of up to €75,000 -- all for doing something as minor as "causing annoyance, inconvenience or anxiety." In addition, the proposed amendment would provide for the seizure of devices used to send the annoying messages, including computers, cell phones -- even the internet connection itself.

Provisions for device seizures first showed up in the 2007 update, as cell phones finally gave law enforcers something they could confiscate with minimal public outrage, at least at that point. Even in 2015, it's still pretty difficult to justify cutting off someone's phone service and almost impossible to find anyone who agrees that banning someone from using the postal service isn't a pretty clear violation of basic rights. But when it comes to computers and internet connections, many legislators still feel these essential tools of communication are just "luxuries" -- a status they haven't held for several years.

But back to the headline. The broad language -- if read literally -- could make emailing an ebook to someone a criminal offense. Works of fiction are, by definition, false. But this isn't a new "feature" of this proposed amendment. The sending of knowingly false messages dates back to the day when people still routed most of their communications through the post office. So, everyone who's ever sent anyone a fictional book through the mail -- including Amazon -- is a potential violator of this law.

It's the vestigial language from previous iterations of the law -- words meant to target scam artists and aggressive telemarketers -- that is problematic. Simply appending the words "electronic communications" to an old law doesn't address the perceived problem (cyberbullying is cited in the governance group's report). It just creates new problems.

Written in this manner, the proposed law allows the pursuit of criminal charges for annoyance and inconvenience -- and the internet has plenty of both. The saving grace is that this pursuit is left to law enforcement, rather than routed through a civil process. It's a criminal offense, which is an adversarial process every step of the way -- in stark contrast to other, far more terrible "cyberbullying" laws that shift the burden of proof to the accused --- if they're even allowed to defend themselves.

Yes, the law is badly written, but it's a not a legislative land grab. It's just a lazy update to an existing law -- one that may have worked out fairly well given the narrow confines under which it operated. But this proposal -- a lazy "on the internet" patch job -- has the potential to criminalize lots of previously protected speech.

Filed Under: annoying people, criminal law, free speech, harassment, ireland, online