German Data Protection Commissioners Take Action Against EU Data Transfers To US Under 'Safe Harbor' Program

from the more-confrontational dept

We pointed out last year that one of the knock-on effects of Edward Snowden's revelations about massive NSA (and GCHQ) spying on Europeans was a call to suspend the economically-critical Safe Harbor program. Without Safe Harbor, it would be illegal under European law for companies like Google and Facebook to take EU citizens' personal data outside the EU, which would make it more difficult to run those services in their present form. Nothing much happened after that call by the European Parliament's Civil Liberties, Justice and Home Affairs (LIBE) committee -- not least because it does not have any direct power to formulate EU policy -- but the unhappiness with Safe Harbor has evidently not gone away.

Heise Online reports that two of Germany's data protection commissioners -- those for the cities of Berlin and Bremen -- have started proceedings against the transfer of data to the US under the Safe Harbor agreement (original in German.) This seems to represent a hardening of their position. The Heise article quotes another data protection commissioner, this time for the city of Hamburg, as saying that the mood among his colleagues was more confrontational now. Similarly, the commissioner for Berlin commented:

"In my view, Safe Harbor is dead if essential improvements aren't found."

Whether the US authorities will be willing to make of those improvements, or whether they might just hope the European public's dependence on Google and Facebook will prevent drastic action being taken by the EU, remains unclear. Complicating matters still further is a separate argument about whether data flows should be included in the various trade negotiations involving the US and the European Union. The latest move by German data protection commissioners is unlikely to make resolving these issues any easier.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: data, data privacy, data protection, eu, fragmentation, german, localization, safe harbor, us

New TISA Leak: US On Collision Course With EU Over Global Data Flows

from the would-be-fun-to-watch-if-only-it-weren't-secret dept

Although most attention has been given to the Trans-Pacific Partnership agreement (TPP) and the Trans-Atlantic Free Trade Agreement (TAFTA), also known as TTIP, it's important to remember that a third set of global trade negotiations are underway -- those for the Trade in Services Agreement (TISA), which involves more countries than either of the other two. Like TPP and TAFTA/TTIP, TISA is being negotiated in strict secrecy, but earlier this year the financial services annex leaked, giving us the first glimpse of the kind of bad ideas that were being worked on. Now, another leak has surfaced, which reveals the US's proposals to free up data flows online.

For the European Union, that's a hugely sensitive issue. Under data protection laws there, personal data cannot be sent outside the EU unless companies sign up to the self-certification scheme known as the Safe Harbor framework. However, in the wake of Snowden's revelations about NSA spying in Europe, the European Parliament has called for the Safe Harbor scheme to be suspended. If that happens, the only way that US Internet companies could comply with the EU Data Protection Directive would be to hold personal information about EU citizens on servers physically located in Europe. But it is precisely that kind of requirement the leaked TISA position seeks to forbid:

Article X.2: Local Content

l. Subject to any conditions, limitations and qualifications set out in its Schedule, no Party may, in connection with the supply of a service by a service supplier, impose or enforce any requirement; enforce any commitment or undertaking; or, in connection with the supply of a service through commercial presence, condition the receipt or continued receipt of an advantage on compliance with any requirement:

(a) to purchase, use or accord a preference to:

...

(iii) computing facilities located in its territory or computer processing or storage services supplied from within its territory;

Another section would stop countries from imposing any restrictions on data flows:

Article X.4: Movement of Information

No Party may prevent a service supplier of another Party from transferring, accessing, processing or storing information, including personal information, within or outside the Party's territory, where such activity is carried out in connection with the conduct of the service supplier's business.

It comes as no surprise that the US is pushing for the unhindered cross-border flow of all data, including personal data: it's what both the USTR and US companies have been demanding for a while. But it's going to be hard to get the European Union to agree to such a direct attack on its privacy framework. The European Commission has publicly stated that TISA will not undermine the EU's data protection laws. Moreover, just a few hours after the TISA leak was published, the EU politician with responsibility for TISA in the European Parliament, Viviane Reding, tweeted as follows:

As @EP_Trade Rapporteur on #TiSA, I'll oppose any provision undermining right to data privacy: competition by the rules, not for the rules!

With such entrenched positions on both sides, it's hard to see how any kind of compromise will be possible. The imminent battle between the US and the EU on this key issue in TISA will doubtless be fun to watch; what a pity it will happen in secret, behind closed doors.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: data, data protection, data storage, eu, local content, privacy, safe harbors, tisa

US Forbids The European Law Enforcement Agency From Releasing European Documents To European Officials

from the bloody-cheek dept

Europol is probably not very well-known outside the EU. Here's how it describes itself:

Europol is the European Union's law enforcement agency whose main goal is to help achieve a safer Europe for the benefit of all EU citizens. We do this by assisting the European Union's Member States in their fight against serious international crime and terrorism.

The emphasis is in the original. You may notice that it mentions Europe a few times, which underlines the fact that Europol is a European organization based in Europe, run by Europeans and serving Europeans. But the US seems to take a different view:

The head of the EU police agency Europol is taking instructions from the Americans on what EU-drafted documents he can and cannot release to EU lawmakers.

The story in the EUobserver quoted above explains:

The issue came up over the summer when US ambassador to the EU Anthony Gardner told EU ombudsman Emily O'Reilly she cannot inspect an annual Europol report drafted by the agency's own internal data protection review board.

And if you are thinking there might be some top-secret US information in that report, the Dutch MEP Sophie In't Veld says that isn't the case:

"There is no operational information, there is no intelligence, there is nothing in the document. So you really wonder why it is kept a secret."

The problem seems to be simply that the uppity Europeans dared to write their report without asking for US permission first:

The Americans are unhappy because Europol had drafted the report "without prior written authorisation from the information owner (in this case the Treasury Department)."

The fact that the Treasury Department thinks that it "owns" information about how the Terrorist Finance Tracking Program (TFTP) complies with European data protection laws is rather telling. No wonder that back in March, the European Parliament called for the TFTP to be suspended in the wake of revelations that the US was going outside the program, and accessing EU citizens' bank data illegally. The latest high-handed action by the US ambassador to the EU is unlikely to encourage them to change their mind.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: crime, data protection, documents, eu, eu parliament, europol, lawa enforcement, us

Court Says Who Cares If Ireland Is Another Country, Of Course DOJ Can Use A Warrant To Demand Microsoft Cough Up Your Emails

from the say-what-now? dept

A NY judge has ruled against Microsoft in a rather important case concerning the powers of the Justice Department to go fishing for information in other countries -- and what it means for privacy laws in those countries. As you may recall, back in April, we wrote about a magistrate judge first ruling that the DOJ could issue a warrant demanding email data that Microsoft held overseas, on servers in Dublin, Ireland. Microsoft challenged that, pointing out that you can't issue a warrant in another country. However, the magistrate judge said that this "warrant" wasn't really a "warrant" but a "hybrid warrant/subpoena." That is when the DOJ wanted it to be like a warrant, it was. When it wanted it to be like a subpoena, it was.

Microsoft fought back, noting that the distinction between a warrant and a subpoena is a rather important one. And you can't just say "hey, sure that's a warrant, but we'll pretend it's a subpoena." As Microsoft noted:

This interpretation not only blatantly rewrites the statute, it reads out of the Fourth Amendment the bedrock requirement that the Government must specify the place to be searched with particularity, effectively amending the Constitution for searches of communications held digitally. It would also authorize the Government (including state and local governments) to violate the territorial integrity of sovereign nations and circumvent the commitments made by the United States in mutual legal assistance treaties expressly designed to facilitate cross-border criminal investigations. If this is what Congress intended, it would have made its intent clear in the statute. But the language and the logic of the statute, as well as its legislative history, show that Congress used the word "warrant" in ECPA to mean "warrant," and not some super-powerful "hybrid subpoena." And Congress used the term "warrant" expecting that the Government would be bound by all the inherent limitations of warrants, including the limitation that warrants may not be issued to obtain evidence located in the territory of another sovereign nation.

The Government's interpretation ignores the profound and well established differences between a warrant and a subpoena. A warrant gives the Government the power to seize evidence without notice or affording an opportunity to challenge the seizure in advance. But it requires a specific description (supported by probable cause) of the thing to be seized and the place to be searched and that place must be in the United States. A subpoena duces tecum, on the other hand, does not authorize a search and seizure of the private communications of a third party. Rather. it gives the Government the power to require a person to collect items within her possession, custody, or control, regardless of location, and bring them to court at an appointed time. It also affords the recipient an opportunity to move in advance to quash. Here, the Government wants to exploit the power of a warrant and the sweeping geographic scope of a subpoena, without having to comply with fundamental protections provided by either. There is not a shred of support in the statute or its legislative history for the proposition that Congress intended to allow the Government to mix and match like this. In fact, Congress recognized the basic distinction between a warrant and a subpoena in ECPA when it authorized the Government to obtain certain types of data with a subpoena or a "court order," but required a warrant to obtain a person's most sensitive and constitutionally protected information -- the contents of emails less than 6 months old.

The DOJ hit back earlier this month by basically saying, "yeah, whatever, let's pretend it's a subpoena and give us what we want already."

Overseas records must be disclosed domestically when a valid subpoena, order, or warrant compels their production. The disclosure of records under such circumstances has never been considered tantamount to a physical search under Fourth Amendment principles, and Microsoft is mistaken to argue that the SCA provides for an overseas search here. As there is no overseas search or seizure, Microsoft’s reliance on principles of extra-territoriality and comity falls wide of the mark.

Unfortunately, it appears that the judge just went with the DOJ's reasoning -- though, immediately stayed the ruling since Microsoft made it clear it plans to appeal. Judge Loretta Preska basically just upheld the magistrate judge's ruling that Microsoft could, in fact, be compelled to hand over data held overseas via a warrant under ECPA, the Electronic Communications and Privacy Act (which we've already noted has tremendous problems and needs to be reformed).

Beyond the problems this has for the 4th Amendment in the US, it's also going to create a mess in Europe, where they have much stricter data privacy rules, and where something like ECPA is clearly a problem. For the US to argue that it can make ECPA reach across the ocean into European servers is going to be a big problem -- especially at a time when Europeans are (rightfully) distrustful of the US government's ability to snoop on their data.

Filed Under: 4th amendment, data protection, ecpa, ecpa reform, email, eu, ireland, loretta preska, privacy, subpoena, warrant
Companies: microsoft

EU Data Protection Proposal Gets Stronger, But With Big Loopholes

from the one-step-forward,-one-step-back dept

One of the most important pieces of legislation wending its way through the European Parliament concerns data protection. Because of its potential impact on major US companies like Google and Facebook, this has become one of the most fought-over proposals in the history of the EU, with lobbyists apparently writing large chunks of suggested amendments more favorable to online services. And all of that was before Snowden's revelations about NSA spying in the EU made data protection an even more politically-sensitive area.

Against that background, a vote that took place yesterday in one of the main European Parliamentary committees, LIBE (handling legislation concerning civil liberties), was important for the indications it gave about the current mood there. Where before the concerted lobbying campaign seemed to have managed to water down the proposals, now the Snowden Effect was in evidence, as the committee beefed up privacy protection for the public. A post on the European Digital Rights (EDRI) blog wrote:

We applaud Parliamentarians for supporting -- and even improving -- several important and valuable elements of the original Commission proposal. We are particularly happy that the Committee chose to overturn the Commission's proposal to allow Member States the scope to exempt themselves from the rules on profiling.

Here are some of the key measures adopted, as explained by EurActiv:

The parliament's civil liberties committee has come up with nearly 4,000 amendments to the original plan, including increasing the fine to 5% of annual worldwide turnover or €100 million, whichever is greater.

The changes also mean the replacement of the "right to be forgotten" with "the right of erasure", seen as a lesser obligation.

…

Parliament, in line with the Commission's proposals, also wants to impose strict rules on how data is shared or transferred to non-EU countries. For example, if the United States wants access to information held by Google or Yahoo! about a European citizen based in Europe, the firm would have to seek authorisation from a European data authority first.

That would establish an extra, EU-controlled gateway that might go some way to assuaging the profound concerns raised in Europe about U.S. data spying activities revealed via the leaks from former U.S. data analyst Edward Snowden.

However, that does not mean the current text is without serious problems, as EDRI emphasizes:

we are shocked and disappointed that Parliamentarians voted to introduce massive loopholes that undermine the whole proposal.

Perhaps the biggest loophole concerns the concept of " legitimate interest" (pdf), which allows a company to use personal data provided it meets "the reasonable expectations of the data subject based on his or her relationship with the [company]". Of course, that is so vague as to be utterly useless -- what does "reasonable expectations" mean in this context? As the draft legislation stands, companies are essentially being given a free pass to do pretty much whatever like with the personal data they gather, despite all the other supposed safeguards. And there's another serious issue, as noted by La Quadrature du Net:

The Members of the LIBE Committee also made the very disturbing choice of accept the secret tripartite negotiations requested by the rapporteur Jan Philipp Albrecht. The text will now be modified behind closed doors, between the European Commission, the European Parliament and the Council (ministers from the Member States). The latter could use untransparent negotiations to annihilate all the positive provisions of this Regulation, leading to a weak and dangerous final version of this legislation.

In other words, the good parts of the proposals could be watered down or even removed during the secret negotiations with the European Commission and the European Council (representing the EU nations, including data privacy-hostile ones like the UK), something we discussed here on Techdirt before. However, the lead MEP in this area, Jan Philipp Albrecht, insists that this is not an "undemocratic" way of proceeding. EurActive explains when those talks will take place:

Negotiations with EU member states and the European Commission on the law are to start later this year or early in 2014. EU leaders will discuss the issue at a summit in Brussels on Oct. 24-25 and could give some indication then of how quickly they want to proceed.

The aim is to have the legislation agreed before May, when the assembly breaks up and new European Parliament elections are held. However, EU officials are not convinced this is feasible.

So it looks like the great EU Data Protection saga will continue to entertain us for a while, with yet more twists and turns, as opposing forces battle over the key issue of online privacy.

Follow me @glynmoody on Twitter or identi.ca, and on Google+

Filed Under: data protection, eu, privacy

Russia's Version Of Facebook, VKontakte, Offers Ed Snowden A Job In Data Protection

from the he's-qualified dept

Well this is marginally amusing. Now that Ed Snowden is actually in Russia, apparently a bunch of job offers are flowing in -- including from the somewhat controversial massive social network VKontatke, often called "Russia's Facebook," which is apparently hoping that Snowden might help with data protection, especially as the Russian government is looking to have more access and control over VKontatke (which many in the entertainment industry also insist is a major source for infringing content).

One place that had made an offer, [Snowden's lawyer Anatoly] Kucherena added, was VKontakte, Russia's Facebook rip-off, which also gives users access to a massive trove of pirated music, TV shows, and movies. Pavel Durov, VKontakte's founder, has been fighting off official pressure—prosecutorial summons, searches—in part because the internet wilds of VKontakte are one of the last bastions of freedom in Russia, and the opposition does a lot of its organizing through VKontakte, which is Russia's largest social network. In the last year or so, the government wanted to muscle in, and get a share of the company in order to exercise some control over it. So far, Durov has fought them off effectively, including today's court decision not to charge VKontakte under a new anti-piracy law. How's that for irony?

Who knows what will happen, but imagine Snowden helping to secure Russia's main social network from further government intrusion...

Filed Under: data protection, ed snowden, russia, social media, social network, surveillance
Companies: vkontatke

Controversial EU Data Protection Regulation May Be Negotiated In Secret In Breach Of Parliamentary Process

from the snowden-effect dept

Today, the European Parliament held a three-hour long debate on PRISM, Tempora and what the EU response should be. Many wanted TAFTA/TTIP put on hold; others didn't. But one theme cropped up again and again: the need for strong data protection laws that would offer at least some legal protection against massive and unregulated transfer of Europeans' personal data to the US.

As Techdirt readers may recall, the EU's Data Protection Regulation was already contentious even before Ed Snowden revealed the scale of US and UK spying on EU citizens. The new focus on passing it soon only intensifies the battle going on there between those who want to introduce meaningful constraints on what can be done with EU data, and those who seem happier to listen to lobbyists and allow personal information to flow across the Atlantic largely unchecked. But it looks like the politicians have come up with a way to avoid public debate on the matter, as Monica Horten at Iptegrity.com reports:

Secret trilogue negotiations between the European Parliament and the Council of Ministers are being proposed as a way to get around the impasse of 3000+ amendments on the Data Protection Regulation.

As Horten explains:

trilogues are held in secret, behind closed doors, and the only people allowed in are the rapporteur [the lead MEP representing the European Parliament] and his shadows, the Commissioner, the Presidency, and selected advisers from each institution. The trilogue discussions are not made public.

As well as being reprehensible -- if anything needed to be conducted in public, this did -- it may be against the EU's own rules:

trilogues cannot start before the responsible committee has given a mandate. That's what's a little bit odd here. The mandate can only be given when the committee votes in October.

But the Brussels rumour mill is suggesting that there could be a move to begin trilogues on the Data Protection Regulation before October, without waiting for the committee mandate.

That might solve the problem of avoiding high-profile arguments over what should be in the Regulation, but it would also place anything that comes out of these secret negotiations on a questionable footing:

it would be a breach of Parliamentary process, and especially egregious given that this law deals with fundamental rights.

In any event, the rapporteur does not have to agree to trilogues. It is an option.

In other words, nobody really knows what will happen here. Call it the Snowden Effect: anything relating even indirectly to his case seems to become more complex and unpredictable....

Follow me @glynmoody on Twitter or identi.ca, and on Google+

Filed Under: data protection, eu, eu parliament, procedures, secrecy

How Lobbyists' Changes To EU Data Protection Regulation Were Copied Word-For-Word Into Proposed Amendments

from the well,-just-look-at-that dept

Everyone knows that politicians are lobbied, sometimes massively. But it's rare to be able to track directly the detailed effects of that lobbying. That's why a new site called LobbyPlag is so interesting: it allows people to do precisely that in the case of the controversial data protection rules in the EU, which aim to regulate how personal information harvested from users of online services can be used. Naturally, many large Net companies -- mostly in the US -- are unhappy about these moves; some US diplomats are even talking of a possible "trade war" if the proposals go through in their current form. That's unlikely, not least because the lobbying is starting to pay off, as LobbyPlag's analysis makes clear.

The site takes two sets of publicly-available documents -- those prepared by companies or their lobbyists, and the amendments proposed for the Data Protection Regulation -- and compares them, showing the results in a highly visual way. It turns out that entire paragraphs have been copied word-for-word from the lobbyists' documents and put forward as suggested amendments. Similarly, some of the deletions that European politicians have proposed are precisely those asked for by various companies.

One amendment concerns what LobbyPlag terms "forum shopping":

This amendment allows companies to "designate" its main establishment. The previous version of the law would make the member state of the factual "main establishment" responsible. This amendment allows massive "forum shopping" -- companies can choose the member state with the weakest data protection authority or the littlest enforcement (e.g. UK or Ireland) while actually being situated in a totally different member state. Even Peter Fleischer (Google’s Privacy Officer) has recently criticized Microsoft for "forum shopping" in Luxemburg

Here's the original text from the European Commission (pdf), Article 4(13):

'main establishment' means as regards the controller , the place of its establishment in the Union where the main decisions as to the purposes, conditions and means of the processing of personal data are taken; if no decisions as to the purposes, conditions and means of the processing of personal data are taken in the Union, the main establishment is the place where the main processing activities in the context of the activities of an establishment of a controller in the Union take place. As regards the processor, 'main establishment' means the place of its central administration in the Union;

Here's what Amazon (pdf) and eBay (Microsoft Word) wanted:

'main establishment' means the location as designated by the undertaking or group of undertakings, whether controller or processor, on the basis of, but not limited to, the following optional objective criteria: (1) the location of the European headquarters of a group of undertakings; (2) the location of the entity within a group of undertakings with delegated data protection responsibilities; (3) the location of the entity within the group which is best placed in terms of management functions and administrative responsibilities to deal with and enforce the rules as set out in this Regulation; or (4) the location where effective and real management activities are exercised determining the data processing through stable arrangements. The competent authority shall be informed by the undertaking or group of undertakings of the designation of the main establishment;

Here's what several MEPs proposed as an amended version:

'main establishment' means the location as designated by the undertaking or group of undertakings, whether controller or processor, on the basis of, but not limited to, the following optional objective criteria: (1) the location of the European headquarters of a group of undertakings; (2) the location of the entity within a group of undertakings with delegated data protection responsibilities; (3) the location of the entity within the group which is best placed in terms of management functions and administrative responsibilities to deal with and enforce the rules as set out in this Regulation; or (4) the location where effective and real management activities are exercised determining the data processing through stable arrangements. The competent authority shall be informed by the undertaking or group of undertakings of the designation of the main establishment;

As you can see, the last of these is identical with the companies' text. Of course, there's nothing wrong in using lobbyists' suggestions if they are valuable; and there's no reason why companies shouldn't come up with good ideas that could be used. But what's striking about the changes adopted by European politicians, as revealed by LobbyPlag, is that they seem to favor the companies, and to be detrimental to the European public -- not what you would hope for from the latter's representatives in the European Parliament, who should be protecting their interests, not attacking them.

Some have countered these accusations by pointing out that suggestions from civil groups moving things the other way have also been included; that may well be true, although I've not seen any proof that exactly the same wording has been adopted. But even if that were true, that doesn't represent balance of any kind: the money that companies like Amazon or eBay are able to put behind lobbying efforts in the European Union (and around the world) dwarf the very limited resources of cash-strapped citizen rights groups.

Given that lobbying will never disappear, perhaps the best we can hope for is what LobbyPlag provides us for the first time: real transparency. Using the powerful digital tools now available, we can easily compare huge numbers of documents to find similarities. That allows us as citizens to follow the threads that link lobbyists -- of all persuasions -- to the politicians that shape our laws. The hope has to be that by shining a light on those links, and letting politicians know that we are watching what they do and where they get their amendments from, the more blatant dependencies on external groups might be diminished, or at least made more subtle.

Follow me @glynmoody on Twitter or identi.ca, and on Google+

Filed Under: data protection, eu, lobbyists, politics

Spotify Finally Launches In Germany -- And Immediately Hits Data Protection Problems

from the one-thing-after-another dept

The music streaming service Spotify has adopted a rather unusual pattern of launches around the world. Founded in Sweden, it spread gradually to various parts of Europe, and only later arrived in the US. The main reason for this slow rollout seems to have been difficulty striking licensing deals with the major recording companies.

That's also why Spotify has only just launched in the important market of Germany. The main problem is the notoriously unhelpful German music collection society GEMA. Surprisingly, Spotify still doesn't have a license, but it turns out that's only one of its problems in the country. Via Twitter, Arjan points out that Germany's Federal Commissioner for Data Protection, Peter Schaar, and Berlin's Data Protection Commissioner, Alexander Dix, are both unhappy with Spotify, since it seems to be incompatible with Germany's data protection laws (German original.)

The problem arises from the fact that Spotify requires users to have a Facebook account to sign up. That means it is not possible to use the service anonymously or pseudonymously -- as required by German law. It's not yet clear what the data protection commissioners intend to do about this -- Dix, for example, is simply recommending that Spotify changes its business model to render it compatible with German laws.

It's rather appropriate that when Spotify launches in Germany, a country well-known for its concerns about privacy, it should encounter problems in this area -- just as it was probably inevitable that soon after its arrival in the US, Spotify was sued for alleged patent infringement.

Follow me @glynmoody on Twitter or identi.ca, and on Google+

Filed Under: data protection, germany, privacy
Companies: spotify

EU Politicians Realize US View Of De Facto Ownership Of The Internet Makes Their Data Protection Laws Irrelevant

from the jurisdictional-mess dept

One of the topics that we've discussed since the very beginning of Techdirt is the odd questions of jurisdiction raised by the internet. Pre-internet, most (though not all) jurisdiction questions where fairly straightforward: where was the alleged infraction/crime committed. Once you added the internet to the question, things got weird fast and no one seemed to really want to deal with it. Over the years, there have been some flareups here and there, but over the last couple of years, one thing has started to become clear: the US government feels that it has jurisdiction over much of the internet, even as it decries any other country that suggests something similar.

As we noted recently, folks, like Erik Barnett at Homeland Security, have a rather expansive view over why the US has jurisdiction over any website using a .com or .net domain name. And, of course, it goes way beyond that as well, with the recent admissions from Microsoft that EU data protection rules are effectively meaningless when faced with a US PATRIOT Act request for data. Basically, the US appears to claim that even if the data is stored in Europe, with strict data protection rules, if it's a US company, the US believes it has jurisdiction and can demand access to it.

Not surprisingly, this is upsetting EU officials, who realize that their data protection rules may be effectively meaningless if the US continues to take this rather expansive view of its own jurisdiction.

While you can understand why US officials and law enforcement want to view the world this way, what stuns me is that they appear to be both totally tone deaf to how this makes the US look abroad, as well as oblivious to the obvious unintended consequences and likely counter moves to such a view. Not only does it give moral cover to other countries doing the same thing -- potentially harming US interests significantly -- it's also going to lead to inevitable backlash and widespread harm to US companies and internet users, as users in foreign countries won't go near their services.

This is what happens when you have people who can't think more than single step ahead and put them in a position of power.

Filed Under: data protection, eu, europe, jurisdiction, ownership, patriot act, privacy