Hacker News Reader

Comment by sschueller | Hacker News Reader

How does CISA apply to US companies with subsidiaries in Europe like Microsoft? Will Microsoft now be required to hand over data located in datacenters abroad?

View on HN

Not if they want to comply with existing European privacy law, which the European courts have no problem at all interpreting in maximally draconian form - up to and including forbidding access to the European market.

Even if the US government would attempt to force companies to do this, they wouldn't. And as far as I can tell, this bill doesn't force companies to comply, it just holds them harmless should they choose to comply.

Sadly not. The US courts have already ruled that data held in other data centres are fair game for a US warrant [1]. In this case the data is held in the EU (in Dublin, Ireland to be precise) and MS was found in contempt of court for failing to hand the data over [2]. They're still fighting this case now - over a year later - and it's currently in the 2nd Circuit Court of Appeals [3].

This means that the precedent is already set. If the company operates in the US and is served a warrant, the US Govt wants ALL of the data WHEREVER it's held.

I'm rooting for MS on this one and hope their appeal is upheld.

[1] http://www.theguardian.com/technology/2014/apr/29/us-court-m...

[2] http://www.zdnet.com/article/microsoft-refuses-to-hand-over-...

[3] http://www.techweekeurope.co.uk/e-regulation/microsoft-resis...

Good Lord. Yeah, that's messed up.

The problem is that the EU recently ruled that it was illegal for US companies to send data back to the US for any reason.

The US and EU obviously have two completely imcompatible rulings in play now.

CISA does not require any company to hand over any data. In fact it explicitly prohibits such requirements.

Reply on news.ycombinator.com