Let's play nicely please.

For what it's worth:

- Facebook LLC was formed in Cambridge, MA

- Later Facebook Incorporated was registered in Delaware, like about 50% of corporations in the US. That corporate entity bought the LLC and diluted the other founder's holdings - they even made a movie about it . That state laws are fairly unique in that the owners are explicitly not liable for losses/damages, plus you don't have to pay corporation tax out-of-state for those shareholder by-laws. Most lawyers are also very familiar with the Delaware business friendly statutes, so it's very common thing to do. As the company is head-quartered in California, they still have to operate under local corporate bylaws for that state.

- Facebook Ireland Ltd in Europe is registered as an Irish organization, as Ireland is part of the single EU market and offers one of the lowest corporation tax rates (12.5%). This is very common where a company needs to physically locate somewhere in Europe, i.e. the large Facebook data-centers. If you are a user in Europe then your user agreement is through Facebook Ireland to be compliant with the various EU data protection rules.

They are going to be registered in each of the 50 states they do business in and any other jurisdictions they are qualified to do business in. But it's headquartered in the US- meaning where the majority of its business records are located are subject to US law. The international character of the Internet might lead people to think that it doesn't work that way, but remember- it's just the records we're talking about. It doesn't mean that the FBI is arresting people in Ireland.

The data for Europe is stored in Ireland. European's terms of use when joining are with Facebook Ireland Ltd rather than Facebook Inc. Ireland and the USA have an extradition treaty as well. Are you claiming that European laws aren't applicable to Facebook generally or am I misunderstanding you a bit here?

So, any company can have an overseas local office to handle things administratively. Whether Facebook has servers located physically in Ireland I haven't a clue, but they might have offices in Ireland and they are qualified to do business in Ireland. What this probably means in the case of Ireland is that the Irish authorities, or let's say a lawyer with a lawsuit goes to Facebook Ireland inquiring about Irish accounts. No problem- they go to Facebook Ireland's offices, they follow all applicable local laws. Their people in Ireland can probably retrieve the data from the US if all their servers are located there, or from their Irish based servers, if any. If for some reason there was some US based account they were looking for, now it won't work that way, Irish authorities are going to invoke a treaty and petition the US government to get that information for them. The US government will search Facebook using their available mechanisms, and turn that over to the Irish authorities.

However, let's say the US Department of Homeland Security wanted information on what turned out to be someone in Ireland. They are just going to get it from Facebook in the US- because basically the majority of Facebook's contact with the US is where it is incorporated, domiciled, physically located. It's a US company for their purposes, and they can get what they want. Because of the international character of the internet, and information can travel across different states and different countries, everyone has to sort of agree where they reside for all practical purposes. For a US agency, or a lawyer in private practice, Facebook's business records are fair game (the contents of emails and things like that will be subject to US privacy laws however, even if it is a foreigner using the account, they are still protected by US statute).

It's quite a complicated (and dull!) area, but it's not really as simple as the FBI being able to do that - not in the case where the sole evidence for prosecution is from Facebook like that. Of course the FBI will look and do other things to build a case, but the bit you might not be appreciating is the various legal structures and contracts between the user, Facebook Inc, Facebook Ireland Ltd and the EU Data Protection laws that have been agreed to when signed up.

If someone from a EU member state, say Spain or France, gets an extradition request and that evidence is based on information obtained in the US on Facebook servers that is a copy of the data that's held in Ireland then it's unlikely (although not impossible) that anyone is forced on a plane. Facebook Ireland Ltd is legally bound by Irish law, Irish law is superseded by the EU Data Protection law and the terms of use for a Facebook user in Europe is, like I said, with Facebook Ireland Ltd and not Facebook Inc. If the FBI break that contract (and perhaps they do all the time, probably) then that's fine until you need to provide an admissible case for extradition that's dependant on it

PS Anyone like sims?

It is as simple as that. A US company cannot enjoy the privileges and protection of US law, and then suddenly turn jurisdictions when it wants and deny US law, and then go back and forth again. Decide- are you a US company? You are subject to US law. This also means that if say the FBI were looking for an Irish terrorist, they have to follow US law in order to do so, not Irish law- that means that the Irish account still gets the same protection: it is a US based agency, subject to the US Constitution and applicable US laws. Cannot suddenly act as though no laws apply to it, or that another country's laws apply. So they would still have to get a valid search warrant in compliance with Federal guidelines, they couldn't just seize whatever they want without legal process.

A US company doing business in Ireland with its overseas divisions located there will also follow Irish law, just as a company headquartered in CA doing business in any state will also follow their laws. Their overseas divisions will have a different set of laws entirely to deal with regarding disclosure and privacy as it concerns the Irish authorities, but US authorities won't be constrained the same way for a foreign account.

Scenario 1

In the case of Irish authorities:

Is it an Irish based account, or does the account when it signed up agree to an Irish TOS (terms of service)? Then if Irish authorities want it, then yes, they follow Irish law.

Scenario 2
In the case of US authorities:

Is it an Irish based account, or does the account when it signed up agree to an Irish TOS (terms of service)? US Authorities don't care about that at all, they follow US law to get the information from a US company. The company and their records are under US jurisdiction, no MLAT treaty required. The only thing that happens is that a judge might rule against the petitioning agency for one reason or another, but potentially, all is fair game.

Scenario 3
In the case of Irish authorities:

Is it an US based account, or does the account when it signed up agree to an US TOS (terms of service)? Irish authorities invoke an MLAT treaty and go to the US government- like the US DOJ, through the embassy or consular office, or get nothing at all. The account is protected by US privacy laws.

Scenario 4
In the case of US authorities:

Is it an US based account, or does the account when it signed up agree to an US TOS (terms of service)? No surprise, the US agency gets what it wants.


I promise you this is how it's done.

I think you might be misunderstanding scenario 2 Kontat? For scenario 2 they are not US accounts. As I've mentioned a few times now Ireland is a member of the EU and the EU-based users have signed a user agreement when creating their account that complies with the EU Data Protection legislation. Just like in your scenario 3, where it a US member is protected by US privacy laws, the EU user is protected by those similar ones within those member states.

You originally seemed unsure why Delaware was used for corporations, and how the EU laws fit within the Maastrict Agreement of the member states, and how Facebook has two major data-centers in Ireland for tax and data privacy reasons, so really my comments were more to help highlight some useful info about the discussion you and comache were having, as it was getting a bit derogatory etc. I'm not really here to prove anyone right or wrong (it's the internet, everyone is right), more just to keep the peace

Once more. It is a US based company. So, in scenario 2 where there is an Irish based account and US authorities want information about it, they only care about the fact that it is a US based company. To whom the accounts belongs to MATTERS NOT. It's a US company, it's a US company's records under subpoena or search warrant. The Company might be registered in Ireland, it STILL is a US based company, not an Irish based company. A US company will be REQUIRED to turn over information about its records to US authorities with the proper, legal process. It is subject to US privacy laws irrespective of whom its customers are. If it were the other way around and it were an Irish company, then all scenarios would be turned on their heads.



Uh? what? No, I said I didn't know if Facebook was a Delaware or a CA corp. You're really adding things I never said, I'm afraid. Go back and look what I said- I said I don't know if it's a CA corp or a Delaware Corp, but I wouldn't be surprised it was a Delaware Corp, because, Delaware is where you would probably want to incorporate. Nothing unusual about that, Delaware is one of the earliest states people were forming corporations, as such the laws have a long history and tend to favor corporate insiders over investors for tax and liability purposes.

So, let me tell you I work in this industry, I deal with all of this, among other things. This is what I do specifically. You couldn't be more wrong about what you're saying I don't know.

Here's my question to you, because what you think entails a strange circumstance. If everything is as you say, and US authorities can't get this information as you seem to think because the EU agreements wouldn't allow it, then why are people complaining about it? What's the problem? Why are they worried? How do you think the US government authorities are getting information about foreign accounts from US companies? Evidently, it's not happening, and it can't happen, so what's to worry?

We're probably saying the same things, but I think the difference in what we are saying is not really on the ability for the FBI to legally see the data but in being able to use it against someone outside the jurisdiction of the US, with regards that the privacy agreement in the EU has been broken.

There's a fair amount of CAPS in that reply, so I'm done as don't feel that strongly about it..

The FBI isn't going to go abroad and arrest a EU citizen to be prosecuted in the EU by US laws, that's the only thing I can think of that's being confused here. Everyone generally can only be prosecuted under their own country's laws, unless they were in another country breaking that country's laws. So if I were in Ireland and stole something from a shop, I can be prosecuted in Ireland.

Collecting data however doesn't work the same way, it's different how that works or if not, everything you've heard about the Patriot Act or anything else you may have heard about wouldn't exist.