I have to admit I find this whole situation (and also Krebs article bizarre). The problem seems to be that tech companies approve EDRs without much checking. Then the argument somehow becomes it is essentially impossible for them to check because there could be any of the thousands of police departments in the world requesting the EDR? Why should MS in the US somehow respond to a request from police department in Cuxhafen in Germany?
I think the argument being made here is one of those "we can't make a perfect solution so no solution works", which is nonsense. Simply don't answer requests from police departmenents you can't verify. I bet you if a police department would request some business sensitive information they would not hand it over without going over the subpoena with a fine toothed comb. The issue is just that they don't value their customers privacy high enough to do a proper check.
I think the argument being made here is one of those "we can't make a perfect solution so no solution works", which is nonsense. Simply don't answer requests from police departmenents you can't verify. I bet you if a police department would request some business sensitive information they would not hand it over without going over the subpoena with a fine toothed comb. The issue is just that they don't value their customers privacy high enough to do a proper check.