Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

U.S. Cloud Act is raising concern about extraterritoriality

bloomberg.com

Post reply on HN
Print view View original

41–50 of 148 posts

Re: U.S. Cloud Act is raising concern about extraterritoriality

#41

Post by guitarbill »

mcv wrote: post #26

I think this CLOUD Act will basically force internationally operating US companies to split up into a US part and an EU part. This law makes it impossible for any company with access to personal data of EU citizens, to obey both US and EU law. The only solution seems to be to ensure that they are two different companies. The other option is to abandon the EU market. What still surprises me is that nearly all of the m…

> The only solution seems to be to ensure that they are two different companies. The other option is to abandon the EU market.

> What still surprises me is that nearly all of the major cloud companies are based in the US. Microsoft, Amazon, Netflix, Google, Apple, all of them US companies. If ever a law is going to create some EU competitors, it's the Cloud Act.

Given that e.g. AWS alone "owns"/operates two regions in China and several GovCloud regions, at worst it'll have a slight impact on these cloud provider's business via mainly legal and not technical changes.

What it will do is show the Privacy Shield agreement is a farce, and the US cannot be trusted in these matters - well, hardly new insights, with things like ICANN et al, but these things were largely left unsaid. I suspect US foreign politics and their image will be harmed more than any of these cloud companies.

Re: U.S. Cloud Act is raising concern about extraterritoriality

#42

Post by fixermark »

ionised wrote: post #38
TomMarius wrote: post #8

Earlier quoted context omitted.

One step at a time. Having physical control over data definitely is an improvement. Not everyone believes conspiracy theories about spy microchips in mainboards.

> believes conspiracy theories about spy microchips in mainboards. You mean not everyone believes the cold, hard truth? That's unfortunate, because most of us here saw the evidence of this taking place.

Interesting. Can you provide a source?

Re: U.S. Cloud Act is raising concern about extraterritoriality

#43

Post by ben_w »

noir_lord wrote: post #40
stunt wrote: post #5

Is there a good European cloud provider?

ByteMark over in the UK but given Brexit I'm not sure a mainland company would want to use a company here. Might be cost effective if the pound takes another beating though.

Given the point of Brexit seems to be “sovereignty” which in turn seems to mean “no foreign courts ever not even for trade deals”, I think that even a 10:1 devaluation of GBP vs. EUR wouldn’t make a post-Brexit UK appealing for hosting EU-27 services. And even my worst-case estimates are not yet beyond 1.3:1 devaluation.

Re: U.S. Cloud Act is raising concern about extraterritoriality

#44

Post by j16sdiz »

Neil44 wrote: post #37
Isinlor wrote: post #36

If complying with CLOUD act would infringe on EU citizens rights, is there any legal reason why EU regulator should not fine a company that is infringing EU laws? We, Europeans, should follow our laws to their full extend and fine infringing companies with full power. No matter on whose request they break our laws. Be it Russians, Chinese, Australian or Americans.

I agree. Companies need to find a way to operate within the law, or not operate. Throwing your hands up and saying it’s too hard is not an acceptable answer.

No. They just stash the fine as operation cost. Every bank have been doing this for decades.

Re: U.S. Cloud Act is raising concern about extraterritoriality

#45

Post by chopin »

fixermark wrote: post #42
ionised wrote: post #38

Earlier quoted context omitted.

> believes conspiracy theories about spy microchips in mainboards. You mean not everyone believes the cold, hard truth? That's unfortunate, because most of us here saw the evidence of this taking place.

Interesting. Can you provide a source?

https://en.wikipedia.org/wiki/Intel_Management_Engine#Claims...

Re: U.S. Cloud Act is raising concern about extraterritoriality

#46

Post by CannisterFlux »

mcv wrote: post #26

I think this CLOUD Act will basically force internationally operating US companies to split up into a US part and an EU part. This law makes it impossible for any company with access to personal data of EU citizens, to obey both US and EU law. The only solution seems to be to ensure that they are two different companies. The other option is to abandon the EU market. What still surprises me is that nearly all of the m…

The Microsoft response was to have a separate German trustee be the ones that held the data, and MS have access to the data as needed (but I guess MS could not just hand it all over to the US government when demanded to) https://azure.microsoft.com/en-us/global-infrastructure/germ...

"All customer data and related systems reside in Germany Controlled by a German data trustee"

Re: U.S. Cloud Act is raising concern about extraterritoriality

#47

Post by kkarakk »

tyfon wrote: post #16
Tsubasachan wrote: post #13

Earlier quoted context omitted.

Microsoft Euro branch is still subject to US law. The US can still seize your data.

Yes, that is why you use azure stack and not azure. It's a licensed version of the software that you can run completely independent of Microsoft.

licenses usually include provisions for being disabled if the parent country requires it. see what happened to iran when US levied sanctions

Re: U.S. Cloud Act is raising concern about extraterritoriality

#48

Post by jdietrich »

vegardx wrote: post #20
tyfon wrote: post #15

Earlier quoted context omitted.

Banking data is at least considered to be "important" enough to keep within the borders too, but privacy is important too in regards to GDPR. How do you prevent unauthorized access to the data (i.e. the US government) with the cloud act. Do you report those requests as a breech? There is really no difference between that and having the servers hacked in other ways.

Banking data is important because the police and tax authority wants to make sure they have access, privacy doesn't really come into play here. It's a nice side effect, though. It's the same with accounting data. When it comes to GDPR it only talks about where and by who data is processed, it doens't really put any restriction on storage, except for some pretty vague (on purpose) requirements about data protection (r…

Storage is processing.

‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction

https://gdpr-info.eu/art-4-gdpr/

Re: U.S. Cloud Act is raising concern about extraterritoriality

#49

Post by wvh »

mcv wrote: post #26

I think this CLOUD Act will basically force internationally operating US companies to split up into a US part and an EU part. This law makes it impossible for any company with access to personal data of EU citizens, to obey both US and EU law. The only solution seems to be to ensure that they are two different companies. The other option is to abandon the EU market. What still surprises me is that nearly all of the m…

I don't think it will necessarily create a lot more competition inside the EU. All of those companies already have European data centers; surely it would complicate some technical deployments, but definitely not more so than the effort their legal, HR, accounting and other divisions already have to go through to comply with local regulations. I assume those companies already have multiple legal entities for all sorts of reasons.

I guess all companies ought to start tagging data with a jurisdiction tag of sorts now, if that data doesn't already come with a clear location indicator.

Re: U.S. Cloud Act is raising concern about extraterritoriality

#50

Post by jdietrich »

ben_w wrote: post #43
noir_lord wrote: post #40

Earlier quoted context omitted.

ByteMark over in the UK but given Brexit I'm not sure a mainland company would want to use a company here. Might be cost effective if the pound takes another beating though.

Given the point of Brexit seems to be “sovereignty” which in turn seems to mean “no foreign courts ever not even for trade deals”, I think that even a 10:1 devaluation of GBP vs. EUR wouldn’t make a post-Brexit UK appealing for hosting EU-27 services. And even my worst-case estimates are not yet beyond 1.3:1 devaluation.

Transfers of personal data to non-EU countries are specifically regulated by Chapter 5 of GDPR. After Brexit, Britain is "foreign" as far as the EU is concerned.

It's also worth noting that a lot of Brexiters consider closer political ties and a strong trade deal with the US as an essential element of their ideal Brexit scenario, by weakening Britain's ties to (and dependency on) the EU. In a no deal/hard Brexit scenario, Britain may lack the negotiating leverage to assert any meaningful kind of sovereignty. Many pro-Brexit campaigners have described Britain as being trapped in vassalage to the EU, but a chaotic Brexit could make Britain just as dependent on the US, with everything that implies politically.

Post reply on HN