Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

U.S. Cloud Act is raising concern about extraterritoriality

bloomberg.com

Post reply on HN
Print view View original

111–120 of 148 posts

Re: U.S. Cloud Act is raising concern about extraterritoriality

#111

Post by deadmetheny »

Tsubasachan wrote: post #109
zepearl wrote: post #102

Earlier quoted context omitted.

>>If the EU comany is a subsiduary of the US company, then it will have to follow its orders and won't really be separate. Maybe the US company could be a holding which would "only" own 100% of its independent EU subsidiary (which would be its own legal entity, reporting in EU)?

The question is: does America care about international law and treaties or will they just do whatever they want? Ten years ago I knew the answer to this question. Today not so much. This is why the EU should hedge its bets and keep the door open for Chinese companies.

Ah yes, the Chinese, those paragons of upholding international laws and agreements. They certainly won't end up just doing whatever they want to do.

Re: U.S. Cloud Act is raising concern about extraterritoriality

#112

Post by cabalamat »

hellisothers wrote: post #80
cabalamat wrote: post #76

Earlier quoted context omitted.

> The only solution seems to be to ensure that they are two different companies. If the EU comany is a subsiduary of the US company, then it will have to follow its orders and won't really be separate. Furthermore if people based in the USA have physical access to the servers located in the EU, then if the US government wants that data, it will probably be exfiltrated to the USA, regardless of what EU governments wan…

Here lies humanity, they tried to do the same things 15 different ways and squandered their resources doing so. (Not saying you’re advocating for this, just that it is the current plan it seems)

> Here lies humanity, they tried to do the same things 15 different ways and squandered their resources doing so.

Polities that don't retain control over their computing infrastructure will in the future have effectively ceded independence to others.

Because controlling the full stack from silicon to cloud services is expensive (fabs can cost c. $20 billion), this has geo-political implications: namely that in the future there will only be a small number of loci of independent power. The USA will be one, China another. Does Europe want to make itself a third, or will it be content to be subservient to others?

Re: U.S. Cloud Act is raising concern about extraterritoriality

#113

Post by tzs »

Suppose I, operating in the US, rent some physical storage space in Europe from a European storage company, and then ship a box of documents to them and tell them to put them in my rented storage space.

I don't think there is any serious doubt that a US court or US law enforcement with a warrant would be able to order me to contact the storage company and tell them to ship the box back to me.

The European country the storage unit is in would not see this as some attempt at exercising extraterritorial jurisdiction. To them, it is just a routine interaction between me and a service provider I am using in Europe. That my motive for asking for my box back was to satisfy a court order rather than because I actually wanted to use my documents is irrelevant.

(This works both ways. A French court ordering a French company that had stored physical documents to retrieve those documents would not raise issues in the US if the French company was using a US document archiving service to hold them).

I don't see why there should be any difference between my physical documents that I keep in a box in a Paris storage unit, and my electronic documents that I keep on an Amazon server in the Paris AWS region.

Re: U.S. Cloud Act is raising concern about extraterritoriality

#114

Post by mcv »

delinka wrote: post #97
mcv wrote: post #55

Earlier quoted context omitted.

I'm not sure how I feel about this argument in light of article 13 of the EU's new copyright directive. Legislators also have a responsibility to make laws that are reasonable and possible to obey. It is possible for companies to obey the Cloud Act, but as far as I can see, only by choosing between operating in the US and operating in the EU. If that's considered unreasonable, then it's a bad law.

A company choosing to operate in multiple jurisdictions with competing/contradicting laws does not put a requirement on lawmakers to make the laws more amenable to the company trying to satisfy both jurisdictions. If you take that path, consumers end up with little protection under the law. Maybe the company should split up operations, or operate under licensing agreements with foreign companies rather than thwart th…

You're right, it's not the government's job to protect business models, particularly if they are considered harmful. A sensible government would probably want a healthy environment and market for companies to operate it, but exactly what that means is clearly something on which governments can radically disagree.

So I admit that the US is entirely within its rights to create a law that makes it impossible for cloud providers to simultaneously operate in the US and the EU.

It's still be sad though that the two major democratic power blocs in the world can't agree on something like this.

Re: U.S. Cloud Act is raising concern about extraterritoriality

#115

Post by cesarb »

tzs wrote: post #113

Suppose I, operating in the US, rent some physical storage space in Europe from a European storage company, and then ship a box of documents to them and tell them to put them in my rented storage space. I don't think there is any serious doubt that a US court or US law enforcement with a warrant would be able to order me to contact the storage company and tell them to ship the box back to me. The European country the…

In your example, the US court is ordering you to request the documents. There's no question that the US court has jurisdiction over you.

What about this variation over your example: instead of contacting you, the US court bypasses you and asks directly the European storage company. This is much more questionable, since a US court shouldn't have jurisdiction over an European company.

Re: U.S. Cloud Act is raising concern about extraterritoriality

#116

Post by bradknowles »

gumby wrote: post #88
hellisothers wrote: post #80

Earlier quoted context omitted.

Here lies humanity, they tried to do the same things 15 different ways and squandered their resources doing so. (Not saying you’re advocating for this, just that it is the current plan it seems)

Here stands humanity, they tried to do the same things 15 different ways as a way of figuring out what was best for various situations.

And then there were 16: https://xkcd.com/927/

Re: U.S. Cloud Act is raising concern about extraterritoriality

#117

Post by bradknowles »

guitarbill wrote: post #41
mcv wrote: post #26

I think this CLOUD Act will basically force internationally operating US companies to split up into a US part and an EU part. This law makes it impossible for any company with access to personal data of EU citizens, to obey both US and EU law. The only solution seems to be to ensure that they are two different companies. The other option is to abandon the EU market. What still surprises me is that nearly all of the m…

> The only solution seems to be to ensure that they are two different companies. The other option is to abandon the EU market. > What still surprises me is that nearly all of the major cloud companies are based in the US. Microsoft, Amazon, Netflix, Google, Apple, all of them US companies. If ever a law is going to create some EU competitors, it's the Cloud Act. Given that e.g. AWS alone "owns"/operates two regions i…

The AWS Chinese regions were handed over to a Chinese operator. They're "AWS Regions" in name only.

Re: U.S. Cloud Act is raising concern about extraterritoriality

#118

Post by pjc50 »

Tsubasachan wrote: post #109
zepearl wrote: post #102

Earlier quoted context omitted.

>>If the EU comany is a subsiduary of the US company, then it will have to follow its orders and won't really be separate. Maybe the US company could be a holding which would "only" own 100% of its independent EU subsidiary (which would be its own legal entity, reporting in EU)?

The question is: does America care about international law and treaties or will they just do whatever they want? Ten years ago I knew the answer to this question. Today not so much. This is why the EU should hedge its bets and keep the door open for Chinese companies.

Ten years ago the answer was also no, but with a bit more lip service.

The US hasn't bothered with such things as the ban on landmines, the ICC for war crimes, and the U.N. convention on rights of the child. The U.S. is only interested in law that binds other countries.

Re: U.S. Cloud Act is raising concern about extraterritoriality

#119

Post by wmf »

mcv wrote: post #60
pergadad wrote: post #58

Earlier quoted context omitted.

Wouldn't the cloud act also apply to subsidiaries? It's be surprised if the giants can at the same time split (for the purposes of the cloud act) and stay one coherent entity with central steering.

I suppose that's going to be the big challenge. You'd want a structure where neither company controls the other, yet they still have every incentive to cooperate closely. Maybe they should each own 49% of the other's stock?

The same lawyers who invented the Double Irish Dutch Sandwich can start working on this problem.

Re: U.S. Cloud Act is raising concern about extraterritoriality

#120

Post by pjc50 »

hellisothers wrote: post #80
cabalamat wrote: post #76

Earlier quoted context omitted.

> The only solution seems to be to ensure that they are two different companies. If the EU comany is a subsiduary of the US company, then it will have to follow its orders and won't really be separate. Furthermore if people based in the USA have physical access to the servers located in the EU, then if the US government wants that data, it will probably be exfiltrated to the USA, regardless of what EU governments wan…

Here lies humanity, they tried to do the same things 15 different ways and squandered their resources doing so. (Not saying you’re advocating for this, just that it is the current plan it seems)

Well, yes. Merely duplicate effort is a great improvement over last century's plan to be able to destroy civilization at 45 minutes notice.

Speaking of which, I believe Pakistan had two mutually distrusting nuclear weapons programs, reflecting the internal conflicts between parts of the state security apparatus.

Post reply on HN