Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

U.S. Cloud Act is raising concern about extraterritoriality

bloomberg.com

Post reply on HN
Print view View original

121–130 of 148 posts

Re: U.S. Cloud Act is raising concern about extraterritoriality

#121

Post by hopler »

hellisothers wrote: post #80
cabalamat wrote: post #76

Earlier quoted context omitted.

> The only solution seems to be to ensure that they are two different companies. If the EU comany is a subsiduary of the US company, then it will have to follow its orders and won't really be separate. Furthermore if people based in the USA have physical access to the servers located in the EU, then if the US government wants that data, it will probably be exfiltrated to the USA, regardless of what EU governments wan…

Here lies humanity, they tried to do the same things 15 different ways and squandered their resources doing so. (Not saying you’re advocating for this, just that it is the current plan it seems)

Humanity built the tower of Babel, all speaking one language, and was struck down and fragmented for their hubris.

Re: U.S. Cloud Act is raising concern about extraterritoriality

#122

Post by logfromblammo »

tzs wrote: post #113

Suppose I, operating in the US, rent some physical storage space in Europe from a European storage company, and then ship a box of documents to them and tell them to put them in my rented storage space. I don't think there is any serious doubt that a US court or US law enforcement with a warrant would be able to order me to contact the storage company and tell them to ship the box back to me. The European country the…

Further suppose that I prearrange instructions with the storage company such that they are to ship my documents back to me in the US, only if I ask that they be destroyed, and to ignore any other requests for shipment.

Am I guilty of contempt of court if I do exactly as the court orders, knowing that the only way to accomplish the end the court desires is to do something the court has likely already ordered me to not do? The foreign entity could just as easily have instructions to not release the documents until presented with evidence of my death, then release them to my heirs, or respond only to requests from my lawyer that contain the word "cockatiel".

The only reliable and reasonable way to handle it, is for the US court to request extradition of the documents from the French authorities, and rely upon them to seize the documents and transmit them with clear chain of custody directly to the US court.

If the court is aware the documents exist, and that they lie in a foreign jurisdiction, they have no particular reason to rely upon me for their retrieval. It is dangerous to even try, if I am in any way uncooperative.

Re: U.S. Cloud Act is raising concern about extraterritoriality

#124

Post by guitarbill »

bradknowles wrote: post #117
guitarbill wrote: post #41

Earlier quoted context omitted.

> The only solution seems to be to ensure that they are two different companies. The other option is to abandon the EU market. > What still surprises me is that nearly all of the major cloud companies are based in the US. Microsoft, Amazon, Netflix, Google, Apple, all of them US companies. If ever a law is going to create some EU competitors, it's the Cloud Act. Given that e.g. AWS alone "owns"/operates two regions i…

The AWS Chinese regions were handed over to a Chinese operator. They're "AWS Regions" in name only.

Precisely. But the code deployed there seems to offer the same functionality as other regions, right? So this is a legal/business trick, not a technical challenge.

Re: U.S. Cloud Act is raising concern about extraterritoriality

#125

Post by TuringNYC »

cabalamat wrote: post #76
mcv wrote: post #26

I think this CLOUD Act will basically force internationally operating US companies to split up into a US part and an EU part. This law makes it impossible for any company with access to personal data of EU citizens, to obey both US and EU law. The only solution seems to be to ensure that they are two different companies. The other option is to abandon the EU market. What still surprises me is that nearly all of the m…

> The only solution seems to be to ensure that they are two different companies. If the EU comany is a subsiduary of the US company, then it will have to follow its orders and won't really be separate. Furthermore if people based in the USA have physical access to the servers located in the EU, then if the US government wants that data, it will probably be exfiltrated to the USA, regardless of what EU governments wan…

>> If the EU comany is a subsiduary of the US company, then it will have to follow its orders and won't really be separate.

Accenture and other US consultancies with global operations faced this problem when bidding for government contracts. They created a global parent corporation (in Accenture's case it was Luxembourg and in many cases it is Bermuda.) The US portion of the business is owned by the global parent. The EU portion of the business is owned by the global parent as well. Same for other subsidiaries.

Re: U.S. Cloud Act is raising concern about extraterritoriality

#126

Post by DuskStar »

cesarb wrote: post #115
tzs wrote: post #113

Suppose I, operating in the US, rent some physical storage space in Europe from a European storage company, and then ship a box of documents to them and tell them to put them in my rented storage space. I don't think there is any serious doubt that a US court or US law enforcement with a warrant would be able to order me to contact the storage company and tell them to ship the box back to me. The European country the…

In your example, the US court is ordering you to request the documents. There's no question that the US court has jurisdiction over you. What about this variation over your example: instead of contacting you, the US court bypasses you and asks directly the European storage company. This is much more questionable, since a US court shouldn't have jurisdiction over an European company.

Funnily enough, in the GDPR equivalent (you, a EU resident, hire a company in the US to store a box for you) the EU bypasses you and requires the storage company to have an effective security guard and fire suppression system...

Re: U.S. Cloud Act is raising concern about extraterritoriality

#127

Post by TheAceOfHearts »

sangnoir wrote: post #78
judge2020 wrote: post #59

Earlier quoted context omitted.

> Apple tracking your pulse in your phone(that gives them knowledge about your deep emotions an activities on real time). Health data is encrypted to a point where Apple can't read it: https://www.apple.com/business/site/docs/iOS_Security_Guide.... > Health data can be stored in iCloud. When configured for iCloud storage, Health data is synced between devices and secured by encryption that protects the data both in t…

> Health data is encrypted to a point where Apple can't read it Apple controls the encryption keys and the underlying OS. If the user is not in control of the encryption, then it's nothing more than a pinky-promise that they won't peek at your data, for example, if a new management team takes over tomorrow.

For many people this is a reasonable risk. If they pulled something like that it would start a huge legal battle, and it would seriously harm their reputation. I suspect that pushing out a change of this sort would also require a system update, which you could always delay until it's been carefully vetted by others.

At least with Apple you can maintain a fairly small chain of trust, since they have greater control over their hardware. Being in control of the encryption keys is unlikely to protect you from hardware backdoors or state-sponsored attacks.

Re: U.S. Cloud Act is raising concern about extraterritoriality

#129

Post by Silhouette »

mcv wrote: post #55
Neil44 wrote: post #37

Earlier quoted context omitted.

I agree. Companies need to find a way to operate within the law, or not operate. Throwing your hands up and saying it’s too hard is not an acceptable answer.

I'm not sure how I feel about this argument in light of article 13 of the EU's new copyright directive. Legislators also have a responsibility to make laws that are reasonable and possible to obey. It is possible for companies to obey the Cloud Act, but as far as I can see, only by choosing between operating in the US and operating in the EU. If that's considered unreasonable, then it's a bad law.

I'm not sure how I feel about this argument in light of article 13 of the EU's new copyright directive. Legislators also have a responsibility to make laws that are reasonable and possible to obey.

And the GDPR.

And the proposals to force payment service providers to report or even automatically collect and remit taxes that the EU decides are due.

I'm not fan of the US government's invasions of privacy, but it is the height of hypocrisy for the EU in 2019 to complain about a foreign government attempting to enforce its laws extra-territorially.

Re: U.S. Cloud Act is raising concern about extraterritoriality

#130

Post by jeroenhd »

KorematsuFred wrote: post #128

What happens if say EU were to pass a law that no data stored in EU data centered be shared with non-EU countries ? In such case no company can obey both laws. How will this be handled ?

Actually, the EU privacy laws already forbid loads of data being stored in countries where the privacy of that data might not be maintained.

When the US was ruled as not trustworthy enough, the Privacy Shield agreement was quickly thrown together. That's currently why some sensitive information about European citizens is allowed to be stored on US soil.

However, acts like these (Cloud act, PATRIOT act, etc.) make me, as a European, very uncomfortable. I hope the EU will take action against the US. Russia and China already have regulations that certain information can only be stored inside their own country's borders and MS Outlook still works fine; there's no need for the EU to just take crap like this without putting up a fight.

Post reply on HN