12 ms·

The End of Safe Harbor and a Scary Path Forward

139 points by di 11y ago

_pferreir_ 11y ago
Call me a hipster, but I really miss back when no-one cared about the Internet.
- TeMPOraL 11y ago
  Me too. In many ways, money basically ruined it. It happens everywhere where builders get replaced by businessmen. Don't get me wrong - I appreciate what money did here. But I also hate that most of the Internet is now flooded with ads, SEO, "entrepreneurs" seeking ways to make a quick buck and startups monetizing the most basic aspects of human interaction.
  - realquick81 11y ago
    It wasn't money that ruined it, it was business people, marketing people and advertising people. As always, they're the ones that ruin everything.
  - kuschku 11y ago
    It’s funny that you say this on a website aimed at people who do exactly that. Make a quick bucks by monetizing the most simple things. You know, I’ve been thinking about it for a long time. In a lot of ways, the internet was an anarchist society for some time. Then some people took advantage of it, used anarcho-capitalism to get insane profits and violate any normal laws, and nowadays, it’s a bit regulated, but still anarcho-capitalist. The anti-spam measure re-captcha is effectively everyone giving Google training data for their neural networks. Maybe it would have been better if everything on the web was GPL. Maybe it wouldn’t. Who knows. But obviously, this should be a sign for entrepreneurs that maybe, just maybe, your users might be more important than profits.
- kalms 11y ago
  Let's build a new one.
Keats 11y ago
So does that rule out a good chunk of US providers for european companies (stripe/braintree/slack etc)? I could only find mention of Safe Harbor in their privacy policy and not where the data is hosted.
- the_mitsuhiko 11y ago
  Pretty much. From what I have heard so far the general assumption is that you can still set up a contract to achieve what Save Harbor did, you users need to explicitly agree with the provisions.
  - Silhouette 11y ago
    This is our concern, as a small business using a very small but non-zero set of US services, all of which were previously covered by Safe Harbor provisions. This ruling is something we have always been concerned about from a business point of view, because ever since it became untenable to claim US companies could actually protect any personal data at all the basic legal premise on which Safe Harbor was built has been shaky. We don't know now whether it will still be sufficient to merely disclose our commercial partners in our privacy policy (which we do, by name and with an indication of what we use them for) or whether we need some sort of more active consent. I haven't had chance to speak to our lawyer yet, but I'm expecting him to tell us something along the lines of: the law now requires us to add yet another prominent notice at the conclusion of a sale. On top of all the consumer protection rubbish from the recent EU changes there -- which again were well-intentioned but actually impose silly things that help neither us nor our customers -- the number of such notices we need by law is making our sales pages almost comical now. I can't believe all these notices really help to protect anyone from much of anything in practice, and anyone reading this on HN probably knows what effect compliance has on conversions. The second to worst possible outcome is probably that we are now required to seek active consent from our existing customers before continuing to use things like US-based payment services. The worst is that it actually becomes illegal to use those services at all, though I don't think that is going to happen. It's sad, because from a personal point of view this mess is long overdue for being cleaned up. But the authorities are so clumsy about handling these issues that a lot of the time they just hurt small businesses and legitimate international trade.
k__ 11y ago
I must admit, after the NSA stuff, I feel safer without "Safe Harbor". But I guess a bunch of US companies are pretty scared about the financial implications right now. Kicking out EU citizens or moving their data to the EU.
- daxelrod 11y ago
  Do we actually know whether any of the Five Eyes nations are any better than the US in this regard?
  - omouse 11y ago
    If they're in the Five Eyes then no, they aren't any better.
- geofft 11y ago
  Well, this is the usual thing about whether you're worried about the NSA or you're worried about more mundane threats. If your threat model is "government coercion," sure, stay out of the US. But if your threat model is something like "an attacker broke into a cloud provider employee's account" or "the provider didn't take software updates", you're probably safer on the world's larger, more-staffed, more-well-run, etc. services, which are largely (though not entirely) in the US. The best outcome here, I think, would involve serious, secure competitors to things like AWS being run by European countries in Europe.
  - sokoloff 11y ago
    You can already choose AWS services and ensure that they stay located only in a single region (that you decide), so you can pick EU-West-1 (Ireland) or EU-Central-1 (Germany) and be assured that Amazon won't move your data into another region. If you are contemplating "pan-cloud root compromise", I'd worry more about the probability of that happening and less about in which countries that cloud provider operates. That would push me towards the larger, established provider (perceived lower probability of all-access-root compromise) over a smaller upstart whose value prop was "we ONLY operate in Europe".
kawera 11y ago
Snowden's tweet, to the point: https://twitter.com/Snowden/status/651383168650604544 https://twitter.com/Snowden/status/651383168650604544
- debacle 11y ago
  I don't necessarily agree with him. People who live in countries with strict data protection laws are safer, but those who live in more lax surveillance might actually wind up less safe.
gozo 11y ago
We are dealing with the consequences of not taking this very seriously for the last decade. It's not good enough to just hope that the Internet will remain free in the face of legitimate concerns. Yes, it's a concern that the Internet won't be global anymore, but it never really was. Up until thing like Firesheep and Snowden, and still to some extent, a lot of Internet traffic was only safe based on not passing any bad actors.
- the_mitsuhiko 11y ago
  > Yes, it's a concern that the Internet won't be global anymore, but it never really was. So we're willing to throw all this interconnection away, the one thing that made the internet the place it is? The interconnected nature of the internet is what made me the person I am today. I have more friends from other countries than I have friends from my own and from my friendship circles I know I'm not the only one.
  - deleted 11y ago
    [deleted]
  - gozo 11y ago
    Not taking legitimate concerns seriously and securing the Internet we want is what is going to throw away the positive things about the Internet. Something that isn't technically secure nor robust in the face of arguments is bound to change
- bediger4000 11y ago
  And by "bad actors" you mean folks like NSA, GCHQ and FSB, right? Oh, and Unit 8200.
  - rdancer 11y ago
    Yes
  - freehunter 11y ago
    "Bad actors" includes all bad actors, and the parent explicitly called out both major bad actors (hackers and governments). Not sure what more you want by demanding a clarification.
coldcode 11y ago
The end result may become a Balkanized internet - you can't share anything outside your country's borders or access them from outside. Each country winds up as a China, a government's dream situation. In the end though we all lose.
- kawera 11y ago
  Not necessarily Balkanized if we concentrate our efforts in developing better protocols and not larger centralized platforms. Decentralization is key to internet freedom.
  - the_mitsuhiko 11y ago
    Not sure what you are proposing. This is not really something we can improve as nature works against us. Unless someone finds a wormhole for data, we will be bound by latency and thus the only solution is user segregation.
    - kuschku 11y ago
      Or one can use distributed protocols like XMPP. I can send messages just fine from @jabber.de to someone on a US server.
      - the_mitsuhiko 11y ago
        Message delivery is not a problem that needs solving. You don't even need XMPP for that, good old sockets do the trick. The problem is that you need to fetch data over high latency network links and you are not even allowed to cache it due to legal reasons.
        kuschku 11y ago
        Eh, what? The EU data privacy laws have a specific paragraph directly and specifically declaring that caching is exempt. You can even use worldwide cloudflare caching for your site, and store userdata in the EU, and still comply.
Animats 11y ago
This is great! It gives users lots more privacy rights, rights that come with teeth. See page 105 of [1]. It's going to force many US companies to register with a European data privacy controller. Here are the basic rights of a "data subject": Everyone shall have the right under national law to request from any controller information as to whether the controller is processing his or her data. • Data subjects shall have the right under national law to: • access their own data from any controller who processes such data; • have their data rectified (or blocked, as appropriate) by the controller processing their data, if the data are inaccurate; • have their data deleted or blocked, as appropriate, by the controller if the controller is processing their data illegally. • Additionally, data subjects shall have the right to object to controllers about: • automated decisions (made using personal data processed solely by automatic means); • the processing of their data if it leads to disproportionate results; • the use of their data for direct marketing purposes. What this means is that data collected by a company about an individual belongs to the individual, not the company. The individual can look at it, correct it, and take it back. This isn't a problem if you're not a scumbag. If you're selling your customer list for marketing purposes, or using data you collect about users for marketing purposes, you have a problem. The EU requires explicit consent for such things. A contract of adhesion EULA is not enough. Exceptions to data privacy must be opt-in, not opt-out. Passing data about persons on to another party can cause serious liability. You have to know where the data went, exactly who has it, and be able to delete it even if it's now in the hands of another party. This is EU-wide, and registration with one national data controller (a Government agency which checks for privacy violations) in the EU is usually sufficient. Here's a set of guidelines from the European trade association for online marketing.[2] The biggest practical implication here is that any data you collect and share about individuals must remain within your reach, because you're responsible for correcting it, blocking it, or deleting it. Mailing lists must now contain info as to where the info was originally collected. It's not really that bad. Europe has operated under these rules for decades. Deal with it. [1] http://www.echr.coe.int/Documents/Handbook_data_protection_ENG.pdf http://www.echr.coe.int/Documents/Handbook_data_protection_E... [2] http://www.fedma.org/fileadmin/documents/SelfReg_Codex/FEDMACodeEN.pdf http://www.fedma.org/fileadmin/documents/SelfReg_Codex/FEDMA...
- Silhouette 11y ago
deleted 11y ago
[deleted]
pastycrinkles 11y ago
So what happens if an EU country sees a BGP routing error that sends traffic to the US?
ar0 11y ago
Good article, but he almost lost me when he started with the passport thing: European privacy laws apply to European residents (regardless of citizenship) and not to European citizens living outside of the European Union. The latter would be unenforceable anyways. In fact, the United States is the only major country exporting laws on their citizens living abroad (e.g. taxes). EDIT: And, in fact, detecting the location of an Internet user (while not perfect) unfortunately works very well for "regular" users not well versed in VPNs and proxying - think YouTube country restrictions or also Google Maps' approach to display different maps depending on the user's location.
Kiro 11y ago
So I can't use AWS to store stuff if I'm in EU? Whst happens if I just ignore this?
- junto 11y ago
  Can't you just chose the Irish or Frankfurt region foot your deployments?
TACIXAT 11y ago
What are the business implications for this? Does this only matter for businesses registered in Europe operating off US servers? Or does it prevent any US business from storing European customers' data?
fixxer 11y ago
My take away: What a massive pain in the ass it is to build/run a business, especially in the EU.
- baudehlo 11y ago
  The flip side is it's a better place to be a free citizen for the most part. You can ask companies for all the data they have on you and they are legally compelled to comply.
  - fixxer 11y ago
    Respectfully, do you think that is perhaps a false sense of security? Government surveillance is ubiquitous and American companies are going to track you regardless.
    - baudehlo 11y ago
      In some sense I absolutely agree. There's a difference to be seen in requests for existing data and the realtime feeds we now know exist. But I guess something could be considered better than nothing. Europeans definitely do have better legal access to correcting incorrect data for example.
csense 11y ago
If you're a US company and some of your users happen to be European, and you just ignore this and store all users' data in the US, what kinds of sanctions can be imposed by the European Court of Justice or national authorities in individual European countries? Do they have some way to block your site at the national / continental level or go after your users? Can they fine you, send you a bill and ask US authorities to seize your company's assets if you fail to comply, even though you're breaking no US laws? If they can't take any enforcement action against non-compliant companies outside European borders, how does this decision even matter for non-European startups?
- umanwizard 11y ago
  I'm no expert, but -- am I missing something? Why can't they just (after all other due process is exhausted) just send the police to seize your servers from your data center in their territory?
  - kijin 11y ago
    What if you have no servers in their territory?
    - Thimothy 11y ago
      Then you probably are so small that you aren't in nobodies radar, not for an EU court and, hopefully, not for the NSA.
    - csense 11y ago
      Yeah that's the scenario I was imagining, where you have no physical assets in EU territory.
gasull 11y ago
As bad as it can be, it is still damage minimization compared to allowing the NSA dragnet.
senjindarashiva 11y ago
As a eurpean I can't help but feel like this is a step to move the internet away from only "adhereing" to US "law" which would be nice change.
spaceSub 11y ago
I hear your words and all I can conclude is: What a _great_ ruling. Seriously. Decentralization is a major thing we need right now. Also: the EU gov. agencies are very unlike the US ones in that we have a political power over them.

139 points by di 11y ago

_pferreir_ 11y ago

Call me a hipster, but I really miss back when no-one cared about the Internet.

TeMPOraL 11y ago
Me too. In many ways, money basically ruined it. It happens everywhere where builders get replaced by businessmen. Don't get me wrong - I appreciate what money did here. But I also hate that most of the Internet is now flooded with ads, SEO, "entrepreneurs" seeking ways to make a quick buck and startups monetizing the most basic aspects of human interaction.
- realquick81 11y ago
  It wasn't money that ruined it, it was business people, marketing people and advertising people. As always, they're the ones that ruin everything.
- kuschku 11y ago
  It’s funny that you say this on a website aimed at people who do exactly that. Make a quick bucks by monetizing the most simple things. You know, I’ve been thinking about it for a long time. In a lot of ways, the internet was an anarchist society for some time. Then some people took advantage of it, used anarcho-capitalism to get insane profits and violate any normal laws, and nowadays, it’s a bit regulated, but still anarcho-capitalist. The anti-spam measure re-captcha is effectively everyone giving Google training data for their neural networks. Maybe it would have been better if everything on the web was GPL. Maybe it wouldn’t. Who knows. But obviously, this should be a sign for entrepreneurs that maybe, just maybe, your users might be more important than profits.
kalms 11y ago
Let's build a new one.

Keats 11y ago

So does that rule out a good chunk of US providers for european companies (stripe/braintree/slack etc)? I could only find mention of Safe Harbor in their privacy policy and not where the data is hosted.

the_mitsuhiko 11y ago
Pretty much. From what I have heard so far the general assumption is that you can still set up a contract to achieve what Save Harbor did, you users need to explicitly agree with the provisions.
- Silhouette 11y ago
  This is our concern, as a small business using a very small but non-zero set of US services, all of which were previously covered by Safe Harbor provisions. This ruling is something we have always been concerned about from a business point of view, because ever since it became untenable to claim US companies could actually protect any personal data at all the basic legal premise on which Safe Harbor was built has been shaky. We don't know now whether it will still be sufficient to merely disclose our commercial partners in our privacy policy (which we do, by name and with an indication of what we use them for) or whether we need some sort of more active consent. I haven't had chance to speak to our lawyer yet, but I'm expecting him to tell us something along the lines of: the law now requires us to add yet another prominent notice at the conclusion of a sale. On top of all the consumer protection rubbish from the recent EU changes there -- which again were well-intentioned but actually impose silly things that help neither us nor our customers -- the number of such notices we need by law is making our sales pages almost comical now. I can't believe all these notices really help to protect anyone from much of anything in practice, and anyone reading this on HN probably knows what effect compliance has on conversions. The second to worst possible outcome is probably that we are now required to seek active consent from our existing customers before continuing to use things like US-based payment services. The worst is that it actually becomes illegal to use those services at all, though I don't think that is going to happen. It's sad, because from a personal point of view this mess is long overdue for being cleaned up. But the authorities are so clumsy about handling these issues that a lot of the time they just hurt small businesses and legitimate international trade.

k__ 11y ago

I must admit, after the NSA stuff, I feel safer without "Safe Harbor". But I guess a bunch of US companies are pretty scared about the financial implications right now. Kicking out EU citizens or moving their data to the EU.

daxelrod 11y ago
Do we actually know whether any of the Five Eyes nations are any better than the US in this regard?
- omouse 11y ago
  If they're in the Five Eyes then no, they aren't any better.
geofft 11y ago
Well, this is the usual thing about whether you're worried about the NSA or you're worried about more mundane threats. If your threat model is "government coercion," sure, stay out of the US. But if your threat model is something like "an attacker broke into a cloud provider employee's account" or "the provider didn't take software updates", you're probably safer on the world's larger, more-staffed, more-well-run, etc. services, which are largely (though not entirely) in the US. The best outcome here, I think, would involve serious, secure competitors to things like AWS being run by European countries in Europe.
- sokoloff 11y ago
  You can already choose AWS services and ensure that they stay located only in a single region (that you decide), so you can pick EU-West-1 (Ireland) or EU-Central-1 (Germany) and be assured that Amazon won't move your data into another region. If you are contemplating "pan-cloud root compromise", I'd worry more about the probability of that happening and less about in which countries that cloud provider operates. That would push me towards the larger, established provider (perceived lower probability of all-access-root compromise) over a smaller upstart whose value prop was "we ONLY operate in Europe".

kawera 11y ago

Snowden's tweet, to the point: https://twitter.com/Snowden/status/651383168650604544 https://twitter.com/Snowden/status/651383168650604544

debacle 11y ago
I don't necessarily agree with him. People who live in countries with strict data protection laws are safer, but those who live in more lax surveillance might actually wind up less safe.

gozo 11y ago

We are dealing with the consequences of not taking this very seriously for the last decade. It's not good enough to just hope that the Internet will remain free in the face of legitimate concerns. Yes, it's a concern that the Internet won't be global anymore, but it never really was. Up until thing like Firesheep and Snowden, and still to some extent, a lot of Internet traffic was only safe based on not passing any bad actors.

the_mitsuhiko 11y ago
> Yes, it's a concern that the Internet won't be global anymore, but it never really was. So we're willing to throw all this interconnection away, the one thing that made the internet the place it is? The interconnected nature of the internet is what made me the person I am today. I have more friends from other countries than I have friends from my own and from my friendship circles I know I'm not the only one.
- deleted 11y ago
  [deleted]
- gozo 11y ago
  Not taking legitimate concerns seriously and securing the Internet we want is what is going to throw away the positive things about the Internet. Something that isn't technically secure nor robust in the face of arguments is bound to change
bediger4000 11y ago
And by "bad actors" you mean folks like NSA, GCHQ and FSB, right? Oh, and Unit 8200.
- rdancer 11y ago
  Yes
- freehunter 11y ago
  "Bad actors" includes all bad actors, and the parent explicitly called out both major bad actors (hackers and governments). Not sure what more you want by demanding a clarification.

coldcode 11y ago

The end result may become a Balkanized internet - you can't share anything outside your country's borders or access them from outside. Each country winds up as a China, a government's dream situation. In the end though we all lose.

kawera 11y ago
Not necessarily Balkanized if we concentrate our efforts in developing better protocols and not larger centralized platforms. Decentralization is key to internet freedom.
- the_mitsuhiko 11y ago
  Not sure what you are proposing. This is not really something we can improve as nature works against us. Unless someone finds a wormhole for data, we will be bound by latency and thus the only solution is user segregation.
  - kuschku 11y ago
    Or one can use distributed protocols like XMPP. I can send messages just fine from @jabber.de to someone on a US server.
    - the_mitsuhiko 11y ago
      Message delivery is not a problem that needs solving. You don't even need XMPP for that, good old sockets do the trick. The problem is that you need to fetch data over high latency network links and you are not even allowed to cache it due to legal reasons.
      - kuschku 11y ago
        Eh, what? The EU data privacy laws have a specific paragraph directly and specifically declaring that caching is exempt. You can even use worldwide cloudflare caching for your site, and store userdata in the EU, and still comply.

Animats 11y ago

This is great! It gives users lots more privacy rights, rights that come with teeth. See page 105 of [1]. It's going to force many US companies to register with a European data privacy controller. Here are the basic rights of a "data subject": Everyone shall have the right under national law to request from any controller information as to whether the controller is processing his or her data. • Data subjects shall have the right under national law to: • access their own data from any controller who processes such data; • have their data rectified (or blocked, as appropriate) by the controller processing their data, if the data are inaccurate; • have their data deleted or blocked, as appropriate, by the controller if the controller is processing their data illegally. • Additionally, data subjects shall have the right to object to controllers about: • automated decisions (made using personal data processed solely by automatic means); • the processing of their data if it leads to disproportionate results; • the use of their data for direct marketing purposes. What this means is that data collected by a company about an individual belongs to the individual, not the company. The individual can look at it, correct it, and take it back. This isn't a problem if you're not a scumbag. If you're selling your customer list for marketing purposes, or using data you collect about users for marketing purposes, you have a problem. The EU requires explicit consent for such things. A contract of adhesion EULA is not enough. Exceptions to data privacy must be opt-in, not opt-out. Passing data about persons on to another party can cause serious liability. You have to know where the data went, exactly who has it, and be able to delete it even if it's now in the hands of another party. This is EU-wide, and registration with one national data controller (a Government agency which checks for privacy violations) in the EU is usually sufficient. Here's a set of guidelines from the European trade association for online marketing.[2] The biggest practical implication here is that any data you collect and share about individuals must remain within your reach, because you're responsible for correcting it, blocking it, or deleting it. Mailing lists must now contain info as to where the info was originally collected. It's not really that bad. Europe has operated under these rules for decades. Deal with it. [1] http://www.echr.coe.int/Documents/Handbook_data_protection_ENG.pdf http://www.echr.coe.int/Documents/Handbook_data_protection_E... [2] http://www.fedma.org/fileadmin/documents/SelfReg_Codex/FEDMACodeEN.pdf http://www.fedma.org/fileadmin/documents/SelfReg_Codex/FEDMA...

Silhouette 11y ago

deleted 11y ago

[deleted]

pastycrinkles 11y ago

So what happens if an EU country sees a BGP routing error that sends traffic to the US?

ar0 11y ago

Good article, but he almost lost me when he started with the passport thing: European privacy laws apply to European residents (regardless of citizenship) and not to European citizens living outside of the European Union. The latter would be unenforceable anyways. In fact, the United States is the only major country exporting laws on their citizens living abroad (e.g. taxes). EDIT: And, in fact, detecting the location of an Internet user (while not perfect) unfortunately works very well for "regular" users not well versed in VPNs and proxying - think YouTube country restrictions or also Google Maps' approach to display different maps depending on the user's location.

Kiro 11y ago

So I can't use AWS to store stuff if I'm in EU? Whst happens if I just ignore this?

junto 11y ago
Can't you just chose the Irish or Frankfurt region foot your deployments?

TACIXAT 11y ago

What are the business implications for this? Does this only matter for businesses registered in Europe operating off US servers? Or does it prevent any US business from storing European customers' data?

fixxer 11y ago

My take away: What a massive pain in the ass it is to build/run a business, especially in the EU.

baudehlo 11y ago
The flip side is it's a better place to be a free citizen for the most part. You can ask companies for all the data they have on you and they are legally compelled to comply.
- fixxer 11y ago
  Respectfully, do you think that is perhaps a false sense of security? Government surveillance is ubiquitous and American companies are going to track you regardless.
  - baudehlo 11y ago
    In some sense I absolutely agree. There's a difference to be seen in requests for existing data and the realtime feeds we now know exist. But I guess something could be considered better than nothing. Europeans definitely do have better legal access to correcting incorrect data for example.

csense 11y ago

If you're a US company and some of your users happen to be European, and you just ignore this and store all users' data in the US, what kinds of sanctions can be imposed by the European Court of Justice or national authorities in individual European countries? Do they have some way to block your site at the national / continental level or go after your users? Can they fine you, send you a bill and ask US authorities to seize your company's assets if you fail to comply, even though you're breaking no US laws? If they can't take any enforcement action against non-compliant companies outside European borders, how does this decision even matter for non-European startups?

umanwizard 11y ago
I'm no expert, but -- am I missing something? Why can't they just (after all other due process is exhausted) just send the police to seize your servers from your data center in their territory?
- kijin 11y ago
  What if you have no servers in their territory?
  - Thimothy 11y ago
    Then you probably are so small that you aren't in nobodies radar, not for an EU court and, hopefully, not for the NSA.
  - csense 11y ago
    Yeah that's the scenario I was imagining, where you have no physical assets in EU territory.

gasull 11y ago

As bad as it can be, it is still damage minimization compared to allowing the NSA dragnet.

senjindarashiva 11y ago

As a eurpean I can't help but feel like this is a step to move the internet away from only "adhereing" to US "law" which would be nice change.

spaceSub 11y ago

I hear your words and all I can conclude is: What a _great_ ruling. Seriously. Decentralization is a major thing we need right now. Also: the EU gov. agencies are very unlike the US ones in that we have a political power over them.