9 ms·

The Collapse of the US-EU Safe Harbor

142 points by twsted 11y ago

jacquesm 11y ago
Color me impressed with the no-nonsense and respectful way in which Microsoft tackles this. Looking forward to other tech giants following suit. The 'privacy is dead' crowd should really take notice of this article.
- jmnicolas 11y ago
  You know I really wanted to believe in the new Microsoft ... then I started to notice the new telemetry patches in Windows update. They can say whatever they want about privacy, as long as they sneakily collect data about my computer usage I won't believe a word of what they say.
  - jacquesm 11y ago
    I try very hard to never use Microsoft products, that's for sure let there be no mis-understandings about that. So I can't comment on what the most recent incarnation of Windows does but I'm well aware that Skype did not change for the better after MS took over. Even so, saying this as not exactly a Microsoft fan (to put it very mildly) their words (not necessarily their deeds) are spot on, this is really what is needed and privacy really is a fundamental human right. Now if they will actually act on these words it will count for something.
    - _lce0 11y ago
      > I try very hard to never use Microsoft products I also went ahead to not help anyone to install, fix, or do any type of support for such systems; instead I always have with me a usb drive ready to live-test linux, and to replace that ugly thing. Divulge, Replace, and Extinguish.
    - randomhunt 11y ago
      > I'm well aware that Skype did not change for the better after MS took over While I'm acutely aware of the negative impact various changes had on privacy, cf the leaked documents referencing it, however I'm not sure that statement is blanketly true. I can now have Skype running on my phone where previously it used to drain the battery in a few hours flat. That is, personally, a huge improvement. Another thing I've noticed is I get both better video quality (when I use video, I prefer audio only) and I get less disconnects due to "network" reasons.
      - jacquesm 11y ago
        I meant that - in case the context did not make it abundantly clear - from a privacy perspective, not from a usability perspective.
    - HelloNurse 11y ago
      Privacy of European computer users requires NSA vassal companies, e.g. Microsoft, to fuck off because they aren't reliable. Microsoft isn't going to magically become reliable only because it says it cares about privacy, nor because it actually defends the privacy of USA customers (which is remotely possible after all).
      - cwyers 11y ago
        Microsoft is currently in contempt of court because they're refusing to hand over data the US government wants. They're appealing. If Microsoft isn't reliable, then nobody is. And if that's the case, then it's not a problem with Microsoft, it's a problem with everybody, everywhere, that is within the reach of the US government. Which is everyone.
  - leppr 11y ago
    I hope you realize a huge multi-billion dollar company such as Microsoft isn't one unified entity. Chances are the PR/politics guys never even talked to the team responsible for that telemetry update and have very different agendas. Furthermore, this kind of article is the last place where they would want to bullshit you, seeing how it is a prime target for their critics.
    - jacquesm 11y ago
      If there is one challenge that Nadella is facing then it is that one: to get a single unified set of goals that Microsoft will strive to achieve. As long as 'the team responsible for the telemetry update' can screw up their long term prospects they're not looking good. Note how the GP writes "I really wanted to believe in the new Microsoft". And then some out-of-control arm of the company comes along and wrecks that (assuming it really is out-of-control rather than that it is a case of saying one thing and doing another).
      - ethbro 11y ago
        This is why having technical management (or at least technical-understanding) is key once you grow past a certain size, I think. There was a link here a few months back about some MS tiger team that upper management convened to solve a cross-department issue (something about a webpage in updates?). Additional department heads kept getting added to the call everytime someone said "It's not my issue, it's X's!" (ah, here's the link -- http://blog.seattlepi.com/microsoft/files/library/2003Jangatesmoviemaker.pdf http://blog.seattlepi.com/microsoft/files/library/2003Jangat...) I think that's what it takes nowadays: "I have the authority to make you and anyone else necessary resolve this" + "I recognize this is a problem" Too often it's one without the other. PS: Side tip. I think one great thing large organizations can do is have a more outside-the-org-chart independent problem solver. Problems get reported, they summarize the issue and get priority/sign-off from only above themselves, then they're empowered to pull who they need to fix it. Otherwise "that's an issue that only affects our users (aka not dev)" seems all too common.
    - kardos 11y ago
      > I hope you realize a huge multi-billion dollar company such as Microsoft isn't one unified entity. Chances are the PR/politics guys never even talked to the team responsible for that telemetry update and have very different agendas. The article was not written by "some PR guy", the author is stated as "Brad Smith, the President and Chief Legal Officer". I don't think someone with that position would be blissfully unaware of the telemetry/spying issue. Actions speak louder than words.
  - mtgx 11y ago
    Which reminds me, I assume now Microsoft can't collect most if not all of that data through Windows 10 from EU citizens? I just hope it won't use that "third-party trick", where it routes the data through another EU company first, because that would definitely be illegal under the recent ruling, too, but Microsoft may wrongfully believe it's "grey area", so it might just do that. If it does try to use that trick, and then later it's once again confirmed that what it's been doing is illegal, I hope it's sued for all its worth.
    - jmnicolas 11y ago
      It's not only Windows 10 : the telemetry patches were backported for Windows 7 and Windows 8 too. Not long ago they were saying that Internet Explorer and DirectX could not be backported to previous Windows versions. I guess with the right incentives nothing is impossible ...
- Mickydtron 11y ago
  I was also overall impressed with the tone of the article. However, there were a few phrases which somewhat worried me. Specifically, "there is a broad recognition on both sides of the Atlantic that we live in dangerous times" and "if governments are going to prevent and investigate threats to public safety in the real world, they need timely and appropriate access to data that is stored online". The first is somewhat debatable (there obviously is danger, but more or less than there used to be?), and even if completely true, "dangerous times" have been used to justify a lot of very bad things, so nebulous references worry me. The second is also a sentence that by itself is fairly straightforward and uncontroversial, but is highly dependent on "timely" and "appropriate". After all, if "timely" means "as soon as we need/want it", and "appropriate" means "we swear we won't look at it unless we need to, honest", then many NSA programs could be loosely described as a way to get "timely and appropriate access to data that is stored online". It is possible that neither of these sentences is meant to weasel in these sorts of meanings, and that I'm simply reacting to anti-privacy advocates having used otherwise innocuous phrases to justify bad behavior.
buro9 11y ago
The proposals do not address the elephant in the room and the very reason Safe Harbor collapsed: The NSA and the ability of the US government to override any treaty to access any data using secret warrants. It is that which killed Safe Harbor, and none of the proposals at the end of the article would be immune to that weakness again. It would remain the case that the proposals made would not be in line with the clear ruling that the European court gave if the US government can continue to override international treaties and their own courts.
- Zach_the_Lizard 11y ago
  The European intelligence agencies were trading info with the NSA, so European companies can be under the same sorts of threats. It's a red herring. Personally I think this is really about protectionism and the NSA provides a convenient excuse given European intelligence agency involvement.
  - mtgx 11y ago
    Eh, I could see the Commission doing it for protectionist purposes, but why would the highest Court care about that? If it's "protectionist" it's for EU citizens' data, not for economic purposes. I've seen no evidence to the contrary so far. If anything, it's the Commission that has been much more willing to give the US government and companies "some slack" about collecting all this data. Luckily, the Commission's hands are now tied, and the ruling sets a rather clear roadmap for the minimum requirements of privacy in any sort of new EU law or agreement with the US.
  - Zigurd 11y ago
    Not all of Europe is part of the Five Eyes, or even it's outer orbits. And if they are, the relationship is not symmetric. They don't have first-party access to US government communications, never mind, say, POTUS's cell phone. "They all do it" is meaningless if one nation has an NSA and Greece has a sketchy looking guy with black shoes and no socks and a tape recorder.
    - Zach_the_Lizard 11y ago
BuildTheRobots 11y ago
Site seems down. Copy/paste from google-cache here (too big to submit as a comment): http://pastebin.com/0jLCA65D http://pastebin.com/0jLCA65D
- spython 11y ago
  "Legal rules that were written at the dawn of the personal computer are no longer adequate for an era with ubiquitous mobile devices connected to my butt." Are you sure it's from google cache?
  - BuildTheRobots 11y ago
    Ah, ok. Apparently I still have the cloud-to-butt extension installed o_0
    - ewzimm 11y ago
      This may be remembered as cloud-to-butt's finest hour. A potentially historically significant statement made readable to the Buzzfeed crowd.
    - jackgavigan 11y ago
      Inadvertently hilarious!
  - SideburnsOfDoom 11y ago
    On reading that, I had to check if I had the "cloud to butt" extension installed. ;) I don't, so it must be the paster, BuildTheRobots.
    - BuildTheRobots 11y ago
      I completely forgot I had the plugin installed for months until I started gliding -all of a sudden I was trying to read about butts in a non-computer context and everything got extremely confusing. In other news, I feel someone really should write a "butt to cl0ud" plugin, aimed specificity at Proctologists ;)
mtgx 11y ago
> Government officials in Washington and Brussels will need to act quickly, and we should all hope that Congress will enact promptly the Judicial Redress Act, so European citizens have appropriate access to American courts. Well, Microsoft is wrong here to believe that the Judicial Redress Act [1] will be sufficient. The CJEU has required "essentially equivalent" privacy protections for EU citizens as they get in the EU. The US Privacy Act does not give them that, so this Judicial Redress Act is a hit and a miss. The US needs to pass a much stronger privacy law that is "at least" as good as the one in the EU, if it wants its companies to continue to get EU citizen data (and I assume it does). It can start by finally reforming the ECPA for the 21st century. [1] http://judiciary.house.gov/index.cfm/press-releases?id=9455FA93-0026-4928-8D3A-DDB374D64472 http://judiciary.house.gov/index.cfm/press-releases?id=9455F...
- estel 11y ago
  From the rest of the article, I don't think he's suggesting that only the Judicial Redress Act is sufficient as a replacement for Safe Harbour? Just that it's a useful first step that congress can take soon.
hopeless 11y ago
Microsoft are at the centre of another case which will really decide how badly EU-US trade is affected: > Microsoft stands in contempt of court right now for refusing to hand over to US authorities, emails held in its Irish data centre. This case will surely go to the Supreme Court and will be an extremely important determination for the cloud business, and any company or individual using data centre storage. If Microsoft loses, US multinationals will be left scrambling to somehow, legally firewall off their EU-based data centres from US government reach. — from http://www.irishtimes.com/business/ecj-ruling-on-irish-privacy-case-has-huge-significance-1.2382895 http://www.irishtimes.com/business/ecj-ruling-on-irish-priva... At the moment, data can be held within the EU by US companies and it's all ok. If Microsoft is forced to hand over emails stored within the EU to the US government, then all bets are off. In that future, it may not even be enough to have an EU-based subsidiary of a US company hold data within the EU, since it'll have been shown that the U.S. government can coerce them. And we like to talk about large companies like Microsoft, Apple, Facebook, Google etc. But they can throw money, lawyers and engineers at this problem. But the thousands of US-based SaaS apps do not have that luxury. Likewise, there are thousands of EU-based small SaaS app that will have everything from their hosting stack, to their bug tracker, to their communications tools taken off them.
- fpgeek 11y ago
  In that future, even an EU company may not be enough if that company does business in the US (or, in the most extreme case, accepts and/or makes a significant amount of USD payments). The US government can coerce them too (and in some cases already does today e.g. sanctions and FATCA).
- TazeTSchnitzel 11y ago
  > In that future, it may not even be enough to have an EU-based subsidiary of a US company hold data within the EU, since it'll have been shown that the U.S. government can coerce them. Wouldn't the other way round be more sensible, then? Make Microsoft be technically headquartered in the EU and have its main operations handled by a US subsidiary. Wouldn't that work? (Not familiar with legal/financial/etc. reasons this would be a problem.)
- 11y ago
pfortuny 11y ago
The excuse that the legal rules are obsolete is a red herring. It depends on the rules. For example: privacy of communications has no intrinsic dependence on technology. Security of personal data requires the verification of said security (or the commitment to it), etc... I do not know about this specific law. But just because a law is old does not mean that it is bad. And this is what Microsoft is saying. After hundreds of years of slavery, it was abolished in the US in a single day. So what? Is this bad?
grabcocque 11y ago
The ECJ was simply responding to a fairly obvious and fundamental problem: your private data IS NOT SAFE in the US. The US government doesn't care and has no intention of changing this, so expect the ECJ's ruling to stand for a long time.
linkregister 11y ago
Google cache: http://webcache.googleusercontent.com/search?q=cache:0BKIRj96qT0J:blogs.microsoft.com/on-the-issues/2015/10/20/the-collapse-of-the-us-eu-safe-harbor-solving-the-new-privacy-rubiks-cube/+&cd=3&hl=en&ct=clnk&gl=us http://webcache.googleusercontent.com/search?q=cache:0BKIRj9... I'm getting an Internal Server Error on the original page.
devy 11y ago
To me the key idea from Brad Smith's post, which I don't neccessarily agree with, was this: Third, there should be an exception to this approach for citizens who move physically across the Atlantic. For example, the U.S. government should be permitted to turn solely to its own courts under U.S. law to obtain data about EU citizens that move to the United States... What he really arguing is that EU should not invalidate the Safe Harbor in that it breaks the Internet and Microsoft will provide its customers data access for U.S. and EU governments under "in the most limited circumstances". In that sense, it's not something out of ordinary than what typical Microsoft's position is in this issue. They can certainly do better than that, I.E. throwing away the server side encryption key like Apple does for iOS devices so that they don't have the technical capability to give out user data even if summoned to.
- jvdh 11y ago
  To me the quote you use from the original post talks about people who move (physically) from the EU to the US. These people remain EU citizens, but can hardly be distinguished from US people, as they have a US address. As EU citizens they have more rights to privacy than their US neighbors.
forgotAgain 11y ago
He makes the issue more complex than necessary for the benefit of his employer. There is no reason why private information needs to move across borders without the express consent of the individual involved. At that point the individual agrees to be bound by the rules of the country where the data is going or no transaction is done. Let each country have it's own set of rules and have all countries respect those rules for data located in the hosting country. The idea that each country must be exactly the same and data is by default available for transmission across borders is only to the benefit of multinational companies.
- richmarr 11y ago
  > At that point the individual agrees to be bound by the rules of the country where the data is going or no transaction is done What does this look like? Another section in a EULA? A popup/banner thing like for cookies? An extra tickbox on the registration page? To me this feels like moving the problem of choosing sensible data protection juristiction onto the customer, rather than making a sensible choice yourself. Personally I prefer to keep all personal data within the EU and avoid bothering my end users with this stuff, and that rules out any services that aren't available here... reducing choice & competition, which sucks. In that respect I was a fan of the Safe Harbour.
  - forgotAgain 11y ago
    I think you're overestimating the amount of times that data needs to move across borders to complete a transaction. As an example, you're buying an airline ticket to a foreign destination. There is a check box next to the purchase button. The check box says that to complete the transaction you agree that information will be transferred to the destination country.
    - richmarr 11y ago
      > I think you're overestimating the amount of times that data needs to move across borders to complete a transaction. The word need in this context is an oversimplification. For example, if I want to build an app where data doesn't leave the UK I have very little choice in providers, so have to compromise other things, like convenience, cost, security, etc. If I accept that data will move across some borders (and the EU is really really really valuable in this regard) then I can locate the data in eu-west-1 in Dublin and many more options open up. That said... if I want to use any SaaS services that don't offer an EU hosting option then I still can't unless I want to accept much more variation in data protection law. That rules out plenty of analytics packages, centralised logging services, PaaS providers, etc. Every compromise choice subtracts value and reduces competitiveness, which affects the end-user. Do we need to move data across borders? No. Does it make sense to? Yes, frequently.
ChuckMcM 11y ago
I think we'll look back at this and say "That is when the whole house of cards collapsed." The notions of the Internet being "somewhere else" and the rules being coded by the body legislating the person who is accessing it, is untenable. I expect a lot of churn on the privacy, tax, and access (censorship) policies which have grown up over the years. Consider: * France (and China) trying to impose content restrictions on Google results. [1] * The EU invalidating the safe harbor privacy rules.[2] * The recent invalidation of tax strategies in the Netherlands and Luxembourg. [3] These are all soverign issues. And for anyone who has ever looked at the Internet as a "place" intuitively understands how impractical it is to have the rules be based on that origin of the connection in meat space. The depth and complexity of this particular confluence of concepts is really staggering. I can not even imagine how you would establish an institution to "rule" the Internet. I might even go so far as to assert it isn't possible. What I fear is that what is possible is the Chinese model where every country has its own "Internet" and your ability to access it from outside, or to leave it from inside, will be governed by some electronic equivalent of a passport. And that idea brings the whole "identity" question really out to the forefront of the discussion. Very interesting challenges ahead. [1] http://www.teleread.com/chris-meadows/france-demands-google-censor-search-results-everywhere/ http://www.teleread.com/chris-meadows/france-demands-google-... [2] http://www.natlawreview.com/article/european-court-justice-invalidates-us-eu-safe-harbor-agreement http://www.natlawreview.com/article/european-court-justice-i... [3] http://www.thisismoney.co.uk/money/news/article-3062128/Apple-warned-face-1-5bn-bill-guilty-tax-avoidance.html http://www.thisismoney.co.uk/money/news/article-3062128/Appl... http://www.wsj.com/articles/googles-tax-setup-faces-french-challenge-1412790355 http://www.wsj.com/articles/googles-tax-setup-faces-french-c... http://www.reuters.com/article/2015/10/21/us-eu-taxavoidance-idUSKCN0SF0US20151021 http://www.reuters.com/article/2015/10/21/us-eu-taxavoidance...
- JoBrad 11y ago
  On the other hand, it could lead to a more fractured web, that is highly segregated based on where the host is that is serving up the data. Like US Corporate law, it could lead to a mass of companies deciding to place most or all of their servers in what would otherwise be very silly locations.
sbov 11y ago
As a small company, stuff like this scares the shit out of me. It would be expensive, but companies like Microsoft can survive things like this. But how can a small company do anything but ignore it?
- stoolpigeon 11y ago
  I work for a missions organization with ministries all over the world. We are trying to centralize for cost and due to lack of resources but everything we collect is pretty sensitive since it gets tied back to religious stuff. I think we'll need to hire lawyers in every EU country to get an idea of what we need to do - and then we'll probably need to duplicate a lot of effort to comply and we may just not use certain tools because it will become impossible.

142 points by twsted 11y ago

Color me impressed with the no-nonsense and respectful way in which Microsoft tackles this. Looking forward to other tech giants following suit. The 'privacy is dead' crowd should really take notice of this article.

jmnicolas 11y ago
You know I really wanted to believe in the new Microsoft ... then I started to notice the new telemetry patches in Windows update. They can say whatever they want about privacy, as long as they sneakily collect data about my computer usage I won't believe a word of what they say.
- jacquesm 11y ago
  I try very hard to never use Microsoft products, that's for sure let there be no mis-understandings about that. So I can't comment on what the most recent incarnation of Windows does but I'm well aware that Skype did not change for the better after MS took over. Even so, saying this as not exactly a Microsoft fan (to put it very mildly) their words (not necessarily their deeds) are spot on, this is really what is needed and privacy really is a fundamental human right. Now if they will actually act on these words it will count for something.
  - _lce0 11y ago
    > I try very hard to never use Microsoft products I also went ahead to not help anyone to install, fix, or do any type of support for such systems; instead I always have with me a usb drive ready to live-test linux, and to replace that ugly thing. Divulge, Replace, and Extinguish.
  - randomhunt 11y ago
    > I'm well aware that Skype did not change for the better after MS took over While I'm acutely aware of the negative impact various changes had on privacy, cf the leaked documents referencing it, however I'm not sure that statement is blanketly true. I can now have Skype running on my phone where previously it used to drain the battery in a few hours flat. That is, personally, a huge improvement. Another thing I've noticed is I get both better video quality (when I use video, I prefer audio only) and I get less disconnects due to "network" reasons.
    - jacquesm 11y ago
      I meant that - in case the context did not make it abundantly clear - from a privacy perspective, not from a usability perspective.
  - HelloNurse 11y ago
    Privacy of European computer users requires NSA vassal companies, e.g. Microsoft, to fuck off because they aren't reliable. Microsoft isn't going to magically become reliable only because it says it cares about privacy, nor because it actually defends the privacy of USA customers (which is remotely possible after all).
    - cwyers 11y ago
      Microsoft is currently in contempt of court because they're refusing to hand over data the US government wants. They're appealing. If Microsoft isn't reliable, then nobody is. And if that's the case, then it's not a problem with Microsoft, it's a problem with everybody, everywhere, that is within the reach of the US government. Which is everyone.
- leppr 11y ago
  I hope you realize a huge multi-billion dollar company such as Microsoft isn't one unified entity. Chances are the PR/politics guys never even talked to the team responsible for that telemetry update and have very different agendas. Furthermore, this kind of article is the last place where they would want to bullshit you, seeing how it is a prime target for their critics.
  - jacquesm 11y ago
    If there is one challenge that Nadella is facing then it is that one: to get a single unified set of goals that Microsoft will strive to achieve. As long as 'the team responsible for the telemetry update' can screw up their long term prospects they're not looking good. Note how the GP writes "I really wanted to believe in the new Microsoft". And then some out-of-control arm of the company comes along and wrecks that (assuming it really is out-of-control rather than that it is a case of saying one thing and doing another).
    - ethbro 11y ago
      This is why having technical management (or at least technical-understanding) is key once you grow past a certain size, I think. There was a link here a few months back about some MS tiger team that upper management convened to solve a cross-department issue (something about a webpage in updates?). Additional department heads kept getting added to the call everytime someone said "It's not my issue, it's X's!" (ah, here's the link -- http://blog.seattlepi.com/microsoft/files/library/2003Jangatesmoviemaker.pdf http://blog.seattlepi.com/microsoft/files/library/2003Jangat...) I think that's what it takes nowadays: "I have the authority to make you and anyone else necessary resolve this" + "I recognize this is a problem" Too often it's one without the other. PS: Side tip. I think one great thing large organizations can do is have a more outside-the-org-chart independent problem solver. Problems get reported, they summarize the issue and get priority/sign-off from only above themselves, then they're empowered to pull who they need to fix it. Otherwise "that's an issue that only affects our users (aka not dev)" seems all too common.
  - kardos 11y ago
    > I hope you realize a huge multi-billion dollar company such as Microsoft isn't one unified entity. Chances are the PR/politics guys never even talked to the team responsible for that telemetry update and have very different agendas. The article was not written by "some PR guy", the author is stated as "Brad Smith, the President and Chief Legal Officer". I don't think someone with that position would be blissfully unaware of the telemetry/spying issue. Actions speak louder than words.
- mtgx 11y ago
  Which reminds me, I assume now Microsoft can't collect most if not all of that data through Windows 10 from EU citizens? I just hope it won't use that "third-party trick", where it routes the data through another EU company first, because that would definitely be illegal under the recent ruling, too, but Microsoft may wrongfully believe it's "grey area", so it might just do that. If it does try to use that trick, and then later it's once again confirmed that what it's been doing is illegal, I hope it's sued for all its worth.
  - jmnicolas 11y ago
    It's not only Windows 10 : the telemetry patches were backported for Windows 7 and Windows 8 too. Not long ago they were saying that Internet Explorer and DirectX could not be backported to previous Windows versions. I guess with the right incentives nothing is impossible ...
Mickydtron 11y ago
I was also overall impressed with the tone of the article. However, there were a few phrases which somewhat worried me. Specifically, "there is a broad recognition on both sides of the Atlantic that we live in dangerous times" and "if governments are going to prevent and investigate threats to public safety in the real world, they need timely and appropriate access to data that is stored online". The first is somewhat debatable (there obviously is danger, but more or less than there used to be?), and even if completely true, "dangerous times" have been used to justify a lot of very bad things, so nebulous references worry me. The second is also a sentence that by itself is fairly straightforward and uncontroversial, but is highly dependent on "timely" and "appropriate". After all, if "timely" means "as soon as we need/want it", and "appropriate" means "we swear we won't look at it unless we need to, honest", then many NSA programs could be loosely described as a way to get "timely and appropriate access to data that is stored online". It is possible that neither of these sentences is meant to weasel in these sorts of meanings, and that I'm simply reacting to anti-privacy advocates having used otherwise innocuous phrases to justify bad behavior.

buro9 11y ago

The proposals do not address the elephant in the room and the very reason Safe Harbor collapsed: The NSA and the ability of the US government to override any treaty to access any data using secret warrants. It is that which killed Safe Harbor, and none of the proposals at the end of the article would be immune to that weakness again. It would remain the case that the proposals made would not be in line with the clear ruling that the European court gave if the US government can continue to override international treaties and their own courts.

Zach_the_Lizard 11y ago
The European intelligence agencies were trading info with the NSA, so European companies can be under the same sorts of threats. It's a red herring. Personally I think this is really about protectionism and the NSA provides a convenient excuse given European intelligence agency involvement.
- mtgx 11y ago
  Eh, I could see the Commission doing it for protectionist purposes, but why would the highest Court care about that? If it's "protectionist" it's for EU citizens' data, not for economic purposes. I've seen no evidence to the contrary so far. If anything, it's the Commission that has been much more willing to give the US government and companies "some slack" about collecting all this data. Luckily, the Commission's hands are now tied, and the ruling sets a rather clear roadmap for the minimum requirements of privacy in any sort of new EU law or agreement with the US.
- Zigurd 11y ago
  Not all of Europe is part of the Five Eyes, or even it's outer orbits. And if they are, the relationship is not symmetric. They don't have first-party access to US government communications, never mind, say, POTUS's cell phone. "They all do it" is meaningless if one nation has an NSA and Greece has a sketchy looking guy with black shoes and no socks and a tape recorder.
  - Zach_the_Lizard 11y ago

BuildTheRobots 11y ago

Site seems down. Copy/paste from google-cache here (too big to submit as a comment): http://pastebin.com/0jLCA65D http://pastebin.com/0jLCA65D

spython 11y ago
"Legal rules that were written at the dawn of the personal computer are no longer adequate for an era with ubiquitous mobile devices connected to my butt." Are you sure it's from google cache?
- BuildTheRobots 11y ago
  Ah, ok. Apparently I still have the cloud-to-butt extension installed o_0
  - ewzimm 11y ago
    This may be remembered as cloud-to-butt's finest hour. A potentially historically significant statement made readable to the Buzzfeed crowd.
  - jackgavigan 11y ago
    Inadvertently hilarious!
- SideburnsOfDoom 11y ago
  On reading that, I had to check if I had the "cloud to butt" extension installed. ;) I don't, so it must be the paster, BuildTheRobots.
  - BuildTheRobots 11y ago
    I completely forgot I had the plugin installed for months until I started gliding -all of a sudden I was trying to read about butts in a non-computer context and everything got extremely confusing. In other news, I feel someone really should write a "butt to cl0ud" plugin, aimed specificity at Proctologists ;)

mtgx 11y ago

> Government officials in Washington and Brussels will need to act quickly, and we should all hope that Congress will enact promptly the Judicial Redress Act, so European citizens have appropriate access to American courts. Well, Microsoft is wrong here to believe that the Judicial Redress Act [1] will be sufficient. The CJEU has required "essentially equivalent" privacy protections for EU citizens as they get in the EU. The US Privacy Act does not give them that, so this Judicial Redress Act is a hit and a miss. The US needs to pass a much stronger privacy law that is "at least" as good as the one in the EU, if it wants its companies to continue to get EU citizen data (and I assume it does). It can start by finally reforming the ECPA for the 21st century. [1] http://judiciary.house.gov/index.cfm/press-releases?id=9455FA93-0026-4928-8D3A-DDB374D64472 http://judiciary.house.gov/index.cfm/press-releases?id=9455F...

estel 11y ago
From the rest of the article, I don't think he's suggesting that only the Judicial Redress Act is sufficient as a replacement for Safe Harbour? Just that it's a useful first step that congress can take soon.

hopeless 11y ago

Microsoft are at the centre of another case which will really decide how badly EU-US trade is affected: > Microsoft stands in contempt of court right now for refusing to hand over to US authorities, emails held in its Irish data centre. This case will surely go to the Supreme Court and will be an extremely important determination for the cloud business, and any company or individual using data centre storage. If Microsoft loses, US multinationals will be left scrambling to somehow, legally firewall off their EU-based data centres from US government reach. — from http://www.irishtimes.com/business/ecj-ruling-on-irish-privacy-case-has-huge-significance-1.2382895 http://www.irishtimes.com/business/ecj-ruling-on-irish-priva... At the moment, data can be held within the EU by US companies and it's all ok. If Microsoft is forced to hand over emails stored within the EU to the US government, then all bets are off. In that future, it may not even be enough to have an EU-based subsidiary of a US company hold data within the EU, since it'll have been shown that the U.S. government can coerce them. And we like to talk about large companies like Microsoft, Apple, Facebook, Google etc. But they can throw money, lawyers and engineers at this problem. But the thousands of US-based SaaS apps do not have that luxury. Likewise, there are thousands of EU-based small SaaS app that will have everything from their hosting stack, to their bug tracker, to their communications tools taken off them.

fpgeek 11y ago
In that future, even an EU company may not be enough if that company does business in the US (or, in the most extreme case, accepts and/or makes a significant amount of USD payments). The US government can coerce them too (and in some cases already does today e.g. sanctions and FATCA).
TazeTSchnitzel 11y ago
> In that future, it may not even be enough to have an EU-based subsidiary of a US company hold data within the EU, since it'll have been shown that the U.S. government can coerce them. Wouldn't the other way round be more sensible, then? Make Microsoft be technically headquartered in the EU and have its main operations handled by a US subsidiary. Wouldn't that work? (Not familiar with legal/financial/etc. reasons this would be a problem.)
11y ago

pfortuny 11y ago

The excuse that the legal rules are obsolete is a red herring. It depends on the rules. For example: privacy of communications has no intrinsic dependence on technology. Security of personal data requires the verification of said security (or the commitment to it), etc... I do not know about this specific law. But just because a law is old does not mean that it is bad. And this is what Microsoft is saying. After hundreds of years of slavery, it was abolished in the US in a single day. So what? Is this bad?

grabcocque 11y ago

The ECJ was simply responding to a fairly obvious and fundamental problem: your private data IS NOT SAFE in the US. The US government doesn't care and has no intention of changing this, so expect the ECJ's ruling to stand for a long time.

linkregister 11y ago

Google cache: http://webcache.googleusercontent.com/search?q=cache:0BKIRj96qT0J:blogs.microsoft.com/on-the-issues/2015/10/20/the-collapse-of-the-us-eu-safe-harbor-solving-the-new-privacy-rubiks-cube/+&cd=3&hl=en&ct=clnk&gl=us http://webcache.googleusercontent.com/search?q=cache:0BKIRj9... I'm getting an Internal Server Error on the original page.

devy 11y ago

To me the key idea from Brad Smith's post, which I don't neccessarily agree with, was this: Third, there should be an exception to this approach for citizens who move physically across the Atlantic. For example, the U.S. government should be permitted to turn solely to its own courts under U.S. law to obtain data about EU citizens that move to the United States... What he really arguing is that EU should not invalidate the Safe Harbor in that it breaks the Internet and Microsoft will provide its customers data access for U.S. and EU governments under "in the most limited circumstances". In that sense, it's not something out of ordinary than what typical Microsoft's position is in this issue. They can certainly do better than that, I.E. throwing away the server side encryption key like Apple does for iOS devices so that they don't have the technical capability to give out user data even if summoned to.

jvdh 11y ago
To me the quote you use from the original post talks about people who move (physically) from the EU to the US. These people remain EU citizens, but can hardly be distinguished from US people, as they have a US address. As EU citizens they have more rights to privacy than their US neighbors.

forgotAgain 11y ago

He makes the issue more complex than necessary for the benefit of his employer. There is no reason why private information needs to move across borders without the express consent of the individual involved. At that point the individual agrees to be bound by the rules of the country where the data is going or no transaction is done. Let each country have it's own set of rules and have all countries respect those rules for data located in the hosting country. The idea that each country must be exactly the same and data is by default available for transmission across borders is only to the benefit of multinational companies.

richmarr 11y ago
> At that point the individual agrees to be bound by the rules of the country where the data is going or no transaction is done What does this look like? Another section in a EULA? A popup/banner thing like for cookies? An extra tickbox on the registration page? To me this feels like moving the problem of choosing sensible data protection juristiction onto the customer, rather than making a sensible choice yourself. Personally I prefer to keep all personal data within the EU and avoid bothering my end users with this stuff, and that rules out any services that aren't available here... reducing choice & competition, which sucks. In that respect I was a fan of the Safe Harbour.
- forgotAgain 11y ago
  I think you're overestimating the amount of times that data needs to move across borders to complete a transaction. As an example, you're buying an airline ticket to a foreign destination. There is a check box next to the purchase button. The check box says that to complete the transaction you agree that information will be transferred to the destination country.
  - richmarr 11y ago
    > I think you're overestimating the amount of times that data needs to move across borders to complete a transaction. The word need in this context is an oversimplification. For example, if I want to build an app where data doesn't leave the UK I have very little choice in providers, so have to compromise other things, like convenience, cost, security, etc. If I accept that data will move across some borders (and the EU is really really really valuable in this regard) then I can locate the data in eu-west-1 in Dublin and many more options open up. That said... if I want to use any SaaS services that don't offer an EU hosting option then I still can't unless I want to accept much more variation in data protection law. That rules out plenty of analytics packages, centralised logging services, PaaS providers, etc. Every compromise choice subtracts value and reduces competitiveness, which affects the end-user. Do we need to move data across borders? No. Does it make sense to? Yes, frequently.

ChuckMcM 11y ago

I think we'll look back at this and say "That is when the whole house of cards collapsed." The notions of the Internet being "somewhere else" and the rules being coded by the body legislating the person who is accessing it, is untenable. I expect a lot of churn on the privacy, tax, and access (censorship) policies which have grown up over the years. Consider: * France (and China) trying to impose content restrictions on Google results. [1] * The EU invalidating the safe harbor privacy rules.[2] * The recent invalidation of tax strategies in the Netherlands and Luxembourg. [3] These are all soverign issues. And for anyone who has ever looked at the Internet as a "place" intuitively understands how impractical it is to have the rules be based on that origin of the connection in meat space. The depth and complexity of this particular confluence of concepts is really staggering. I can not even imagine how you would establish an institution to "rule" the Internet. I might even go so far as to assert it isn't possible. What I fear is that what is possible is the Chinese model where every country has its own "Internet" and your ability to access it from outside, or to leave it from inside, will be governed by some electronic equivalent of a passport. And that idea brings the whole "identity" question really out to the forefront of the discussion. Very interesting challenges ahead. [1] http://www.teleread.com/chris-meadows/france-demands-google-censor-search-results-everywhere/ http://www.teleread.com/chris-meadows/france-demands-google-... [2] http://www.natlawreview.com/article/european-court-justice-invalidates-us-eu-safe-harbor-agreement http://www.natlawreview.com/article/european-court-justice-i... [3] http://www.thisismoney.co.uk/money/news/article-3062128/Apple-warned-face-1-5bn-bill-guilty-tax-avoidance.html http://www.thisismoney.co.uk/money/news/article-3062128/Appl... http://www.wsj.com/articles/googles-tax-setup-faces-french-challenge-1412790355 http://www.wsj.com/articles/googles-tax-setup-faces-french-c... http://www.reuters.com/article/2015/10/21/us-eu-taxavoidance-idUSKCN0SF0US20151021 http://www.reuters.com/article/2015/10/21/us-eu-taxavoidance...

JoBrad 11y ago
On the other hand, it could lead to a more fractured web, that is highly segregated based on where the host is that is serving up the data. Like US Corporate law, it could lead to a mass of companies deciding to place most or all of their servers in what would otherwise be very silly locations.

sbov 11y ago

As a small company, stuff like this scares the shit out of me. It would be expensive, but companies like Microsoft can survive things like this. But how can a small company do anything but ignore it?

stoolpigeon 11y ago
I work for a missions organization with ministries all over the world. We are trying to centralize for cost and due to lack of resources but everything we collect is pretty sensitive since it gets tied back to religious stuff. I think we'll need to hire lawyers in every EU country to get an idea of what we need to do - and then we'll probably need to duplicate a lot of effort to comply and we may just not use certain tools because it will become impossible.