5 ms·

The proposals do not address the elephant in the room and the very reason Safe Harbor collapsed: The NSA and the ability of the US government to override any tr

by buro9 11y ago

The proposals do not address the elephant in the room and the very reason Safe Harbor collapsed: The NSA and the ability of the US government to override any treaty to access any data using secret warrants. It is that which killed Safe Harbor, and none of the proposals at the end of the article would be immune to that weakness again. It would remain the case that the proposals made would not be in line with the clear ruling that the European court gave if the US government can continue to override international treaties and their own courts.

Zach_the_Lizard 11y ago
The European intelligence agencies were trading info with the NSA, so European companies can be under the same sorts of threats. It's a red herring. Personally I think this is really about protectionism and the NSA provides a convenient excuse given European intelligence agency involvement.
- mtgx 11y ago
  Eh, I could see the Commission doing it for protectionist purposes, but why would the highest Court care about that? If it's "protectionist" it's for EU citizens' data, not for economic purposes. I've seen no evidence to the contrary so far. If anything, it's the Commission that has been much more willing to give the US government and companies "some slack" about collecting all this data. Luckily, the Commission's hands are now tied, and the ruling sets a rather clear roadmap for the minimum requirements of privacy in any sort of new EU law or agreement with the US.
- Zigurd 11y ago
  Not all of Europe is part of the Five Eyes, or even it's outer orbits. And if they are, the relationship is not symmetric. They don't have first-party access to US government communications, never mind, say, POTUS's cell phone. "They all do it" is meaningless if one nation has an NSA and Greece has a sketchy looking guy with black shoes and no socks and a tape recorder.
  - Zach_the_Lizard 11y ago
    >Not all of Europe is part of the Five Eyes, or even it's outer orbits. Five Eyes is only one such intelligence alliance. Germany, for instance, cooperated with the NSA despite not being part of FVEY: http://www.spiegel.de/international/germany/german-intelligence-agencies-used-nsa-spying-program-a-912173.html http://www.spiegel.de/international/germany/german-intellige... The Dutch, again not part of Five Eyes, tapped phone calls to pass to the US. We don't know the full extent of which nations played a role. I'm willing to bet it's more than have so far been revealed. >They don't have first-party access to US government communications, never mind, say, POTUS's cell phone. Germany wasn't exactly giving the US access to their government's communications either, "just" private citizens. They did assist the US in getting access to the French leadership, though. >"They all do it" is meaningless if one nation has an NSA and Greece has a sketchy looking guy with black shoes and no socks and a tape recorder. When the large European nations are aggressively spying on their own citizens and then passing that info around to foreign governments in exchange for special software or information, it sort of renders their complaints about the NSA kind of moot. Yeah, the NSA spied on your citizens, but you helped them. For those nations that didn't engage in this, I have a feeling not having your data in America isn't going to prevent the NSA from getting it if they desire it. Especially since much of that data will end up in the sorts of European nations that are spying on their citizens and trading data with the NSA anyways.
    - biafra 11y ago
      > Yeah, the NSA spied on your citizens, but you helped them. I did not help them. Either the German government did or the BND and VS did without orders from the German government. This needs to be investigated and punished accordingly. That is very unlikely, but at least we have parliamentary commision (NSA Untersuchungsausschuss, NSAUA) to investigate these wrongdoings. Some interesting things were already uncovered by the NSAUA.
      - JoBrad 11y ago
        Well, I (a person) didn't directly help the NSA, either. I didn't vote for the people who did it, either. But "I" (a citizen of the United States) did help them in that I am part of the US, and I generally support the form of government that we have. I doubt that the BND acted without orders from the Chancellor's office, just as the NSA didn't and hasn't acted without orders from the President.
- icebraining 11y ago
  The European intelligence agencies were trading info with the NSA, so European companies can be under the same sorts of threats. It's a red herring. But the court wasn't asked to decide about the actions of the intelligence agencies, it was asked to decide on a complaint against Facebook. Personally I think this is really about protectionism and the NSA provides a convenient excuse given European intelligence agency involvement. On the contrary; if anything, it was the Safe Harbour process that was supported on a convenient excuse, which the Commission allowed despite being clear from the start that the US didn't offer the necessary privacy protections to comply with the Directive. The court has just stated the obvious.
  - Zach_the_Lizard 11y ago
    >But the court wasn't asked to decide about the actions of the intelligence agencies, it was asked to decide on a lawsuit against Facebook. You're right, and as the basis of its ruling it decided that intelligence agency action caused a violation of the law. Given that intelligence agencies in the EU were willing partners in NSA spying in clear violation of US and EU law it stands to reason that much of the EU is similarly incompatible with these laws. Why can we store data in Germany when the BND is shipping your data to the NSA, but not America, where the NSA is doing it first hand (and might be doing it on its own in Germany anyways)?
    - icebraining 11y ago
      Why can we store data in Germany when the BND is shipping your data to the NSA, but not America, where the NSA is doing it first hand (and might be doing it on its own in Germany anyways)? For the same reason we could store data in the US right until this decision.
    - pjc50 11y ago
      The legal action has only just got going: https://www.amnesty.org/en/press-releases/2015/04/amnesty-international-takes-uk-government-to-european-court-of-human-rights-over-mass-surveillance/ https://www.amnesty.org/en/press-releases/2015/04/amnesty-in...
    - 11y ago
- rmc 11y ago
  EU intelligence agencies are under EU law (more or less). The US Gov/NSA is not under EU law. So you can't say that data in the US is compatible with EU law.
  - Zach_the_Lizard 11y ago
    Both the NSA and various EU intelligence agencies were violating their various laws. Or, if you're a lawyer for one of these agencies, they had found convenient loopholes that violated the spirit of the laws and rendered them meaningless. So if we apply the standard of intelligence agencies violating the laws mean a country is unfit for storing EU data, then many EU nations are now unfit to store this data.
    - toyg 11y ago
      > So if we apply the standard of intelligence agencies violating the laws mean a country is unfit for storing EU data, then many EU nations are now unfit to store this data The difference is that EU citizens can hold "unfit" actors responsible, if they are from their own country (or even continent, via the ECJ); but they cannot do anything against the NSA.
- avenueb 11y ago
  Absolutely agree. The EU data regulators consistently ignore their own governments intelligence gathering activities and powers.
  - ajross 11y ago
    Which, to be fair, they are absolutely allowed to do. That "everyone does it" doesn't make it acceptable that the NSA does do it. And if that also makes for a convenient excuse to pry some of the data currently stored on US-based servers out of the US and into the EU where it can drive local economies, so much the better from their perspective. The EU regulators are being selfish jerks and forcing Facebook and Google to spend their hard earned cash on a datacenter in Antwerp or whatever. That's... hardly the worst evil afoot.
- makeitsuckless 11y ago
  It's embarrassing that the tin foil hat suggestion that the European Court has a political agenda isn't downvoted into oblivion. Not to mention the simple fact that through this ruling the court actually struck down a treaty supported by the EU politicians.
rwmj 11y ago
TBH as soon as you're using a cloud that you don't control anywhere you've lost control of your data.
- toomuchtodo 11y ago
  https://www.stickermule.com/marketplace/3442-there-is-no-cloud https://www.stickermule.com/marketplace/3442-there-is-no-clo...
Aloisius 11y ago
Even if the US passed identical data protection laws as the EU, the NSA would still have the ability to do what they did legally since EU data protection laws have exceptions for national defense and national security. It appears that the EU wants the US to pass laws that are stronger than their own.
- M2Ys4U 11y ago
  There are exemptions for national security, but they have to be proportionate (and if you read the judgment of the court, they're pointing at a high bar there) and non-discriminatory with regards to citizenship. Part of the problem with SH was the fact that there was no legal recourse at all for EU citizens. Also, let's not forget that the CJEU stuck down the Data Retention Directive recently - so they are enforcing this human right against EU member states. They just have to wait for the right referral to their court.
- Mickydtron 11y ago
  I think it would be very interesting if the civil courts of the US and EU each forced the other entity into passing stronger privacy protections than they have currently. Specifically, I'm thinking of a scenario where the collapse of Safe Harbor helps force Congress into passing meaningful privacy legislation and drastically curtailing the NSAs overbroad powers and mandates, and the US then turns around to the EU and says "ok, now it's your turn. If we can't spy on everybody, then neither can you."
kefka 11y ago
The only effective solution to the problem of "NSA and the ability of the US government to override any treaty to access any data" is the furtherance of study, and application of Homomorphic encryption. Homomorphic encryption is a type of encryption done on data, and sent to a remove server (cloud), and the data is processed in an encrypted form. It never is unencrypted during any part of processing. And when it is transmitted back to the originator, they can decrypt when they choose. Unfortunately, right now the speed is very slow, but work in this area can allow all sorts of data to be processed in the cloud securely.

by buro9 11y ago

Zach_the_Lizard 11y ago

The European intelligence agencies were trading info with the NSA, so European companies can be under the same sorts of threats. It's a red herring. Personally I think this is really about protectionism and the NSA provides a convenient excuse given European intelligence agency involvement.

mtgx 11y ago
Eh, I could see the Commission doing it for protectionist purposes, but why would the highest Court care about that? If it's "protectionist" it's for EU citizens' data, not for economic purposes. I've seen no evidence to the contrary so far. If anything, it's the Commission that has been much more willing to give the US government and companies "some slack" about collecting all this data. Luckily, the Commission's hands are now tied, and the ruling sets a rather clear roadmap for the minimum requirements of privacy in any sort of new EU law or agreement with the US.
Zigurd 11y ago
Not all of Europe is part of the Five Eyes, or even it's outer orbits. And if they are, the relationship is not symmetric. They don't have first-party access to US government communications, never mind, say, POTUS's cell phone. "They all do it" is meaningless if one nation has an NSA and Greece has a sketchy looking guy with black shoes and no socks and a tape recorder.
- Zach_the_Lizard 11y ago
  >Not all of Europe is part of the Five Eyes, or even it's outer orbits. Five Eyes is only one such intelligence alliance. Germany, for instance, cooperated with the NSA despite not being part of FVEY: http://www.spiegel.de/international/germany/german-intelligence-agencies-used-nsa-spying-program-a-912173.html http://www.spiegel.de/international/germany/german-intellige... The Dutch, again not part of Five Eyes, tapped phone calls to pass to the US. We don't know the full extent of which nations played a role. I'm willing to bet it's more than have so far been revealed. >They don't have first-party access to US government communications, never mind, say, POTUS's cell phone. Germany wasn't exactly giving the US access to their government's communications either, "just" private citizens. They did assist the US in getting access to the French leadership, though. >"They all do it" is meaningless if one nation has an NSA and Greece has a sketchy looking guy with black shoes and no socks and a tape recorder. When the large European nations are aggressively spying on their own citizens and then passing that info around to foreign governments in exchange for special software or information, it sort of renders their complaints about the NSA kind of moot. Yeah, the NSA spied on your citizens, but you helped them. For those nations that didn't engage in this, I have a feeling not having your data in America isn't going to prevent the NSA from getting it if they desire it. Especially since much of that data will end up in the sorts of European nations that are spying on their citizens and trading data with the NSA anyways.
  - biafra 11y ago
    > Yeah, the NSA spied on your citizens, but you helped them. I did not help them. Either the German government did or the BND and VS did without orders from the German government. This needs to be investigated and punished accordingly. That is very unlikely, but at least we have parliamentary commision (NSA Untersuchungsausschuss, NSAUA) to investigate these wrongdoings. Some interesting things were already uncovered by the NSAUA.
    - JoBrad 11y ago
      Well, I (a person) didn't directly help the NSA, either. I didn't vote for the people who did it, either. But "I" (a citizen of the United States) did help them in that I am part of the US, and I generally support the form of government that we have. I doubt that the BND acted without orders from the Chancellor's office, just as the NSA didn't and hasn't acted without orders from the President.
icebraining 11y ago
The European intelligence agencies were trading info with the NSA, so European companies can be under the same sorts of threats. It's a red herring. But the court wasn't asked to decide about the actions of the intelligence agencies, it was asked to decide on a complaint against Facebook. Personally I think this is really about protectionism and the NSA provides a convenient excuse given European intelligence agency involvement. On the contrary; if anything, it was the Safe Harbour process that was supported on a convenient excuse, which the Commission allowed despite being clear from the start that the US didn't offer the necessary privacy protections to comply with the Directive. The court has just stated the obvious.
- Zach_the_Lizard 11y ago
  >But the court wasn't asked to decide about the actions of the intelligence agencies, it was asked to decide on a lawsuit against Facebook. You're right, and as the basis of its ruling it decided that intelligence agency action caused a violation of the law. Given that intelligence agencies in the EU were willing partners in NSA spying in clear violation of US and EU law it stands to reason that much of the EU is similarly incompatible with these laws. Why can we store data in Germany when the BND is shipping your data to the NSA, but not America, where the NSA is doing it first hand (and might be doing it on its own in Germany anyways)?
  - icebraining 11y ago
    Why can we store data in Germany when the BND is shipping your data to the NSA, but not America, where the NSA is doing it first hand (and might be doing it on its own in Germany anyways)? For the same reason we could store data in the US right until this decision.
  - pjc50 11y ago
    The legal action has only just got going: https://www.amnesty.org/en/press-releases/2015/04/amnesty-international-takes-uk-government-to-european-court-of-human-rights-over-mass-surveillance/ https://www.amnesty.org/en/press-releases/2015/04/amnesty-in...
  - 11y ago
rmc 11y ago
EU intelligence agencies are under EU law (more or less). The US Gov/NSA is not under EU law. So you can't say that data in the US is compatible with EU law.
- Zach_the_Lizard 11y ago
  Both the NSA and various EU intelligence agencies were violating their various laws. Or, if you're a lawyer for one of these agencies, they had found convenient loopholes that violated the spirit of the laws and rendered them meaningless. So if we apply the standard of intelligence agencies violating the laws mean a country is unfit for storing EU data, then many EU nations are now unfit to store this data.
  - toyg 11y ago
    > So if we apply the standard of intelligence agencies violating the laws mean a country is unfit for storing EU data, then many EU nations are now unfit to store this data The difference is that EU citizens can hold "unfit" actors responsible, if they are from their own country (or even continent, via the ECJ); but they cannot do anything against the NSA.
avenueb 11y ago
Absolutely agree. The EU data regulators consistently ignore their own governments intelligence gathering activities and powers.
- ajross 11y ago
  Which, to be fair, they are absolutely allowed to do. That "everyone does it" doesn't make it acceptable that the NSA does do it. And if that also makes for a convenient excuse to pry some of the data currently stored on US-based servers out of the US and into the EU where it can drive local economies, so much the better from their perspective. The EU regulators are being selfish jerks and forcing Facebook and Google to spend their hard earned cash on a datacenter in Antwerp or whatever. That's... hardly the worst evil afoot.
makeitsuckless 11y ago
It's embarrassing that the tin foil hat suggestion that the European Court has a political agenda isn't downvoted into oblivion. Not to mention the simple fact that through this ruling the court actually struck down a treaty supported by the EU politicians.

rwmj 11y ago

TBH as soon as you're using a cloud that you don't control anywhere you've lost control of your data.

toomuchtodo 11y ago
https://www.stickermule.com/marketplace/3442-there-is-no-cloud https://www.stickermule.com/marketplace/3442-there-is-no-clo...

Aloisius 11y ago

Even if the US passed identical data protection laws as the EU, the NSA would still have the ability to do what they did legally since EU data protection laws have exceptions for national defense and national security. It appears that the EU wants the US to pass laws that are stronger than their own.

M2Ys4U 11y ago
There are exemptions for national security, but they have to be proportionate (and if you read the judgment of the court, they're pointing at a high bar there) and non-discriminatory with regards to citizenship. Part of the problem with SH was the fact that there was no legal recourse at all for EU citizens. Also, let's not forget that the CJEU stuck down the Data Retention Directive recently - so they are enforcing this human right against EU member states. They just have to wait for the right referral to their court.
Mickydtron 11y ago
I think it would be very interesting if the civil courts of the US and EU each forced the other entity into passing stronger privacy protections than they have currently. Specifically, I'm thinking of a scenario where the collapse of Safe Harbor helps force Congress into passing meaningful privacy legislation and drastically curtailing the NSAs overbroad powers and mandates, and the US then turns around to the EU and says "ok, now it's your turn. If we can't spy on everybody, then neither can you."

kefka 11y ago

The only effective solution to the problem of "NSA and the ability of the US government to override any treaty to access any data" is the furtherance of study, and application of Homomorphic encryption. Homomorphic encryption is a type of encryption done on data, and sent to a remove server (cloud), and the data is processed in an encrypted form. It never is unencrypted during any part of processing. And when it is transmitted back to the originator, they can decrypt when they choose. Unfortunately, right now the speed is very slow, but work in this area can allow all sorts of data to be processed in the cloud securely.