7 ms·

Today, the first thing we have to check when sourcing some saas solution is where the data is stored and weather the company has a US department (I work in a No

by tyfon 9y ago

Today, the first thing we have to check when sourcing some saas solution is where the data is stored and weather the company has a US department (I work in a Norwegian bank). So far, if the data is stored physically in the EU and we get a list of names with access to said data, we have been able to use the service, however if the DoJ wins this case we can never use a US based saas type company again regardless of where the data is stored. Is this on the agenda at all? I think a ruling like that would be most harmful for the US IT industry.

wavefunction 9y ago
We have many factions in the US, some more short-sighted or zealous than others. There certainly are citizens of the US who feel that unquestioning compliance with authority is paramount above all other concerns, including long-term economic effects.
- tyfon 9y ago
  They must be very short-sighted, even a dotard should be able to understand what happens if you remove large sections of a companies market overnight. I mean, we would have to pull out of azure completely. Today we spend millions of kroner there every year. It would also leave a very sour taste for going back to US based companies if this is rectified at a later stage of fear of a similar event.
  - craftyguy 9y ago
    Our El Dotart, and his old fat friends, probably won't be alive long enough to realize any long term economic damage due to these types of decisions. What motivation do the self-centered have to think beyond their lifetimes?
    - andrew-lucker 9y ago
      This isn't climate science, we could see the economic effect immediately. That is simple enough for most people to draw a connection. I think the problem is more that some people want to hurt the US IT industry for political gain.
      - craftyguy 9y ago
        I disagree on how 'soon' the effect can be 'seen.' Any adverse effects would be rhetoric'd away by those in power at the moment. Their supporters would not 'see' (or if they did, acknowledge) any bad effects, and those in power would likely find another scapegoat. It's only after they are out that their supporters might (but no guarantees..) understand what happened. There will always be folks who can see through the bullshit, I wasn't referring to those good people in my original comment.
      - vixen99 9y ago
        You mean quickly as in the global temperature warming from roughly 1.53 degrees Fahrenheit (0.85 degrees Celsius) from 1880 to 2012?
  - stanfordkid 9y ago
    Luckily US companies are much more nimble than their government. Most major companies have European branches and subsidiaries specifically for the purposes of ensuring international compliance and skirting around such legislative issues. We certainly poured a huge amount of engineering effort to make sure we had data centers that were EU compliant and completely bifurcated from our US datacenters.
    - deleted 9y ago
      [deleted]
    - Eridrus 9y ago
      You would have to show that the EU entity is not under the control of the US entity before the court. I don't see how you could get there without a fully separate entity that is not owned by the same parent company. Not to say it's not doable, AmaGooSoft are certainly capable of pulling it off, but you've got to be pretty convinced you're leaving a LOT of money in the table by not doing so. I predict EU firms will get over it unless there are regulatory reasons they can't. Any EU company with a US presence is already vulnerable to DoJ lawsuits and can be directly compelled.
      - tyfon 9y ago
        Regulatory reasons. Just to demonstrate the kind of hell we have to go through (today) when we look at cloud services for storing personal data. This is the recommended checklist from the Data Protection Authority in Norway when look at new cloud sources. By default we can't use anything outside the EEA, however there have been some agreements with e.g. US (safe harbour). This ruling will effectively eliminate the safe harbour agreements the EU/EEA has with the US. https://www.datatilsynet.no/en/regulations-and-tools/guidelines/cloud-computing/checklist/ https://www.datatilsynet.no/en/regulations-and-tools/guideli...
deleted 9y ago
[deleted]
x0x0 9y ago
I don't understand how it can possibly be the case that google doesn't have to produce data under a valid court order because, well, they don't feel like it. If the data is in google's possession -- which it is -- then google needs to produce it. I understand this is not necessarily great for google's businesses abroad... but it remains ludicrous for a US corp to tell a US court to piss off.
- pjc50 9y ago
  If it was illegal in the other country to do this, then what?
  - x0x0 9y ago
    Too bad? X laws don't actually trump American laws.
    - deleted 9y ago
      [deleted]
- pedrocr 9y ago
  >but it remains ludicrous for a US corp to tell a US court to piss off. Assume I build a storage box business with headquarters in the US. After a few years of good business I decide to expand and open a subsidiary in Ireland with a local CEO in charge. I now get an order from a US court saying I need to hand over the contents of box #371 that's sitting in Ireland. I consult my lawyers in Ireland who tell me handing over those contents will be a breach of Irish law and very likely to be prosecuted. As the US based CEO do you think I should go to jail or I should send my Irish CEO to jail?
  - Eridrus 9y ago
    I do not think this is an accurate analogy, specifically I do not think an Irish CEO would be violating the law, but in any case, most jurisdictions do not care if you have placed yourself between a rock and a hard place legally and will operate as if no other jurisdictions exist; the main question is usually "can the US entity do what is being demanded"
rainsford 9y ago
Are EU regulations on this issue substantially different? I ask because every time this topic comes up, a comment will inevitably be made saying how you should keep data in the EU and this will be the death of the US IT industry. However, what I've never seen is any actual evidence that these court cases would proceed differently in an EU country (and note that Microsoft actually seems to be winning their similar case as far as I know). As an example, suppose France had a Google equivalent (Le Google) with servers all over the world. The French government issued a search warrant for an email account, and Le Google refused to hand over the contents of that email account because the data was (or could be) on a server located in a United States. Under French or EU law, is this a valid reason to reject a warrant (and does it matter if the account belongs to a French citizen or not)?
- bsder 9y ago
  Your entity has a presence where the warrant is served. Your entity where the warrant is served can get at the data. You probably will be forced to comply. If you genuinely want to avoid this issue, your foreign entity needs to be distinct and independent. That way Le Google could say "Serve the warrant. We have no ability to comply. What do you expect us to do?" Of course, this means that you don't get the nice benefits of putting ALL your data into one gigantic maw to be chewed up by the machine.
  - rainsford 9y ago
    Right, except the specific claim here as I understand it is that companies should be able to refuse to comply with warrants if the responsive data is stored in another country even if the company can access said data and that the lack of ability to do so exists in the US but not in the EU.
    - bsder 9y ago
      "Lack of ability" will have to be demonstrated politically as well as technically. If Google doesn't want to be subject to US laws, then the data and servers in question have to be under the control of an entity not under US jurisdiction. And that includes financially and politically as well as technically. This really isn't that hard. Google can either set things up so that Google US really, truly cannot affect anything in Le Google--and that includes management decisions--of course, Google does not want independent Googlets as those companies will start to compete with the mothership (or they can't function because they lose the economy of scale). Or Google can set it up so that NOBODY including Google, Le Google, etc. can get at the data because it is encrypted--of course, Google doesn't want this as then they cannot mine your stuff for advertising. Why do you think Microsoft just announced all the SGX support stuff for Azure? They want email to be really, truly encrypted such that even Microsoft can't get at it so that the can keep selling Office 365 without getting embroiled in this.
__s 9y ago
I work in a less strict environment, education on call management & insurance claims, in a more US friendly country, Canada, & we too are required to host through Canadian hosting companies. This in response to the Patriot Act
RcouF1uZ4gsC 9y ago
That actually might not be a bad thing. Because of the network effects and economies of scale, by being first the US companies is such as Google, Microsoft, and Amazon have sucked up all the oxygen in terms of large competitors from other countries. The only exception is China where the government has actively intervened to keep out foreign tech companies and has thus given Baidu, Alibaba, Tencent, etc time and a market to grow. I think the global Internet is coming to an end. Look at Facebook. Basically, if you are not the US, your citizens are giving a vast treasure trove of intelligence concerning who is connected to whom and what is important to them to a company which is currently either sharing that information with the US to Electric electrical Government, or else can easily be compelled to share it. Across the world, many countries' governments are worried about the power and influence of these multinational tech companies. In the past in the US, they used to be able to count on the Right to somewhat protect them. For example, the election of George W Bush probably saved Microsoft from breakup. Now, I think a lot of the Right also views these tech companies with suspicion. I think we are going to see more and more government action, for example going after them for antitrust and monopoly abuses.
- est 9y ago
  > keep out foreign tech companies and has thus given Baidu, Alibaba, Tencent, etc time and a market to grow The case is true for Baidu, but only true for Baidu. eBay/Amazon/Newegg competed with Alibaba/JD for a decade and lost. For Tencent, MSN Messenger was killed by Microsoft, Skype was .... killed by Microsoft. For gaming sectors, western companies like Blizzard profits in China.
  - deadfoxygrandpa 9y ago
    Google also competed against Baidu for years and lost. When they exited China in the early 2010s they only had 20% marketshare
    - mrep 9y ago
      Uber also lost in China

by tyfon 9y ago

wavefunction 9y ago

We have many factions in the US, some more short-sighted or zealous than others. There certainly are citizens of the US who feel that unquestioning compliance with authority is paramount above all other concerns, including long-term economic effects.

tyfon 9y ago
They must be very short-sighted, even a dotard should be able to understand what happens if you remove large sections of a companies market overnight. I mean, we would have to pull out of azure completely. Today we spend millions of kroner there every year. It would also leave a very sour taste for going back to US based companies if this is rectified at a later stage of fear of a similar event.
- craftyguy 9y ago
  Our El Dotart, and his old fat friends, probably won't be alive long enough to realize any long term economic damage due to these types of decisions. What motivation do the self-centered have to think beyond their lifetimes?
  - andrew-lucker 9y ago
    This isn't climate science, we could see the economic effect immediately. That is simple enough for most people to draw a connection. I think the problem is more that some people want to hurt the US IT industry for political gain.
    - craftyguy 9y ago
      I disagree on how 'soon' the effect can be 'seen.' Any adverse effects would be rhetoric'd away by those in power at the moment. Their supporters would not 'see' (or if they did, acknowledge) any bad effects, and those in power would likely find another scapegoat. It's only after they are out that their supporters might (but no guarantees..) understand what happened. There will always be folks who can see through the bullshit, I wasn't referring to those good people in my original comment.
    - vixen99 9y ago
      You mean quickly as in the global temperature warming from roughly 1.53 degrees Fahrenheit (0.85 degrees Celsius) from 1880 to 2012?
- stanfordkid 9y ago
  Luckily US companies are much more nimble than their government. Most major companies have European branches and subsidiaries specifically for the purposes of ensuring international compliance and skirting around such legislative issues. We certainly poured a huge amount of engineering effort to make sure we had data centers that were EU compliant and completely bifurcated from our US datacenters.
  - deleted 9y ago
    [deleted]
  - Eridrus 9y ago
    You would have to show that the EU entity is not under the control of the US entity before the court. I don't see how you could get there without a fully separate entity that is not owned by the same parent company. Not to say it's not doable, AmaGooSoft are certainly capable of pulling it off, but you've got to be pretty convinced you're leaving a LOT of money in the table by not doing so. I predict EU firms will get over it unless there are regulatory reasons they can't. Any EU company with a US presence is already vulnerable to DoJ lawsuits and can be directly compelled.
    - tyfon 9y ago
      Regulatory reasons. Just to demonstrate the kind of hell we have to go through (today) when we look at cloud services for storing personal data. This is the recommended checklist from the Data Protection Authority in Norway when look at new cloud sources. By default we can't use anything outside the EEA, however there have been some agreements with e.g. US (safe harbour). This ruling will effectively eliminate the safe harbour agreements the EU/EEA has with the US. https://www.datatilsynet.no/en/regulations-and-tools/guidelines/cloud-computing/checklist/ https://www.datatilsynet.no/en/regulations-and-tools/guideli...

deleted 9y ago

[deleted]

x0x0 9y ago

I don't understand how it can possibly be the case that google doesn't have to produce data under a valid court order because, well, they don't feel like it. If the data is in google's possession -- which it is -- then google needs to produce it. I understand this is not necessarily great for google's businesses abroad... but it remains ludicrous for a US corp to tell a US court to piss off.

pjc50 9y ago
If it was illegal in the other country to do this, then what?
- x0x0 9y ago
  Too bad? X laws don't actually trump American laws.
  - deleted 9y ago
    [deleted]
pedrocr 9y ago
>but it remains ludicrous for a US corp to tell a US court to piss off. Assume I build a storage box business with headquarters in the US. After a few years of good business I decide to expand and open a subsidiary in Ireland with a local CEO in charge. I now get an order from a US court saying I need to hand over the contents of box #371 that's sitting in Ireland. I consult my lawyers in Ireland who tell me handing over those contents will be a breach of Irish law and very likely to be prosecuted. As the US based CEO do you think I should go to jail or I should send my Irish CEO to jail?
- Eridrus 9y ago
  I do not think this is an accurate analogy, specifically I do not think an Irish CEO would be violating the law, but in any case, most jurisdictions do not care if you have placed yourself between a rock and a hard place legally and will operate as if no other jurisdictions exist; the main question is usually "can the US entity do what is being demanded"

rainsford 9y ago

Are EU regulations on this issue substantially different? I ask because every time this topic comes up, a comment will inevitably be made saying how you should keep data in the EU and this will be the death of the US IT industry. However, what I've never seen is any actual evidence that these court cases would proceed differently in an EU country (and note that Microsoft actually seems to be winning their similar case as far as I know). As an example, suppose France had a Google equivalent (Le Google) with servers all over the world. The French government issued a search warrant for an email account, and Le Google refused to hand over the contents of that email account because the data was (or could be) on a server located in a United States. Under French or EU law, is this a valid reason to reject a warrant (and does it matter if the account belongs to a French citizen or not)?

bsder 9y ago
Your entity has a presence where the warrant is served. Your entity where the warrant is served can get at the data. You probably will be forced to comply. If you genuinely want to avoid this issue, your foreign entity needs to be distinct and independent. That way Le Google could say "Serve the warrant. We have no ability to comply. What do you expect us to do?" Of course, this means that you don't get the nice benefits of putting ALL your data into one gigantic maw to be chewed up by the machine.
- rainsford 9y ago
  Right, except the specific claim here as I understand it is that companies should be able to refuse to comply with warrants if the responsive data is stored in another country even if the company can access said data and that the lack of ability to do so exists in the US but not in the EU.
  - bsder 9y ago
    "Lack of ability" will have to be demonstrated politically as well as technically. If Google doesn't want to be subject to US laws, then the data and servers in question have to be under the control of an entity not under US jurisdiction. And that includes financially and politically as well as technically. This really isn't that hard. Google can either set things up so that Google US really, truly cannot affect anything in Le Google--and that includes management decisions--of course, Google does not want independent Googlets as those companies will start to compete with the mothership (or they can't function because they lose the economy of scale). Or Google can set it up so that NOBODY including Google, Le Google, etc. can get at the data because it is encrypted--of course, Google doesn't want this as then they cannot mine your stuff for advertising. Why do you think Microsoft just announced all the SGX support stuff for Azure? They want email to be really, truly encrypted such that even Microsoft can't get at it so that the can keep selling Office 365 without getting embroiled in this.

__s 9y ago

I work in a less strict environment, education on call management & insurance claims, in a more US friendly country, Canada, & we too are required to host through Canadian hosting companies. This in response to the Patriot Act

RcouF1uZ4gsC 9y ago

That actually might not be a bad thing. Because of the network effects and economies of scale, by being first the US companies is such as Google, Microsoft, and Amazon have sucked up all the oxygen in terms of large competitors from other countries. The only exception is China where the government has actively intervened to keep out foreign tech companies and has thus given Baidu, Alibaba, Tencent, etc time and a market to grow. I think the global Internet is coming to an end. Look at Facebook. Basically, if you are not the US, your citizens are giving a vast treasure trove of intelligence concerning who is connected to whom and what is important to them to a company which is currently either sharing that information with the US to Electric electrical Government, or else can easily be compelled to share it. Across the world, many countries' governments are worried about the power and influence of these multinational tech companies. In the past in the US, they used to be able to count on the Right to somewhat protect them. For example, the election of George W Bush probably saved Microsoft from breakup. Now, I think a lot of the Right also views these tech companies with suspicion. I think we are going to see more and more government action, for example going after them for antitrust and monopoly abuses.

est 9y ago
> keep out foreign tech companies and has thus given Baidu, Alibaba, Tencent, etc time and a market to grow The case is true for Baidu, but only true for Baidu. eBay/Amazon/Newegg competed with Alibaba/JD for a decade and lost. For Tencent, MSN Messenger was killed by Microsoft, Skype was .... killed by Microsoft. For gaming sectors, western companies like Blizzard profits in China.
- deadfoxygrandpa 9y ago
  Google also competed against Baidu for years and lost. When they exited China in the early 2010s they only had 20% marketshare
  - mrep 9y ago
    Uber also lost in China