7 ms·
So if you want your data to remain out of scope for US warrants the only way is to choose non-US companies? Drastically reduces the options, I can only think of
by dx034 9y ago
So if you want your data to remain out of scope for US warrants the only way is to choose non-US companies? Drastically reduces the options, I can only think of OVH and Hetzner that would qualify..
Or are the German data centres of Azure safe as they're run by a German company?
- lallysingh 9y agoI don't think #2 (Azure) applies. Your best bet is to store cryptographic keys offsite and leave the data in the cloud. There's a market opportunity for someone who can wrap that up in a reasonable API/library for use on EC2/GCP/Azure.
- dx034 9y agoWhy not use a non-US provider then? Maybe this will lead to more support for those. I can imagine that some EU companies will now struggle even more using AWS/GCP/Azure.
- lallysingh 9y agoDepends on where your customers are and the applicable scale/latency costs of not using the biggest providers.
- isostatic 9y agoIf you want 20ms latency to customers in the US, you're going to be hosting in North America, damn relativity and all that.
- andremat 9y agoAzure does have sovereign clouds, for instance its Germany cloud. [1] In this case data is handled by a German company and not Microsoft and so is subject to EU law. [1] https://azure.microsoft.com/en-us/global-infrastructure/germany/ https://azure.microsoft.com/en-us/global-infrastructure/germ...
- pjc50 9y ago> Your best bet is to store cryptographic keys offsite and leave the data in the cloud. There's a market opportunity for someone who can wrap that up in a reasonable API/library for use on EC2/GCP/Azure. Is there actually a market for this that people would pay for, or is it just something that people would like to exist?
- lallysingh 9y agoSure, for downstream SAAS to use for customers. I think it'd be a nice add-on for services with customers outside the US who are wary of overreach. So if there are two web email vendors, and one has this protection and the other doesn't, it may be the deciding factor for a customer. The one that has that protection could use this service to do that for them. Even without the national boundary feature, good crypto APIs not bound to your compute vendor is a nice thing to have.
- mtgx 9y agoIt's a matter of herd mentality. The more the issue is raised, the more people will be willing to use services from other countries instead of US-based services, which means more non-US companies will gain prominence for certain services, which will encourage even more users to switch to them. As long as everyone thinks everything is fine if they keep using the same old US services they've always used, none of those steps will happen. Expect to get a push-back from users who prefer continuing to use US-based services so they can justify their own choice.
- dx034 9y agoIf it really changes the business then I'd guess that one of the smaller providers (DigitalOcean, Linode, Vultr) relocates their headquarters to a EU country to circumvent that. Could at least bring non-US data centres out of scope.
- rb808 9y agoAlibaba cloud? Presumably Chinese govt can snoop but not sure how much power US has.
- projectramo 9y agoThese are the lowest prices I have seen. Is this new? Surprised not have heard of this before.
- dx034 9y agoI think they're close to a year old. Still more expensive than Hetzner though?
- projectramo 9y agoYou're right. I wish Hetzner didn't require an ID because they're cheap and (allegedly) performant. I wonder if serverpilot etc will work equally well with these guys.
- dx034 9y ago@projectramo (cannot reply to that): I have very good experience with Hetzner, speed is very good even if you ignore prices, considering the price it's by far the best I've used. I still have backups at other providers but switched to only using them for everything I do, saved me a lot of money. I already had an account so didn't need to provide ID but wouldn't see that as a deal breaker. You'd need to pay with credit card anyway so they'll get your name sooner or later. And it has helped with the spam problem they apparently used to have (for a while a lot of their IPs were on blacklists).
- projectramo 9y agoI am not mad at them for asking for my ID, but in the US that is (in my opinion) the big sign of intrusiveness. When they want to scare people, they say "the police will start asking ordinary citizens for ID". Its a huge deal when the pharmacist asks for ID for a controlled substance. And add to that the privacy culture here (on HN and in tech circles). I would rather pay a few extra bucks for now. But if they dropped the requirement I would use it. I bet I am not alone and there are many others who feel the same.
- projectramo 9y agoHetzner requires a copy of your ID which I find more intrusive. Does OVH? If there is a way to sign up for Hetzner without giving them a copy of your passport, does anyone know?
- lucideer 9y agoOVH definitely doesn't, but this requirement by Hetzner is news to me. Do you know how long this has been in place?
- dx034 9y agoI can't remember that I ever provided it but I heard this a lot. They say that it significantly lowers fraud rates. It's not a legal requirement. Interestingly enough, it's debatable if copies of state-issued IDs are even allowed in Germany (there were courts saying that practices like this are illegal). EDIT: apparently that's legal now, see the answer below. I don't like the practice but believe their argument, hosting services attract a lot of bad actors and this will probably filter out most of them from the start.
- germanier 9y agoCopying ID cards in Germany has been made explicitly legal in July 2017 through a change of the relevant law.
- projectramo 9y agoI saw Hetzner cloud upvoted on here about 3 months ago and I liked the pricing so I tried to sign up, and they asked me to send them a copy of my ID. So at least 3 months.
- jbergstroem 9y agoI've been using tilaa as a mail host for about ten years now; its a vm/storage provider based out of Amsterdam. I at least tell myself that my data is relatively safe there.
- neom 9y agoMLAT would probably allow a US court to ask a foreign entity via a foreign court to provide data of US entity, even if the data and the provider are outside of the US.
- dx034 9y agoBut that requires a local judge to confirm the view. I guess most of us naturally trust their local judiciary system more than that of other countries so that this will go a long way for many.
- rgbrenner 9y ago[this was not entirely correct.. so I'm removing it]
- dx034 9y agoEven if they sign an agreement, access to content of EU servers run by a company based in the EU will need a local warrant. The FBI won't get access without help of local law enforcement. And that can be hard even within the EU, as Spain just found out when they tried to arrest a politician. I think many US citizens would be outraged if a Chinese court could issue warrants to access their data stored at any company. Not sure if EU citizens trust the US judicial system much more.
- ar0 9y agoThere are a lot of other cloud providers in Europe besides OVH and Hetzner: - Upcloud (based in Finland) - Cloudsigma (based in Switzerland) - Deutsche Telekom TelekomCLOUD (based in Germany) - Online.net / Scaleway (based in France) - Aruba Cloud (based in Italy) - Swisscom (based in Switzerland) - etc. Unfortunately none of them offer the breadth of services like Google Cloud, Amazon or Azure, but they most likely will be more than enough for many purposes.
- maltalex 9y agoAruba Cloud have a 1 eur/month VMware-based VM with one core and a gig of ram in Italy an CZ. It’s quite nice for tiny projects you don’t want to spend on.
- deleted 9y ago[deleted]
- isostatic 9y agoWow (or should I say Mamma Mia!), at that price it's rude not to.
- sschueller 9y ago- exoscale.com (based in Switzerland)
- eksemplar 9y agoIt depends on who you are and who you deal with. We house a lot of our stuff in Azure, but we entered into an agreement with an European based Microsoft child company. If the us wants access to our data, they’ll need to go through the Danish courts. We spend a lot of money though, but it afford us our own private servers in the Irish farm, that we have physical access to and our data never enters the public part of Azure. If the US government wants to get access, it probably can, after a few months in various EU courts, but all they’ll find by the in our little vault will be a tape recorder playing twister sisters - we’re not gonna take it on repeat. Of course American companies will be replaced by an European competitor if the US government doesn’t wise up and stops being dicks. If there was a real alternative to American clouds we’d have left by now.
- dx034 9y agoIs that still valid even though the European company is controlled by Microsoft? As I understand, the agreement they have in Germany basically hands over all control to Telekom, basically like a franchise model. As long as Microsoft Europe still controls access to the data, can't they be forced by Microsoft US to reveal the data? As I understood, that was the reason why OVH hesitated for so long to build US data centres and then used a separate company for it (not sure if they went through with that plan). Not a lawyer so pure speculation but would be interested if anyone has details.
- eksemplar 9y agoAs far as I know we’re perfectly safe within the setup we run. I haven’t been involved in the legal bits beyond asking for permission to put citizen data in the cloud and being granted permission by our government and the EU. Maybe this verdict changes things, but if it did, I’m fairly confident that I would’ve known by now considering it’s a sensitive issue. We do have extensive exit plans at hand, for such an event. Plans that are really just us burning money because the US surveillance state can’t get it’s damn act together.
- my123 9y agoMicrosoft German datacenters are unaffected yeah. They're not connected in any way to the upstream MS Azure network, the only way for MS to control them would be through an infected security update, which they'll never do.
- pvg 9y ago‘Avoiding lawful warrants’ is just not a service you’re easily going to get from a developed Western country.
- dx034 9y agoIt's not about that. Lawful warrants can easily get confirmed by a local judge and the FBI can access the data via local prosecutors. That already works where the crime committed is very clear. It's more about cases where the US government thinks they need access but where the EU would disagree.
- pvg 9y agoWhat are these cases that affect typical usage? And it’s not where the ‘US government thinks’. They need to show probable cause and get a warrant. Generally, when you get to that point, going from one developed democracy with fairly robust rule of law to another isn’t going to help.
- tracker1 9y agoFISA court rulings are usually accompanied by gag orders here in the US, under "National Security" flags... This means they'd likely be unwilling and/or unable to consult with a foreign, local law enforcement. Not that I really agree with it, most of the time the secrecy is for secrecy sake imho, and to advantage government prosecution. It's pretty scary tbh. Does this mean it's ok for a US company operating in China to turn over US information?
- perpetualpatzer 9y agoYour best plan is [1]: a) don't be a US citizen/resident, and b) store your data in a country where disclosure of this information is banned by law. Under these conditions, the provider can (and has incentives to) challenge the order requiring the production of the data. If the order is quashed, the US government would need to get an order from the local government under MLAT for the data. As for your German datacenter question... Under the text of the law, it depends on whether that data is within a US electronic communications or remote computing service provider's "possession, custody, or control." In theory, a service provider might contract out the management of these aspects of its operations, but it would be hard to imagine a service provider feeling comfortable moving the data outside of its control. [1] See p 2205 of bill text for the CLOUD act part. http://docs.house.gov/billsthisweek/20180319/BILLS-115SAHR1625-RCP115-66.pdf http://docs.house.gov/billsthisweek/20180319/BILLS-115SAHR16...
- tathougies 9y agoI mean... duh? If you don't want your data accessible by a particular sovereign entity, its best to ensure your data is never in the jurisdiction of that sovereign entity. The meaning of sovereign is "We can do whatever crap we want here, and there's no higher authority that can judge us". If you're not okay with that crap, then don't interact with that entity, because -- as the term 'sovereign' implies -- there's no court you can appeal to to settle your dispute in your favor.
- isostatic 9y agoThat's always been the case - US law has had global jurisdiction for decades To their credit, Microsoft have resisted US Government pressure [0] on this subject in the past. [0] https://www.washingtonpost.com/world/national-security/microsoft-fights-us-search-warrant-for-customer-e-mails-held-in-overseas-server/2014/06/10/6b8416ae-f0a7-11e3-914c-1fbd0614e2d4_story.html https://www.washingtonpost.com/world/national-security/micro...