4 ms·

Outside of the government sector it seems like these laws are to make sure that the data is within legal jurisdiction, and has nothing to do with privacy.

tyfon 8y ago
Banking data is at least considered to be "important" enough to keep within the borders too, but privacy is important too in regards to GDPR. How do you prevent unauthorized access to the data (i.e. the US government) with the cloud act. Do you report those requests as a breech? There is really no difference between that and having the servers hacked in other ways.
- vegardx 8y ago
  Banking data is important because the police and tax authority wants to make sure they have access, privacy doesn't really come into play here. It's a nice side effect, though. It's the same with accounting data. When it comes to GDPR it only talks about where and by who data is processed, it doens't really put any restriction on storage, except for some pretty vague (on purpose) requirements about data protection (read: encryption).
  - tyfon 8y ago
    But if the US government access PII without authorization via the cloud act wouldn't it count as a data breech when it comes to GDPR?
    - vegardx 8y ago
      Then they should be getting encrypted or pseudoanonymised data, if you are following the regulations. For services like AWS you can argue that they should be able to get ahold of these encryption keys, but most data protection authorities seems to think this is good enough.
      - thefounder 8y ago
        Encryption is useless when you store the keys on the same infrastucture. U.S may ask for keys as well. Even if you would store the keys on a local service at some point your data will lie/transition decrypted on the remote hardware. It's not a good idea at all to use hardware controlled by a hostile government regardless of what kind of encryption you plan to use.
        Foxboron 8y ago
        >Encryption is useless when you store the keys on the same infrastucture. U.S may ask for keys as well. Are you claiming HSM are unsafe? >Even if you would store the keys on a local service at some point your data will lie/transition decrypted on the remote hardware. Well no. You have TPM and HMS which should solve this problem sufficiently. Even hardware tokens for crypto e.g Nitrokey and/or yubikey should be sufficiently safe for most use cases. >It's not a good idea at all to use hardware controlled by a hostile government regardless of what kind of encryption you plan to use. It depends. You shouldn't host anything at any "hostile government", but who is the hostile government? Is this a hostile nation based on a threat model for your company? Or is this your personal opinion?
        thefounder 8y ago
        Once the attacker gets physical access to your device/computer all bets are off. Not to mention if "your device" is actually provided by a hostile party(i.e amazon/microsoft in collaboration with various US agencies). A government/state is hostile if it breaks the laws designed to protect the citizens and their freedoms(i.e privacy). I believe it's obvious by now that the U.S government seeks not only to apply its justice system over sovereign states but also to control the politics and get strategic information, even from its "allies".
        close04 8y ago
        What's your threat model here? Who's the actor you're protecting yourself from? A government/state acting under they own laws is still acting under a law so they would never have physical access to something like an HSM located in a DC on another continent. Or even your laptop that's sitting in another country. A government/state acting around the law makes any discussion about laws superfluous. They will go around them anyway, as per the premise.
  - jdietrich 8y ago
    Storage is processing. ‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction https://gdpr-info.eu/art-4-gdpr/ https://gdpr-info.eu/art-4-gdpr/
- tinus_hn 8y ago
  It’s the other way around, the Europeans want to be able to snoop in the data. They don’t care if your data leaks to the US, as long as they have access themselves.
  - icebraining 8y ago
    Well, no, we do care if the data leaks to the US; the ECJ struck down the Safe Habour Decision, and there are many critics of the new "Privacy Shield".
mc32 8y ago
Didn’t Russia require something like this back in 2016 or so? All data pertaining to Russians had to stay in Russia?
- edaemon 8y ago
  Yes, it was ostensibly about privacy but the actual compliance requirements align with jurisdiction and access rather than privacy.

tyfon 8y ago

Banking data is at least considered to be "important" enough to keep within the borders too, but privacy is important too in regards to GDPR. How do you prevent unauthorized access to the data (i.e. the US government) with the cloud act. Do you report those requests as a breech? There is really no difference between that and having the servers hacked in other ways.

vegardx 8y ago
Banking data is important because the police and tax authority wants to make sure they have access, privacy doesn't really come into play here. It's a nice side effect, though. It's the same with accounting data. When it comes to GDPR it only talks about where and by who data is processed, it doens't really put any restriction on storage, except for some pretty vague (on purpose) requirements about data protection (read: encryption).
- tyfon 8y ago
  But if the US government access PII without authorization via the cloud act wouldn't it count as a data breech when it comes to GDPR?
  - vegardx 8y ago
    Then they should be getting encrypted or pseudoanonymised data, if you are following the regulations. For services like AWS you can argue that they should be able to get ahold of these encryption keys, but most data protection authorities seems to think this is good enough.
    - thefounder 8y ago
      Encryption is useless when you store the keys on the same infrastucture. U.S may ask for keys as well. Even if you would store the keys on a local service at some point your data will lie/transition decrypted on the remote hardware. It's not a good idea at all to use hardware controlled by a hostile government regardless of what kind of encryption you plan to use.
      - Foxboron 8y ago
        >Encryption is useless when you store the keys on the same infrastucture. U.S may ask for keys as well. Are you claiming HSM are unsafe? >Even if you would store the keys on a local service at some point your data will lie/transition decrypted on the remote hardware. Well no. You have TPM and HMS which should solve this problem sufficiently. Even hardware tokens for crypto e.g Nitrokey and/or yubikey should be sufficiently safe for most use cases. >It's not a good idea at all to use hardware controlled by a hostile government regardless of what kind of encryption you plan to use. It depends. You shouldn't host anything at any "hostile government", but who is the hostile government? Is this a hostile nation based on a threat model for your company? Or is this your personal opinion?
        thefounder 8y ago
        Once the attacker gets physical access to your device/computer all bets are off. Not to mention if "your device" is actually provided by a hostile party(i.e amazon/microsoft in collaboration with various US agencies). A government/state is hostile if it breaks the laws designed to protect the citizens and their freedoms(i.e privacy). I believe it's obvious by now that the U.S government seeks not only to apply its justice system over sovereign states but also to control the politics and get strategic information, even from its "allies".
        close04 8y ago
        What's your threat model here? Who's the actor you're protecting yourself from? A government/state acting under they own laws is still acting under a law so they would never have physical access to something like an HSM located in a DC on another continent. Or even your laptop that's sitting in another country. A government/state acting around the law makes any discussion about laws superfluous. They will go around them anyway, as per the premise.
- jdietrich 8y ago
  Storage is processing. ‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction https://gdpr-info.eu/art-4-gdpr/ https://gdpr-info.eu/art-4-gdpr/
tinus_hn 8y ago
It’s the other way around, the Europeans want to be able to snoop in the data. They don’t care if your data leaks to the US, as long as they have access themselves.
- icebraining 8y ago
  Well, no, we do care if the data leaks to the US; the ECJ struck down the Safe Habour Decision, and there are many critics of the new "Privacy Shield".

mc32 8y ago

Didn’t Russia require something like this back in 2016 or so? All data pertaining to Russians had to stay in Russia?

edaemon 8y ago
Yes, it was ostensibly about privacy but the actual compliance requirements align with jurisdiction and access rather than privacy.