4 ms·

Trump signs executive order controlling foreign access to cloud providers

48 points by neartheplain 6y ago

hexadec 6y ago
Curious to see how the new administration will handle this. They will need to gather personal identity information to determine if you are a US citizen which is scary. Will certainly enable AWS/GCP/Azure to curtail all my free trial accounts I imagine. On the other hand, they do not define US IaaS very well, so I am curious if GCP/AWS will be exempt since I think they are technically shell companies registered in Jersey or Isle of Man or offshored on paper.
- dragonwriter 6y ago
  > Curious to see how the new administration will handle this. Probably just rescind the order. It directs the secretary of commerce to develop regs, and the new administration (even if it agrees with the general thrust) will probably want to direct the parameters for any regulations rather than leave them to the preferences of outgoing administration.
rendx 6y ago
"Within 180 days of the date of this order, the Secretary of Commerce (Secretary) shall propose for notice and comment regulations that require United States IaaS providers to verify the identity of a foreign person that obtains an Account. These regulations shall, at a minimum: (a) set forth the minimum standards that United States IaaS providers must adopt to verify the identity of a foreign person in connection with the opening of an Account or the maintenance of an existing Account, including: [...] (A) the identity of such foreign person and the person’s information, including name, national identification number, and address. [...] (j) The term “United States Infrastructure as a Service Provider” means any United States Person that offers any Infrastructure as a Service Product."
- hexadec 6y ago
  Sure but Amazon (and all others) are not really US persons under the covers. "In the United States, Amazon has been accused of transferring U.S. funds to the same shell company in Luxembourg, to avoid paying $234 million in U.S. taxes for 2005 and 2006. " -https://www.forbes.com/sites/parmyolson/2017/10/04/europe-cracks-down-on-amazons-offshore-tax-arrangement/?sh=6115f77f642c https://www.forbes.com/sites/parmyolson/2017/10/04/europe-cr...
  - deleted 6y ago
    [deleted]
  - sneak 6y ago
    "Under the covers" as you put it refers to where the revenue is ultimately going. Amazon's datacenters in the US absolutely are owned and operated by US-incorporated corporations to which this order applies.
anfilt 6y ago
Err, I am not a fan of this. The identity requirements imply that that services will at the very least request enough information to identify that you are a US citizen. It also seems to make IP logging a requirement: "Internet Protocol addresses used for access or administration and the date and time of each such access or administrative action, related to ongoing verification of such foreign person’s ownership of such an Account"
- Terretta 6y ago
  In the 80s and 90s, I imagined the ‘Net as borderless. That didn’t last long, and because it’s so long gone, this seems not to really add any scope to that creep. That said... First point seems less worrisome until you see the intent to have access to access patterns (not just IPs, also timings) outside the US by non-US persons. Note the “or” and remember “corporations are people”, as well as remembering there are no loopholes to pick at here until after it’s drafted. The intent is clear: The term “United States Infrastructure as a Service Product” means any Infrastructure as a Service Product owned by any United States person or operated within the territory of the United States of America; On the second point, is there any reputable CSP that doesn’t have the IPs used for access or administration? Is there any that doesn’t already geo-check the edge accesses for proactive threat management? This language could also give legal air cover to enrich domestic CSP security practices.
DethNinja 6y ago
This is such a weird EO, wouldn’t this kill all USA based cloud providers? Or at least limit their ability on acquiring foreign accounts? So long as I don’t need servers in the USA why should I choose a USA based cloud provider? I feel like I’m missing a point here.
- londons_explore 6y ago
  The US is pretty cemented in as a leader in the cloud world. This might be step one to extending these regulations to all cloud providers worldwide, with the threat that anyone who provides IT services to others without strong identity verification gets blocked financially.
mullingitover 6y ago
There really should be a drastic limit to executive authority after an election and before a new administration takes office. I'm talking no new executive orders, no pardons, no judicial nominations, really hardly any executive action at all without congressional approval. This would limit the kind of sour grapes, last minute policy changes arguably enacted in bad faith to hamstring an incoming president.
- ac29 6y ago
  I think thats an argument for reducing the time between elections and when people assume office, not for taking away administrative powers that can also be used for good things and for emergencies.
- colejohnson66 6y ago
  That would just worsen the “lame duck” issue we already have.[0] As @ac29 said, we should shorten the time between election and inauguration. Aside: As it stands, the constitution sets when Inauguration Day is (20th Amendment), so the only option it to modify the US Code which sets Election Day (Tuesday, between November 2-8 inclusive)[1] [0]: https://en.wikipedia.org/wiki/Lame_duck_(politics) https://en.wikipedia.org/wiki/Lame_duck_(politics) [1]: https://en.wikipedia.org/wiki/Election_Day_(United_States) https://en.wikipedia.org/wiki/Election_Day_(United_States)
  - mullingitover 6y ago
    I wholeheartedly agree that the time between election and inauguration should be shortened. Really, the current administration's powers should be gone the minute the last tipping point state certifies its results.
- cafard 6y ago
  It is an old tradition, and in fact contributed very much to making the US what it is. John Adams appointed John Marshall Chief Justice of the Supreme Court very late in his one term. With a different justice--one with a less expansive view of federal power, or just one without the personality to carry the court with him--the Supreme Court might have considerably less weight. Apart from that, though, the worst I can remember from recent history are a pardon binge or two. But the outgoing president is not one to be constrained by custom.
nzrf 6y ago
From what I am reading here. This really targets VPS providers that allow payment through let’s say bitcoin and such which provide as proxy points to anonymize traffic. This will impact I am sure the big players in some way, but see smaller operators hosting vps(iaas) impacted more.
sneak 6y ago
TL;DR: "If you want hosting in the US, you can show strongly identity-linked US bank/card information, or, if you don't have one of those, strongly identity-linked ID documents." It somehow doesn't feel like he's ramming this through on the last day of his presidency because he cares deeply about the safety and security of the citizens of the USA. Publishing anonymously should be something the government is actively trying to protect, not criminalize.
- webmaven 6y ago
  > It somehow doesn't feel like he's ramming this through on the last day of his presidency because he cares deeply about the safety and security of the citizens of the USA. No, but it doesn't feel like it is being done out of spite either. I mean, there is nothing here that can't be ignored or negated by the incoming administration when any proposed regs are eventually drafted, so someone lobbied for this EO, but I don't see who this benefits enough to have been worth expending financial or political capital just to get draft legislation that they will have to expend more capital on to actually get enacted, and perhaps then a bit more to have enforced (it is a characteristic of such efforts to enact legislation or regulation that if you are clever enough, enforcement is something that the lobbying entity largely gets "for free" when their pet legislation is enacted). Although it does seem plain that the amount of capital expended right now is likely smaller than if trying to get the incoming administration to get the ball rolling, but that just answers "why today" rather than "why". Cui bono?

48 points by neartheplain 6y ago

Curious to see how the new administration will handle this. They will need to gather personal identity information to determine if you are a US citizen which is scary. Will certainly enable AWS/GCP/Azure to curtail all my free trial accounts I imagine. On the other hand, they do not define US IaaS very well, so I am curious if GCP/AWS will be exempt since I think they are technically shell companies registered in Jersey or Isle of Man or offshored on paper.

dragonwriter 6y ago
> Curious to see how the new administration will handle this. Probably just rescind the order. It directs the secretary of commerce to develop regs, and the new administration (even if it agrees with the general thrust) will probably want to direct the parameters for any regulations rather than leave them to the preferences of outgoing administration.

rendx 6y ago

"Within 180 days of the date of this order, the Secretary of Commerce (Secretary) shall propose for notice and comment regulations that require United States IaaS providers to verify the identity of a foreign person that obtains an Account. These regulations shall, at a minimum: (a) set forth the minimum standards that United States IaaS providers must adopt to verify the identity of a foreign person in connection with the opening of an Account or the maintenance of an existing Account, including: [...] (A) the identity of such foreign person and the person’s information, including name, national identification number, and address. [...] (j) The term “United States Infrastructure as a Service Provider” means any United States Person that offers any Infrastructure as a Service Product."

hexadec 6y ago
Sure but Amazon (and all others) are not really US persons under the covers. "In the United States, Amazon has been accused of transferring U.S. funds to the same shell company in Luxembourg, to avoid paying $234 million in U.S. taxes for 2005 and 2006. " -https://www.forbes.com/sites/parmyolson/2017/10/04/europe-cracks-down-on-amazons-offshore-tax-arrangement/?sh=6115f77f642c https://www.forbes.com/sites/parmyolson/2017/10/04/europe-cr...
- deleted 6y ago
  [deleted]
- sneak 6y ago
  "Under the covers" as you put it refers to where the revenue is ultimately going. Amazon's datacenters in the US absolutely are owned and operated by US-incorporated corporations to which this order applies.

anfilt 6y ago

Err, I am not a fan of this. The identity requirements imply that that services will at the very least request enough information to identify that you are a US citizen. It also seems to make IP logging a requirement: "Internet Protocol addresses used for access or administration and the date and time of each such access or administrative action, related to ongoing verification of such foreign person’s ownership of such an Account"

Terretta 6y ago
In the 80s and 90s, I imagined the ‘Net as borderless. That didn’t last long, and because it’s so long gone, this seems not to really add any scope to that creep. That said... First point seems less worrisome until you see the intent to have access to access patterns (not just IPs, also timings) outside the US by non-US persons. Note the “or” and remember “corporations are people”, as well as remembering there are no loopholes to pick at here until after it’s drafted. The intent is clear: The term “United States Infrastructure as a Service Product” means any Infrastructure as a Service Product owned by any United States person or operated within the territory of the United States of America; On the second point, is there any reputable CSP that doesn’t have the IPs used for access or administration? Is there any that doesn’t already geo-check the edge accesses for proactive threat management? This language could also give legal air cover to enrich domestic CSP security practices.

DethNinja 6y ago

This is such a weird EO, wouldn’t this kill all USA based cloud providers? Or at least limit their ability on acquiring foreign accounts? So long as I don’t need servers in the USA why should I choose a USA based cloud provider? I feel like I’m missing a point here.

londons_explore 6y ago
The US is pretty cemented in as a leader in the cloud world. This might be step one to extending these regulations to all cloud providers worldwide, with the threat that anyone who provides IT services to others without strong identity verification gets blocked financially.

mullingitover 6y ago

There really should be a drastic limit to executive authority after an election and before a new administration takes office. I'm talking no new executive orders, no pardons, no judicial nominations, really hardly any executive action at all without congressional approval. This would limit the kind of sour grapes, last minute policy changes arguably enacted in bad faith to hamstring an incoming president.

ac29 6y ago
I think thats an argument for reducing the time between elections and when people assume office, not for taking away administrative powers that can also be used for good things and for emergencies.
colejohnson66 6y ago
That would just worsen the “lame duck” issue we already have.[0] As @ac29 said, we should shorten the time between election and inauguration. Aside: As it stands, the constitution sets when Inauguration Day is (20th Amendment), so the only option it to modify the US Code which sets Election Day (Tuesday, between November 2-8 inclusive)[1] [0]: https://en.wikipedia.org/wiki/Lame_duck_(politics) https://en.wikipedia.org/wiki/Lame_duck_(politics) [1]: https://en.wikipedia.org/wiki/Election_Day_(United_States) https://en.wikipedia.org/wiki/Election_Day_(United_States)
- mullingitover 6y ago
  I wholeheartedly agree that the time between election and inauguration should be shortened. Really, the current administration's powers should be gone the minute the last tipping point state certifies its results.
cafard 6y ago
It is an old tradition, and in fact contributed very much to making the US what it is. John Adams appointed John Marshall Chief Justice of the Supreme Court very late in his one term. With a different justice--one with a less expansive view of federal power, or just one without the personality to carry the court with him--the Supreme Court might have considerably less weight. Apart from that, though, the worst I can remember from recent history are a pardon binge or two. But the outgoing president is not one to be constrained by custom.

nzrf 6y ago

From what I am reading here. This really targets VPS providers that allow payment through let’s say bitcoin and such which provide as proxy points to anonymize traffic. This will impact I am sure the big players in some way, but see smaller operators hosting vps(iaas) impacted more.

sneak 6y ago

TL;DR: "If you want hosting in the US, you can show strongly identity-linked US bank/card information, or, if you don't have one of those, strongly identity-linked ID documents." It somehow doesn't feel like he's ramming this through on the last day of his presidency because he cares deeply about the safety and security of the citizens of the USA. Publishing anonymously should be something the government is actively trying to protect, not criminalize.

webmaven 6y ago
> It somehow doesn't feel like he's ramming this through on the last day of his presidency because he cares deeply about the safety and security of the citizens of the USA. No, but it doesn't feel like it is being done out of spite either. I mean, there is nothing here that can't be ignored or negated by the incoming administration when any proposed regs are eventually drafted, so someone lobbied for this EO, but I don't see who this benefits enough to have been worth expending financial or political capital just to get draft legislation that they will have to expend more capital on to actually get enacted, and perhaps then a bit more to have enforced (it is a characteristic of such efforts to enact legislation or regulation that if you are clever enough, enforcement is something that the lobbying entity largely gets "for free" when their pet legislation is enacted). Although it does seem plain that the amount of capital expended right now is likely smaller than if trying to get the incoming administration to get the ball rolling, but that just answers "why today" rather than "why". Cui bono?