7 ms·

The obsession with where data physically sits at rest is so amusing to me. Not limited to overzealous governments and financial data; healthcare is singularly o

The obsession with where data physically sits at rest is so amusing to me. Not limited to overzealous governments and financial data; healthcare is singularly obsessed with this. It makes no sense whatsoever, of course. I'd much rather store properly encrypted personal information or financial data in North Korea than storing it unencrypted in my home country. I would understand if they demanded both storage and processing be done in India. Then it's just about control, and the ability to sever MC's India operations from the mother ship in case things go really sour and the US tries to cut India off from the global financial system or something. But since it's just about data at rest, it's nonsensical. Or am I missing something?

phoe-krk 5y ago
> I'd much rather store properly encrypted personal information or financial data in North Korea than storing it unencrypted in my home country. What do you mean by "properly encrypted"? MasterCard is not going to let you be the sole holder of your encryption keys. And if you aren't holding them, then they they hold it, and then they must be holding in at least one given country. And that country has the power to force them to turn these keys over. The power to do this is the goal of this game.
- kspacewalk2 5y ago
  That country already has the power to force them to turn these keys over (or use the keys to decrypt data of interest). Every non-tax-haven country which regulates its financial sector does (so, every country). It's unclear what is added by forcing them to store data locally.
  - phoe-krk 5y ago
    In most cases you can't easily tell that company to hand over data that is held in another country though.
ko27 5y ago
> I'd much rather store properly encrypted personal information or financial data in North Korea than storing it unencrypted in my home country That encryption is pointlesss. North Korea can just demand the key and decrypt your data (assuming the company has presence in that country). Very few services have true end to end encryption. Currently it's not even feasible for healthcare data (homomorphic encryption is not practical yet).
- kspacewalk2 5y ago
  North Korea can demand what it wants. I'm not in North Korea. For North Koreans, all encryption is indeed pointless if the goal is to hide it from the government, regardless of where they want to store data, for this very reason. I can implement true end-to-end encryption in about 30 minutes (only because I gotta look up where I implemented it last). I will encrypt my data using well known and validated libraries, send it over to the cloud. Retrieve when I need it and decrypt it then. Not sure what about this is not feasible.
  - ko27 5y ago
    You are moving the goal posts. Of course simple data storage can be made secure, because you have the key. But the article is talking about financial data that is processed by companies. And you mentioned healthcare data, which would also be processed. The companies have the key and they can be forced to hand it over easily. What use is end to end encryption for your healthcare data, if nobody except you can process that data? In that case, why don't you just put it on some external hard drive?
    - derenge 5y ago
      I think the point they are making hinges on the fact that the data just has to be _stored_ there. You can do the processing outside of India, so a company can store the encrypted data in India but process the decrypted data elsewhere.
herbst 5y ago
> I'd much rather store properly encrypted personal information or financial data in North Korea than storing it unencrypted in my home country. How about it gets encrypted same way in North Korea or South Korea. Which one would you prefer? What if North Korea says it is properly encrypted and gov has no easy access, but we all know that could be just as well wrong? The U.S. Not exactly enjoys a lot of trust internationally when it comes to customer protection and privacy.
- kspacewalk2 5y ago
  >How about it gets encrypted same way in North Korea or South Korea. Which one would you prefer? Whichever is cheaper and/or more reliable. If I trust encryption, all other answers are bogus. >What if North Korea says it is properly encrypted and gov has no easy access, but we all know that could be just as well wrong? In this scenario, I decide how to encrypt my data. The storage service is just dumb disk space for me to rent. Call it The People's Democratic B2. Otherwise, it's not really secure no matter who gives you assurances.
  - herbst 5y ago
    I doubt it would be an option for MasterCard that countries get to decide how they encrypt the related data. But I get your point :)
signal11 5y ago
India wants data residency because it wants to apply its own somewhat unique approach to law enforcement to all digital data — financial and otherwise. This is a country that switches off mobile data (3G and 4G) at the drop of a hat[1], and switched off an entire state’s mobile Internet access for 18 months[2]. This may appear unnecessary and capricious to some especially in the West. However I’m sure pro-Indian government commenters will say “we’re sovereign, our government can do as it likes as it has a democratic mandate” and that is of course true. And that is, in my view, the driver for India’s interest in data residency. Its laws allow its government an enormous degree of latitude to do what it likes. When it has to access foreign data it is often thwarted by EU or US privacy & legal rules, which it feels is unbecoming of a nation as geopolitically important as India. What I feel about this is that of course India has the sovereign right to do as it pleases, but its messy, adhoc approach to digital governance won’t win it any laurels and will actually tarnish its reputation. Also, it would be on a much better footing if it passed a decent law on digital privacy, which many have been saying is long overdue — leading to a flourishing unregulated economy in selling Indians’ data[3]. [1] https://www.bbc.co.uk/news/world-asia-india-50819905 https://www.bbc.co.uk/news/world-asia-india-50819905 [2] https://techcrunch.com/2021/02/05/india-is-restoring-4g-internet-in-jammu-and-kashmir-after-18-months/ https://techcrunch.com/2021/02/05/india-is-restoring-4g-inte... [3] https://restofworld.org/2020/all-the-data-fit-to-sell/ https://restofworld.org/2020/all-the-data-fit-to-sell/
- mdasen 5y ago
  To expand on this a bit, if you want leverage over companies like MasterCard, Visa, and American Express, it definitely helps to have the data in your jurisdiction. As you noted, they will shut off mobile internet to support the state. If Visa decides that it doesn't want to give the government data on someone's transactions, it helps to have that data in the country. "Oh, but the data is encrypted." Sure, but the country could literally seize all of the servers and shut down the payment processor. "Hey, American Express, if you don't give us the data we want, we'll simply take your whole payment network offline." It's a lot harder to pressure a payment network when you don't have physical control - especially if that payment network can challenge you in court. It's easy for the government to shut off mobile networks that are physically present. It's harder for the government to stop traffic from routing to a payment processor whose servers are outside of the country - especially if they have a half-decent security/threat team ready to avoid blocks. I don't know the laws of India, but it seems likely that the Executive has a certain amount of discretion that can be challenged. However, it's a lot harder to challenge that discretion if your business is offline for a year while you challenge it. Payment processors need to comply with local laws, but if you're a country where the Executive doesn't mind disrupting services, that gives them a huge amount of leverage to get your compliance beyond local laws. If the data is hosted outside of India, it's a lot easier to to simply comply with the laws rather than the laws plus whatever the Executive thinks they can claim the laws support. Ultimately, if the data is stored within India, the Indian government can be an existential threat to their business in the country beyond what the law allows. A company will hand over data rather than seeing its servers seized for a year while a trial ensues. During that year, they'd lose all their customers to competitors and they'd be shut out of the market. Likewise, what if the government "accidentally" damages the data when they lose the trial? If you have 100M customers in a country and each is carrying a balance of $100, that's $10B that people owe. If the government has seized all those records and then damages them, your business is in a lot of trouble. Data residency gives a government willing to bully companies a lot of power. It's simply a lot harder to access information stored abroad and you have a lot less leverage.
gpm 5y ago
All data is capable of being decrypted somewhere. Usually where you are storing it. Otherwise you can't do anything with it. Storing data encryped in north korea, with the capability to fetch and decrypt that data in Sweden, is approximately equivalent to storing the unencrypted data in Sweden (as far as hackers, law enforcement, etc. are concerned), except you've now added the additional risk that north korea only needs to exfiltrate one encryption key to gain access to all your data. More reasonably, if you're storing the data in north korea, that's also where you have the compute, and therefore the decryption keys, and therefore someone in north korea who knows what they are doing can quitely steal the decryption keys, make a copy of your data, and view all the data unencrypted. Encryption is only foolproof(ish) when you are sending data between two trusted endpoints. That's not the case for the cloud, the place you are storing the data is also almost always one of the "trusted" endpoints. Encrypting the data at rest has some minor benefits (being a hurdle to accessing the data, meaning that theft of a single hard disk doesn't get data) but doesn't provide any form of unbreakable security.
- dannyw 5y ago
  No, I can store encrypted data in North Korea without storing any decryption keys there. I run a Filecoin node and I store the data of approximately 200 clients in my homelab. I don't know who they are, or what they store, because it's all end to end encrypted. And no -- my clients don't trust me, it's crypto, it's trustless :)
- kspacewalk2 5y ago
  Usually where you're processing it, not where you're storing it. That's when you need to do something with it. Encrypting the data at rest has the major benefit of making its physical location completely irrelevant. Transmitting the data while encrypted has the major benefit of making the physical location of all the nodes through which it passes completely irrelevant. Hence the only thing that matters is the geographic location of where the data is processed, because that is where you decrypt it. All privacy laws should be written with that understanding, but they are not. They are written by people who are ignorant of this simple logic, because they don't understand how Internet works, how encryption works, how routing traffic works and how little it has to do with borders of countries, etc etc. Healthcare privacy laws in my country, for example, have this exactly 100% backwards. They force me to store data in my country, but say nothing about where it is processed. And of course there's no hard requirement to encrypt data at rest. It's hard to imagine how you can get this kind of law more wrong.
iamgopal 5y ago
Also, All big company shows server expense from foreign country and move profit earned from India to abroad. This way some part of the profit stays in india.
bushbaba 5y ago
Forcing the data to reside in India. Forces companies to build data centers (jobs) in India. Forces the deployments to be in India. And drives benefits to the local players over international bodies.
- kspacewalk2 5y ago
  Yeah, I suspect that is the logic, such as it is. Quite unburdened with an understanding of how trade works, and seemingly susceptible to the greater fool theory of trade - I'll do it because I'm so smart, but that guy over there won't, and my companies will reap benefits. Not for long.
  - ngc248 5y ago
    The Chinese great firewall, even though it is primarily to not allow info flow from outside, one benefit has been that, a lot of the internet companies that operate in china have been local and they were able to develop without any competition from western players. This has benefited china and its companies. But in the rest of the world its mostly the SV companies who rule the roost. There are bith advantages and disadvantages to protectionism I feel.
kube-system 5y ago
There's multiple reasons. Mostly: jurisdiction and protectionism.
deleted 5y ago
[deleted]
spoonjim 5y ago
The obsession with physical data residence comes from the physical nature of government’s power: the ability to apply violence within its borders. The Indian government wants as much data (and encryption keys) inside Indian borders as possible because it can send in guys with guns to take it whenever they want.
- naruvimama 5y ago
  Providing guys with guns is the primary purpose of any government.
nacho2sweet 5y ago
From my understanding (I could be wrong) and why I have to follow all these rules here in Canada, is the USA made a homeland security law in like 2007 that said law enforcement can have access to any foreign individuals data without a warrant/good reason. So now when picking services I am not allowed to host on any non Canadian servers if we are hosting personal information about staff/users etc. It can be a simple event registration system, survey, or just having to be really careful when using cloud services. I even have to watch out when sharing a innocuous file over Slack. This really sucked when stuff was moving over to cloud and we wanted to use a lot of hot new stuff, but most providers get it now and provide Canadian servers so not as bad finding compliant vendors.
- 908B64B197 5y ago
  Ultimately, isn't it the owner of the server who's targeted by the laws? Where the server is really doesn't matter that much.
  - PeterisP 5y ago
    One thing is that usually the local server would be owned and managed by a local subsidiary of that foreign company - it may even be a requirement, to have them be run by a local company (even if fully owned by a foreign entity) with local responsible officers. Another issue is establishing jurisdiction; if the server is held locally, then it's clear that local laws apply to things done on that server - the owner of the server can't claim that they e.g. got a US subpoena and did some stuff in USA that fulfills all the USA legal requirements and everything that's it; if the server was physically located in e.g. Canadian soil, then it means that the violation (if any) happened "in Canada" even if it was done by USA-located USA citizens of USA company.
sneak 5y ago
> It makes no sense whatsoever, of course. Silent, bulk, state-mandated surveillance. Both for the at-home surveillance, as well as to counter the effect of storing it elsewhere, and permitting that state silent, bulk surveillance of the data of your own subjects/citizens.
argomo 5y ago
> I'd much rather store properly encrypted personal information or financial data in North Korea than storing it unencrypted in my home country. You might feel comfortable with that as an individual, but geopolitically speaking, India would be giving North Korea a pretty bargaining chip by letting payment processors store their data there (if they were so inclined). Imagine the havoc that could be caused! By requiring data residency, it is instead India who gets a pretty bargaining chip against these huge multi-national corporations.
unknownOrigin 5y ago
> I'd much rather store properly encrypted personal information or financial data in North Korea Ah, a fan of cold storage, are we.
EVa5I7bHFq9mnYK 5y ago
Of course they also require full unencrypted access to the data. If the company doesn't surrender the keys to the server data, they can just switch the server off.
KorematsuFred 5y ago
I have been a party to some discussion around the laws with mid level government officials and this was a bit like an episode of Yes Minister. One of the government consultants spoke about "Data sovereignty". When someone asked what it meant he spoke for like 10 minutes without actually answering the question. "Data of Indians must belong to Indians", "Data is the gold of modern world" he then referred to various international reports without actually telling what those reports say. "We must protect our citizens data" one official said as others nodded in agreement. What they imagined here (I think) was data sitting on a hard drive and protected by people with guns creating a parameter around it. The files of these regulations moved across many tables and many offices. I am told the real estate companies in India had a big role and influence on these regulations. Yes, ultimately it is a ridiculous law that does not help anyone. It does not protect anything.
- kspacewalk2 5y ago
  I hope, for the sake of their sanity and ours, that they won't one day look into how routing of Internet traffic works.
passivate 5y ago
Governments care about financial data for a lot of legitimate reasons, including fraud, criminal activity, etc. Having the data local makes sending legal notices for data access easier and makes supervision easier. A country shouldn't rely on sending international data-access petitions to random data centers with possibly hostile governments who will fight them on jurisdiction and non-treaty grounds. I think what they're doing makes sense.
- kspacewalk2 5y ago
  The company does business in India. If they want to continue doing business in India, they will comply with lawful court orders of Indian courts (or whatever other lawful mechanisms exist in India). If they store their data on the Moon, they will have to comply in the exact same way. It changes literally nothing.
rrrrrrrrrrrryan 5y ago
Will you always be able to access your data stored on North Korean soil? Sure, if it's properly encrypted, the North Korean government may not be able to access it, but nothing's stopping them from cutting you off and holding your data hostage. I used to work for a company that made software for casinos. Many of them were on tribal land, and refused to use any cloud services because they didn't want any of their data on American soil. All their software was on-prem, all their data was on-prem. If Uncle Sam came a-knockin' with warrants and court orders, they'd tell him to take it up with the tribal elders.
- kspacewalk2 5y ago
  Well, I wouldn't necessarily only store it on North Korean soil. Raw data we use for image processing at work (we will miss it if it's gone) is stored in three locations: server room, another server room in a different building, and on the cloud. Properly-as-of-2021-encrypted, of course. Unless we really fuck something up with securing our storage servers or running a script that accidentally wipes it all at once, it's really hard to imagine a scenario under which all of that is gone at once. If the cheapest and most reliable cloud storage provider was in North Korea, the only reason I wouldn't use them is the reaction I'd get from Very Important Privacy Peoples when they hear of it. (And also because I don't want to fund a criminal totalitarian regime responsible for sending people to the Gulag).
jollybean 5y ago
"Or am I missing something? " Jurisdiction is huge thing, not a side show. Data that sits overseas is subject to entirely different sets of laws which can conflict with local laws. Those laws also relate to espionage, and even outside the framework of legality ... it matters as well. It's a lot easier for the NSA to collect data on individuals if it's hosted in the US. I have absolutely no doubt that financial, legal and health records should simply not leave the local legal jurisdiction without consent and a few more things.
- kspacewalk2 5y ago
  Nothing in your comment invalidates these simple points: 1. If it's encrypted, it doesn't matter where it's stored. 2. If it's not encrypted, it can be easily stored in country X, processed in country X, but routed via SnoopHub in country Y. Country Y loves surveilling and is very happy about this state of affairs. >I have absolutely no doubt that financial, legal and health records should simply not leave the local legal jurisdiction without consent and a few more things. A very common attitude, usually held by people who "geographize" that which is not geographic in nature - the Internet.
  - jollybean 5y ago
    1) Your assertion that 'the data would be encrypted' is false. There's no reason to believe that Visa/MC would simply use 'America' as a based to host dumb, encrypted data which enters and leaves the the US fully opaque. That would be pointless. Visa/MS are using services hosted in the US which will process customer data. 2) Statement #2 is also false. There is no arbitrary way for the US to snoop on data that doesn't flow through the US. For a whole variety of reasons - legal, operational, technical, political, cost etc.. Surely it can be done in a limited way, but at a level nowhere near the domestic capability. 3) Finally, you're statement on "geographizing" is also false. Data, encrypted or not - falls under legal jurisdiction of the 'nation / geography' it's in, and this has many significant consequences. It makes a corporation subject to local laws, regulations, liabilities etc.. The internet is very geographic in nature.

phoe-krk 5y ago

> I'd much rather store properly encrypted personal information or financial data in North Korea than storing it unencrypted in my home country. What do you mean by "properly encrypted"? MasterCard is not going to let you be the sole holder of your encryption keys. And if you aren't holding them, then they they hold it, and then they must be holding in at least one given country. And that country has the power to force them to turn these keys over. The power to do this is the goal of this game.

kspacewalk2 5y ago
That country already has the power to force them to turn these keys over (or use the keys to decrypt data of interest). Every non-tax-haven country which regulates its financial sector does (so, every country). It's unclear what is added by forcing them to store data locally.
- phoe-krk 5y ago
  In most cases you can't easily tell that company to hand over data that is held in another country though.

ko27 5y ago

> I'd much rather store properly encrypted personal information or financial data in North Korea than storing it unencrypted in my home country That encryption is pointlesss. North Korea can just demand the key and decrypt your data (assuming the company has presence in that country). Very few services have true end to end encryption. Currently it's not even feasible for healthcare data (homomorphic encryption is not practical yet).

kspacewalk2 5y ago
North Korea can demand what it wants. I'm not in North Korea. For North Koreans, all encryption is indeed pointless if the goal is to hide it from the government, regardless of where they want to store data, for this very reason. I can implement true end-to-end encryption in about 30 minutes (only because I gotta look up where I implemented it last). I will encrypt my data using well known and validated libraries, send it over to the cloud. Retrieve when I need it and decrypt it then. Not sure what about this is not feasible.
- ko27 5y ago
  You are moving the goal posts. Of course simple data storage can be made secure, because you have the key. But the article is talking about financial data that is processed by companies. And you mentioned healthcare data, which would also be processed. The companies have the key and they can be forced to hand it over easily. What use is end to end encryption for your healthcare data, if nobody except you can process that data? In that case, why don't you just put it on some external hard drive?
  - derenge 5y ago
    I think the point they are making hinges on the fact that the data just has to be _stored_ there. You can do the processing outside of India, so a company can store the encrypted data in India but process the decrypted data elsewhere.

herbst 5y ago

> I'd much rather store properly encrypted personal information or financial data in North Korea than storing it unencrypted in my home country. How about it gets encrypted same way in North Korea or South Korea. Which one would you prefer? What if North Korea says it is properly encrypted and gov has no easy access, but we all know that could be just as well wrong? The U.S. Not exactly enjoys a lot of trust internationally when it comes to customer protection and privacy.

kspacewalk2 5y ago
>How about it gets encrypted same way in North Korea or South Korea. Which one would you prefer? Whichever is cheaper and/or more reliable. If I trust encryption, all other answers are bogus. >What if North Korea says it is properly encrypted and gov has no easy access, but we all know that could be just as well wrong? In this scenario, I decide how to encrypt my data. The storage service is just dumb disk space for me to rent. Call it The People's Democratic B2. Otherwise, it's not really secure no matter who gives you assurances.
- herbst 5y ago
  I doubt it would be an option for MasterCard that countries get to decide how they encrypt the related data. But I get your point :)

signal11 5y ago

India wants data residency because it wants to apply its own somewhat unique approach to law enforcement to all digital data — financial and otherwise. This is a country that switches off mobile data (3G and 4G) at the drop of a hat[1], and switched off an entire state’s mobile Internet access for 18 months[2]. This may appear unnecessary and capricious to some especially in the West. However I’m sure pro-Indian government commenters will say “we’re sovereign, our government can do as it likes as it has a democratic mandate” and that is of course true. And that is, in my view, the driver for India’s interest in data residency. Its laws allow its government an enormous degree of latitude to do what it likes. When it has to access foreign data it is often thwarted by EU or US privacy & legal rules, which it feels is unbecoming of a nation as geopolitically important as India. What I feel about this is that of course India has the sovereign right to do as it pleases, but its messy, adhoc approach to digital governance won’t win it any laurels and will actually tarnish its reputation. Also, it would be on a much better footing if it passed a decent law on digital privacy, which many have been saying is long overdue — leading to a flourishing unregulated economy in selling Indians’ data[3]. [1] https://www.bbc.co.uk/news/world-asia-india-50819905 https://www.bbc.co.uk/news/world-asia-india-50819905 [2] https://techcrunch.com/2021/02/05/india-is-restoring-4g-internet-in-jammu-and-kashmir-after-18-months/ https://techcrunch.com/2021/02/05/india-is-restoring-4g-inte... [3] https://restofworld.org/2020/all-the-data-fit-to-sell/ https://restofworld.org/2020/all-the-data-fit-to-sell/

mdasen 5y ago
To expand on this a bit, if you want leverage over companies like MasterCard, Visa, and American Express, it definitely helps to have the data in your jurisdiction. As you noted, they will shut off mobile internet to support the state. If Visa decides that it doesn't want to give the government data on someone's transactions, it helps to have that data in the country. "Oh, but the data is encrypted." Sure, but the country could literally seize all of the servers and shut down the payment processor. "Hey, American Express, if you don't give us the data we want, we'll simply take your whole payment network offline." It's a lot harder to pressure a payment network when you don't have physical control - especially if that payment network can challenge you in court. It's easy for the government to shut off mobile networks that are physically present. It's harder for the government to stop traffic from routing to a payment processor whose servers are outside of the country - especially if they have a half-decent security/threat team ready to avoid blocks. I don't know the laws of India, but it seems likely that the Executive has a certain amount of discretion that can be challenged. However, it's a lot harder to challenge that discretion if your business is offline for a year while you challenge it. Payment processors need to comply with local laws, but if you're a country where the Executive doesn't mind disrupting services, that gives them a huge amount of leverage to get your compliance beyond local laws. If the data is hosted outside of India, it's a lot easier to to simply comply with the laws rather than the laws plus whatever the Executive thinks they can claim the laws support. Ultimately, if the data is stored within India, the Indian government can be an existential threat to their business in the country beyond what the law allows. A company will hand over data rather than seeing its servers seized for a year while a trial ensues. During that year, they'd lose all their customers to competitors and they'd be shut out of the market. Likewise, what if the government "accidentally" damages the data when they lose the trial? If you have 100M customers in a country and each is carrying a balance of $100, that's $10B that people owe. If the government has seized all those records and then damages them, your business is in a lot of trouble. Data residency gives a government willing to bully companies a lot of power. It's simply a lot harder to access information stored abroad and you have a lot less leverage.

gpm 5y ago

All data is capable of being decrypted somewhere. Usually where you are storing it. Otherwise you can't do anything with it. Storing data encryped in north korea, with the capability to fetch and decrypt that data in Sweden, is approximately equivalent to storing the unencrypted data in Sweden (as far as hackers, law enforcement, etc. are concerned), except you've now added the additional risk that north korea only needs to exfiltrate one encryption key to gain access to all your data. More reasonably, if you're storing the data in north korea, that's also where you have the compute, and therefore the decryption keys, and therefore someone in north korea who knows what they are doing can quitely steal the decryption keys, make a copy of your data, and view all the data unencrypted. Encryption is only foolproof(ish) when you are sending data between two trusted endpoints. That's not the case for the cloud, the place you are storing the data is also almost always one of the "trusted" endpoints. Encrypting the data at rest has some minor benefits (being a hurdle to accessing the data, meaning that theft of a single hard disk doesn't get data) but doesn't provide any form of unbreakable security.

dannyw 5y ago
No, I can store encrypted data in North Korea without storing any decryption keys there. I run a Filecoin node and I store the data of approximately 200 clients in my homelab. I don't know who they are, or what they store, because it's all end to end encrypted. And no -- my clients don't trust me, it's crypto, it's trustless :)
kspacewalk2 5y ago
Usually where you're processing it, not where you're storing it. That's when you need to do something with it. Encrypting the data at rest has the major benefit of making its physical location completely irrelevant. Transmitting the data while encrypted has the major benefit of making the physical location of all the nodes through which it passes completely irrelevant. Hence the only thing that matters is the geographic location of where the data is processed, because that is where you decrypt it. All privacy laws should be written with that understanding, but they are not. They are written by people who are ignorant of this simple logic, because they don't understand how Internet works, how encryption works, how routing traffic works and how little it has to do with borders of countries, etc etc. Healthcare privacy laws in my country, for example, have this exactly 100% backwards. They force me to store data in my country, but say nothing about where it is processed. And of course there's no hard requirement to encrypt data at rest. It's hard to imagine how you can get this kind of law more wrong.

iamgopal 5y ago

Also, All big company shows server expense from foreign country and move profit earned from India to abroad. This way some part of the profit stays in india.

bushbaba 5y ago

Forcing the data to reside in India. Forces companies to build data centers (jobs) in India. Forces the deployments to be in India. And drives benefits to the local players over international bodies.

kspacewalk2 5y ago
Yeah, I suspect that is the logic, such as it is. Quite unburdened with an understanding of how trade works, and seemingly susceptible to the greater fool theory of trade - I'll do it because I'm so smart, but that guy over there won't, and my companies will reap benefits. Not for long.
- ngc248 5y ago
  The Chinese great firewall, even though it is primarily to not allow info flow from outside, one benefit has been that, a lot of the internet companies that operate in china have been local and they were able to develop without any competition from western players. This has benefited china and its companies. But in the rest of the world its mostly the SV companies who rule the roost. There are bith advantages and disadvantages to protectionism I feel.

kube-system 5y ago

There's multiple reasons. Mostly: jurisdiction and protectionism.

deleted 5y ago

[deleted]

spoonjim 5y ago

The obsession with physical data residence comes from the physical nature of government’s power: the ability to apply violence within its borders. The Indian government wants as much data (and encryption keys) inside Indian borders as possible because it can send in guys with guns to take it whenever they want.

naruvimama 5y ago
Providing guys with guns is the primary purpose of any government.

nacho2sweet 5y ago

From my understanding (I could be wrong) and why I have to follow all these rules here in Canada, is the USA made a homeland security law in like 2007 that said law enforcement can have access to any foreign individuals data without a warrant/good reason. So now when picking services I am not allowed to host on any non Canadian servers if we are hosting personal information about staff/users etc. It can be a simple event registration system, survey, or just having to be really careful when using cloud services. I even have to watch out when sharing a innocuous file over Slack. This really sucked when stuff was moving over to cloud and we wanted to use a lot of hot new stuff, but most providers get it now and provide Canadian servers so not as bad finding compliant vendors.

908B64B197 5y ago
Ultimately, isn't it the owner of the server who's targeted by the laws? Where the server is really doesn't matter that much.
- PeterisP 5y ago
  One thing is that usually the local server would be owned and managed by a local subsidiary of that foreign company - it may even be a requirement, to have them be run by a local company (even if fully owned by a foreign entity) with local responsible officers. Another issue is establishing jurisdiction; if the server is held locally, then it's clear that local laws apply to things done on that server - the owner of the server can't claim that they e.g. got a US subpoena and did some stuff in USA that fulfills all the USA legal requirements and everything that's it; if the server was physically located in e.g. Canadian soil, then it means that the violation (if any) happened "in Canada" even if it was done by USA-located USA citizens of USA company.

sneak 5y ago

> It makes no sense whatsoever, of course. Silent, bulk, state-mandated surveillance. Both for the at-home surveillance, as well as to counter the effect of storing it elsewhere, and permitting that state silent, bulk surveillance of the data of your own subjects/citizens.

argomo 5y ago

> I'd much rather store properly encrypted personal information or financial data in North Korea than storing it unencrypted in my home country. You might feel comfortable with that as an individual, but geopolitically speaking, India would be giving North Korea a pretty bargaining chip by letting payment processors store their data there (if they were so inclined). Imagine the havoc that could be caused! By requiring data residency, it is instead India who gets a pretty bargaining chip against these huge multi-national corporations.

unknownOrigin 5y ago

> I'd much rather store properly encrypted personal information or financial data in North Korea Ah, a fan of cold storage, are we.

EVa5I7bHFq9mnYK 5y ago

Of course they also require full unencrypted access to the data. If the company doesn't surrender the keys to the server data, they can just switch the server off.

KorematsuFred 5y ago

I have been a party to some discussion around the laws with mid level government officials and this was a bit like an episode of Yes Minister. One of the government consultants spoke about "Data sovereignty". When someone asked what it meant he spoke for like 10 minutes without actually answering the question. "Data of Indians must belong to Indians", "Data is the gold of modern world" he then referred to various international reports without actually telling what those reports say. "We must protect our citizens data" one official said as others nodded in agreement. What they imagined here (I think) was data sitting on a hard drive and protected by people with guns creating a parameter around it. The files of these regulations moved across many tables and many offices. I am told the real estate companies in India had a big role and influence on these regulations. Yes, ultimately it is a ridiculous law that does not help anyone. It does not protect anything.

kspacewalk2 5y ago
I hope, for the sake of their sanity and ours, that they won't one day look into how routing of Internet traffic works.

passivate 5y ago

Governments care about financial data for a lot of legitimate reasons, including fraud, criminal activity, etc. Having the data local makes sending legal notices for data access easier and makes supervision easier. A country shouldn't rely on sending international data-access petitions to random data centers with possibly hostile governments who will fight them on jurisdiction and non-treaty grounds. I think what they're doing makes sense.

kspacewalk2 5y ago
The company does business in India. If they want to continue doing business in India, they will comply with lawful court orders of Indian courts (or whatever other lawful mechanisms exist in India). If they store their data on the Moon, they will have to comply in the exact same way. It changes literally nothing.

rrrrrrrrrrrryan 5y ago

Will you always be able to access your data stored on North Korean soil? Sure, if it's properly encrypted, the North Korean government may not be able to access it, but nothing's stopping them from cutting you off and holding your data hostage. I used to work for a company that made software for casinos. Many of them were on tribal land, and refused to use any cloud services because they didn't want any of their data on American soil. All their software was on-prem, all their data was on-prem. If Uncle Sam came a-knockin' with warrants and court orders, they'd tell him to take it up with the tribal elders.

kspacewalk2 5y ago
Well, I wouldn't necessarily only store it on North Korean soil. Raw data we use for image processing at work (we will miss it if it's gone) is stored in three locations: server room, another server room in a different building, and on the cloud. Properly-as-of-2021-encrypted, of course. Unless we really fuck something up with securing our storage servers or running a script that accidentally wipes it all at once, it's really hard to imagine a scenario under which all of that is gone at once. If the cheapest and most reliable cloud storage provider was in North Korea, the only reason I wouldn't use them is the reaction I'd get from Very Important Privacy Peoples when they hear of it. (And also because I don't want to fund a criminal totalitarian regime responsible for sending people to the Gulag).

jollybean 5y ago

"Or am I missing something? " Jurisdiction is huge thing, not a side show. Data that sits overseas is subject to entirely different sets of laws which can conflict with local laws. Those laws also relate to espionage, and even outside the framework of legality ... it matters as well. It's a lot easier for the NSA to collect data on individuals if it's hosted in the US. I have absolutely no doubt that financial, legal and health records should simply not leave the local legal jurisdiction without consent and a few more things.

kspacewalk2 5y ago
Nothing in your comment invalidates these simple points: 1. If it's encrypted, it doesn't matter where it's stored. 2. If it's not encrypted, it can be easily stored in country X, processed in country X, but routed via SnoopHub in country Y. Country Y loves surveilling and is very happy about this state of affairs. >I have absolutely no doubt that financial, legal and health records should simply not leave the local legal jurisdiction without consent and a few more things. A very common attitude, usually held by people who "geographize" that which is not geographic in nature - the Internet.
- jollybean 5y ago
  1) Your assertion that 'the data would be encrypted' is false. There's no reason to believe that Visa/MC would simply use 'America' as a based to host dumb, encrypted data which enters and leaves the the US fully opaque. That would be pointless. Visa/MS are using services hosted in the US which will process customer data. 2) Statement #2 is also false. There is no arbitrary way for the US to snoop on data that doesn't flow through the US. For a whole variety of reasons - legal, operational, technical, political, cost etc.. Surely it can be done in a limited way, but at a level nowhere near the domestic capability. 3) Finally, you're statement on "geographizing" is also false. Data, encrypted or not - falls under legal jurisdiction of the 'nation / geography' it's in, and this has many significant consequences. It makes a corporation subject to local laws, regulations, liabilities etc.. The internet is very geographic in nature.