5 ms·

The CLOUD Act itself is the issue. Don't use MS Office 365 or any other US based service even if their servers are in Europe as they can not guarantee that your

• lnsp 5y ago
  You can control locality for some parts of Cloudflare's offering [1], so I guess if you want to comply with the privacy shield stuff, you would have to ensure that the data is stored on a server within a EU country. [1] https://blog.cloudflare.com/introducing-the-cloudflare-data-localization-suite/ https://blog.cloudflare.com/introducing-the-cloudflare-data-...
  • dismalpedigree 5y ago
    Doesn’t work that way. This issue is that CloudFlare is a US company and can be compelled to disclose information to US Govt regardless of where they hold the data.
    • throwawayvibes 5y ago
      I came here to say this. People should read at least the Wikipedia summary for CLOUD act. It's classic US legislation, 'we don't care about borders when it suits us' style.
      • kube-system 5y ago
        > It's classic US legislation, 'we don't care about borders when it suits us' style. GDPR is written the same way. i.e: https://gdpr.eu/article-3-requirements-of-handling-personal-data-of-subjects-in-the-union/ https://gdpr.eu/article-3-requirements-of-handling-personal-...
        • throwawayvibes 5y ago
          Yes, but while the US generally wants to have their dick up your arse, GDPR makes sure your butt is protected by law.
        • sofixa 5y ago
          It's not the same, because the GDPR only concerns itself with EU citizens ( based on which it claims jurisdiction). The US doesn't pretend to bother itself with such trivialities. The same way that US sanctions are applied by the US and everyone everywhere should follow them or risk fines and sanctions. No other country does this - when France sanctions Iran, only French citizens and companies are concerned.
          • kube-system 5y ago
            "These laws apply outside our borders because the data is about our citizens" "These laws apply outside our borders because the data is stored by our companies" ...are both examples of projection of power beyond borders, just with very slightly different rationale.
            • albertopv 5y ago
              You can see very clearly what's most important for each one: USA cares about money, EU about people. I don't consider it a very slightly different rationale. And it's the same abount health care, really two different ways of life.
• znpy 5y ago
  If one stops and thinks about this point of view, most of the services used globally are under US jurisdiction... Which is less than ideal.
  • frockington1 5y ago
    Can you think of a good alternative other than outlawing Microsoft 365? I want these services to be spread out however this particular idea would make the EU even more sluggish than it already is
    • znpy 5y ago
      > Can you think of a good alternative other than outlawing Microsoft 365? The US withrawing the CLOUD Act.
    • sjogress 5y ago
      Im not a legal scholar in any way, but perhaps a solution would be a fully independent Microsoft EU that licenses Microsoft US tech for deployment/use within Europe?
      • realityking 5y ago
        Microsoft used to do this together with Deutsche Telekom in Germany. They started phasing it out in 2018. https://mspoweruser.com/microsoft-is-discontinuing-the-german-data-trustee-model/ https://mspoweruser.com/microsoft-is-discontinuing-the-germa...
• frockington1 5y ago
  So the entire EU is going to be forced to use Open Office or some other equivalent? Non tech people will hate this and it will cripple many businesses that rely on Microsoft Excel. You'd be surprised how much of the world economy is based on emailing Excel sheets back and forth
  • denton-scratch 5y ago
    You are assuming that these businesses are using online versions of Excel (or whatever) that store the data under US jurisdiction. If they have committed to using online services that rely on US storage, then they have made a bad mistake - that is not allowed, and this case just reaffirms that.
  • JumpCrisscross 5y ago
    > You'd be surprised how much of the world economy is based on emailing Excel sheets back and forth How would Excel being run locally, with its work product being emailed back and forth, be impacted by this?
  • 2Gkashmiri 5y ago
    Why not now force the EU to heavily invest in libreoffice so that it becomes a drop replacement to excel? I'm sure the European union can spare some euros to make it possible and this isn't even a utopian dream that can't be achieved. It just needs a good push
    • spaniard89277 5y ago
      I'd rather have my money spent in allowing a fiscal and investment frame so we don't have to think of this top-down approach to everything everytime.
      • 2Gkashmiri 5y ago
        fiscal and investment frame means what exactly?
    • 5y ago
• whiteboardr 5y ago
  What are solid european alternatives?
  • deleted 5y ago
    [deleted]
  • schleck8 5y ago
    For servers, there is countless providers. Not nearly as big as the hyperscalers, but certainly sufficient. Netcup, xTom, Hetzner, OVH, Scaleway just off the top of my head
  • sschueller 5y ago
    Co-locate run your own hardware, Hetzner, Exoscale etc. There are many alternatives just not as large as Amazon. Many ISPs also offer DDoS protection.
  • ognarb 5y ago
    Nextcloud would be a solid European alternative for office365. It's a file sync, groupware, office and xhat solution all in one. It's open source, self hostable and has enterprise support. Disclaimer: I work at Nextcloud so I'm a bit biased
    • msh 5y ago
      Its not a managed service so its not a direct alternative.
      • catfishx 5y ago
        Yes it is, but you have to pay for it https://nextcloud.com/trial/ https://nextcloud.com/trial/
        • msh 5y ago
          It sounds pretty hostile to end users: Please do not email us from private mail addresses like gmail, gmx and the like. We only provide a trial to businesses > 50 employees. As a small business or private user, we recommend you simply try our demo or talk to one of our partners.
• p_l 5y ago
  Interestingly, Google afaik did some funky business with SAP where they swap jurisdiction around so that when faced with US request they can at some point say "send it to SAP AG and see if they care" - or so it seemed few years ago (source: notification of contract change wrt GCP)
  • AniseAbyss 5y ago
    Obviously if the EU actually grew some fucking balls and start to enforce the rules corporations would take steps to comply. But when was the last time a US CEO was dragged of a private jet?
• JumpCrisscross 5y ago
  Can’t this be solved by providing zero-knowledge encrypted services? Won’t work in all cases. But could work in some.
  • kenniskrag 5y ago
    maybe use something like goatcounter or selfhost the analytics.
  • amelius 5y ago
    How does the consumer know it is zero-knowledge?
    • JumpCrisscross 5y ago
      > How does the consumer know it is zero-knowledge? The courts, not consumers, are the ultimate deciders in this situation. Companies say so under oath and a judge weighs the evidence.
      • kiallmacinnes 5y ago
        That's not strictly true - or at least - it's missing a piece. When a company decides to use a product, it needs to ensure that product is legal to use in their jurisdiction(s). If it gets to a court, it's likely that the consumer/client is the claimant and the Company who chose to use US Product X is the defendant. The company who makes US Product X is likely nowhere to be seen.
        • JumpCrisscross 5y ago
          > When a company decides to use a product, it needs to ensure that product is legal to use in their jurisdiction(s) This is the proximal decider. They’re predicting the decision of the ultimate decider, which remains the courts. Providers would have to make the proximal deciders comfortable that the ultimate deciders will accept their compromise.
      • amelius 5y ago
• BjoernKW 5y ago
  The problem with EU legislation in that regard - or rather the current lack of pertinent agreements since the EU–US Privacy Shield has been declared invalid - is that it doesn't just apply to US-based services and US companies. Having a US subsidiary or even just a US-based supplier is enough for an entire company to theoretically be considered in violation of EU laws and GDPR in particular. This means that as a business, theoretically you'd have to vet every single customer and supplier regarding their involvement with US-based companies. Since realistically this would amount to most companies not being able to do any business at all anymore - and consequently the economy grinding to a halt - in most cases this doesn't have immediate repercussions. However, such unpredictability caused by regulations such as GDPR is a huge problem because you can't ever be sure you won't be issued a - potentially crippling - fine simply because some local authority considered this a good idea.
  • albertopv 5y ago
    The problem is USA jurisdiction outside of USA, I'm not a lawyer but how can this be legal under international laws? How is it possible that EU citizen data is under USA jurisdiction?
    • BjoernKW 5y ago
      International law simply is what countries agree upon, either bilaterally or multilaterally. Even if countries disagree and international law indeed favours one party, in most circumstances there's hardly any recourse if that party is the weaker one. Technically, the US can seize the assets of a US company that refuses to comply with these rules (or simply have their CEO arrested). That's what it comes down to: If a US company has a controlling stake in a subsidiary it's legally obligated to hand over any data that subsidiary controls. The EU on the other hand could escalate this further and prohibit American citizens and organizations from owning a majority stake in EU-based companies because that's what this boils down to on the other hand: Running or even just doing business with a company that's controlled by a US entity technically is illegal for EU businesses and citizens right now. This is not a pretty situation, but it's not one either where one side is clearly right and the other side is clearly wrong. In principle, I agree with the EU point of view. Privacy is a fundamental right that should be upheld. However, de facto outlawing most economic activity and then washing one's hands of any responsibility to provide a reasonable alternative is no solution at all, but makes the problem worse: Businesses might establish legal entities outside the EU, where they're not affected by this. Others might try to host and run everything themselves, which will result in much less secure data and infrastructure because most SMBs simply aren't able to provide the same security standards as Microsoft, Amazon or Google. It's on the EU und the US to provide a dependable legal framework for dealing with these types of situations. That's ultimately what entities like the EU are for, after all.