5 ms·

EU based cloud services always could compete before. Now they will compete on the basis of being in the EU instead of being better.

by wbl 5y ago

DaiPlusPlus 5y ago
Nah, what happens is the US-based companies will just geo-wall the data and throw more money at their EU-based AWS and Azure regions.
- rini17 5y ago
  To me it reads as only walling the data off is insufficient. They will have to incorporate in Europe or in jurisdiction without FISA-like laws and completely split whole operation there.
  - 7steps2much 5y ago
    I believe that it would come down to this as well. The problem is both them being located in the US AND being a US company. Alternatively they could mirror an approach that Microsoft had with ther Office Online for a while, that is find a European company acting as "trustee" for the data, so that even if the NSA came knocking the US based company would not have any data on any of their infrastructure it could give them.
    - spaniard89277 5y ago
      But this is only viable for very large companies.
      - slig 5y ago
        One might think that all these extra regulations benefits only the giants and curbs any newcomers.
        Kbelicius 5y ago
        Only if one has no idea what these cases are about.
      - simion314 5y ago
        This means US government should pass laws to protect EU citizens data, if they feel generous they could apply it to every person regardless of his citizenship,
        Deukhoofd 5y ago
        Or far simpler, revoke section 702 of the Foreign Intelligence Surveillance Act. It's an absolutely insane law anyhow, basically "we can spy on any data of non-American users of American services, without any restrictions"
        yohannparis 5y ago
        I agree that section 702 is a bit extreme. But, at the heart of it, it makes sense. If foreigners can use services in your jurisdiction, you want to see what they do for security purposes. Nonetheless, it's against the belief of "innocent until proven guilty."
        danhor 5y ago
        This assumption leads to the conclusion that only services that reside in the same jurisdiction (EU, USA, ...) can be used if legal protection from the state is desired. If legal protection from the state is enforced (even for other states) this means there need to be wholly separate services in each jurisdiction. This seems very undesirable, especially for the US with it's multinational web companies.
        kazen44 5y ago
        > This assumption leads to the conclusion that only services that reside in the same jurisdiction (EU, USA, ...) can be used if legal protection from the state is desired. which is the correct conclusion? As the state can only offer legal protection under its own jurisdiction. Sure, real life complicates things a bit. (mainly, the jurisdiction of the EU as an institution in and of itself compared to its member states is a messy affair) but it is still a totally valid argument none the less.
    - perlgeek 5y ago
      I believe that Microsoft is already licensing Azure tech to big European companies to host GDPR-compliant, Azure-compliant regions in Europe. More expensive than regular Azure regions, but still in use for some purposes. Given that the big 3 cloud providers already have some trouble providing stable operations, I suspect it won't be the pinnacle of reliability, but have no first-hand experience with them.
      - DaiPlusPlus 5y ago
        I checked the Azure Pricing Calculator just now. Pricing for services in the EU GDPR "Sovereign" safe-zones (e.g. "Germany Central (Sovereign)") is largely the same as for services in other zones: Azure App Service in Germany Sovereign: $62/mo Azure App Service in West US: $54/mo 1TB Azure Storage in Germany Sovereign: $21.00 1TB Azure Storage in West US: $20.80/mo --------------- As for reliability, I haven't noticed any difference in availability and downtime between my Azure resources in any of the zones I've got services in. YMMV. Lately Azure's actually looking pretty good compared to AWS's spate of outages over the past 6 months.
  - perch56 5y ago
    Yep, you’re spot on with this. Even with a geo-wall AWS or Microsoft are still US based companies that have to comply with a FISA order. I work for a SaaS and we’re continuously questioned by our customers about this but we can’t do much as everything we have is architected around one particular US based cloud provider. We tried HYOK/BYOK/EU entity, so both security and legal controls which are insufficient today.
  - dustinmoris 5y ago
    It should be this way anyway. Currently they pay little to no tax on all their European income. They don't even collect VAT which to me is a mystery how they can get away with it, because AFAIK it's already a law they should have to follow.
- zoobab 5y ago
  "throw more money at their EU-based AWS and Azure regions." Impossible, the mother company is still american.
pimterry 5y ago
Interestingly, it's not actually about being in the EU specifically, it's just about being in a jurisdiction with equivalent data protections. It's not a "must be EU" cloud requirement, it's a "must not be USA" requirement. Canada, Brazil, Japan, India, and many other non-EU countries have GDPR-like data protection regulation that would be totally acceptable I think (IANAL). The core problem is USA specific - either the USA needs to implement serious data protection laws where they can't blanket surveil foreign user's data, or EU businesses will have to move elsewhere. I wouldn't be surprised if in future, similar local rulings appear in Canada/Brazil/Japan/Indian/the rest of the world for businesses based there too. It might be a difficult few years for US-based cloud providers.
- kazen44 5y ago
  and this is exactly what makes the EU a player in geopolitics. This kind of soft power even has a name, the brussels effect[0] 0: https://en.wikipedia.org/wiki/Brussels_effect https://en.wikipedia.org/wiki/Brussels_effect
- floatingatoll 5y ago
  Note that the US is absolutely capable of passing a data protection law at any time. I wouldn’t hold my breath, though.
- arlort 5y ago
  > that would be totally acceptable There needs to be an official adequacy decision, it's not automatic https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en https://ec.europa.eu/info/law/law-topic/data-protection/inte... Canada is indeed covered by one such decision
  - pimterry 5y ago
    Ah, good info, thanks! Looks like the full list of 'already approved as adequate' countries for data protection is: - Andorra - Argentina - Canada (commercial organisations) - Faroe Islands - Guernsey - Israel - Isle of Man - Japan - Jersey - New Zealand - Republic of Korea - Switzerland - the UK - Uruguay 2022 is a great year to be a cloud provider based in any of those.
wccrawford 5y ago
I somewhat agree, but it depends on how you define 'better'. Data privacy is better for the end user, and it wasn't something that was properly taken into account before, and users basically had no way to make any difference in the decision.
JoachimS 5y ago
Now they will compete _also_ on the basis of being in the EU. This adds an advantage. It doesn't mean they can be, and need to be competitive in other ways too. And there is not one, but several EU based services that compete with each other.
malermeister 5y ago
Have you considered that being in the EU, with higher data protection standards, makes them better?

EU based cloud services always could compete before. Now they will compete on the basis of being in the EU instead of being better.

by wbl 5y ago

EU based cloud services always could compete before. Now they will compete on the basis of being in the EU instead of being better.

DaiPlusPlus 5y ago

Nah, what happens is the US-based companies will just geo-wall the data and throw more money at their EU-based AWS and Azure regions.

rini17 5y ago
To me it reads as only walling the data off is insufficient. They will have to incorporate in Europe or in jurisdiction without FISA-like laws and completely split whole operation there.
- 7steps2much 5y ago
  I believe that it would come down to this as well. The problem is both them being located in the US AND being a US company. Alternatively they could mirror an approach that Microsoft had with ther Office Online for a while, that is find a European company acting as "trustee" for the data, so that even if the NSA came knocking the US based company would not have any data on any of their infrastructure it could give them.
  - spaniard89277 5y ago
    But this is only viable for very large companies.
    - slig 5y ago
      One might think that all these extra regulations benefits only the giants and curbs any newcomers.
      - Kbelicius 5y ago
        Only if one has no idea what these cases are about.
    - simion314 5y ago
      This means US government should pass laws to protect EU citizens data, if they feel generous they could apply it to every person regardless of his citizenship,
      - Deukhoofd 5y ago
        Or far simpler, revoke section 702 of the Foreign Intelligence Surveillance Act. It's an absolutely insane law anyhow, basically "we can spy on any data of non-American users of American services, without any restrictions"
        yohannparis 5y ago
        I agree that section 702 is a bit extreme. But, at the heart of it, it makes sense. If foreigners can use services in your jurisdiction, you want to see what they do for security purposes. Nonetheless, it's against the belief of "innocent until proven guilty."
        danhor 5y ago
        This assumption leads to the conclusion that only services that reside in the same jurisdiction (EU, USA, ...) can be used if legal protection from the state is desired. If legal protection from the state is enforced (even for other states) this means there need to be wholly separate services in each jurisdiction. This seems very undesirable, especially for the US with it's multinational web companies.
        kazen44 5y ago
        > This assumption leads to the conclusion that only services that reside in the same jurisdiction (EU, USA, ...) can be used if legal protection from the state is desired. which is the correct conclusion? As the state can only offer legal protection under its own jurisdiction. Sure, real life complicates things a bit. (mainly, the jurisdiction of the EU as an institution in and of itself compared to its member states is a messy affair) but it is still a totally valid argument none the less.
  - perlgeek 5y ago
    I believe that Microsoft is already licensing Azure tech to big European companies to host GDPR-compliant, Azure-compliant regions in Europe. More expensive than regular Azure regions, but still in use for some purposes. Given that the big 3 cloud providers already have some trouble providing stable operations, I suspect it won't be the pinnacle of reliability, but have no first-hand experience with them.
    - DaiPlusPlus 5y ago
      I checked the Azure Pricing Calculator just now. Pricing for services in the EU GDPR "Sovereign" safe-zones (e.g. "Germany Central (Sovereign)") is largely the same as for services in other zones: Azure App Service in Germany Sovereign: $62/mo Azure App Service in West US: $54/mo 1TB Azure Storage in Germany Sovereign: $21.00 1TB Azure Storage in West US: $20.80/mo --------------- As for reliability, I haven't noticed any difference in availability and downtime between my Azure resources in any of the zones I've got services in. YMMV. Lately Azure's actually looking pretty good compared to AWS's spate of outages over the past 6 months.
- perch56 5y ago
  Yep, you’re spot on with this. Even with a geo-wall AWS or Microsoft are still US based companies that have to comply with a FISA order. I work for a SaaS and we’re continuously questioned by our customers about this but we can’t do much as everything we have is architected around one particular US based cloud provider. We tried HYOK/BYOK/EU entity, so both security and legal controls which are insufficient today.
- dustinmoris 5y ago
  It should be this way anyway. Currently they pay little to no tax on all their European income. They don't even collect VAT which to me is a mystery how they can get away with it, because AFAIK it's already a law they should have to follow.
zoobab 5y ago
"throw more money at their EU-based AWS and Azure regions." Impossible, the mother company is still american.

pimterry 5y ago

Interestingly, it's not actually about being in the EU specifically, it's just about being in a jurisdiction with equivalent data protections. It's not a "must be EU" cloud requirement, it's a "must not be USA" requirement. Canada, Brazil, Japan, India, and many other non-EU countries have GDPR-like data protection regulation that would be totally acceptable I think (IANAL). The core problem is USA specific - either the USA needs to implement serious data protection laws where they can't blanket surveil foreign user's data, or EU businesses will have to move elsewhere. I wouldn't be surprised if in future, similar local rulings appear in Canada/Brazil/Japan/Indian/the rest of the world for businesses based there too. It might be a difficult few years for US-based cloud providers.

kazen44 5y ago
and this is exactly what makes the EU a player in geopolitics. This kind of soft power even has a name, the brussels effect[0] 0: https://en.wikipedia.org/wiki/Brussels_effect https://en.wikipedia.org/wiki/Brussels_effect
floatingatoll 5y ago
Note that the US is absolutely capable of passing a data protection law at any time. I wouldn’t hold my breath, though.
arlort 5y ago
> that would be totally acceptable There needs to be an official adequacy decision, it's not automatic https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en https://ec.europa.eu/info/law/law-topic/data-protection/inte... Canada is indeed covered by one such decision
- pimterry 5y ago
  Ah, good info, thanks! Looks like the full list of 'already approved as adequate' countries for data protection is: - Andorra - Argentina - Canada (commercial organisations) - Faroe Islands - Guernsey - Israel - Isle of Man - Japan - Jersey - New Zealand - Republic of Korea - Switzerland - the UK - Uruguay 2022 is a great year to be a cloud provider based in any of those.

wccrawford 5y ago

I somewhat agree, but it depends on how you define 'better'. Data privacy is better for the end user, and it wasn't something that was properly taken into account before, and users basically had no way to make any difference in the decision.

JoachimS 5y ago

Now they will compete _also_ on the basis of being in the EU. This adds an advantage. It doesn't mean they can be, and need to be competitive in other ways too. And there is not one, but several EU based services that compete with each other.

malermeister 5y ago

Have you considered that being in the EU, with higher data protection standards, makes them better?