4 ms·

Nah, what happens is the US-based companies will just geo-wall the data and throw more money at their EU-based AWS and Azure regions.

rini17 5y ago
To me it reads as only walling the data off is insufficient. They will have to incorporate in Europe or in jurisdiction without FISA-like laws and completely split whole operation there.
- 7steps2much 5y ago
  I believe that it would come down to this as well. The problem is both them being located in the US AND being a US company. Alternatively they could mirror an approach that Microsoft had with ther Office Online for a while, that is find a European company acting as "trustee" for the data, so that even if the NSA came knocking the US based company would not have any data on any of their infrastructure it could give them.
  - spaniard89277 5y ago
    But this is only viable for very large companies.
    - slig 5y ago
      One might think that all these extra regulations benefits only the giants and curbs any newcomers.
      - Kbelicius 5y ago
        Only if one has no idea what these cases are about.
    - simion314 5y ago
      This means US government should pass laws to protect EU citizens data, if they feel generous they could apply it to every person regardless of his citizenship,
      - Deukhoofd 5y ago
        Or far simpler, revoke section 702 of the Foreign Intelligence Surveillance Act. It's an absolutely insane law anyhow, basically "we can spy on any data of non-American users of American services, without any restrictions"
        yohannparis 5y ago
        I agree that section 702 is a bit extreme. But, at the heart of it, it makes sense. If foreigners can use services in your jurisdiction, you want to see what they do for security purposes. Nonetheless, it's against the belief of "innocent until proven guilty."
        danhor 5y ago
        This assumption leads to the conclusion that only services that reside in the same jurisdiction (EU, USA, ...) can be used if legal protection from the state is desired. If legal protection from the state is enforced (even for other states) this means there need to be wholly separate services in each jurisdiction. This seems very undesirable, especially for the US with it's multinational web companies.
        kazen44 5y ago
        > This assumption leads to the conclusion that only services that reside in the same jurisdiction (EU, USA, ...) can be used if legal protection from the state is desired. which is the correct conclusion? As the state can only offer legal protection under its own jurisdiction. Sure, real life complicates things a bit. (mainly, the jurisdiction of the EU as an institution in and of itself compared to its member states is a messy affair) but it is still a totally valid argument none the less.
  - perlgeek 5y ago
    I believe that Microsoft is already licensing Azure tech to big European companies to host GDPR-compliant, Azure-compliant regions in Europe. More expensive than regular Azure regions, but still in use for some purposes. Given that the big 3 cloud providers already have some trouble providing stable operations, I suspect it won't be the pinnacle of reliability, but have no first-hand experience with them.
    - DaiPlusPlus 5y ago
      I checked the Azure Pricing Calculator just now. Pricing for services in the EU GDPR "Sovereign" safe-zones (e.g. "Germany Central (Sovereign)") is largely the same as for services in other zones: Azure App Service in Germany Sovereign: $62/mo Azure App Service in West US: $54/mo 1TB Azure Storage in Germany Sovereign: $21.00 1TB Azure Storage in West US: $20.80/mo --------------- As for reliability, I haven't noticed any difference in availability and downtime between my Azure resources in any of the zones I've got services in. YMMV. Lately Azure's actually looking pretty good compared to AWS's spate of outages over the past 6 months.
- perch56 5y ago
  Yep, you’re spot on with this. Even with a geo-wall AWS or Microsoft are still US based companies that have to comply with a FISA order. I work for a SaaS and we’re continuously questioned by our customers about this but we can’t do much as everything we have is architected around one particular US based cloud provider. We tried HYOK/BYOK/EU entity, so both security and legal controls which are insufficient today.
- dustinmoris 5y ago
  It should be this way anyway. Currently they pay little to no tax on all their European income. They don't even collect VAT which to me is a mystery how they can get away with it, because AFAIK it's already a law they should have to follow.
zoobab 5y ago
"throw more money at their EU-based AWS and Azure regions." Impossible, the mother company is still american.

rini17 5y ago

To me it reads as only walling the data off is insufficient. They will have to incorporate in Europe or in jurisdiction without FISA-like laws and completely split whole operation there.

7steps2much 5y ago
I believe that it would come down to this as well. The problem is both them being located in the US AND being a US company. Alternatively they could mirror an approach that Microsoft had with ther Office Online for a while, that is find a European company acting as "trustee" for the data, so that even if the NSA came knocking the US based company would not have any data on any of their infrastructure it could give them.
- spaniard89277 5y ago
  But this is only viable for very large companies.
  - slig 5y ago
    One might think that all these extra regulations benefits only the giants and curbs any newcomers.
    - Kbelicius 5y ago
      Only if one has no idea what these cases are about.
  - simion314 5y ago
    This means US government should pass laws to protect EU citizens data, if they feel generous they could apply it to every person regardless of his citizenship,
    - Deukhoofd 5y ago
      Or far simpler, revoke section 702 of the Foreign Intelligence Surveillance Act. It's an absolutely insane law anyhow, basically "we can spy on any data of non-American users of American services, without any restrictions"
      - yohannparis 5y ago
        I agree that section 702 is a bit extreme. But, at the heart of it, it makes sense. If foreigners can use services in your jurisdiction, you want to see what they do for security purposes. Nonetheless, it's against the belief of "innocent until proven guilty."
        danhor 5y ago
        This assumption leads to the conclusion that only services that reside in the same jurisdiction (EU, USA, ...) can be used if legal protection from the state is desired. If legal protection from the state is enforced (even for other states) this means there need to be wholly separate services in each jurisdiction. This seems very undesirable, especially for the US with it's multinational web companies.
        kazen44 5y ago
        > This assumption leads to the conclusion that only services that reside in the same jurisdiction (EU, USA, ...) can be used if legal protection from the state is desired. which is the correct conclusion? As the state can only offer legal protection under its own jurisdiction. Sure, real life complicates things a bit. (mainly, the jurisdiction of the EU as an institution in and of itself compared to its member states is a messy affair) but it is still a totally valid argument none the less.
- perlgeek 5y ago
  I believe that Microsoft is already licensing Azure tech to big European companies to host GDPR-compliant, Azure-compliant regions in Europe. More expensive than regular Azure regions, but still in use for some purposes. Given that the big 3 cloud providers already have some trouble providing stable operations, I suspect it won't be the pinnacle of reliability, but have no first-hand experience with them.
  - DaiPlusPlus 5y ago
    I checked the Azure Pricing Calculator just now. Pricing for services in the EU GDPR "Sovereign" safe-zones (e.g. "Germany Central (Sovereign)") is largely the same as for services in other zones: Azure App Service in Germany Sovereign: $62/mo Azure App Service in West US: $54/mo 1TB Azure Storage in Germany Sovereign: $21.00 1TB Azure Storage in West US: $20.80/mo --------------- As for reliability, I haven't noticed any difference in availability and downtime between my Azure resources in any of the zones I've got services in. YMMV. Lately Azure's actually looking pretty good compared to AWS's spate of outages over the past 6 months.
perch56 5y ago
Yep, you’re spot on with this. Even with a geo-wall AWS or Microsoft are still US based companies that have to comply with a FISA order. I work for a SaaS and we’re continuously questioned by our customers about this but we can’t do much as everything we have is architected around one particular US based cloud provider. We tried HYOK/BYOK/EU entity, so both security and legal controls which are insufficient today.
dustinmoris 5y ago
It should be this way anyway. Currently they pay little to no tax on all their European income. They don't even collect VAT which to me is a mystery how they can get away with it, because AFAIK it's already a law they should have to follow.

zoobab 5y ago

"throw more money at their EU-based AWS and Azure regions." Impossible, the mother company is still american.