3 ms·
The basic Problem is that if some CCP goon turns up at your Chinese branch and requests all data on your US/EU users and your local branch is able to do that yo
by josefx 4y ago
The basic Problem is that if some CCP goon turns up at your Chinese branch and requests all data on your US/EU users and your local branch is able to do that you failed. Same if some goon from the US government wants to access all data on your EU users. Or some German guy looking for US data in your German data center.
You have to take steps to prevent this.
- coffeeblack 4y agoDifference is that your US and German branches have access to a justice system that can stop the government. In China, the justice system is part of the CCP and if you don’t comply, your company is gone.
- tirpen 4y ago> Difference is that your US and German branches have access to a justice system that can stop the government. Germany sure, but The US? Do you not remember the Snowden leaks at all? Almost every company I've worked with the past several years has had a very strict No-US-Servers-Ever-policy, because people don't trusts the US government to not snoop around.
- fmajid 4y agoIt should be “No US company, period” because the Cloud Act empowers the US government to compel, say Amazon Web Services to disclose information they hold on a server hosted in Germany even if this violates EU law.
- deleted 4y ago[deleted]
- techdragon 4y agoThe whole US / EU safe harbour provisions issue is because the EU is not satisfied that in the United States you don’t in fact have a justice system that can stop the government… that there are insufficient powers to stop certain parts of the government like the the NSA, CIA, DEA, FBI counter terrorism groups etc… who are granted extraordinary powers to do questionable shit like sucking up as much internet data as possible without a warrant in the name off “efficiency” using such flimsy reasoning as “it’s only a search for legal purposes when we run a database query on a US citizens data later” and “we’re legally allowed to do anything we like with the data of anyone who isn’t a US citizen… so these EU guys can fuck off” (or the appropriate US lawyer speak equivalent)
- fmajid 4y agoThe CJEU explicitly ruled that the FISA courts are not independent, I.e. kangaroo courts. I think it’s a fair assessment.
- voldacar 4y agohttps://en.wikipedia.org/wiki/National_security_letter https://en.wikipedia.org/wiki/National_security_letter
- orthecreedence 4y ago> have access to a justice system that can stop the government. Haha, good one.
- codedokode 4y ago> a justice system that can stop the government. There might be a law that allows government to obtain the data if it is a matter of national security. And what is considered such a matter is up to government to decide.
- null0pointer 4y agoMy interpretation of what GP is trying to say that the way forward is to intentionally limit your own capabilities such that it is simply impossible to comply with government overreach. For an example see Signal and their subpoenas.
- timenova 4y agoEncrypting data at rest and in transit will certainly reduce the risk. If a branch is deemed at risk, its employees would not be given access to any databases. Or don't have branches in regions where you have the risk of a government threatening your employees for other countries' users' data.
- ramtatatam 4y agoI am the believer of simple statement - if you don't control physical servers then your data is not secured, no matter what you do to secure it. Once vault is unlocked and you don't control physical hardware your game is over.