5 ms·

Why are then things like AWS, Azure, Google Cloud, … legal? Are they? I assume Amazon can access data stored in any of their servers, right?

darkwater 4y ago
> I assume Amazon can access data stored in any of their servers, right? If you encrypt the data with your own key, they should not be able to access it.
- fauigerzigerk 4y ago
  Only if you encrypt before upload and decrypt after download, which renders almost all AWS/Azure/GCP services completely useless.
  - darkwater 4y ago
    In-transit encryption protects you against this attack scenario specifically (if you own the keys obviously).
    - fauigerzigerk 4y ago
      How so? Amazon, Google and Microsoft need access to your unencrypted data in order to provide most of their services (such as databases, analytics, machine learning). There's not much they can do with encrypted data. They can store it. They can pass it through. That's it. This problem has to be solved on a political level. There is no technical fix and the legal workarounds appear to be exhausted.
      - darkwater 4y ago
        My RDS data is stored encrypted on disks with a private key AWS operators has no access to [1] (or at least that's what they tell you), and the application layer connection is controlled by a password transmitted over a TLS-only connection, whose private key - again - AWS has no access to. [1] https://aws.amazon.com/blogs/database/securing-data-in-amazon-rds-using-aws-kms-encryption/ https://aws.amazon.com/blogs/database/securing-data-in-amazo...
        fauigerzigerk 4y ago
        You're decrypting data on Amazon's hardware using software provided by Amazon. Of course they can access your unencrypted data if they have to. It comes down to the details of the legal obligation they have under U.S law. Are there limits to what they have to do to help U.S law enforcement, and what exactly are those limits?
        e98cuenc 4y ago
        The data in memory in that server is not encrypted. Amazon owning the server can log in it and read whatever part of the memory they want. I don't see how encrypting data at rest helps you in this scenario. If GDPR makes all the cloud services provided by American companies illegal, what alternatives European companies have? Services like OVH and Hetzner are great as a low cost but they don't provide the same services at all. How about Netsuite (Oracle), Netsuite, etc.? My guess is that ~100% of European companies use some kind of US service and there are no realistic alternatives, are they going to rule all companies are doing something illegal?
      - zelphirkalt 4y ago
        Would creating competing services within Europe, falling under EU law, count as political or technical solution?
        fauigerzigerk 4y ago
        Creating "competing"* services does not solve the problem of how Europeans can continue to use U.S. services if and when they (we) prefer to do so based on technical merit. I don't think it's a good idea to let the world (and the internet) fragment into ever smaller jurisdictions that can no longer find a way to trade with each other. We need a legal agreement to sort this out or everyone will be worse off. * They wouldn't actually have to compete at all if U.S services were banned.
- Rebelgecko 4y ago
  Wouldn't Amazon still have access to metadata, e.g. connection info, IP addresses, etc?
  - darkwater 4y ago
    Yes, that's absolutely right, and in fact about that I don't really know how the GDPR applies, and it's an interesting question to ask.
    - srrr 4y ago
      IP addresses (for connection setup) are personal data: https://ec.europa.eu/info/law/law-topic/data-protection/reform/what-personal-data_en https://ec.europa.eu/info/law/law-topic/data-protection/refo... You can process IP addresses without consent only if it is technically necessary: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679&from=EN#d1e1888-1-1 https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL... (paragraph b) But you always (!) need consent to transfer personal data to a non GDPR compliant entity: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679&from=EN#d1e2254-1-1 https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL... (paragraph f)
      - srrr 4y ago
        To add: The reason why US companies can't be GDPR complaint is because of Article 5 and the conflict with the Cloud Act: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL... (paragraph f) "(1) Personal data shall be: (f) processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’)." See also Schrems II: https://en.wikipedia.org/wiki/Max_Schrems#Schrems_II https://en.wikipedia.org/wiki/Max_Schrems#Schrems_II
        darkwater 4y ago
remus 4y ago
It depends how much credence you put in the standard contractual clauses (SCC) added by these companies after the privacy shield was ruled invalid by the EU. The idea with the SCC is that instead of all data transfers being covered by a single adequacy decision, each company adds SCCs to it's contracts with customers promising that data of EU citizens will be handled in a way that's compliant with GDPR. Reading this piece from CNIL, I can't see how a US company is going to be able to use SCCs to protect EU citizens from data access by the US government. Non US citizens typically don't have a lot of rights in the eyes of the US gov and they've traditionally been pretty happy to rifle through the data of those people at will. ed: the point by another commenter about using your own encryption key is a good one. However, the view of CNIL essentially seems to be that transferring any data to the US is risky so to me it feels like you'd be swimming against the tide.
martin_a 4y ago
They are probably not legal, either, yes.

darkwater 4y ago

> I assume Amazon can access data stored in any of their servers, right? If you encrypt the data with your own key, they should not be able to access it.

fauigerzigerk 4y ago
Only if you encrypt before upload and decrypt after download, which renders almost all AWS/Azure/GCP services completely useless.
- darkwater 4y ago
  In-transit encryption protects you against this attack scenario specifically (if you own the keys obviously).
  - fauigerzigerk 4y ago
    How so? Amazon, Google and Microsoft need access to your unencrypted data in order to provide most of their services (such as databases, analytics, machine learning). There's not much they can do with encrypted data. They can store it. They can pass it through. That's it. This problem has to be solved on a political level. There is no technical fix and the legal workarounds appear to be exhausted.
    - darkwater 4y ago
      My RDS data is stored encrypted on disks with a private key AWS operators has no access to [1] (or at least that's what they tell you), and the application layer connection is controlled by a password transmitted over a TLS-only connection, whose private key - again - AWS has no access to. [1] https://aws.amazon.com/blogs/database/securing-data-in-amazon-rds-using-aws-kms-encryption/ https://aws.amazon.com/blogs/database/securing-data-in-amazo...
      - fauigerzigerk 4y ago
        You're decrypting data on Amazon's hardware using software provided by Amazon. Of course they can access your unencrypted data if they have to. It comes down to the details of the legal obligation they have under U.S law. Are there limits to what they have to do to help U.S law enforcement, and what exactly are those limits?
      - e98cuenc 4y ago
        The data in memory in that server is not encrypted. Amazon owning the server can log in it and read whatever part of the memory they want. I don't see how encrypting data at rest helps you in this scenario. If GDPR makes all the cloud services provided by American companies illegal, what alternatives European companies have? Services like OVH and Hetzner are great as a low cost but they don't provide the same services at all. How about Netsuite (Oracle), Netsuite, etc.? My guess is that ~100% of European companies use some kind of US service and there are no realistic alternatives, are they going to rule all companies are doing something illegal?
    - zelphirkalt 4y ago
      Would creating competing services within Europe, falling under EU law, count as political or technical solution?
      - fauigerzigerk 4y ago
        Creating "competing"* services does not solve the problem of how Europeans can continue to use U.S. services if and when they (we) prefer to do so based on technical merit. I don't think it's a good idea to let the world (and the internet) fragment into ever smaller jurisdictions that can no longer find a way to trade with each other. We need a legal agreement to sort this out or everyone will be worse off. * They wouldn't actually have to compete at all if U.S services were banned.
Rebelgecko 4y ago
Wouldn't Amazon still have access to metadata, e.g. connection info, IP addresses, etc?
- darkwater 4y ago
  Yes, that's absolutely right, and in fact about that I don't really know how the GDPR applies, and it's an interesting question to ask.
  - srrr 4y ago
    IP addresses (for connection setup) are personal data: https://ec.europa.eu/info/law/law-topic/data-protection/reform/what-personal-data_en https://ec.europa.eu/info/law/law-topic/data-protection/refo... You can process IP addresses without consent only if it is technically necessary: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679&from=EN#d1e1888-1-1 https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL... (paragraph b) But you always (!) need consent to transfer personal data to a non GDPR compliant entity: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679&from=EN#d1e2254-1-1 https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL... (paragraph f)
    - srrr 4y ago
      To add: The reason why US companies can't be GDPR complaint is because of Article 5 and the conflict with the Cloud Act: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL... (paragraph f) "(1) Personal data shall be: (f) processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’)." See also Schrems II: https://en.wikipedia.org/wiki/Max_Schrems#Schrems_II https://en.wikipedia.org/wiki/Max_Schrems#Schrems_II
      - darkwater 4y ago

remus 4y ago

It depends how much credence you put in the standard contractual clauses (SCC) added by these companies after the privacy shield was ruled invalid by the EU. The idea with the SCC is that instead of all data transfers being covered by a single adequacy decision, each company adds SCCs to it's contracts with customers promising that data of EU citizens will be handled in a way that's compliant with GDPR. Reading this piece from CNIL, I can't see how a US company is going to be able to use SCCs to protect EU citizens from data access by the US government. Non US citizens typically don't have a lot of rights in the eyes of the US gov and they've traditionally been pretty happy to rifle through the data of those people at will. ed: the point by another commenter about using your own encryption key is a good one. However, the view of CNIL essentially seems to be that transferring any data to the US is risky so to me it feels like you'd be swimming against the tide.

martin_a 4y ago

They are probably not legal, either, yes.