4 ms·

I'm assuming this applies globally?

mjfl 2y ago
absolutely.
michaelt 2y ago
As I understand things, US law lets US spy agencies get secret warrants, requiring Google and AWS to give them access to everything while keeping the existence of such access secret. EU law, meanwhile, prohibits such access, under the GDPR. There is an obvious conflict here, when a US cloud provider operates an EU data centre. Luckily, cloud providers have never received a secret warrant they can't reveal the existence of wink and spy agencies would never operate outside the law wink so the apparent conflict has never arisen in reality wink
- deleted 2y ago
  [deleted]
- Nullinker 2y ago
  Yes, all data stored in data centers administered by US companies like Apple/Google/Amazon/Microsoft should be considered available to the US Government and US competitors. There are known examples of the US government doing industrial espionage for US businesses in the past. This is an extremely uncomfortable truth that European businesses really don't want to acknowledge and just keep pretending it's not true, not a big deal, and even if it was there is nothing they can do about it. Instead they focus on complying with endless security check lists with unlikely scenarios while ignoring the elephant in the room.
  - dotancohen 2y ago
    > There are known examples of the US government doing industrial espionage for US businesses in the past. If you have a glaring example of this, I'd love to know.
    - dijit 2y ago
      how glaring? https://www.reuters.com/world/europe/us-security-agency-spied-merkel-other-top-european-officials-through-danish-2021-05-30/ https://www.reuters.com/world/europe/us-security-agency-spie...
      - 3np 2y ago
        That doesn't sound like industrial espionage? (I'd also love to know)
    - defrost 2y ago
      It was taken as a given at one time: With the Cold War ended, officials of the CIA and other U.S. intelligence agencies have acknowledged that they are redirecting efforts away from traditional spying toward gathering information aimed at ensuring that the United States remains economically and technologically competitive. ~ https://web.archive.org/web/20151016000311/http://www.nytimes.com/1991/09/14/news/14iht-spy_.html?pagewanted=1 https://web.archive.org/web/20151016000311/http://www.nytime... China claimed evidence of eleven years of CIA economic espionage: https://thenextweb.com/news/cia-china-hack-agency-government https://thenextweb.com/news/cia-china-hack-agency-government and Operation Eikonal hoovered up more than it should have: After the revelations made by whistleblower Edward Snowden the BND decided to investigate the issue; their October 2013 conclusion was that at least 2,000 of these selectors were aimed at Western European or even German interests https://en.wikipedia.org/wiki/Operation_Eikonal https://en.wikipedia.org/wiki/Operation_Eikonal
      - fragmede 2y ago
        That's less direct than "ECHELON was used for industrial espionage", which is the specific question being asked. Everyone should be aware of Five (and 18) Eyes, but the TLAs having personal information about individuals is different from them passing Boeing data from Siemen's private business documents.
    - detourdog 2y ago
      Today companies like FedEx can sell their truck videos to authorities. https://www.youtube.com/watch?v=bIUQApnhENU https://www.youtube.com/watch?v=bIUQApnhENU I think that so much data is currently shared with third parties that warrants are obsolete. One can build a data heavy case long before needing a court issued warrant.
  - blueflow 2y ago
    > This is an extremely uncomfortable truth that European businesses really don't want to acknowledge and just keep pretending it's not true, not a big deal, and even if it was there is nothing they can do about it. Doesn't seem true. We have to use local hosting. Hetzner, OVH or a local DC are popular options. Using US services for sensitive data is just not legal.
    - account42 2y ago
      Good for your company. Others are fully embracing Microsoft and Google hosted tools.
- mdhb 2y ago
  Secret warrants only in the context of counterintelligence and counterespionage investigations that target foreigners. Which in that particular context I don’t know what else would possibly be considered a reasonable alternative. The vast majority of countries don’t have to go in front of a court at all to do this exact same thing they just go ahead and do it. I know people here tend to get super pissed about the boogeyman that is FISA but if you had a more transparent example to point to I would love to see it. I think people get really caught up on the fact that they personally don’t have access to that information and then make a large magical leap to all kinds of conclusions that aren’t based in reality at all. If that system was being abused to go after illegitimate targets for example then sure, that’s something to be pissed about but I don’t think we have any compelling evidence of that at this stage. I just find the entire public debate on this topic incredibly lacking in nuance but never lacking in conviction.
  - michaelt 2y ago
    > Secret warrants only in the context of counterintelligence and counterespionage investigations that target foreigners That sounds like a limited context - but the courts were happy to give spy agencies a warrant covering records of every phone call made in America [1] So it turns out the warrants don't have to describe the place or person to be searched, and don't have to be limited to foreigners. And that wasn't a one-off error or individual mistaken judge - it was reauthorized 34 times under 14 different judges. Granted some of the rules were changed after that specific surveillance was revealed - but the "fixes" ignored the fundamental problem that secret courts aren't effective at preventing spy agency overreach. [1] https://www.csis.org/analysis/fact-sheet-section-215-usa-patriot-act https://www.csis.org/analysis/fact-sheet-section-215-usa-pat...
- PoignardAzur 2y ago
  > Luckily, cloud providers have never received a secret warrant they can't reveal the existence of wink and spy agencies would never operate outside the law wink so the apparent conflict has never arisen in reality wink European states are fully aware of that problem, hence why eg companies storing medical data must do so with servers located in Europe and owned by European companies. There's the question of whether it's safe to use servers provided by a european subsidiary of an american company and if the company would bypass their european employees or order them to break the law, but it's not a question that stakeholders are pretending doesn't exist.
  - lupire 2y ago
    Medical data is a small portion of data.
- sebiol 2y ago
  This conflict has been the topic of AFAIK two cases. Known as Schrems I and Schrems 2 [0] The first questioned Safe Harbour and the second the Privacy Shield mechanism. I think the current iteration is called "Data Privacy Framework". I assume that this will also be deemed invalid in the future. [0] https://en.wikipedia.org/wiki/Max_Schrems https://en.wikipedia.org/wiki/Max_Schrems
- Dracophoenix 2y ago
  > There is an obvious conflict here, when a US cloud provider operates an EU data centre. American agencies don't need a secret warrant. The CLOUD ACT already resolved this particular predicament for the government just as Microsoft appealed its 2018 case to the Supreme Court.

mjfl 2y ago

absolutely.

As I understand things, US law lets US spy agencies get secret warrants, requiring Google and AWS to give them access to everything while keeping the existence of such access secret. EU law, meanwhile, prohibits such access, under the GDPR. There is an obvious conflict here, when a US cloud provider operates an EU data centre. Luckily, cloud providers have never received a secret warrant they can't reveal the existence of wink and spy agencies would never operate outside the law wink so the apparent conflict has never arisen in reality wink

deleted 2y ago
[deleted]
Nullinker 2y ago
Yes, all data stored in data centers administered by US companies like Apple/Google/Amazon/Microsoft should be considered available to the US Government and US competitors. There are known examples of the US government doing industrial espionage for US businesses in the past. This is an extremely uncomfortable truth that European businesses really don't want to acknowledge and just keep pretending it's not true, not a big deal, and even if it was there is nothing they can do about it. Instead they focus on complying with endless security check lists with unlikely scenarios while ignoring the elephant in the room.
- dotancohen 2y ago
  > There are known examples of the US government doing industrial espionage for US businesses in the past. If you have a glaring example of this, I'd love to know.
  - dijit 2y ago
    how glaring? https://www.reuters.com/world/europe/us-security-agency-spied-merkel-other-top-european-officials-through-danish-2021-05-30/ https://www.reuters.com/world/europe/us-security-agency-spie...
    - 3np 2y ago
      That doesn't sound like industrial espionage? (I'd also love to know)
  - defrost 2y ago
    It was taken as a given at one time: With the Cold War ended, officials of the CIA and other U.S. intelligence agencies have acknowledged that they are redirecting efforts away from traditional spying toward gathering information aimed at ensuring that the United States remains economically and technologically competitive. ~ https://web.archive.org/web/20151016000311/http://www.nytimes.com/1991/09/14/news/14iht-spy_.html?pagewanted=1 https://web.archive.org/web/20151016000311/http://www.nytime... China claimed evidence of eleven years of CIA economic espionage: https://thenextweb.com/news/cia-china-hack-agency-government https://thenextweb.com/news/cia-china-hack-agency-government and Operation Eikonal hoovered up more than it should have: After the revelations made by whistleblower Edward Snowden the BND decided to investigate the issue; their October 2013 conclusion was that at least 2,000 of these selectors were aimed at Western European or even German interests https://en.wikipedia.org/wiki/Operation_Eikonal https://en.wikipedia.org/wiki/Operation_Eikonal
    - fragmede 2y ago
      That's less direct than "ECHELON was used for industrial espionage", which is the specific question being asked. Everyone should be aware of Five (and 18) Eyes, but the TLAs having personal information about individuals is different from them passing Boeing data from Siemen's private business documents.
  - detourdog 2y ago
    Today companies like FedEx can sell their truck videos to authorities. https://www.youtube.com/watch?v=bIUQApnhENU https://www.youtube.com/watch?v=bIUQApnhENU I think that so much data is currently shared with third parties that warrants are obsolete. One can build a data heavy case long before needing a court issued warrant.
- blueflow 2y ago
  > This is an extremely uncomfortable truth that European businesses really don't want to acknowledge and just keep pretending it's not true, not a big deal, and even if it was there is nothing they can do about it. Doesn't seem true. We have to use local hosting. Hetzner, OVH or a local DC are popular options. Using US services for sensitive data is just not legal.
  - account42 2y ago
    Good for your company. Others are fully embracing Microsoft and Google hosted tools.
mdhb 2y ago
Secret warrants only in the context of counterintelligence and counterespionage investigations that target foreigners. Which in that particular context I don’t know what else would possibly be considered a reasonable alternative. The vast majority of countries don’t have to go in front of a court at all to do this exact same thing they just go ahead and do it. I know people here tend to get super pissed about the boogeyman that is FISA but if you had a more transparent example to point to I would love to see it. I think people get really caught up on the fact that they personally don’t have access to that information and then make a large magical leap to all kinds of conclusions that aren’t based in reality at all. If that system was being abused to go after illegitimate targets for example then sure, that’s something to be pissed about but I don’t think we have any compelling evidence of that at this stage. I just find the entire public debate on this topic incredibly lacking in nuance but never lacking in conviction.
- michaelt 2y ago
  > Secret warrants only in the context of counterintelligence and counterespionage investigations that target foreigners That sounds like a limited context - but the courts were happy to give spy agencies a warrant covering records of every phone call made in America [1] So it turns out the warrants don't have to describe the place or person to be searched, and don't have to be limited to foreigners. And that wasn't a one-off error or individual mistaken judge - it was reauthorized 34 times under 14 different judges. Granted some of the rules were changed after that specific surveillance was revealed - but the "fixes" ignored the fundamental problem that secret courts aren't effective at preventing spy agency overreach. [1] https://www.csis.org/analysis/fact-sheet-section-215-usa-patriot-act https://www.csis.org/analysis/fact-sheet-section-215-usa-pat...
PoignardAzur 2y ago
> Luckily, cloud providers have never received a secret warrant they can't reveal the existence of wink and spy agencies would never operate outside the law wink so the apparent conflict has never arisen in reality wink European states are fully aware of that problem, hence why eg companies storing medical data must do so with servers located in Europe and owned by European companies. There's the question of whether it's safe to use servers provided by a european subsidiary of an american company and if the company would bypass their european employees or order them to break the law, but it's not a question that stakeholders are pretending doesn't exist.
- lupire 2y ago
  Medical data is a small portion of data.
sebiol 2y ago
This conflict has been the topic of AFAIK two cases. Known as Schrems I and Schrems 2 [0] The first questioned Safe Harbour and the second the Privacy Shield mechanism. I think the current iteration is called "Data Privacy Framework". I assume that this will also be deemed invalid in the future. [0] https://en.wikipedia.org/wiki/Max_Schrems https://en.wikipedia.org/wiki/Max_Schrems
Dracophoenix 2y ago
> There is an obvious conflict here, when a US cloud provider operates an EU data centre. American agencies don't need a secret warrant. The CLOUD ACT already resolved this particular predicament for the government just as Microsoft appealed its 2018 case to the Supreme Court.