5 ms·
US Cloud soon illegal in EU? US punches first hole in EU-US Data Deal
- amarcheschi 2y agoGod I hope so
- NomDePlum 2y agoInteresting read. I wasn't aware there was a formal process that allowed the US to snoop on EU data in cloud providers. Very big brother.
- mrtksn 2y agoWhat if EU gives a year to American cloud providers to sell their companies to a European owner? It's important to learn from the best. Considering the election meddling efforts from agents directly from within the US government who are also owner of large media and AI companies the only reasonable outcome would be either sell those companies to EU owners or guarantee exclusion from EU markets for national security reasons.
- belter 2y agoMaybe AWS knew this. In China they already operate under a different company. "AWS plans to invest €7.8 billion into the AWS European Sovereign Cloud " - https://www.aboutamazon.eu/news/aws/aws-plans-to-invest-7-8-billion-into-the-aws-european-sovereign-cloud https://www.aboutamazon.eu/news/aws/aws-plans-to-invest-7-8-... "...The AWS European Sovereign Cloud will provide customers the capability to meet stringent operational autonomy and data residency requirements within the European Union (EU), with infrastructure wholly located within the EU and operated independently from existing Regions. The AWS European Sovereign Cloud will allow customers to keep all customer data and the metadata they create (such as the roles, permissions, resource labels, and configurations they use to run AWS) in the EU..."
- d1sxeyes 2y agoYeah, they'll all just set up new opcos in the EU to carry on doing business, rather than actually selling up.
- WJW 2y agoThe goal of such regulation would be to reduce the amount of influence US tech billionaires can exert over the EU. Any regulation would be written with that in mind, so an opco which would still be controlled from the US is not in line with that goal. At the very least, regulation could enforce that any opcos (more joint ventures at that point) would be at least 51% owned and operated by EU entities.
- mrtksn 2y agoEU tried hard to guarantee open markets through rules based security but this is now out of fashion. Instead, the new game is to close your markets to foreigners and say its for national security reasons. This might be bad for the citizens as it is limiting and breaking the global humanity ideal and I hate it that this is happening but EU must be really stupid to have the only open market then get ridiculed for not having "global" tech companies. As it appears, the world going forward would be like the Chinese "tech" will be for 1.4B people, the US "tech" will be to 330M people and the EU "tech" will be for 450M people. At this time, because you can access the EU market form US you can just form your business in US and hire people from EU to do the work. If EU imposes limits, suddenly it makes sense to invest in EU. If you think about it, EU+UK+Asia taxpayers educate most of the "US talent". Very few of the people who invented the tech are US educated, the US educated ones tend to be the money guy or the entrepreneur free riding on foreign tax money. Time to end the EU subsidies to US companies or maybe impose tariffs to make up for it. US is being very bad for EU, doing very nasty stuff.
- Maken 2y agoDo not forget the Indian "tech" for another 1.4B people. They are also placing restrictions on how Indian's data is handled on the cloud.
- jkaplowitz 2y agoI get your comparison to the TikTok ban, but not even noyb is questioning the legality of transfers outside the EU to countries in general, whether pursuant to an European Commission adequacy decision or pursuant to Standard Contractual Clauses. The problem is specifically that US law and policy will make both of those options unviable to guarantee the rights GDPR requires with respect to transfers to the US, once noyb gets the EU courts to state this clearly enough and invalidate the Commission’s adequacy decision for businesses which participate in the EU-US Data Privacy Framework. (In the meantime, EU companies are allowed to rely on that decision.) There are several non-EU countries with adequacy decisions whose validity nobody is questioning, including Canada, New Zealand, and the UK. Many more countries can adequately be handled through Standard Contractual Clauses. The problem is very US-specific.
- mrtksn 2y agoI mean look, the details may vary but the core holds. The businesspeople running EUs communications are directly involved with the openly hostile US government and directly try to influence politics and create rage with the European public. The current open markets model is not working, time to copy from the success stories: Ban foreign ones or force them to become local. The current politicians are still in denial but as things deteriorate things will have to happen. Unlike US, European politics are not just two parties having about the same support. Things can get very spicy very quickly. You think the anti-establishment ones are pro-American? The most pro-American politicians are those in power or those who recently lost power to the anti-establishment. Pretty much non of the anti-establishent are pro-American(with the exception of UK with Farage) and with Musk targeting Farage I'm sure they took a note on how transactional their relationship with the US anti-establishment is.
- TeMPOraL 2y agoWhichever factions and sentiments gain power in the EU, there's only so much they can do before hitting the major factor that's usually not spelled out explicitly in polite company, but generally understood: the US has nukes and aircraft carriers. We don't - or at least not enough to replace US in the role it plays in Europe's security. I hope they won't be crazy enough to just bludgeon through that anyway, as past that, hic sunt dracones.
- progbits 2y agoGoogle could do this easily, there are whitelabel GCP offerings run by EU companies already: https://cloud.google.com/t-systems-sovereign-cloud?hl=en https://cloud.google.com/t-systems-sovereign-cloud?hl=en Hardware, personnel and all access is EU company. Google can provide updates they have to manually review and install, and provides support. It's pretty niche now but if demand grows more providers will spin up the same thing.
- mrtksn 2y agoThat will probably work as long as it yields the desired results. It would be fine if ends up like this: https://a.dropoverapp.com/cloud/download/b053fcd7-4635-4508-8935-4aac272f0892/5d458422-3eea-472b-b010-b773f2ad3b4a https://a.dropoverapp.com/cloud/download/b053fcd7-4635-4508-...
- wink 2y agoThe common opinion though is that if T-Systems runs it then no way of external knowledge will fix anything.
- pandemic_region 2y ago> What if EU gives a year to American cloud providers to sell their companies to a European owner? Well "liberty" will appear on our doorstep rather quickly, to free those clouds from the oppressive EU regime of course.
- belorn 2y agoThe trend in EU is to tighten up regulation to the point where the achieved goals occurs fairly slow and steady. The goals are also not about ownership (there is no country called Europe, so what would it even mean?), but rather that the data and control remain within the jurisdiction of EU law and then ratified by each country. The results so far has been that most large companies has local legal presence within Europe, EU data centers, EU specific contracts with customers, and recently EU specific features in applications. It basically salami-tactics. Part of this strategy is also to use the court system to enforce specific aspects, like how part of GDPR is just now getting enforced after a case in March in 2024 by EDPS. The case initiated in 2021, GDPR was written 2016, so it also illustrate the pace. In the time between 2016 and now there are multiple new regulations, and those will also take time before they are fully enforced.
- mrtksn 2y agoI don't know about the hidden intentions but it appears that its time to switch the cutting style from salami to ribeye or arms and legs. >here is no country called Europe, so what would it even mean? Soon there will be, they are creating the 28th regime which is essentially a virtual country with a jurisdiction designed for speedy bureaucracy. I hope they do a good job with the implementation of the idea.
- Sander_Marechal 2y ago> but rather that the data and control remain within the jurisdiction of EU law The fundamental problem is that EU and US law are incompatible. FISA allows the US to access any data from any US company no matter where it is located. It doesn't matter that the data is located in the EU, on a European server, manager by the European division of a company. As long as there exists a US parent company, FISA can compel the data. And that is fundamentally against the GDPR.
- epilogue 2y agoIt seems like Oracle Cloud have tried to do something along these lines, with their "EU Sovereign Cloud". I'm not actually sure if it's open to everyone or by application only tho. https://www.oracle.com/uk/cloud/eu-sovereign-cloud/ https://www.oracle.com/uk/cloud/eu-sovereign-cloud/
- ChemSpider 2y agoIn my main job we provide SaaS services. We get more and more requests for "EU located" services. A new trend I see is that some customers even rule out using EU located servers that are owned/run by US companies (such as the AWS Dublin or Franfurt locations).
- croes 2y agoOf course they do. Because of the CloudAct the location of the server doesn’t matter. A US company has to give access to the data on their servers to the authorities no matter where the servers are located. They can go to court to prevent it but aren’t allowed to inform their customer. That violates EU law on multiple levels.
- dathinab 2y agoAlso EU daughter companies of US tech giants are still legally EU companies (owned by US companies) legally they have to strictly comply with EU law and it matters shit what US law says (from the EU legislative POV) so this puts them into a huge problem spot.
- croes 2y agoIt’s a problem without solution. That have to break one side’s law.
- foepys 2y agoDidn't Microsoft argue this in a US court and lost?
- tzs 2y agoAn EU company, even if it is owned by a US company, would not be subject to the Cloud Act and so should not find itself on the spot. The Cloud Act applies to whoever owns the data on the server, not to whoever owns the server. Here's the situation it was designed to deal with. You've got a US company that has some documents. Law enforcement gets a subpoena requiring the company to turn over copies of those documents. If the company has used some third party cloud storage provider to store those documents it has to retrieve them. It does this using the exact same procedure it would use if it was retrieving the documents for its own use. To the cloud storage provider this is just a routine data retrieval of a customer's data by the customer. As far as I know if someone outside the EU buys cloud storage from an EU cloud storage provider, stores some files there, and later retrieves those files the EU provider will not get in trouble if that customer later did something with the files that would not be legal in the EU. I'd be surprised if most countries don't have something equivalent. For example when German prosecutors were investigating VW after VW's emissions test cheating came to light if they had used whatever the German equivalent of a subpoena is to ask for copies of the emission system source code, would VW have been able to say "Sorry, we've got those in a private Github repository which happens to be hosted outside of the EU, so we can't get them for you"? I suspect that the only reason the US actually had to have something like the Cloud Act and others don't is because only in the US could you have actually had a chance to succeed in saying that you cannot be compelled to turn over a document that you control and can legally retrieve at any time just because you happen to have it currently stored somewhere that the compelling government does not have jurisdiction over.
- juliangmp 2y ago> Thousands of EU businesses, government agencies or schools rely on these provisions. Without the TADPF, they would need to stop using US cloud providers like Apple, Google, Microsoft or Amazon instantly. Please God let this happen
- harha 2y agoThis would be incredibly funny to follow. Fax machines and mainframes would make an impressive return, as Europe moves even more towards a more relaxed pace.
- IrezaH 2y agoThe EU economies were better in the early 1990s, before all this unnecessary Windows, cloud nonsense, social networks etc. invaded. The US exports hot air and gets real goods in return.
- egorfine 2y agoYeah, I too had better personal life back in the day when MS-DOS was the main operating system for the common people and offices.
- wfwHa 2y ago[flagged]
- anonzzzies 2y agoThere was at least a lot more sex with ms-dos as your partner wouldn't be very importantly commenting 5 depressed bananas to some shite post about nothing while you try to get them all fired up.
- pjmlp 2y agoNah, we would get fine with SuSE Linux and Jolla.
- Gravityloss 2y agoOne thing is a bit unclear here. US headquartered cloud providers have physical data centers in EU. Would this also prevent EU businesses from using those?
- croes 2y agoThat was their trick to circumvent the Patriot Act. But then came the CloudAct and the location doesn’t matter anymore. You do business in the US, you have to provide the data.
- belter 2y agoIf you use AWS in Europe your invoice is from Amazon Luxembourg...
- preisschild 2y agoThe Parent company is still the US based Amazon though, which can direct Amazon Luxembourg and falls under US laws.
- belter 2y agoYes. What I mean is that they could sell it to somebody else, as it is already a separate corporate entity.
- Juliate 2y agoIt's not the physical location of data that matters, it's the authority and control over the infrastructure and the data it holds. In other words, if a US authority has any say on what's running/hosted in data centers in EU, it's a no go for more and more businesses and administrations.
- rustc 2y agoAnd what about EU headquartered cloud providers that have servers in the US like Hetzner?
- 2y ago
- throwue 2y ago[flagged]
- crimsoneer 2y agoAh, the measured response of bullies everywhere.
- batushka5 2y agoTrump administration uses ALL levers to achieve goals, so if EU will push too hard against US companies... Canada, Denmark, Mexico examples show - a deal will me made.
- raverbashing 2y agoBut it's ok, you just tell trunip what you are doing anyway and package it as a "new deal" and he'll buy it and call it his victory It's what Canada just did
- batushka5 2y agoCase there was to force do it actually, instead of just declaring. So people claim there was no deal, which is true, but esence is the doing part.
- belter 2y agoWow, Anonymous. Such stealth. Or should I just call you Elon?
- croes 2y agoPissing of all your allies at the same time won’t end well for the US in the long run.
- surgical_fire 2y agoIn your poorly written and thought out message, "it" can mean either the EU or America. One of those is not antagonizing everyone else.
- 2y ago
- fergie 2y agoIt already is in practice. You can't legally use cloud services for "red" (personal information) or "black" (national security) data in most jurisdictions. Some organizations that are deeply invested in a given tech provider do it anyway, but this is gradually going away.
- belter 2y agoBut then they use Microsoft Office....
- seper8 2y agoAbsolutely false for most European countries. Most of them are on at least some version of Office365 and many on Azure as well.
- blueflow 2y agoTrue for Germany but their color scheme is different.
- sam_lowry_ 2y agoIt's complicated. Belgium has its own government cloud but its office infrastructure is on M365. The Netherlands have nothing of their own. EU institutions are migrating full-speed on AWS and M365.
- askonomm 2y agoI was pretty sure that Azure in Europe is using EU data centers or something of the like for its users data, is that not the case?
- rustc 2y agoWhat cloud services are there that operate exclusively in the EU? Hetzner has servers in US now so I guess they also won't be an alternative?
- Slartie 2y agoHetzner is not US-headquartered, so I'd say it should not be possible for the US government to make Hetzner turn out data from its EU locations. They will most certainly be able to make the US subsidiary of Hetzner turn out any kind of data it technically has access to. But if Hetzner is not entirely stupid (and they are usually pretty smart) they set up their internal networks such that the US admins cannot access data located in the EU. The problem with EU subsidiaries of Amazon and Microsoft is that the principal corporation is located in the US and subject to US jurisdiction, and that eventually, the owning company is always able to make a subsidiary comply with its demands, so it's virtually impossible to set up an impenetrable barrier between them. It's the other way round with Hetzner. A subsidiary can't command the owning company around, not even if the US government wants it to.
- mariusor 2y agoThe multinational behind Lidl has launched a couple of years ago StackIt: https://en.wikipedia.org/wiki/Schwarz_Group#Schwarz_Digits https://en.wikipedia.org/wiki/Schwarz_Group#Schwarz_Digits.
- xeonmc 2y agoWould Cloudflare fall under this category?
- atwrk 2y agoAs a US company, Cloudflare already has to follow CLOUD Act etc. right now, so yes.
- dathinab 2y agoHonestly most non lobbyist people here in the EU has been expecting this to fall apart sooner or later, even without Trump. Some companies have gone further and not only are assuming data transfer to the EU will become illegal but also that European daughter companies (e.g. MS) might become illegal for some use-cases (e.g. lawyer documents).
- tomtomistaken 2y agoEU should make a own cloud storage (hosted in the EU) giving every citizen 10GB of base storage after applying for it. Cloud is critical infrastructure. Besides, that would lift also the favorability of the EU.
- paganel 2y agoWhy in God's name would I share my personal data with the authorities here in the EU?
- Euphorbium 2y agoRather share it with the authorities in China and the US?
- cudgy 2y agoIs it not more secure or at least less risky to share with foreign country that has no recourse?
- michaelt 2y agoWhen I save things to Google Drive, my data could legally be snooped on in three ways: 1. My national government, by court order or sketchy secret court order. 2. Google, who are in the business of tracking and profiling. 3. The US government, by court order or sketchy secret court order. A person might hope cloud storage provided by a national government would reduce the snooping by two thirds. Of course, that analysis ignores risks like the service getting hacked, my account getting hacked, and suchlike - which some would say are much bigger risks.
- deadlydose 2y agoYou really should be encrypting things before uploading to a cloud provider.
- suraci 2y agoeu is the digital colony of the US, it has no other choice politicians like von der Leyen will make sure it's not gonna happen.
- seper8 2y agoThis is economical suicide for most European companies.
- Juliate 2y agoIt's rather problematic for service providers in the USA: Europe is quite a huge market to lose (as well as a significant source for talents), and other markets may as well follow the switch. There _are_ working alternatives locally for businesses and administrations, only small because so far, most preferred to procure from the USA. Now that there is a significant incentive not to do so anymore, maybe europeans providers will get a chance to grow and improve.
- Etheryte 2y agoWhy would that be? There are plenty of local offerings and they're often cheaper, too. They might not be as well marketed or polished, but at the end of the day, most businesses just need some servers, nothing fancy.
- atwrk 2y agoThe EU company I work for is pretty security conscious and already implements this almost completely (the exception being a few industry specific niche apps). What do you think would be missing?
- yearesadpeople 2y agoFYI https://european-alternatives.eu/ https://european-alternatives.eu/
- pjmlp 2y agoInteresting site, needs more categories, like European Linux distributions for example, like SuSE and Jolla.
- dguest 2y agoI'll take the risk that I'm missing a joke here and ask something very ignorant about linux. Why would you need a regional linux distribution? The base is all open source, and I'm guessing the merges originate from everywhere in the world.
- pjmlp 2y ago> I'm guessing the merges originate from everywhere in the world. That is exactly the issue, when globalisation comes to an end as we are seeing it. Why do you think many nations are already having their distro? Naturally they aren't the kind of countries we would like to live on, but apparently we should not source all key infrastructure components from a country that is turning into 1984 as well.
- SSLy 2y agobecause at this point IBM (Red Hat) could be compelled by secret USA courts to inject backdoors into their binaries, whether RPMs or on quay/UBI.
- pjmlp 2y agoFollowed by OS, could not have those backdoors there. Finally it is going to be the year of SuSE Linux Desktop, and Jolla. Maybe we could have a second coming of Nokia N900 as well.
- belter 2y agoI keep waiting for the year of Linux on the EU Desktop :-)
- pjmlp 2y agoSeveral German libraries have SuSE Linux on their computing systems actually.
- askonomm 2y agoHeyyy, I quite liked Symbian OS! And if this means that Linux would finally work on hardware other than Thinkpads from 20 years ago, I say heck yeah (Out of the box I mean, having to become an expert linux afficionado to be able to make its x11/wayland/xwayland clusterfuck to work does not count as working)!
- pjmlp 2y agoSymbian Belle on C7 and E8 was already quite sweet, for users, and for developers we were finally moving away from Symbian C++, with Qt and PIPS, Eclipse based IDE... Oh well.
- ArtTimeInvestor 2y agoAre there any publicly traded cloud companies in the EU besides OVH, IONOS and Nebius? I have looked into these 3 so far and was not too impressed. Would like to look at more, if there are some.
- aomega08 2y agoScaleway is the closest thing to a public cloud we have in the EU. Although it’s not a publicly traded company.
- sam_lowry_ 2y agoHetzner beats it hands down in terms of cost, scale and customer service. But it's great to have competition )
- mariusor 2y agoThere's also Schwarz Gruppe (of Lidl fame) that started their own cloud infra with StackIt: https://www.stackit.de/de/ https://www.stackit.de/de/ They aren't publicly traded either AFAIK despite being worth over 100Bln.
- rsynnott 2y agoThere's Hetzner, which I think would generally be viewed as better than OVH (or at least used to be), but it's not publicly traded.
- wink 2y agoWhy does it matter if they are publicly traded? Outing myself as European here, but we've had a lot better results with privately owned businesses that are not 100% beholden to grow for their shareholders. No unicorns, but sustainable growth.
- nonrandomstring 2y agoInternational relations with US tech has been a serious talking point for over 25 years at least. Some good talking points here [0] [0] https://cybershow.uk/episodes.php?id=31 https://cybershow.uk/episodes.php?id=31
- ilove196884 2y agoEU holds all the cards here. Aws and azure have everything to lose. Europe has competitors but the offerings are fragmented between different companies. If they come together then yes they can have replacement for most users. Most users don't need bleeding edge features. Painful but can be done. Definitely not impossible.
- tticvs 2y agoI suspect that this is going to fall into the "nothing ever happens" bucket. What they're implying is that it is illegal for US companies to comply with EU law. This is significantly different than the EU enforcing the GDPR extraterritorially since that's basically just an increased cost of doing business in Europe and is apparently worth it. But if the US companies have to choose between complying with US extraterritorial law or EU extraterritorial law they're going to have to choose the US, for obvious reasons. It doesn't seem to me that convenient legal subsidiary structures or data physicality setups are gonna work here. The effect of US companies withdrawing cloud services would be devastating to the EU. Imagine if you could no longer access your gmail or outlook account, your apple or google photos disappear , whatsapp shuts down, all you companies documents are no longer accessible on Office365 or G drive. The results would be indistinguishable from a massive cyber attack and would take decades to recover from. There's just no way the EU would inflict a wound of this magnitude on itself.
- dsign 2y agoIndeed. The EU will search for a way to keep allowing citizen data on American intelligence agencies, because there simply is no alternative politically affordable. It would take American SWAT teams regularly raiding the streets of Belgium and Paris, in plain daylight, and equivocally arresting French/Belgian cafe owners for having abortions (and thus violating Mississippi state laws), for the EU to do the right thing.
- danmaz74 2y ago> The results would be indistinguishable from a massive cyber attack and would take decades to recover from. It would be painful, yes, but it wouldn't "take decades to recover from", not even years. These services, technically, aren't so difficult to recreate, if you have a big enough market.
- tticvs 2y agoVery naive. The services are potentially replaceable, the data is not. That's not even considering the political backlash. How do you explain to your population that their digital lives have been permanently deleted because of a trans-national legal spat they don't care about?
- jsnell 2y agoA lot of people here seem to be interpreting "Cloud" as as "public Cloud infrastructure provider". Note that this isn't just a question of AWS, Azure and GCP. It's about any kind of hosted services. So it would also apply to things like Dropbox, Slack, Gmail, WhatsApp, iCloud, etc. (But it also wouldn't be a ban on personal use of such services, as long as the user consents. It'd "just" be very hard to use those services in business or government.)
- Havoc 2y agoGiven how unreliable the US is becoming a bit of distance might not be a bad thing.
- leowoo91 2y agoFYI, there is already a type of deployment called "sovereign cloud" where data exports are controlled by the country and already under works by major providers.
- jc_811 2y agoWorth noting that there is a European company (I believe headquartered in Sweden) whose mission is to build an EU-first cloud to compete with the large US offerings. Evroc[1] is their name and I’ve been following them for a few years now. They raised a large amount in 2023 [2] and looks like they’ve just broken ground on land to build a data center just last week [3] Very curious on how this will work for them and I plan on following their journey very closely. Any EU-based cloud engineers should apply to join! [1] https://evroc.com/ https://evroc.com/ [2] https://sifted.eu/articles/evroc-plans-e600m-investment https://sifted.eu/articles/evroc-plans-e600m-investment [3] https://www.datacenterdynamics.com/en/news/swedens-evroc-acquires-land-outside-stockholm/ https://www.datacenterdynamics.com/en/news/swedens-evroc-acq...
- sam_lowry_ 2y ago> build an EU-first cloud to compete with the large US offerings Oh come on! There are so many options in the EU to choose from, already. That none of them has the complexity of AWS is a feature, not a bug.
- jc_811 2y agoHi! Sorry I didn’t mean to offend. I just thought it was a cool project I wanted to share. I didn’t mean to disparage or put down any other company or offering
- silexia 2y ago[flagged]
- waltercool 2y ago> Since the Snowden disclosures we know that the US engages in mass surveillance of EU users by scooping up personal data from US Big Tech Meanwhile, Germans pay with cash and credit cards are very unpopular because the German government sniffs every single transaction. Europeans think they are pro freedom, but their idea of freedom begins by getting the government over them 24/7.