3 ms·

One thing is a bit unclear here. US headquartered cloud providers have physical data centers in EU. Would this also prevent EU businesses from using those?

croes 2y ago
That was their trick to circumvent the Patriot Act. But then came the CloudAct and the location doesn’t matter anymore. You do business in the US, you have to provide the data.
belter 2y ago
If you use AWS in Europe your invoice is from Amazon Luxembourg...
- preisschild 2y ago
  The Parent company is still the US based Amazon though, which can direct Amazon Luxembourg and falls under US laws.
  - belter 2y ago
    Yes. What I mean is that they could sell it to somebody else, as it is already a separate corporate entity.
Juliate 2y ago
It's not the physical location of data that matters, it's the authority and control over the infrastructure and the data it holds. In other words, if a US authority has any say on what's running/hosted in data centers in EU, it's a no go for more and more businesses and administrations.
rustc 2y ago
And what about EU headquartered cloud providers that have servers in the US like Hetzner?
- croes 2y ago
  As soon you have a subsidy in the US you fall under the CloudAct
  - dathinab 2y ago
    but it's a different legal structure US daughter companies have not means at all to direct their parent company to breach EU law, the other way around is more complicated
    - croes 2y ago
      It’s not necessary https://english.ncsc.nl/publications/publications/2022/augustus/16/memo-cloud-act https://english.ncsc.nl/publications/publications/2022/augus...
dathinab 2y ago
Technically they also have EU daughter companies operating this services etc. this are legally seen EU companies and have to strictly comply with EU law no matter what US law says. But US law like cloud act is a broad overreach of US law into other countries. Which puts them into a tough spot where there parent company has to comply with US law and give US access to their EU daughter company but their daughter company must not allow them such access at all and if they would use technical means to get it anyway it would be legally no different then a cyberattack....
pyrale 2y ago
Yes. US law says in no uncertain terms that the us government can demand anything from its companies, including breaking the law in foreign countries. And that was before big tech decided to collude with an administration who doesn’t care about the law. For US companies to be in the clear, they would have to split their EU subsidiaries in such a way that the US branch could not access their EU operations or ship new patches, and would not have operational oversight.

croes 2y ago

That was their trick to circumvent the Patriot Act. But then came the CloudAct and the location doesn’t matter anymore. You do business in the US, you have to provide the data.

belter 2y ago

If you use AWS in Europe your invoice is from Amazon Luxembourg...

preisschild 2y ago
The Parent company is still the US based Amazon though, which can direct Amazon Luxembourg and falls under US laws.
- belter 2y ago
  Yes. What I mean is that they could sell it to somebody else, as it is already a separate corporate entity.

Juliate 2y ago

It's not the physical location of data that matters, it's the authority and control over the infrastructure and the data it holds. In other words, if a US authority has any say on what's running/hosted in data centers in EU, it's a no go for more and more businesses and administrations.

rustc 2y ago

And what about EU headquartered cloud providers that have servers in the US like Hetzner?

croes 2y ago
As soon you have a subsidy in the US you fall under the CloudAct
- dathinab 2y ago
  but it's a different legal structure US daughter companies have not means at all to direct their parent company to breach EU law, the other way around is more complicated
  - croes 2y ago
    It’s not necessary https://english.ncsc.nl/publications/publications/2022/augustus/16/memo-cloud-act https://english.ncsc.nl/publications/publications/2022/augus...

dathinab 2y ago

Technically they also have EU daughter companies operating this services etc. this are legally seen EU companies and have to strictly comply with EU law no matter what US law says. But US law like cloud act is a broad overreach of US law into other countries. Which puts them into a tough spot where there parent company has to comply with US law and give US access to their EU daughter company but their daughter company must not allow them such access at all and if they would use technical means to get it anyway it would be legally no different then a cyberattack....

pyrale 2y ago

Yes. US law says in no uncertain terms that the us government can demand anything from its companies, including breaking the law in foreign countries. And that was before big tech decided to collude with an administration who doesn’t care about the law. For US companies to be in the clear, they would have to split their EU subsidiaries in such a way that the US branch could not access their EU operations or ship new patches, and would not have operational oversight.