3 ms·

> "The Cloud Act grants US authorities access to cloud data hosted by US companies. It does not matter if that data is located in the US, Europe, or anywhere el

by pjc50 2y ago

> "The Cloud Act grants US authorities access to cloud data hosted by US companies. It does not matter if that data is located in the US, Europe, or anywhere else." Exactly. So long as that is true, the idea that an EU datacenter run by Microsoft can be "sovereign" is nonsense. Having an in-EU owned cloud becomes a national security issue. Tech independence is a long way off though. I wonder if, like the carbon transition, it will require an announced phaseout date to concentrate minds.

JumpCrisscross 2y ago
Forget about access. What happens if Trump, tomorrow, orders Microsoft to cut off some government because they were mean to him or whatnot? How much leverage does a European economy running on American technology hand D.C., and do you really trust us to safeguard that power responsibly?
- pjc50 2y ago
  It's a very real risk! Economic suicide for Microsoft .. in the long term. In the short term? Well, Satya Nadella is an immigrant, so he can simply be disappeared like Jack Ma, without guaranteed access to a court, if he doesn't follow orders.
- ForHackernews 2y ago
  Uber has already shown tech companies can overthrow local governments that won't play ball. Amazon could probably topple the Trump regime tomorrow by surfacing tariff charges on their invoices. Microsoft could just bluescreen every Windows device in the USA with a message "Call your legislator at 555-9999 and tell them to repeal the CHUM Act"
- belter 2y ago
  There’s virtually nothing, technically or managerially, that can slow down the massive iceberg that is Azure and Microsoft. Call it cynical if you like, but I see it as a plain statement of fact that as of May 2025: - A cloud platform riddled with security vulnerabilities. - Two major breaches that exposed customer data to other customers. - Widely disliked by seasoned cloud professionals who are forced to use it. And yet...it’s thriving....Microsoft’s earnings yesterday showed Azure and other cloud services up 33% year-over-year, and the stock jumped 9% in after-hours trading.
whazor 2y ago
Looking at Microsoft's proposal, it looks like the sovereign data centers will be ran by non-Microsoft owned European companies? But the software would be from Microsoft. I wonder how much difference would there be between a European company running a DC or Microsoft running a DC under a Microsoft European entity. Windows itself has had backdoors via viruses. But even the Linux kernel has been vulnerable in the past to backdoors, so there is also that.
- LadyCailin 2y ago
  Azure is provided by 21vianet in China, https://en.m.wikipedia.org/wiki/21Vianet https://en.m.wikipedia.org/wiki/21Vianet and is only accessible to people in China (maybe there are more requirements too, like security clearances, etc) but folks in Redmond can’t get direct access to these servers, even the ones running only Microsoft software - they have to get an escort, and tell the escort what to do for them. They can only see the screen, so long as the escort allows it. So I imaging there’s no reason this same approach can’t have done in Europe, and Microsoft already has development centers all over Europe, so they already have the necessary employees to run this, to some degree anyways.
Prunkton 2y ago
I dealt with a EU//German regulator in the past about this very topic in a finance context. This behavior is peak willful ignorance. Its sold as risk planing by EU entities but after all its just liability planing. What I mean by that is, for convenience reasons everyone goes along with US Clouds knowing it is technically absolutely possible to access the data but as long the contracts are clean and state they are following EU law its fine. Just in case you can make the point the contract was broken the paper is of relevance.
- bux93 2y ago
  There are a few worries. The US government accessing private data is the one that gets this treatment. Sure, the contracts are not worth the paper they're written on, but it's a state actor - even if you store the data only on a USB stick in your wallet in the end they'll find a way to access it. Preventing data leaks to private parties is a more attainable objective, and using a US cloud might actually contribute positively to that. The new worry is different; denial of service. Your bank can just Go Away one day. Like what happened to Amsterdam-based, but Russian owned, ATB bank. Its cloud resources were blocked and even the Dutch bankruptcy court had trouble getting access to the data to wind down the bank. That's an existential threat. One you can ignore if your values are aligned with the US administration, but the administration is completely unpredictable, not to say nihilistic. This is making companies very (very) nervous, even without the regulator saying anything to them.
- mawadev 2y ago
  The entire chain of command just diverts responsibility wherever they can and then base it off of some paper that has no meaning. In the end, the volume of data that is put up there would cause so much damage, you cannot really hold anyone accountable if stuff goes wrong. Sure a company may vanish or some money moves from A to B, but the damage remains. The entire concept of trust is flawed.
pjmlp 2y ago
To fully achieve independence, we need to move away from US based operating systems, and programming languages that aren't under independent foundations or international standards. Long way indeed, but how knows it could be the year of SuSE desktop or something like that. And naturally Siemens and Nokia could have another go at phones, or maybe everyone should get a Jolla one.
pabs3 2y ago
I'd say that a sovereign cloud is an oxymoron; anything that is "other people's computers" in any sense, is not sovereign. The trade war shows that "sovereign" computing is a spectrum, and to be fully sovereign you need to be able to create everything yourself, from end user software, through services, operating systems, bootloaders, firmware, programming languages, datacentres, network, board layouts, processor designs, board assembly, processor fabs, processing rare earth minerals, mining ore etc, plus everything you need to do that.
mcv 2y ago
If US companies are required to give the US government access the data, and companies operating in the EU are not allowed to give anyone access to data from EU citizens, then US companies are simply not allowed to operate in the EU anymore. The only way out is to split all of those tech companies, which frankly isn't a bad idea at all.
tzs 2y ago
Having data in an in-EU owned cloud does not make it harder for the US government to get the data under the Cloud Act, because the Cloud Act isn't about the server. It is about who controls the data. Suppose I'm a US company and I rent some storage space from a US cloud provider and put some data on their service using the APIs they provide their customers, and I rent some storage space from an EU cloud provider and put some data there using the APIs they provide their customers. I'm the one who controls that data. The cloud providers just provide storage space for me. If the US government wants to get that data using the Cloud Act they don't ask the US cloud company and the EU cloud company for it. They ask me for it. I have to retrieve it, which I do using the exact same APIs I would use if I were retrieving it for my own use. To the cloud providers it just looks like a normal case of a storage client of theirs retrieving data.

by pjc50 2y ago

JumpCrisscross 2y ago

Forget about access. What happens if Trump, tomorrow, orders Microsoft to cut off some government because they were mean to him or whatnot? How much leverage does a European economy running on American technology hand D.C., and do you really trust us to safeguard that power responsibly?

pjc50 2y ago
It's a very real risk! Economic suicide for Microsoft .. in the long term. In the short term? Well, Satya Nadella is an immigrant, so he can simply be disappeared like Jack Ma, without guaranteed access to a court, if he doesn't follow orders.
ForHackernews 2y ago
Uber has already shown tech companies can overthrow local governments that won't play ball. Amazon could probably topple the Trump regime tomorrow by surfacing tariff charges on their invoices. Microsoft could just bluescreen every Windows device in the USA with a message "Call your legislator at 555-9999 and tell them to repeal the CHUM Act"
belter 2y ago
There’s virtually nothing, technically or managerially, that can slow down the massive iceberg that is Azure and Microsoft. Call it cynical if you like, but I see it as a plain statement of fact that as of May 2025: - A cloud platform riddled with security vulnerabilities. - Two major breaches that exposed customer data to other customers. - Widely disliked by seasoned cloud professionals who are forced to use it. And yet...it’s thriving....Microsoft’s earnings yesterday showed Azure and other cloud services up 33% year-over-year, and the stock jumped 9% in after-hours trading.

whazor 2y ago

Looking at Microsoft's proposal, it looks like the sovereign data centers will be ran by non-Microsoft owned European companies? But the software would be from Microsoft. I wonder how much difference would there be between a European company running a DC or Microsoft running a DC under a Microsoft European entity. Windows itself has had backdoors via viruses. But even the Linux kernel has been vulnerable in the past to backdoors, so there is also that.

LadyCailin 2y ago
Azure is provided by 21vianet in China, https://en.m.wikipedia.org/wiki/21Vianet https://en.m.wikipedia.org/wiki/21Vianet and is only accessible to people in China (maybe there are more requirements too, like security clearances, etc) but folks in Redmond can’t get direct access to these servers, even the ones running only Microsoft software - they have to get an escort, and tell the escort what to do for them. They can only see the screen, so long as the escort allows it. So I imaging there’s no reason this same approach can’t have done in Europe, and Microsoft already has development centers all over Europe, so they already have the necessary employees to run this, to some degree anyways.

Prunkton 2y ago

I dealt with a EU//German regulator in the past about this very topic in a finance context. This behavior is peak willful ignorance. Its sold as risk planing by EU entities but after all its just liability planing. What I mean by that is, for convenience reasons everyone goes along with US Clouds knowing it is technically absolutely possible to access the data but as long the contracts are clean and state they are following EU law its fine. Just in case you can make the point the contract was broken the paper is of relevance.

bux93 2y ago
There are a few worries. The US government accessing private data is the one that gets this treatment. Sure, the contracts are not worth the paper they're written on, but it's a state actor - even if you store the data only on a USB stick in your wallet in the end they'll find a way to access it. Preventing data leaks to private parties is a more attainable objective, and using a US cloud might actually contribute positively to that. The new worry is different; denial of service. Your bank can just Go Away one day. Like what happened to Amsterdam-based, but Russian owned, ATB bank. Its cloud resources were blocked and even the Dutch bankruptcy court had trouble getting access to the data to wind down the bank. That's an existential threat. One you can ignore if your values are aligned with the US administration, but the administration is completely unpredictable, not to say nihilistic. This is making companies very (very) nervous, even without the regulator saying anything to them.
mawadev 2y ago
The entire chain of command just diverts responsibility wherever they can and then base it off of some paper that has no meaning. In the end, the volume of data that is put up there would cause so much damage, you cannot really hold anyone accountable if stuff goes wrong. Sure a company may vanish or some money moves from A to B, but the damage remains. The entire concept of trust is flawed.

pjmlp 2y ago

To fully achieve independence, we need to move away from US based operating systems, and programming languages that aren't under independent foundations or international standards. Long way indeed, but how knows it could be the year of SuSE desktop or something like that. And naturally Siemens and Nokia could have another go at phones, or maybe everyone should get a Jolla one.

pabs3 2y ago

I'd say that a sovereign cloud is an oxymoron; anything that is "other people's computers" in any sense, is not sovereign. The trade war shows that "sovereign" computing is a spectrum, and to be fully sovereign you need to be able to create everything yourself, from end user software, through services, operating systems, bootloaders, firmware, programming languages, datacentres, network, board layouts, processor designs, board assembly, processor fabs, processing rare earth minerals, mining ore etc, plus everything you need to do that.

mcv 2y ago

If US companies are required to give the US government access the data, and companies operating in the EU are not allowed to give anyone access to data from EU citizens, then US companies are simply not allowed to operate in the EU anymore. The only way out is to split all of those tech companies, which frankly isn't a bad idea at all.

tzs 2y ago

Having data in an in-EU owned cloud does not make it harder for the US government to get the data under the Cloud Act, because the Cloud Act isn't about the server. It is about who controls the data. Suppose I'm a US company and I rent some storage space from a US cloud provider and put some data on their service using the APIs they provide their customers, and I rent some storage space from an EU cloud provider and put some data there using the APIs they provide their customers. I'm the one who controls that data. The cloud providers just provide storage space for me. If the US government wants to get that data using the Cloud Act they don't ask the US cloud company and the EU cloud company for it. They ask me for it. I have to retrieve it, which I do using the exact same APIs I would use if I were retrieving it for my own use. To the cloud providers it just looks like a normal case of a storage client of theirs retrieving data.