4 ms·

I'm the VP / Distinguished Engineer leading the design, delivery, and operations of the European Sovereign Cloud. I'm in Hamburg right now for the AWS Summit to

I'm the VP / Distinguished Engineer leading the design, delivery, and operations of the European Sovereign Cloud. I'm in Hamburg right now for the AWS Summit tomorrow. To answer some questions here in one go - for the European Sovereign Cloud, EU laws always apply. The only people with operational control or access (physical, or logical) are EU people in the EU, and decisions about how lawful orders are handled are also made by EU people in the EU. This is one of the biggest pieces of what it means to be a "Sovereign Cloud" and comes directly from the requirements of our customers. Another is that there are no technical dependencies on non-EU infrastructure. Of course another answer is that for data access it's also great to build systems like KMS, Nitro, Wickr, CMK encryption, etc ... where we as an operator simply have no access to customer data in the first place. And those protections stand too.

jeroenhd 1y ago
According to the article: > Regardless of Amazon's data sovereignty pledge, the parent company remains under American ownership, and may still be subject to the Cloud Act, which requires US companies to turn over data to law enforcement authorities with the proper warrants, no matter where that data is stored. How does that work with "decisions about how lawful orders are handled are also made by EU people in the EU"? Will the EU cloud division go rogue once the US attempts to use the CLOUD Act or something?
- jiggawatts 1y ago
  I always take it as a very bad sign when someone senior working on a project comes to defend their company in a public forum and then mysteriously loses access to their keyboard when half a dozen people immediately raise an objection.
- openplatypus 1y ago
  Amazon lied about SCCs before. Now they just change vocabulary. Nothing changed.
  - djhn 1y ago
    Could you point to a source, please? I’m not super well versed in the history and lore of cloud and AWS, but interested in and invested in arguing for and supporting adoption of (real) sovereign European computing.
    - belter 1y ago
      Its the EU using Cloudfront... :-) "The General Court orders the Commission to pay damages to a visitor to its ‘Conference on the Future of Europe’ website as a result of the transfer of personal data to the United States" - https://curia.europa.eu/jcms/upload/docs/application/pdf/2025-01/cp250001en.pdf https://curia.europa.eu/jcms/upload/docs/application/pdf/202... From further research, it looks like the Amazon data transfer issue was litigated and resolved at the EU level, with the court finding Amazon's practices were lawful under the contracts in place.
- belter 1y ago
  They will have their own IAM so technically, they could go rogue... :-)
tuyguntn 1y ago
Thanks for being here. Hopefully you can answer some more questions. If company is owned by US entity (AWS/Amazon), can it also block customers by the US government request, similar to how MSFT blocked ICC access to its email service?
- blitzar 1y ago
  Perhaps if Amazon.com Inc. own 100% of the shares as a financial holding but not as a corporate subsidiary, no voting rights, no board seat, no influence whatsoever etc. then there is a chance US requests would have to go via EU courts ... Disclaimer: Not a lawyer or PR person.
  - jplrssn 1y ago
    How would corporate governance work if the only shareholder had no voting rights and no board seat?
    - blitzar 1y ago
      Similarly to how it would work if a shareholder had a conflict of interest - the directors are required to govern in the companies best interest not the (conflicted) shareholders interests.
bgnn 1y ago
Doesn't an EU brach of a foreign company has to comply with EU laws anyhow. The problem is the parent company being US based and susceptible to US government bullying. As long as it is still Amazon owned nothing fundamental changes really.
openplatypus 1y ago
As a US subsidiary, you still fall under FISA and therefore you fail adequate protection of Personal Data. Encryption does not protect data at runtime. Otherwise AWS is just glorified backup storage of e2ee data.
- mox1 1y ago
  On paper (aka the laws of the United State) FISA applies to things that physically reside in the US. "The FISA Court’s only jurisdiction is “to hear applications for and grant orders approving electronic surveillance anywhere within the United States.” 50 U.S.C. § 1803 (a) (1)."
NorwegianDude 1y ago
No technical dependencies on non-EU infrastructure seems very unlikely. Does the EU edition not rely on the same software that American AWS owns? Isn't it owned by AWS?
- belter 1y ago
  Sounds like they have been working on it for a few years.. "AWS re:Invent 2023 - AWS European Sovereign Cloud: A closer look (SEC216)" - https://youtu.be/qNHWeDf-fTQ https://youtu.be/qNHWeDf-fTQ
korijn 1y ago
Are you an EU citizen?
- colmmacc 1y ago
  Yes
  - djhn 1y ago
    Are you exclusively an EU citizen? In certain EU countries, data center sovereignty criteria require the management and beneficiaries to also NOT be citizens of another state.
davidgerard 1y ago
So how are you disentangling it from hard dependency on us-east-1? That would be enough reason for non-EU customers to set up there!
- colmmacc 1y ago
  It's a separate "partition", with its own IAM accounts and orgs stack and everything. Similar to how US GovCloud is its own partition.

jeroenhd 1y ago

According to the article: > Regardless of Amazon's data sovereignty pledge, the parent company remains under American ownership, and may still be subject to the Cloud Act, which requires US companies to turn over data to law enforcement authorities with the proper warrants, no matter where that data is stored. How does that work with "decisions about how lawful orders are handled are also made by EU people in the EU"? Will the EU cloud division go rogue once the US attempts to use the CLOUD Act or something?

jiggawatts 1y ago
I always take it as a very bad sign when someone senior working on a project comes to defend their company in a public forum and then mysteriously loses access to their keyboard when half a dozen people immediately raise an objection.
openplatypus 1y ago
Amazon lied about SCCs before. Now they just change vocabulary. Nothing changed.
- djhn 1y ago
  Could you point to a source, please? I’m not super well versed in the history and lore of cloud and AWS, but interested in and invested in arguing for and supporting adoption of (real) sovereign European computing.
  - belter 1y ago
    Its the EU using Cloudfront... :-) "The General Court orders the Commission to pay damages to a visitor to its ‘Conference on the Future of Europe’ website as a result of the transfer of personal data to the United States" - https://curia.europa.eu/jcms/upload/docs/application/pdf/2025-01/cp250001en.pdf https://curia.europa.eu/jcms/upload/docs/application/pdf/202... From further research, it looks like the Amazon data transfer issue was litigated and resolved at the EU level, with the court finding Amazon's practices were lawful under the contracts in place.
belter 1y ago
They will have their own IAM so technically, they could go rogue... :-)

tuyguntn 1y ago

Thanks for being here. Hopefully you can answer some more questions. If company is owned by US entity (AWS/Amazon), can it also block customers by the US government request, similar to how MSFT blocked ICC access to its email service?

blitzar 1y ago
Perhaps if Amazon.com Inc. own 100% of the shares as a financial holding but not as a corporate subsidiary, no voting rights, no board seat, no influence whatsoever etc. then there is a chance US requests would have to go via EU courts ... Disclaimer: Not a lawyer or PR person.
- jplrssn 1y ago
  How would corporate governance work if the only shareholder had no voting rights and no board seat?
  - blitzar 1y ago
    Similarly to how it would work if a shareholder had a conflict of interest - the directors are required to govern in the companies best interest not the (conflicted) shareholders interests.

bgnn 1y ago

Doesn't an EU brach of a foreign company has to comply with EU laws anyhow. The problem is the parent company being US based and susceptible to US government bullying. As long as it is still Amazon owned nothing fundamental changes really.

openplatypus 1y ago

As a US subsidiary, you still fall under FISA and therefore you fail adequate protection of Personal Data. Encryption does not protect data at runtime. Otherwise AWS is just glorified backup storage of e2ee data.

mox1 1y ago
On paper (aka the laws of the United State) FISA applies to things that physically reside in the US. "The FISA Court’s only jurisdiction is “to hear applications for and grant orders approving electronic surveillance anywhere within the United States.” 50 U.S.C. § 1803 (a) (1)."

NorwegianDude 1y ago

No technical dependencies on non-EU infrastructure seems very unlikely. Does the EU edition not rely on the same software that American AWS owns? Isn't it owned by AWS?

belter 1y ago
Sounds like they have been working on it for a few years.. "AWS re:Invent 2023 - AWS European Sovereign Cloud: A closer look (SEC216)" - https://youtu.be/qNHWeDf-fTQ https://youtu.be/qNHWeDf-fTQ

korijn 1y ago

Are you an EU citizen?

colmmacc 1y ago
Yes
- djhn 1y ago
  Are you exclusively an EU citizen? In certain EU countries, data center sovereignty criteria require the management and beneficiaries to also NOT be citizens of another state.

davidgerard 1y ago

So how are you disentangling it from hard dependency on us-east-1? That would be enough reason for non-EU customers to set up there!

colmmacc 1y ago
It's a separate "partition", with its own IAM accounts and orgs stack and everything. Similar to how US GovCloud is its own partition.