3 ms·
So there's numerous layers to this: 1. Where and how is the data stored and retrieved? This can be made local by forcing all data users/services to use an EU d
by rswail 1y ago
So there's numerous layers to this:
1. Where and how is the data stored and retrieved? This can be made local by forcing all data users/services to use an EU data storage service that is locally owned and operated and under EU jurisdiction. Access to the data would only be to the service delivery operator and the appropriate EU legal authorities.
2. Where and how is the data accessed? The data needs to be accessed by the service provider (eg an email service) to handle incoming updates and requests. The access could be limited to the required updates and inquiries, or otherwise logged so that the service provider is held accountable for access.
3. Where and how is the service accessible to legal authorities? For example, police warrants for an email inbox. The service provider should be required to identify and reveal publicly what data is available and how it is legally accessible if required. Given encryption, it may be that the service provider is unable to provide that access to anyone except the end user (eg Protonmail, Signal).
4. What control does the end user have over their data and the associated meta-data maintained by the service provider? GDPR covers a lot of ground here, including the right to be forgotten.
- CursedSilicon 1y agoSomething you missed as well was 2018's "CLOUD Act" [1] Stealing from Wikipedia since frankly it's better articulated than I could do "The CLOUD Act was introduced following difficulties that the Federal Bureau of Investigation (FBI) had with obtaining remote data through service providers through SCA warrants, as the SCA was written before cloud computing was a viable technology. The situation was highlighted from a 2013 drug trafficking investigation, during which the FBI issued an SCA warrant for emails that a U.S. citizen had stored on one of Microsoft's remote servers in Ireland, which Microsoft refused to provide." US Companies can't simply say "well that's in Europe. That's outside *our control*". The US truly considers its data reach to be global in nature when it comes to US companies. it's absolutely terrifying to think about [1] https://en.wikipedia.org/wiki/CLOUD_Act https://en.wikipedia.org/wiki/CLOUD_Act
- rswail 1y agoThat's why I'm suggesting that the data storage/retrieval supplier is EU owned and controlled. So in the case you quote, FBI can issue a warrant to Microsoft, but all they can do is pass it on to their data storage provider, who can reject it depending on EU law, not US law.
- tzs 1y agoIn the quoted case it would not make a difference if the data storage service was EU owned and controlled because the warrant is asking Microsoft to supply the data. Microsoft can do that by simply using the normal data retrieval API that data storage service makes available to all its customers. To the data storage service the API call Microsoft will make to get the data the FBI wants is no different than the thousands of other API calls Microsoft is making daily to store and retrieve data. What using an EU owned and controlled data storage service gets you is that you don't have to worry about non-EU law enforcement getting your data by forcing the data storage service to give it up directly to them.