5 ms·

"[1] for completeness/fairness, I'm pretty sure Amazon would treat and Sydney AZ instances I spin up exactly the same way. [2] actually, I suspect I'd get the w

by ra 13y ago

"[1] for completeness/fairness, I'm pretty sure Amazon would treat and Sydney AZ instances I spin up exactly the same way. [2] actually, I suspect I'd get the worst-case scenario of the least protection available under either US or Australian law - if push ever came to shove..." Totally. These points completely nail it for me (A non-US consumer of US based services). Anyone who was concerned about "the subpoena risk" [1] before, but was satisfied if their data resides in (eg) Australian data centres will now be forced to think again. I see this as a huge opportunity for non-US domestic PAAS / IAAS providers who keep everything in a single juristiction. [1] http://www.cisco.com/web/about/doing_business/legal/privacy_compliance/docs/CloudPrimer.pdf http://www.cisco.com/web/about/doing_business/legal/privacy_...

bigiain 13y ago
Ninefold (http://www.ninefold.com http://www.ninefold.com) push this pretty hard (see the Data Jurisdiction link in their footer), but unfortunately I fear their (and my) local Australian legal system doesn't provide me with any protection against even medium-level US law enforcement "friendly requests". When you see just how far the New Zealand law enforcement rolled over and violated national law at the request of US copyright enforcement in their shoddily executed raid on Kim Dot Com, I have very little doubt that in spite of Ninefold's marketing using legal jurisdiction nightmares if you use their major competitors AWS or Rackspace - if the NSA showed up even without local law enforcement on their side, me and my data would likley get "thrown under the bus" (especially in the light of stories like this: https://mailman.stanford.edu/pipermail/liberationtech/2013-June/008815.html https://mailman.stanford.edu/pipermail/liberationtech/2013-J... )
- ra 13y ago
  You know what, you're absolutely right. For a long time I've favoured OrionVM over AWS for this reason. Something needs to change. What do you think are the chances of Senator Scott Ludlum's "Get a Warrant" bill [1] making it through before the election? [1] http://www.guardian.co.uk/world/2013/jun/11/greens-warrant-phone-internet-records http://www.guardian.co.uk/world/2013/jun/11/greens-warrant-p...
WatchDog 13y ago
Perhaps one solution is to store your data in a jurisdiction that is not the US or Australia. If some nation can step up and provide some guarantee that your data is not subject to law enforcement without rigorousness due process, they might be able to attract substantial investment.
- bigiain 13y ago
  Perhaps - I don't have any real knowledge here, but I suspect most countries probably have something similar to the stated (but clearly abused) special protection for citizens privacy rights over non-citizens (kinda inevitably in one sense - if you have no ability to vote in elections in the country making the laws, you have very little reason to be protected as much by those laws as those who can vote poor lawmakers out). So for my personal situation - there are two juridictions I have citizenship in (Australia and The UK), neither of which I have much confidence in the amount of resistance they'd provide at a policy or law enforcement level to requests for my personal data from US agencies - and both places where I suspect that companies capable of storing data for me reliably and availably enough probably all have enough of a US presence that they'd be easily "leaned on" by agencies as powerful as the NSA (and probably even the MPAA) in such a way that it'd be "the right thing for them to do" to give up my data rather than incur the costs to the company of fighting. My current "solution" is increase my (and as many people as I work and communicate with as possible) use of encryption (and hope that as well as "not doing anything wrong, so I've got nothing to fear", that things like AES & PBKDF2 with strong passphrases and tools like EncFS, TrueCrypt, 1Password, OpenSSL are still viable options even against the NSA).

by ra 13y ago

bigiain 13y ago

Ninefold (http://www.ninefold.com http://www.ninefold.com) push this pretty hard (see the Data Jurisdiction link in their footer), but unfortunately I fear their (and my) local Australian legal system doesn't provide me with any protection against even medium-level US law enforcement "friendly requests". When you see just how far the New Zealand law enforcement rolled over and violated national law at the request of US copyright enforcement in their shoddily executed raid on Kim Dot Com, I have very little doubt that in spite of Ninefold's marketing using legal jurisdiction nightmares if you use their major competitors AWS or Rackspace - if the NSA showed up even without local law enforcement on their side, me and my data would likley get "thrown under the bus" (especially in the light of stories like this: https://mailman.stanford.edu/pipermail/liberationtech/2013-June/008815.html https://mailman.stanford.edu/pipermail/liberationtech/2013-J... )

ra 13y ago
You know what, you're absolutely right. For a long time I've favoured OrionVM over AWS for this reason. Something needs to change. What do you think are the chances of Senator Scott Ludlum's "Get a Warrant" bill [1] making it through before the election? [1] http://www.guardian.co.uk/world/2013/jun/11/greens-warrant-phone-internet-records http://www.guardian.co.uk/world/2013/jun/11/greens-warrant-p...

WatchDog 13y ago

Perhaps one solution is to store your data in a jurisdiction that is not the US or Australia. If some nation can step up and provide some guarantee that your data is not subject to law enforcement without rigorousness due process, they might be able to attract substantial investment.

bigiain 13y ago
Perhaps - I don't have any real knowledge here, but I suspect most countries probably have something similar to the stated (but clearly abused) special protection for citizens privacy rights over non-citizens (kinda inevitably in one sense - if you have no ability to vote in elections in the country making the laws, you have very little reason to be protected as much by those laws as those who can vote poor lawmakers out). So for my personal situation - there are two juridictions I have citizenship in (Australia and The UK), neither of which I have much confidence in the amount of resistance they'd provide at a policy or law enforcement level to requests for my personal data from US agencies - and both places where I suspect that companies capable of storing data for me reliably and availably enough probably all have enough of a US presence that they'd be easily "leaned on" by agencies as powerful as the NSA (and probably even the MPAA) in such a way that it'd be "the right thing for them to do" to give up my data rather than incur the costs to the company of fighting. My current "solution" is increase my (and as many people as I work and communicate with as possible) use of encryption (and hope that as well as "not doing anything wrong, so I've got nothing to fear", that things like AES & PBKDF2 with strong passphrases and tools like EncFS, TrueCrypt, 1Password, OpenSSL are still viable options even against the NSA).