15 ms·

Sigh, grumpy german privacy data protection consultant here. Can't be used in G. for the same reasons MS Office 365 is off limits, sensitive personal and busin

Sigh, grumpy german privacy data protection consultant here. Can't be used in G. for the same reasons MS Office 365 is off limits, sensitive personal and business data don't belong in non german-hosted clouds. One part of me wants that easy carefree cloud life, the other part doesn't want to feed the US-overlord anymore with our precious informations.

mey 13y ago
Legally or due to your privacy concerns? Just looking for clarification on your statement of "Can't" if that is a personal preference or legal obligation for government/corporations doing business locally.
- SpikeGronim 13y ago
  Legally, due to the EU Data Protection Directive. It's a legal obligation.
- nisa 13y ago
  Legal concerns. I'm not a lawyer but there are quite strict rules. Here is an example based on Google Analytics (first Google hit): http://www.searchlaboratory.com/blog/2013/06/germanys-data-protection-laws/ http://www.searchlaboratory.com/blog/2013/06/germanys-data-p...
- Silhouette 13y ago
  There is a general, Europe-wide restriction on exporting personal data outside of the EEA to somewhere that doesn't provide an acceptable level of protection (which by default the United States does not). There is also a Safe Harbor scheme that is intended to overcome this problem so working with US businesses is still possible if they provide additional safeguards. However, it's now clear that no business operating in the United States can actually offer the required guarantees, no matter how sincerely they might wish to. It is therefore unclear whether a European business relying on Safe Harbor to cover its rear would actually have much of a case in court if one of its customers were actually damaged as a result. I've seen a lot of businesses at least considering pulling out of US services, cloud or otherwise, for this reason in recent months. Some are sticking with it, on the grounds that there is safety in numbers: no government regulator really wants to damage global trade by making examples of businesses who are just trying to do their work and acting in good faith, and if you're dealing with a similarly honest business from the US then the odds of an actual customer complaint are probably low enough that it might be considered an acceptable business risk. Others seem to have lawyers who are more wary and fear the penalties of something like a mass leak across the pond that would come back to bite their clients back home. In addition, some nations in Europe are a lot more concerned about privacy both legally and culturally than the US, for obvious historical reasons if nothing else, and they may have stronger laws still.
  - res0nat0r 13y ago
    eu-west-1 is hosted in Dublin.
    - kyrra 13y ago
      My understand is that since Amazon is a US-based company, they could be forced, by the US government, to turn over data that is hosted in other countries. So using an Amazon cloud, even if its based in the EU, is still not possible. EDIT: well, I guess I'm sorta wrong. The whole thing looks complicated. Making sure you don't violate German data protection laws is confusing [0][1]. [0] http://www.thomashelbing.com/en/analysis-data-protection-authority-use-non-eu-cloud-might-violate-german-data-protection-law http://www.thomashelbing.com/en/analysis-data-protection-aut... [1] http://blogs.computerworlduk.com/cloud-vision/2012/04/cloud-computing-and-eu-data-protection-law-part-two/index.htm http://blogs.computerworlduk.com/cloud-vision/2012/04/cloud-...
      - toyg 13y ago
        You are not wrong: Amazon now agrees not to move data from EU servers... unless compelled by authorities. US authorities can force Amazon to open their data centres wide open, regardless of location, at any time under Patriot Act provisions. Before Snowden, this was considered a far-fetched scenario, unlikely to ever pan out in practice. We now know that it happens pretty much every day. The Safe Harbour program is a weak attempt at saving face: as long as the Patriot Act exists, no US-based company will ever be able to comply with EU privacy laws as they stand. Being "compliant with Safe Harbour provisions" only means that they're making promises they won't be able to keep.
    - toomuchtodo 13y ago
      The company, directors, ands staff must reside outside of US jurisdiction, not just the equipment.
  - bdunbar 13y ago
    > There is also a Safe Harbor scheme that is intended to overcome this problem so working with US businesses is still possible if they provide additional safeguards. However, it's now clear that no business operating in the United States can actually offer the required guarantees, no matter how sincerely they might wish to. Can you provide more data on that? I'm 'only' a system administrator, but I'm working for a company that is doing business in the both US and UK. Real Soon now we're going to be standing up a stack in the UK .. but I'd like to know what safeguards I can't guarantee so when I'm dealing with _two_ data sets and _two_ code bases and squared complexity I know _why_. It will help at 3 a.m.
amaks 13y ago
What if a datacenter which hosts these cloud services was in Germany?
- JulianMorrison 13y ago
  Then you probably have to worry about two legal systems. The company is still American.
  - killerpopiller 13y ago
    exactly. see national securities letters. It will spur european services though and self hosted cloud solutions: own cloud and the like. I am looking forward to see more of those initiatives. This growing distance between one and ones data is a dangerous path anyways, see also the rise of appliances and the decline of full access pc. it takes responsibilty away and media competence.
gcv 13y ago
I'm pretty sure that certain entities within the US (and elsewhere) already have full mirrors of all data hosted in German clouds.
- mark-r 13y ago
  Perhaps, but it's one thing to have your data stolen in secret vs. handing it over voluntarily.
- pekk 13y ago
  Oh yes, I'm also sure that every story I hear is true as long as it plays to my political biases.
parasubvert 13y ago
I am presuming eu-west-1 / Ireland isn't acceptable?
hyperbovine 13y ago
Don't place your precious information in the cloud. NSA or no NSA, was it ever a good idea to store your deepest secrets inside of a nebulous black box that you don't control? What sane person would do this in real life?
- k3n 13y ago
  Because money? The price differential between buying the hw/sw & staffing a professional (or team of professionals) to curate and maintain it 24/7/365, or simply off-loading it all to an outside party, could be huge -- I'd dare say huge enough to make or break a company. From an executive POV, why care about data safety, when hosting it yourself makes your business model non-viable? I realize there are lots of problems with this line of thinking, and I'm not advocating it at all, but I'm willing to bet this has been the case for some.
  - ENGNR 13y ago
    Exactly, the more efficient solution is having a government you can trust.
    - mpyne 13y ago
      Well, and one the Germans can trust too, unless the Internet is artificially split back up across political boundaries :P
    - toyg 13y ago
      For some values of "efficient". Building a government you can trust will take several generations, with each generation providing hundreds of thousands ENTIRE LIVES to the cause. It might be efficient in the grand scheme of things, but from an individual or even corporative point of view, it's terribly inefficient in any timeframe you might consider.
  - hyperbovine 13y ago
    The vast majority of data, business as well as personal, does not require this level of security. For the remaining 1%, these sorts of measures are worth it.t
manmal 13y ago
Might be that Protonet is for you: http://www.protonet.info/de/ http://www.protonet.info/de/ Those guys pitched at the Pioneers Festival in Vienna two weeks ago, and there's really something to the idea of a private, plug- and play box in your office which hosts something like a cloud. They are from Germany, too. It's too expensive for our uses, though.
- fh973 13y ago
  There is also https://www.tocario.com/ https://www.tocario.com/, which seems to have pricing similiar to Amazon. I guess there are tons of others. So actually just another us-too product from big corp. Next Google news in 3, 2, 1....
- desireco42 13y ago
  I can't figure it out from their website, what is the price? Looks like a good concept.
elwell 13y ago
So, I don't want to move to Germany anymore? This is crazy.
anigbrowl 13y ago
Market opportunity for you, then.
Roritharr 13y ago
I can feel your pain. It's a very weird situation in Germany for people like us. Legally it's not allowed, but you have to have ten lawyers backing you to make people in your company believe you that Office 365 and other SAAS Software isn't legally usable... Google Apps for Business, ZenDesk... We've just faced this situation with a customer who we've shown several lawyer inquiries we've sent about this topic and he flatout replied: "Well i guess your lawyers aren't very good then."
- chmars 13y ago
  It can be legal – with information and consent. And it's done all the time. Of course, customers don't pay for using crappy and expensive European IT solutions. Dreaming of a European cloud is great but the leading providers are American.
deleted 13y ago
[deleted]
outside1234 13y ago
your data is less safe in a German cloud - the NSA is no holds barred in going after that.
tallanvor 13y ago
German companies can and do use services like Office 365, AWS, and others. Obviously some choose not to due to concerns about who might access their data, but there are no legal issues preventing them from doing so.

mey 13y ago

Legally or due to your privacy concerns? Just looking for clarification on your statement of "Can't" if that is a personal preference or legal obligation for government/corporations doing business locally.

SpikeGronim 13y ago
Legally, due to the EU Data Protection Directive. It's a legal obligation.
nisa 13y ago
Legal concerns. I'm not a lawyer but there are quite strict rules. Here is an example based on Google Analytics (first Google hit): http://www.searchlaboratory.com/blog/2013/06/germanys-data-protection-laws/ http://www.searchlaboratory.com/blog/2013/06/germanys-data-p...
Silhouette 13y ago
There is a general, Europe-wide restriction on exporting personal data outside of the EEA to somewhere that doesn't provide an acceptable level of protection (which by default the United States does not). There is also a Safe Harbor scheme that is intended to overcome this problem so working with US businesses is still possible if they provide additional safeguards. However, it's now clear that no business operating in the United States can actually offer the required guarantees, no matter how sincerely they might wish to. It is therefore unclear whether a European business relying on Safe Harbor to cover its rear would actually have much of a case in court if one of its customers were actually damaged as a result. I've seen a lot of businesses at least considering pulling out of US services, cloud or otherwise, for this reason in recent months. Some are sticking with it, on the grounds that there is safety in numbers: no government regulator really wants to damage global trade by making examples of businesses who are just trying to do their work and acting in good faith, and if you're dealing with a similarly honest business from the US then the odds of an actual customer complaint are probably low enough that it might be considered an acceptable business risk. Others seem to have lawyers who are more wary and fear the penalties of something like a mass leak across the pond that would come back to bite their clients back home. In addition, some nations in Europe are a lot more concerned about privacy both legally and culturally than the US, for obvious historical reasons if nothing else, and they may have stronger laws still.
- res0nat0r 13y ago
  eu-west-1 is hosted in Dublin.
  - kyrra 13y ago
    My understand is that since Amazon is a US-based company, they could be forced, by the US government, to turn over data that is hosted in other countries. So using an Amazon cloud, even if its based in the EU, is still not possible. EDIT: well, I guess I'm sorta wrong. The whole thing looks complicated. Making sure you don't violate German data protection laws is confusing [0][1]. [0] http://www.thomashelbing.com/en/analysis-data-protection-authority-use-non-eu-cloud-might-violate-german-data-protection-law http://www.thomashelbing.com/en/analysis-data-protection-aut... [1] http://blogs.computerworlduk.com/cloud-vision/2012/04/cloud-computing-and-eu-data-protection-law-part-two/index.htm http://blogs.computerworlduk.com/cloud-vision/2012/04/cloud-...
    - toyg 13y ago
      You are not wrong: Amazon now agrees not to move data from EU servers... unless compelled by authorities. US authorities can force Amazon to open their data centres wide open, regardless of location, at any time under Patriot Act provisions. Before Snowden, this was considered a far-fetched scenario, unlikely to ever pan out in practice. We now know that it happens pretty much every day. The Safe Harbour program is a weak attempt at saving face: as long as the Patriot Act exists, no US-based company will ever be able to comply with EU privacy laws as they stand. Being "compliant with Safe Harbour provisions" only means that they're making promises they won't be able to keep.
  - toomuchtodo 13y ago
    The company, directors, ands staff must reside outside of US jurisdiction, not just the equipment.
- bdunbar 13y ago
  > There is also a Safe Harbor scheme that is intended to overcome this problem so working with US businesses is still possible if they provide additional safeguards. However, it's now clear that no business operating in the United States can actually offer the required guarantees, no matter how sincerely they might wish to. Can you provide more data on that? I'm 'only' a system administrator, but I'm working for a company that is doing business in the both US and UK. Real Soon now we're going to be standing up a stack in the UK .. but I'd like to know what safeguards I can't guarantee so when I'm dealing with _two_ data sets and _two_ code bases and squared complexity I know _why_. It will help at 3 a.m.

amaks 13y ago

What if a datacenter which hosts these cloud services was in Germany?

JulianMorrison 13y ago
Then you probably have to worry about two legal systems. The company is still American.
- killerpopiller 13y ago
  exactly. see national securities letters. It will spur european services though and self hosted cloud solutions: own cloud and the like. I am looking forward to see more of those initiatives. This growing distance between one and ones data is a dangerous path anyways, see also the rise of appliances and the decline of full access pc. it takes responsibilty away and media competence.

gcv 13y ago

I'm pretty sure that certain entities within the US (and elsewhere) already have full mirrors of all data hosted in German clouds.

mark-r 13y ago
Perhaps, but it's one thing to have your data stolen in secret vs. handing it over voluntarily.
pekk 13y ago
Oh yes, I'm also sure that every story I hear is true as long as it plays to my political biases.

parasubvert 13y ago

I am presuming eu-west-1 / Ireland isn't acceptable?

hyperbovine 13y ago

Don't place your precious information in the cloud. NSA or no NSA, was it ever a good idea to store your deepest secrets inside of a nebulous black box that you don't control? What sane person would do this in real life?

k3n 13y ago
Because money? The price differential between buying the hw/sw & staffing a professional (or team of professionals) to curate and maintain it 24/7/365, or simply off-loading it all to an outside party, could be huge -- I'd dare say huge enough to make or break a company. From an executive POV, why care about data safety, when hosting it yourself makes your business model non-viable? I realize there are lots of problems with this line of thinking, and I'm not advocating it at all, but I'm willing to bet this has been the case for some.
- ENGNR 13y ago
  Exactly, the more efficient solution is having a government you can trust.
  - mpyne 13y ago
    Well, and one the Germans can trust too, unless the Internet is artificially split back up across political boundaries :P
  - toyg 13y ago
    For some values of "efficient". Building a government you can trust will take several generations, with each generation providing hundreds of thousands ENTIRE LIVES to the cause. It might be efficient in the grand scheme of things, but from an individual or even corporative point of view, it's terribly inefficient in any timeframe you might consider.
- hyperbovine 13y ago
  The vast majority of data, business as well as personal, does not require this level of security. For the remaining 1%, these sorts of measures are worth it.t

manmal 13y ago

Might be that Protonet is for you: http://www.protonet.info/de/ http://www.protonet.info/de/ Those guys pitched at the Pioneers Festival in Vienna two weeks ago, and there's really something to the idea of a private, plug- and play box in your office which hosts something like a cloud. They are from Germany, too. It's too expensive for our uses, though.

fh973 13y ago
There is also https://www.tocario.com/ https://www.tocario.com/, which seems to have pricing similiar to Amazon. I guess there are tons of others. So actually just another us-too product from big corp. Next Google news in 3, 2, 1....
desireco42 13y ago
I can't figure it out from their website, what is the price? Looks like a good concept.

elwell 13y ago

So, I don't want to move to Germany anymore? This is crazy.

anigbrowl 13y ago

Market opportunity for you, then.

Roritharr 13y ago

I can feel your pain. It's a very weird situation in Germany for people like us. Legally it's not allowed, but you have to have ten lawyers backing you to make people in your company believe you that Office 365 and other SAAS Software isn't legally usable... Google Apps for Business, ZenDesk... We've just faced this situation with a customer who we've shown several lawyer inquiries we've sent about this topic and he flatout replied: "Well i guess your lawyers aren't very good then."

chmars 13y ago
It can be legal – with information and consent. And it's done all the time. Of course, customers don't pay for using crappy and expensive European IT solutions. Dreaming of a European cloud is great but the leading providers are American.

deleted 13y ago

[deleted]

outside1234 13y ago

your data is less safe in a German cloud - the NSA is no holds barred in going after that.

tallanvor 13y ago

German companies can and do use services like Office 365, AWS, and others. Obviously some choose not to due to concerns about who might access their data, but there are no legal issues preventing them from doing so.