11 ms·

New Twist in International Relations: Corporate Keep-My-Data-Out-of-U.S. Clause

156 points by RougeFemme 13y ago

xacaxulu 13y ago
The inevitable backlash. Bullies only last so long.
deleted 13y ago
[deleted]
robomartin 13y ago
I've probably devoted more time on HN to discuss the reality of politics and government than to cover technology issues. At times I feel pretty bad about this. I've also been subject to a partial new post hell-ban which may still be in place (surprisingly enough, most of my new submissions are tech related). And, yes, I've felt bad about this from time to time, to the point of limiting myself to reading HN and not posting for weeks at a time. As I have watched all of this NSA, IRS, ACA/Obamacare and big-broken-government nonsense has developed over the last, say, ten years or so, I can't help but think that the tech community needs to be shaken-up like this in order to finally abandon ship and start really using their brains politically rather than acting as mindless sheep following who knows what. I'll issue a blanket statement and say that everyone reading HN is smart. About technology. Not necessarily about politics and the ways in which the world turns. And yes, I'll say it, there's a wide swath of HN'ers who have been indoctrinated by the left-leaning academia, media and the echo chamber of the circles they frequent and identify themselves with that they've stopped applying critical reasoning skills to their political life. As I said here [0], you have to be smart about your politics if you want to succeed in business in general. If you are not, you run the risk of incompetent moronic government-originated factors affecting your playing field in small and major ways. And, by the way, it really doesn't matter if you are an employee or an entrepreneur, a union or non-unionized worker. When things like this start happening they affect EVERYONE and there's a chain reaction that will make things suck in a big way for all involved, at any layer and at every station in life. What you want, in order to succeed, is as little meddling and interference as possible. No, I am not suggesting anarchy. That's bad. No, I am not suggesting no government. That's worst. What I am saying is that you want a small non-intrusive government at all levels, from local to federal. You want a government that truly has our long term best interests at heart and not one that is a partisan prostitute acting almost exclusively to keep their sick species and party alive at the expense of the opposition and, what's worst, you, me, our families and our very country. We might just be entering into a phase where we might just realize that terrorism can't even begin to match the level of destruction bad governments and their policies are capable of producing. Yes, yes. Crazy talk. I really don't like talking this way. It's just that sometimes I feel like people need a collective slap on the face with a well timed "Snap out of it!" before they'll wake up and see what is really going on. Snap out of it! Get involved! [0] https://news.ycombinator.com/item?id=6961005 https://news.ycombinator.com/item?id=6961005
- lambda 13y ago
  > rather than acting as mindless sheep following who knows what. I'll tell you right now, that anyone who uses that phrase is more of a "mindless sheep" than those he criticizes. > What I am saying is that you want a small non-intrusive government at all levels, from local to federal. Not particularly. There is no intrinsic reason to want a "small government" over a large one (or vice versa). What you want is an effective government, that best matches your interests. Of course, everyone has their own interests, so the best rough metric that we've come up for maximizing the effectiveness of the government across the whole population, and minimizing its harm, are democratic institutions with various protections in place to prevent various types of abuses. Likewise, you don't necessarily want small corporations or large ones. A large corporation has more power and is able to abuse that power more; but it is also frequently more efficient than having lots of small actors, as lots of transactions between independent actors can add friction and cost. Distributed systems have problems, as they can exhibit lots of complex behaviors that can cause destabilizing feedback, and they can be inefficient. Centralized systems have problems, because they provide single points of failure or points of corruption that can be exploited for gain. Some balance between the two of them is necessary, and it's also necessary to spend effort on simply fixing problems that come up rather than thinking that every problem can be solved by adhering to some philosophy of "big government" vs. "small government". > mindless sheep ... wake up and see what is really going on. Did you really just write a long winded "wake up sheeple" post? Are you trying to be a self-parody?
  - robomartin 13y ago
    > I'll tell you right now, that anyone who uses that phrase is more of a "mindless sheep" than those he criticizes. Why? > There is no intrinsic reason to want a "small government" over a large one (or vice versa). What you want is an effective government, that best matches your interests. You would have a point there if "big government" was used to convey the literal meaning of the phrase by Libertarians. It is not. In proper context "big government" refers to size, reach, complexity, all of the above and sometimes even more. It is generally about government that has grown beyond some boundary. This is just like saying "big brother is watching". This doesn't literally mean that your eldest brother or a some kind of a giant person is watching you. You do get that, right? Big government: wants to touch, manipulate and regulate everything and wants to have a say in everything in your life, from how much soda you can drink to which doctors you can see and more. It spends money inefficiently and with damaging results. It thinks it has power over people and that our rights are granted by government and their laws. Small government: stays out of the way and lets market forces act. It enacts and enforces just enough regulations to create protections from extremes and to protect and support those in need. It certainly stays the hell out of your diet, home, sex life and medical choices. It operates within a strict balanced budget framework that ensures our financial stability and well being as a nation. It knows that they derive their ability to act from the will of the people and that our rights cannot be trampled. In this context, yes, you do want small government.
jmspring 13y ago
An interesting idea to conform to and one I am researching for a service I've been building. There is data in transit and data at rest. For many people I know, North America (I assume Canada and the US are one and the same, at this point) is the primary market/closest entry point. Do regulations require tracking data in transit thT may eventually be stored somewhere other than the US?
Maxious 13y ago
This has been around for a while under the guise of "data sovereignty". If you look back at search results for that term, there are now laughable comments particularly by Microsoft that your data is safe in the US because even the Patriot Act requires warrants right? Little did they know...
- f_salmon 13y ago
  > Little did they know... I'd argue that a company that explicitly agrees to work with the NSA, for example by handing them over Windows security holes to be exploited by the NSA (and potentially other hackers), knows exactly the kinds of things that are going on.
- swombat 13y ago
  Even more ironic are the "digital safe harbour" provisions that cloud providers have been operating under, telling their clients that the law requires the US government to treat servers put under those provisions as not located in the US. The irony being that since the servers are "not located in the US", they are even more easily targeted by the NSA since the NSA considers the rest of the world to be sub-humans without any rights.
  - pilsetnieks 13y ago
    To nitpick somewhat, at least in the case of the US-EU safe harbor protection, it meant that certified providers were to provide the same protection to European data as it would have in the EU under the relevant EU directive, it doesn't have anything to do with location of the servers. The certification, however, is a complete joke since companies can self-assess and register themselves as safe harbor compliant.
    - Silhouette 13y ago
      The certification, however, is a complete joke since companies can self-assess and register themselves as safe harbor compliant. And this creates a genuine difficulty for EU businesses, because it's no longer credible to claim that you thought a US business was compliant because of safe harbour arrangements. It may therefore not actually be legal under European laws to export personal data to those US businesses any more. If any European company did so, and as a result there were negative consequences for the subject of the data, that could lead to a nasty lawsuit for the company that did it, even if their actions would have been considered reasonably diligent because of safe harbour a few years ago.
codex 13y ago
It's a bit laughable to presume that the NSA would be interested in a random company's laundry, or would divulge it to anyone else. Snowden's leaks do not contain any evidence of this, and yet it is well known that the Chinese, in fact, do spy for corporate gain.
- rgj 13y ago
  There is not much evidence of commercial espionage indeed. But it's not about company's laundry. It's about the laundry of the users, stored by the company. If NSA access to that hits the press, a EU company will lose a lot of customers.
  - perlpimp 13y ago
    just because it was not aired particularly what kind of economic espionage was happening - it does not mean that it is not happening.
- salient 13y ago
  Maybe you just aren't paying attention: http://www.cnbc.com/id/101291247 http://www.cnbc.com/id/101291247 http://www.theguardian.com/world/2013/sep/09/nsa-spying-brazil-oil-petrobras http://www.theguardian.com/world/2013/sep/09/nsa-spying-braz... http://www.washingtonsblog.com/2013/10/nsa-busted-conducting-industrial-espionage-in-france-mexico-brazil-and-other-countries.html http://www.washingtonsblog.com/2013/10/nsa-busted-conducting... There are a lot of things that we thought it would be "outrageous" for NSA to do, and yet we found out later they're doing them. If anything, NSA is more interested in spying on corporations for the purpose of economic espionage than anything else. Why else would Germany be spied upon by the NSA as much as China is? http://www.theverge.com/2013/6/30/4481670/nsa-spying-in-germany-revealed-der-spiegel http://www.theverge.com/2013/6/30/4481670/nsa-spying-in-germ...
zaroth 13y ago
Worst possible knee-jerk reaction. Data outside the US is the easiest for the NSA to access. It's only data that never leaves the US which in theory you can argue is subject to warrants. Of course, since it's so easy to redirect your traffic outside the US using BGP, it's not really a defense no matter where you are storing your data, but the clause is certainly pointless.
- sentenza 13y ago
  Oh, so since me and my company are _physically_ outside of the US, we're fucked then? But your point, of course, stands. Maybe avoid sending the data to the US and in addition punishing providing access to the NSA as treason? (I know. Won't happen.)
- bjelkeman-again 13y ago
  For international customers it is rather pointless to talk about data that never leaves the US. If this is a bad reaction, then what is a meaningful reaction?
- skrebbel 13y ago
  Wait, so the NSA can walk into a German hosting provider's office and force them to install a box and no we won't tell you what it does? You're mistaken. The NSA might have more legal space to hack into systems outside the US, but their main snooping appears to happen in (forced) cooperation with US companies. So it's a pretty decent reaction.
  - zebra 13y ago
    Given that NSA tapped the phone of the Chancellor, it's not unlikely.
  - inerte 13y ago
    The article is about US corporations. Doesn't matter where Cisco hosts the data, the NSA can knock on its door and ask for access. Do you really think Cisco is going to reply: 'Nope can't do, this data is "on" Germany!'?, when the NSA spies on Merkel herself?
adventured 13y ago
US companies would be lucky if all this did is reduce their international sales. That's just the tip of the iceberg. By far the worst damage is all that lost capital is going to flow into helping to generate a vast supply of new and bigger competition overseas. So not only will the US companies lose sales in the immediate future, they'll face amplified competition that will hit sales even more so long term. Even if the US Government has cleaned up this mess by the end of the decade, it won't matter, the financial consequences will just keep rolling. When it's all tallied up, I think the NSA and US Government abuses will cost the economy trillions of dollars in value over the course of a few decades. Something akin financially to a hundred September 11th attacks in damages. Oh the staggering brilliance of the DC machine.
- salient 13y ago
  I agree. I don't know how that number was reached, but if the potential for losses is $180 billion already, then the long term losses might reach $1 trillion, maybe more. There are so many companies that change so slowly. They probably won't give up on the US products and services within 6 months. It might take them 2 years, 3 years, or even 5 years. So there are probably many more foreign customers thinking about dumping US companies, but they just can't do it yet. But that doesn't mean they will get their future contracts if nothing (radically) changes until then.
- 001sky 13y ago
  Something akin financially to a hundred September 11th attacks in damages not to mention the waste of resources that spurnrd this on...
  - Systemic33 13y ago
    Ye, the NSA information trawling takes some serious amount of money to work, and they don't exactly employ just a hand full of analysts, more like a an army of them.
EdSharkey 13y ago
Seems to me that the reality is that big businesses hold the leash of the US government, so this is as much a repudiation of them as it is the NSA, the Obama admin et al. Microsoft, Google, Facebook, RSA and the rest deserve the shame and scorn they are receiving right now. I'm sorry if my techie friends working at those places are hurt by this, but I feel very betrayed by these companies' complicity in and taking moneys for all the surveillance and backdooring, etc. So, shame on you, I hope your brands aren't totally ruined.
rgj 13y ago
The customers of the Dutch cloud-services conpany I work for haven been demanding this for at least ten years. Snowden didn't change much there, it's been going on since the Patriot act. European Union privacy legislation demands that sensitive data is stored within the EU. Storing data in other countries is only permitted if a satisfactory level of protection can be offered. This was used in marketing by EU companies in order to promote their own services, effectively creating FUD around US-based services. When the Amsterdam Internet Exchange (AMS-IX) recently opened up an office in NYC there was a big fuss about it, because it would make the entire Dutch internet traffic subject to the Patriot act, since it applies to any company with an office on American soil.
- bjelkeman-again 13y ago
  So what did AMS-IX say?
  - rgj 13y ago
    http://translate.google.com/translate?sl=nl&tl=en&u=http%3A//tweakers.net/nieuws/92142/ams-ix-kiest-niet-voor-onafhankelijke-stichting-bij-amerikaanse-uitbreiding.html http://translate.google.com/translate?sl=nl&tl=en&u=http%3A/...
- thisone 13y ago
  I've been dealing with this for what seems like ages now. At my last job I actually had to go a get a new service shut down because the people who provisioned it didn't realise or understand that it was a problem that all the PID was being stored in the US. I've read the Safe Harbor rules and audit information and I don't trust it one bit. I really can't blame corporations, especially EU ones, from stating very plainly that they don't want their data stored in the US.
- draugadrotten 13y ago
  > European Union privacy legislation demands that sensitive data is stored within the EU While this may be officially promoted as a way of protecting against EU citizens against NSA (US access) to the data, it is also a way for the EU to ensure that EU can get to the data when the EU wants access.
bjelkeman-again 13y ago
Everyone in Europe I talk to about online data agrees that this isn't empty talk. Practically it really isn't possible today to in a meaningful way avoid some of your data or data about your usage of the Internet to end up in the US. But, I would argue that this is more of a change in mindset and awareness at this point, which eventually will force changes. Companies or local government will want their data to be stored in a jurisdiction where they at least have an influence over how it is protected. Balkanisation may be the result, or ineffectual laws and regulations, maybe even something useful. But I believe something will happen.
- tombrossman 13y ago
  I'm surprised to see the focus on jurisdiction versus other more effective methods, like open-source encrypting locally prior to moving the data off-site. Key control and eliminating the need to trust third-parties is the way forward, not trusting that some government somewhere is going to follow the rules perfectly. This also has the added benefit of protecting against unauthorised third parties gaining access via back doors or hacking, etc. These ineffectual laws and regulations you warn about are already in place. That's a dead end. It is time for people and corporations to take charge and make their data safe before it leaves their control. We've seen this happen on a big scale with Google now supposedly encrypting data between data centers, and on a (much) smaller scale with people like me using EncFS to encrypt before moving online backups to Dropbox.
  - zachrose 13y ago
    I agree that encryption could mitigate the actual threat posed by government mass surveillance, but I also wonder how much of the new language in contracts is about consumer perception and boycotting.
- yxhuvud 13y ago
  Then you obviously didn't talk to the Swedish legislator that was perfectly fine with the fact that foreign surveillance agencies could read her email.
Paul12345534 13y ago
Spying is an age-old game and it's not just the US doing it ;) I'd love to see some leaks out of Russia and China. It doesn't matter where your data is stored if it's off-premises. If you were putting it in the cloud unencrypted, you were already at risk, Snowden or not. Intelligence agencies around the world recruit workers in tech companies, the company need not overtly cooperate to get screwed. Countries around the world slurp up data over the wire, they just haven't been caught with their hand in the cookie jar yet. At least the NSA's massive data caches won't be easily hacked. Verint (just one of many companies in the surveillance space) has 75 countries as customers. There's a ton of sh*t going on under the radar. You may hate surveillance and want more transparency but nobody can pretend it's just the US doing this stuff.
- Paul12345534 13y ago
  On top of that, I suspect some of the anti-US stuff posted is for the express purpose of gaining customers away from the US. (this may get downvoted, people may disagree, but I have no doubt it's happening)
  - dspillett 13y ago
    No, that is definitely a factor here: non-US companies are taking advantage of the recent growth in anti-US feeling to make themselves look more attractive to potential customers and investors. No one should really be surprised by this: it simply makes good business sense. The politicians will be on the ball too, at at least those whose remit covers national/international business or who have a constituency with a large workforce that could benefit. You can see a push in the other direction too: the "buy American" campaigns state-side have grown in volume, more so than can be explained purely by economic factors (which have been the key driver for that sort of thing since 2008) and an interest in protecting manufacturing jobs. If the large (relatively affluent) American market can be discouraged from buying goods/services without a US connection, companies will be discouraged from distancing themselves from US interests. Of course there has always been a certain amount of keeping business information in particular places. Some regulated industries have to by law and have had to for a long time (you can't properly regulate something if you allow it to move out of your jurisdiction), and all businesses should be aware of the issue (though sadly many aren't) when dealing with personal data. In the UK the Data Protection Act has clauses covering information security which mean you need to be care careful not only how you store personal data but where, and I assume most countries have something equivalent. A little healthy paranoia always snook in to: if the data is more local to you there is less chance you will loose access due to either technical, political, or local issues. The big difference right now compared to a-year-or-two ago is that the US has fallen off the secondary safe location list for many, and for EU based companies (and individuals) the balance in "I'd rather it be local, but if we can save a bit by hosting in the US, where market scale currently makes it cheaper, I might" has changed.
loomio 13y ago
What will the alternative cloud solutions be? I assume that many will rush to fill the gap as clients vacate US providers, offering increased privacy as a specific selling point. As a non-US startup, we're still using Heroku and AWS because we don't have the resources to make the jump to something more secure, even though we'd really like to. As soon as an accessible alternative appears we'd switch in a heartbeat.
beloch 13y ago
Other HN readers are making some assumptions that I have to take issue with. A1: Stories about this kind of thing are posted by people who want to take business away from the U.S.. This is possible, but there are a lot of people who value privacy too, and I suspect they are in the majority. Want to prove me wrong? Get polling. A2: Everybody else is doing it, but only the NSA got caught. First, this doesn't make it acceptable. Second, it's entirely possible not everybody else is doing it. Third, even if everybody is doing it, the U.S. has more money to pour into black-op projects than any other nation on Earth, so it's a safe bet that the NSA is, by far, the worst offender. A3: Countries like China spy for corporate gain, but the U.S. would never do such a thing. Right, the U.S. has never staged a coup or conducted a war that benefited U.S. corporations, and certainly wouldn't need intelligence to help with that sort of thing in the future... ----- If you're okay with what the NSA has been doing, here's something to consider. Several years ago Sony got a lot of bad press for putting rootkits onto audio CD's. They wanted to stop piracy. Honest customers had nothing to fear from Sony! However, honest customers did have something to fear from viruses, malware, etc. that were subsequently written to exploit the security holes created by the root-kit. The NSA is collecting data on you. You trust the NSA and your nation, so you're not worried about how they'll use that data. Fine. Do you trust everyone who works for them? You probably shouldn't. They certainly don't trust their own employees and they still got burned by Snowden! The NSA might not be looking at your data until you do something terroristy, but who else could have access to the NSA's data-stores? Would anyone know Snowden had stolen all those files if he kept quiet about them? Probably not. Odds are you're pretty boring and nobody is interested in what the NSA has on you. What if you were actually really interesting, and your enemies had a lot of money? Do you plan on becoming interesting at some point in the future, or are you firmly committed to being a bore until you die?
- seanccox 13y ago
  Several good points here... For me, it boils down to a simple question: If the NSA doesn't intend to use my data or data about me for some malicious purpose, then why do they need it?
  - slashdotaccount 13y ago
parag_c_mehta 13y ago
Just imagine ramifications of this on person level too. You use Facebook ? Google ? Dropbox ? SkyDrive ? you are already under NSA Scanner :) I just hope corporates put pressure on US government to back out of NSA treachery.
atmosx 13y ago
I agree with most comments here. This was expected, these are not empty threats and no one is over-reacting. Everyone is just re-acting as they were expected too. Except maybe the Obama administration, which has to do some hard decisions. Snowden is growing stronger by the day now. The part that caught my eye though was this: > It's not all doom and gloom, however. Thompson's comments show that some U.S. firms stand to benefit from distrust of the U.S. government, and that a new model may be in the offing for protecting sensitive data from the NSA's prying eyes. Apparently, Bloomberg sticks to the Liberal mantra that says more or less that when a market dies a new one emerges. Maybe the 5% of affected population, in terms of companies, will build a new business model but how this is good news is beyond me. It's like when you listen people saying that YOU can now create a startup in TV because they saw a Steve Jobs 2-minute video documentary on Apple. People apparently don't know that for every successful startup there are 1.000.000 failed for no apparent reason.
- bryanlarsen 13y ago
  This is good news in the same way that a broken window is good news to the glazier. The broken windows fallacy is alive and well in the media. Journalists are also trained to show "both sides" of the story even if the other side of the story is complete nonsense.
bowlofpetunias 13y ago
This trend pre-dates the NSA scandal, at least from my European perspective. The US government has legally given it's intelligence and security agencies the right to secretly claim access to data stored by American companies including data not physically stored in the US. As a result, it's not just a matter of non-US companies and citizens not wanting to store data with US companies, in many if not most cases it's not even legal for them to do so. As a European company, I have to give certain guarantees about the protection and usages of privacy sensitive data. Storing it under the jurisdiction of a country that does not respect that is out of the question. This has nothing to do with any illegal activities by the NSA or their non-American counterparts. This is the existing legal regime of the US. Of course the NSA scandal has highlighted the facts that any guarantees the US so far has given about not abusing this are null and void. From the US can get use data, it has now become the US will us your data. That will significantly and irreversibly speed up the process of taking data out of US companies. But the process itself had already started, it is just a very slow process (no corporation or government can drastically alter their IT infrastructure within a short term). The real effects won't be felt until another five to ten years, if not more.
cpfohl 13y ago
Well...if Americans cant get things changed with votes in their own democratic society, at least non-Americans can get things changed with their own wallets. (Debated using quotes around democratic...left 'em off after all...but it was close). Americans obviously can change things with their wallets, but it's more difficult, and involves a lot more steps like encrypting before sending, etc.
puppetmaster3 13y ago
Predictable. This will make Silicon Valley into Detroit, and my job. Thank you corrupt congress w/ your 10% approval.
- csense 13y ago
  Actually the NSA's overreach is more a problem with the executive branch. Congress tried to establish checks and balances over the intelligence community by establishing FISA after Watergate, but it wasn't enough. Judge Leon's ruling [1] actually discusses the shortcomings of the FISA court. [1] http://legaltimes.typepad.com/files/obamansa.pdf http://legaltimes.typepad.com/files/obamansa.pdf
polskibus 13y ago
As far as I know, similar data locality guarantees are now hot topic in Germany and are often mentioned during sales pitches of SaaS platforms. USA shot itself in the foot and it is competition's holy duty to its shareholders to exploit it.
devrelm 13y ago
This has been going on for at least a few years. Large financial institutions in Europe have contracts with vendors stating that servers cannot be hosted in the US because of all the warrantless snooping.
stcredzero 13y ago
Could this be a possible benefit of the Google Barge? Could they be trying to get data out of the jurisdiction of the US government?

156 points by RougeFemme 13y ago

xacaxulu 13y ago

The inevitable backlash. Bullies only last so long.

deleted 13y ago

[deleted]

robomartin 13y ago

I've probably devoted more time on HN to discuss the reality of politics and government than to cover technology issues. At times I feel pretty bad about this. I've also been subject to a partial new post hell-ban which may still be in place (surprisingly enough, most of my new submissions are tech related). And, yes, I've felt bad about this from time to time, to the point of limiting myself to reading HN and not posting for weeks at a time. As I have watched all of this NSA, IRS, ACA/Obamacare and big-broken-government nonsense has developed over the last, say, ten years or so, I can't help but think that the tech community needs to be shaken-up like this in order to finally abandon ship and start really using their brains politically rather than acting as mindless sheep following who knows what. I'll issue a blanket statement and say that everyone reading HN is smart. About technology. Not necessarily about politics and the ways in which the world turns. And yes, I'll say it, there's a wide swath of HN'ers who have been indoctrinated by the left-leaning academia, media and the echo chamber of the circles they frequent and identify themselves with that they've stopped applying critical reasoning skills to their political life. As I said here [0], you have to be smart about your politics if you want to succeed in business in general. If you are not, you run the risk of incompetent moronic government-originated factors affecting your playing field in small and major ways. And, by the way, it really doesn't matter if you are an employee or an entrepreneur, a union or non-unionized worker. When things like this start happening they affect EVERYONE and there's a chain reaction that will make things suck in a big way for all involved, at any layer and at every station in life. What you want, in order to succeed, is as little meddling and interference as possible. No, I am not suggesting anarchy. That's bad. No, I am not suggesting no government. That's worst. What I am saying is that you want a small non-intrusive government at all levels, from local to federal. You want a government that truly has our long term best interests at heart and not one that is a partisan prostitute acting almost exclusively to keep their sick species and party alive at the expense of the opposition and, what's worst, you, me, our families and our very country. We might just be entering into a phase where we might just realize that terrorism can't even begin to match the level of destruction bad governments and their policies are capable of producing. Yes, yes. Crazy talk. I really don't like talking this way. It's just that sometimes I feel like people need a collective slap on the face with a well timed "Snap out of it!" before they'll wake up and see what is really going on. Snap out of it! Get involved! [0] https://news.ycombinator.com/item?id=6961005 https://news.ycombinator.com/item?id=6961005

lambda 13y ago
> rather than acting as mindless sheep following who knows what. I'll tell you right now, that anyone who uses that phrase is more of a "mindless sheep" than those he criticizes. > What I am saying is that you want a small non-intrusive government at all levels, from local to federal. Not particularly. There is no intrinsic reason to want a "small government" over a large one (or vice versa). What you want is an effective government, that best matches your interests. Of course, everyone has their own interests, so the best rough metric that we've come up for maximizing the effectiveness of the government across the whole population, and minimizing its harm, are democratic institutions with various protections in place to prevent various types of abuses. Likewise, you don't necessarily want small corporations or large ones. A large corporation has more power and is able to abuse that power more; but it is also frequently more efficient than having lots of small actors, as lots of transactions between independent actors can add friction and cost. Distributed systems have problems, as they can exhibit lots of complex behaviors that can cause destabilizing feedback, and they can be inefficient. Centralized systems have problems, because they provide single points of failure or points of corruption that can be exploited for gain. Some balance between the two of them is necessary, and it's also necessary to spend effort on simply fixing problems that come up rather than thinking that every problem can be solved by adhering to some philosophy of "big government" vs. "small government". > mindless sheep ... wake up and see what is really going on. Did you really just write a long winded "wake up sheeple" post? Are you trying to be a self-parody?
- robomartin 13y ago
  > I'll tell you right now, that anyone who uses that phrase is more of a "mindless sheep" than those he criticizes. Why? > There is no intrinsic reason to want a "small government" over a large one (or vice versa). What you want is an effective government, that best matches your interests. You would have a point there if "big government" was used to convey the literal meaning of the phrase by Libertarians. It is not. In proper context "big government" refers to size, reach, complexity, all of the above and sometimes even more. It is generally about government that has grown beyond some boundary. This is just like saying "big brother is watching". This doesn't literally mean that your eldest brother or a some kind of a giant person is watching you. You do get that, right? Big government: wants to touch, manipulate and regulate everything and wants to have a say in everything in your life, from how much soda you can drink to which doctors you can see and more. It spends money inefficiently and with damaging results. It thinks it has power over people and that our rights are granted by government and their laws. Small government: stays out of the way and lets market forces act. It enacts and enforces just enough regulations to create protections from extremes and to protect and support those in need. It certainly stays the hell out of your diet, home, sex life and medical choices. It operates within a strict balanced budget framework that ensures our financial stability and well being as a nation. It knows that they derive their ability to act from the will of the people and that our rights cannot be trampled. In this context, yes, you do want small government.

jmspring 13y ago

An interesting idea to conform to and one I am researching for a service I've been building. There is data in transit and data at rest. For many people I know, North America (I assume Canada and the US are one and the same, at this point) is the primary market/closest entry point. Do regulations require tracking data in transit thT may eventually be stored somewhere other than the US?

Maxious 13y ago

This has been around for a while under the guise of "data sovereignty". If you look back at search results for that term, there are now laughable comments particularly by Microsoft that your data is safe in the US because even the Patriot Act requires warrants right? Little did they know...

f_salmon 13y ago
> Little did they know... I'd argue that a company that explicitly agrees to work with the NSA, for example by handing them over Windows security holes to be exploited by the NSA (and potentially other hackers), knows exactly the kinds of things that are going on.
swombat 13y ago
Even more ironic are the "digital safe harbour" provisions that cloud providers have been operating under, telling their clients that the law requires the US government to treat servers put under those provisions as not located in the US. The irony being that since the servers are "not located in the US", they are even more easily targeted by the NSA since the NSA considers the rest of the world to be sub-humans without any rights.
- pilsetnieks 13y ago
  To nitpick somewhat, at least in the case of the US-EU safe harbor protection, it meant that certified providers were to provide the same protection to European data as it would have in the EU under the relevant EU directive, it doesn't have anything to do with location of the servers. The certification, however, is a complete joke since companies can self-assess and register themselves as safe harbor compliant.
  - Silhouette 13y ago
    The certification, however, is a complete joke since companies can self-assess and register themselves as safe harbor compliant. And this creates a genuine difficulty for EU businesses, because it's no longer credible to claim that you thought a US business was compliant because of safe harbour arrangements. It may therefore not actually be legal under European laws to export personal data to those US businesses any more. If any European company did so, and as a result there were negative consequences for the subject of the data, that could lead to a nasty lawsuit for the company that did it, even if their actions would have been considered reasonably diligent because of safe harbour a few years ago.

codex 13y ago

It's a bit laughable to presume that the NSA would be interested in a random company's laundry, or would divulge it to anyone else. Snowden's leaks do not contain any evidence of this, and yet it is well known that the Chinese, in fact, do spy for corporate gain.

rgj 13y ago
There is not much evidence of commercial espionage indeed. But it's not about company's laundry. It's about the laundry of the users, stored by the company. If NSA access to that hits the press, a EU company will lose a lot of customers.
- perlpimp 13y ago
  just because it was not aired particularly what kind of economic espionage was happening - it does not mean that it is not happening.
salient 13y ago
Maybe you just aren't paying attention: http://www.cnbc.com/id/101291247 http://www.cnbc.com/id/101291247 http://www.theguardian.com/world/2013/sep/09/nsa-spying-brazil-oil-petrobras http://www.theguardian.com/world/2013/sep/09/nsa-spying-braz... http://www.washingtonsblog.com/2013/10/nsa-busted-conducting-industrial-espionage-in-france-mexico-brazil-and-other-countries.html http://www.washingtonsblog.com/2013/10/nsa-busted-conducting... There are a lot of things that we thought it would be "outrageous" for NSA to do, and yet we found out later they're doing them. If anything, NSA is more interested in spying on corporations for the purpose of economic espionage than anything else. Why else would Germany be spied upon by the NSA as much as China is? http://www.theverge.com/2013/6/30/4481670/nsa-spying-in-germany-revealed-der-spiegel http://www.theverge.com/2013/6/30/4481670/nsa-spying-in-germ...

zaroth 13y ago

Worst possible knee-jerk reaction. Data outside the US is the easiest for the NSA to access. It's only data that never leaves the US which in theory you can argue is subject to warrants. Of course, since it's so easy to redirect your traffic outside the US using BGP, it's not really a defense no matter where you are storing your data, but the clause is certainly pointless.

sentenza 13y ago
Oh, so since me and my company are _physically_ outside of the US, we're fucked then? But your point, of course, stands. Maybe avoid sending the data to the US and in addition punishing providing access to the NSA as treason? (I know. Won't happen.)
bjelkeman-again 13y ago
For international customers it is rather pointless to talk about data that never leaves the US. If this is a bad reaction, then what is a meaningful reaction?
skrebbel 13y ago
Wait, so the NSA can walk into a German hosting provider's office and force them to install a box and no we won't tell you what it does? You're mistaken. The NSA might have more legal space to hack into systems outside the US, but their main snooping appears to happen in (forced) cooperation with US companies. So it's a pretty decent reaction.
- zebra 13y ago
  Given that NSA tapped the phone of the Chancellor, it's not unlikely.
- inerte 13y ago
  The article is about US corporations. Doesn't matter where Cisco hosts the data, the NSA can knock on its door and ask for access. Do you really think Cisco is going to reply: 'Nope can't do, this data is "on" Germany!'?, when the NSA spies on Merkel herself?

adventured 13y ago

US companies would be lucky if all this did is reduce their international sales. That's just the tip of the iceberg. By far the worst damage is all that lost capital is going to flow into helping to generate a vast supply of new and bigger competition overseas. So not only will the US companies lose sales in the immediate future, they'll face amplified competition that will hit sales even more so long term. Even if the US Government has cleaned up this mess by the end of the decade, it won't matter, the financial consequences will just keep rolling. When it's all tallied up, I think the NSA and US Government abuses will cost the economy trillions of dollars in value over the course of a few decades. Something akin financially to a hundred September 11th attacks in damages. Oh the staggering brilliance of the DC machine.

salient 13y ago
I agree. I don't know how that number was reached, but if the potential for losses is $180 billion already, then the long term losses might reach $1 trillion, maybe more. There are so many companies that change so slowly. They probably won't give up on the US products and services within 6 months. It might take them 2 years, 3 years, or even 5 years. So there are probably many more foreign customers thinking about dumping US companies, but they just can't do it yet. But that doesn't mean they will get their future contracts if nothing (radically) changes until then.
001sky 13y ago
Something akin financially to a hundred September 11th attacks in damages not to mention the waste of resources that spurnrd this on...
- Systemic33 13y ago
  Ye, the NSA information trawling takes some serious amount of money to work, and they don't exactly employ just a hand full of analysts, more like a an army of them.

EdSharkey 13y ago

Seems to me that the reality is that big businesses hold the leash of the US government, so this is as much a repudiation of them as it is the NSA, the Obama admin et al. Microsoft, Google, Facebook, RSA and the rest deserve the shame and scorn they are receiving right now. I'm sorry if my techie friends working at those places are hurt by this, but I feel very betrayed by these companies' complicity in and taking moneys for all the surveillance and backdooring, etc. So, shame on you, I hope your brands aren't totally ruined.

rgj 13y ago

The customers of the Dutch cloud-services conpany I work for haven been demanding this for at least ten years. Snowden didn't change much there, it's been going on since the Patriot act. European Union privacy legislation demands that sensitive data is stored within the EU. Storing data in other countries is only permitted if a satisfactory level of protection can be offered. This was used in marketing by EU companies in order to promote their own services, effectively creating FUD around US-based services. When the Amsterdam Internet Exchange (AMS-IX) recently opened up an office in NYC there was a big fuss about it, because it would make the entire Dutch internet traffic subject to the Patriot act, since it applies to any company with an office on American soil.

bjelkeman-again 13y ago
So what did AMS-IX say?
- rgj 13y ago
  http://translate.google.com/translate?sl=nl&tl=en&u=http%3A//tweakers.net/nieuws/92142/ams-ix-kiest-niet-voor-onafhankelijke-stichting-bij-amerikaanse-uitbreiding.html http://translate.google.com/translate?sl=nl&tl=en&u=http%3A/...
thisone 13y ago
I've been dealing with this for what seems like ages now. At my last job I actually had to go a get a new service shut down because the people who provisioned it didn't realise or understand that it was a problem that all the PID was being stored in the US. I've read the Safe Harbor rules and audit information and I don't trust it one bit. I really can't blame corporations, especially EU ones, from stating very plainly that they don't want their data stored in the US.
draugadrotten 13y ago
> European Union privacy legislation demands that sensitive data is stored within the EU While this may be officially promoted as a way of protecting against EU citizens against NSA (US access) to the data, it is also a way for the EU to ensure that EU can get to the data when the EU wants access.

bjelkeman-again 13y ago

Everyone in Europe I talk to about online data agrees that this isn't empty talk. Practically it really isn't possible today to in a meaningful way avoid some of your data or data about your usage of the Internet to end up in the US. But, I would argue that this is more of a change in mindset and awareness at this point, which eventually will force changes. Companies or local government will want their data to be stored in a jurisdiction where they at least have an influence over how it is protected. Balkanisation may be the result, or ineffectual laws and regulations, maybe even something useful. But I believe something will happen.

tombrossman 13y ago
I'm surprised to see the focus on jurisdiction versus other more effective methods, like open-source encrypting locally prior to moving the data off-site. Key control and eliminating the need to trust third-parties is the way forward, not trusting that some government somewhere is going to follow the rules perfectly. This also has the added benefit of protecting against unauthorised third parties gaining access via back doors or hacking, etc. These ineffectual laws and regulations you warn about are already in place. That's a dead end. It is time for people and corporations to take charge and make their data safe before it leaves their control. We've seen this happen on a big scale with Google now supposedly encrypting data between data centers, and on a (much) smaller scale with people like me using EncFS to encrypt before moving online backups to Dropbox.
- zachrose 13y ago
  I agree that encryption could mitigate the actual threat posed by government mass surveillance, but I also wonder how much of the new language in contracts is about consumer perception and boycotting.
yxhuvud 13y ago
Then you obviously didn't talk to the Swedish legislator that was perfectly fine with the fact that foreign surveillance agencies could read her email.

Paul12345534 13y ago

Spying is an age-old game and it's not just the US doing it ;) I'd love to see some leaks out of Russia and China. It doesn't matter where your data is stored if it's off-premises. If you were putting it in the cloud unencrypted, you were already at risk, Snowden or not. Intelligence agencies around the world recruit workers in tech companies, the company need not overtly cooperate to get screwed. Countries around the world slurp up data over the wire, they just haven't been caught with their hand in the cookie jar yet. At least the NSA's massive data caches won't be easily hacked. Verint (just one of many companies in the surveillance space) has 75 countries as customers. There's a ton of sh*t going on under the radar. You may hate surveillance and want more transparency but nobody can pretend it's just the US doing this stuff.

Paul12345534 13y ago
On top of that, I suspect some of the anti-US stuff posted is for the express purpose of gaining customers away from the US. (this may get downvoted, people may disagree, but I have no doubt it's happening)
- dspillett 13y ago
  No, that is definitely a factor here: non-US companies are taking advantage of the recent growth in anti-US feeling to make themselves look more attractive to potential customers and investors. No one should really be surprised by this: it simply makes good business sense. The politicians will be on the ball too, at at least those whose remit covers national/international business or who have a constituency with a large workforce that could benefit. You can see a push in the other direction too: the "buy American" campaigns state-side have grown in volume, more so than can be explained purely by economic factors (which have been the key driver for that sort of thing since 2008) and an interest in protecting manufacturing jobs. If the large (relatively affluent) American market can be discouraged from buying goods/services without a US connection, companies will be discouraged from distancing themselves from US interests. Of course there has always been a certain amount of keeping business information in particular places. Some regulated industries have to by law and have had to for a long time (you can't properly regulate something if you allow it to move out of your jurisdiction), and all businesses should be aware of the issue (though sadly many aren't) when dealing with personal data. In the UK the Data Protection Act has clauses covering information security which mean you need to be care careful not only how you store personal data but where, and I assume most countries have something equivalent. A little healthy paranoia always snook in to: if the data is more local to you there is less chance you will loose access due to either technical, political, or local issues. The big difference right now compared to a-year-or-two ago is that the US has fallen off the secondary safe location list for many, and for EU based companies (and individuals) the balance in "I'd rather it be local, but if we can save a bit by hosting in the US, where market scale currently makes it cheaper, I might" has changed.

loomio 13y ago

What will the alternative cloud solutions be? I assume that many will rush to fill the gap as clients vacate US providers, offering increased privacy as a specific selling point. As a non-US startup, we're still using Heroku and AWS because we don't have the resources to make the jump to something more secure, even though we'd really like to. As soon as an accessible alternative appears we'd switch in a heartbeat.

beloch 13y ago

Other HN readers are making some assumptions that I have to take issue with. A1: Stories about this kind of thing are posted by people who want to take business away from the U.S.. This is possible, but there are a lot of people who value privacy too, and I suspect they are in the majority. Want to prove me wrong? Get polling. A2: Everybody else is doing it, but only the NSA got caught. First, this doesn't make it acceptable. Second, it's entirely possible not everybody else is doing it. Third, even if everybody is doing it, the U.S. has more money to pour into black-op projects than any other nation on Earth, so it's a safe bet that the NSA is, by far, the worst offender. A3: Countries like China spy for corporate gain, but the U.S. would never do such a thing. Right, the U.S. has never staged a coup or conducted a war that benefited U.S. corporations, and certainly wouldn't need intelligence to help with that sort of thing in the future... ----- If you're okay with what the NSA has been doing, here's something to consider. Several years ago Sony got a lot of bad press for putting rootkits onto audio CD's. They wanted to stop piracy. Honest customers had nothing to fear from Sony! However, honest customers did have something to fear from viruses, malware, etc. that were subsequently written to exploit the security holes created by the root-kit. The NSA is collecting data on you. You trust the NSA and your nation, so you're not worried about how they'll use that data. Fine. Do you trust everyone who works for them? You probably shouldn't. They certainly don't trust their own employees and they still got burned by Snowden! The NSA might not be looking at your data until you do something terroristy, but who else could have access to the NSA's data-stores? Would anyone know Snowden had stolen all those files if he kept quiet about them? Probably not. Odds are you're pretty boring and nobody is interested in what the NSA has on you. What if you were actually really interesting, and your enemies had a lot of money? Do you plan on becoming interesting at some point in the future, or are you firmly committed to being a bore until you die?

seanccox 13y ago
Several good points here... For me, it boils down to a simple question: If the NSA doesn't intend to use my data or data about me for some malicious purpose, then why do they need it?
- slashdotaccount 13y ago

parag_c_mehta 13y ago

Just imagine ramifications of this on person level too. You use Facebook ? Google ? Dropbox ? SkyDrive ? you are already under NSA Scanner :) I just hope corporates put pressure on US government to back out of NSA treachery.

atmosx 13y ago

I agree with most comments here. This was expected, these are not empty threats and no one is over-reacting. Everyone is just re-acting as they were expected too. Except maybe the Obama administration, which has to do some hard decisions. Snowden is growing stronger by the day now. The part that caught my eye though was this: > It's not all doom and gloom, however. Thompson's comments show that some U.S. firms stand to benefit from distrust of the U.S. government, and that a new model may be in the offing for protecting sensitive data from the NSA's prying eyes. Apparently, Bloomberg sticks to the Liberal mantra that says more or less that when a market dies a new one emerges. Maybe the 5% of affected population, in terms of companies, will build a new business model but how this is good news is beyond me. It's like when you listen people saying that YOU can now create a startup in TV because they saw a Steve Jobs 2-minute video documentary on Apple. People apparently don't know that for every successful startup there are 1.000.000 failed for no apparent reason.

bryanlarsen 13y ago
This is good news in the same way that a broken window is good news to the glazier. The broken windows fallacy is alive and well in the media. Journalists are also trained to show "both sides" of the story even if the other side of the story is complete nonsense.

bowlofpetunias 13y ago

This trend pre-dates the NSA scandal, at least from my European perspective. The US government has legally given it's intelligence and security agencies the right to secretly claim access to data stored by American companies including data not physically stored in the US. As a result, it's not just a matter of non-US companies and citizens not wanting to store data with US companies, in many if not most cases it's not even legal for them to do so. As a European company, I have to give certain guarantees about the protection and usages of privacy sensitive data. Storing it under the jurisdiction of a country that does not respect that is out of the question. This has nothing to do with any illegal activities by the NSA or their non-American counterparts. This is the existing legal regime of the US. Of course the NSA scandal has highlighted the facts that any guarantees the US so far has given about not abusing this are null and void. From the US can get use data, it has now become the US will us your data. That will significantly and irreversibly speed up the process of taking data out of US companies. But the process itself had already started, it is just a very slow process (no corporation or government can drastically alter their IT infrastructure within a short term). The real effects won't be felt until another five to ten years, if not more.

cpfohl 13y ago

Well...if Americans cant get things changed with votes in their own democratic society, at least non-Americans can get things changed with their own wallets. (Debated using quotes around democratic...left 'em off after all...but it was close). Americans obviously can change things with their wallets, but it's more difficult, and involves a lot more steps like encrypting before sending, etc.

puppetmaster3 13y ago

Predictable. This will make Silicon Valley into Detroit, and my job. Thank you corrupt congress w/ your 10% approval.

csense 13y ago
Actually the NSA's overreach is more a problem with the executive branch. Congress tried to establish checks and balances over the intelligence community by establishing FISA after Watergate, but it wasn't enough. Judge Leon's ruling [1] actually discusses the shortcomings of the FISA court. [1] http://legaltimes.typepad.com/files/obamansa.pdf http://legaltimes.typepad.com/files/obamansa.pdf

polskibus 13y ago

As far as I know, similar data locality guarantees are now hot topic in Germany and are often mentioned during sales pitches of SaaS platforms. USA shot itself in the foot and it is competition's holy duty to its shareholders to exploit it.

devrelm 13y ago

This has been going on for at least a few years. Large financial institutions in Europe have contracts with vendors stating that servers cannot be hosted in the US because of all the warrantless snooping.

stcredzero 13y ago

Could this be a possible benefit of the Google Barge? Could they be trying to get data out of the jurisdiction of the US government?