The End of Safe Harbor and a Scary Path Forward
lucumr.pocoo.org
lucumr.pocoo.org
Yes, it's a concern that the Internet won't be global anymore, but it never really was. Up until thing like Firesheep and Snowden, and still to some extent, a lot of Internet traffic was only safe based on not passing any bad actors.
So we're willing to throw all this interconnection away, the one thing that made the internet the place it is? The interconnected nature of the internet is what made me the person I am today. I have more friends from other countries than I have friends from my own and from my friendship circles I know I'm not the only one.
So what? "Only safe based on not encountering bad actors" is far and away the dominant mode of security everywhere. It's what keeps your house unburgled, your planes in the air, and your family alive. Breaking into a house, taking down a plane, and murdering strangers all require very little in the way of skill or planning. Burglary and murder are also unlikely to be caught (absent a connection to the victim).
Why not? Facebook, or some other centralized cloud service, is not the only way you have of using the Internet.
If the end of Safe Harbor spells disaster for all those centralized cloud services, that might actually turn out to be a good thing for the Internet in the long term.
We often think of decentralized peer-to-peer networks as a rebellious technology, something we need to develop in order to evade oppressive laws in an increasingly dystopian world. But what if decentralization becomes the only legal way to create and maintain a global social network? That would be ironic but also deeply satisfying.
My only worry is that this ruling might not spell enough of a disaster to shake up the VCs' faith in the centralized cloud.
I can send messages just fine from @jabber.de to someone on a US server.
You can even use worldwide cloudflare caching for your site, and store userdata in the EU, and still comply.
That works for actual short lived caching, but not for database replication which is what you would actually need for services like facebook.
//EDIT: also the directive does not actually mention caching directly, it just mentions various exceptions of the rule. Can I have a reference to what you mean exactly?
Even just adding 100ms latency to Google's page load time had a clear measurably effect on # of searches, and having 100+ms latency for each database request during a pageview would absolutely kill performance of most sites...
EDIT: to those downvoting try cold loading google.com, I get > 200ms within San Francisco. 100ms is not "insanely" bad, and maybe a good price to pay for regulated data privacy
Back to topic: Database replication is forbidden, yes. So, well, host your data in the EU for now, and hope that the US finally comes to senses regarding spying. Same applies to GCHQ and BND
only three of my top links are from today if I search something like "EU safe harbor caching" and even fewer for searches that omit "safe harbor" and search for data protection (which gets you the actual directives as the first hit).
Regardless, your problem is solved easily with Search Tools -> Any Time -> Custom range...
Anyway, database replication is nothing that is supposed to be exempt from data privacy laws anyway. You’ll have to deal with it somehow without giving my data into the hands of a US entity.
People actually paying for the services they use is key to Internet freedom.
But the general economy would still have issues, startups are one of the few things in the US still running profit right now.
If they can't take any enforcement action against non-compliant companies outside European borders, how does this decision even matter for non-European startups?
Don't get me wrong - I appreciate what money did here. But I also hate that most of the Internet is now flooded with ads, SEO, "entrepreneurs" seeking ways to make a quick buck and startups monetizing the most basic aspects of human interaction.
You know, I’ve been thinking about it for a long time. In a lot of ways, the internet was an anarchist society for some time. Then some people took advantage of it, used anarcho-capitalism to get insane profits and violate any normal laws, and nowadays, it’s a bit regulated, but still anarcho-capitalist.
The anti-spam measure re-captcha is effectively everyone giving Google training data for their neural networks.
Maybe it would have been better if everything on the web was GPL. Maybe it wouldn’t. Who knows.
But obviously, this should be a sign for entrepreneurs that maybe, just maybe, your users might be more important than profits.
But I guess a bunch of US companies are pretty scared about the financial implications right now. Kicking out EU citizens or moving their data to the EU.
If your threat model is "government coercion," sure, stay out of the US. But if your threat model is something like "an attacker broke into a cloud provider employee's account" or "the provider didn't take software updates", you're probably safer on the world's larger, more-staffed, more-well-run, etc. services, which are largely (though not entirely) in the US.
The best outcome here, I think, would involve serious, secure competitors to things like AWS being run by European countries in Europe.
If you are contemplating "pan-cloud root compromise", I'd worry more about the probability of that happening and less about in which countries that cloud provider operates. That would push me towards the larger, established provider (perceived lower probability of all-access-root compromise) over a smaller upstart whose value prop was "we ONLY operate in Europe".
Is this true? If Amazon received a US subpoena requiring them to provide a copy of data on EU-West-1, is violating EU privacy laws a reason to deny a seemingly lawful court order? After all, it is against the law in the US to withhold the information.
[1] https://en.wikipedia.org/wiki/Microsoft_Corporation_v._Unite...
US corporations can be compelled by subpoena to appear before court and turn over documents/evidence they control regardless of what country they are stored in.
No idea about administrative subpoenas which I believe include National Security Letters though. I imagine it is the same as the judicial subpoenas.
1. You can still (as a user) avail yourself of user of AWS (aka "you") controlled encryption for most of the relevant data at rest.
2. There is still a legal hurdle for the US to provide a subpoena for data which doesn't reside in the US to be brought into the US and provided. I'm no legal expert, but I doubt that's going to be as simple as "because we said we want to look at it" as this is an issue of sovereignty of the counterpart nation, particularly given that the EU high court has just ruled that the export of this data is contrary to EU law.
Of the two, #1 has significant mathematical assurance.
#2 assumes that the US national security apparatus is playing by international law, which the EU may not want to assume. Like the EU cookie law, regardless of the intentions behind the ruling/law, what matters for me as a developer is what the law thinks I should do to protect my users, not what I think I should do.
My point was that when you're considering what technology/hosting/cloud provider to use, you are balancing a variety of factors and very few people should weigh "can be attacked legally by the US govt" with weight of 1.0 and all other factors with weight 0.0.
Some businesses will weigh the US risk as 0.1; others at 0.001 and even those that weigh it at 0.1 might be better off choosing a provider with a higher risk of that in exchange for a richer catalog of building block services.
If there is big issue in future, you can summon European intelligence at court.
https://en.wikipedia.org/wiki/Five_Eyes
In practice, there's little advantage to living in Europe, being spied on by the NSA who then sends that data to European intelligence agencies.
It makes a difference depending on whether you're OK to be spied upon by a foreign power -- who might damage, take advantage and exploit your country.
Would Americans be OK to be spied by foreign powers while in the US?
And if yes, would the answer still be yes if the US wasn't the top dog, and the other country was, and could hurt them whenever they wanted?
Maybe or maybe not, but they do have a very realistic expectation of it having no consequences to them and the country at large. It's not like China (much less Russia) will do anything to the US (as a land and population). Other countries even less so.
Whereas lesser countries have seen the US (and Russia, especially as USSR and/or China) mess up with their internal politics, even topple legitimate governments and install friendly lackeys in power, assist one or the other party to get in power, help friendly governments prosecute their citizenry (especially during the Cold War), bully them to sign favorable trade and other deals (favorable not for them of course), or downright get to war with them.
The latter would be unenforceable anyways. In fact, the United States is the only major country exporting laws on their citizens living abroad (e.g. taxes).
EDIT: And, in fact, detecting the location of an Internet user (while not perfect) unfortunately works very well for "regular" users not well versed in VPNs and proxying - think YouTube country restrictions or also Google Maps' approach to display different maps depending on the user's location.
But I guess something could be considered better than nothing. Europeans definitely do have better legal access to correcting incorrect data for example.
This ruling is something we have always been concerned about from a business point of view, because ever since it became untenable to claim US companies could actually protect any personal data at all the basic legal premise on which Safe Harbor was built has been shaky. We don't know now whether it will still be sufficient to merely disclose our commercial partners in our privacy policy (which we do, by name and with an indication of what we use them for) or whether we need some sort of more active consent.
I haven't had chance to speak to our lawyer yet, but I'm expecting him to tell us something along the lines of: the law now requires us to add yet another prominent notice at the conclusion of a sale. On top of all the consumer protection rubbish from the recent EU changes there -- which again were well-intentioned but actually impose silly things that help neither us nor our customers -- the number of such notices we need by law is making our sales pages almost comical now. I can't believe all these notices really help to protect anyone from much of anything in practice, and anyone reading this on HN probably knows what effect compliance has on conversions.
The second to worst possible outcome is probably that we are now required to seek active consent from our existing customers before continuing to use things like US-based payment services. The worst is that it actually becomes illegal to use those services at all, though I don't think that is going to happen.
It's sad, because from a personal point of view this mess is long overdue for being cleaned up. But the authorities are so clumsy about handling these issues that a lot of the time they just hurt small businesses and legitimate international trade.
The big issue is the fact that we have become accustomed to being relived of both the choice and the information about which choices thats been made for us. Which of course makes us a bit lazy since it's hard to make informed choices which probably is going to make a system like the one you described a hassle to implement but id say it's worth it to bring back at least a small resemblance of choice and control of your own information.
Here are the basic rights of a "data subject":
Everyone shall have the right under national law to request from any controller information as to whether the controller is processing his or her data.
• Data subjects shall have the right under national law to:
• access their own data from any controller who processes such data;
• have their data rectified (or blocked, as appropriate) by the controller processing their data, if the data are inaccurate;
• have their data deleted or blocked, as appropriate, by the controller if the controller is processing their data illegally.
• Additionally, data subjects shall have the right to object to controllers about:
• automated decisions (made using personal data processed solely by automatic means);
• the processing of their data if it leads to disproportionate results;
• the use of their data for direct marketing purposes.
What this means is that data collected by a company about an individual belongs to the individual, not the company. The individual can look at it, correct it, and take it back.
This isn't a problem if you're not a scumbag. If you're selling your customer list for marketing purposes, or using data you collect about users for marketing purposes, you have a problem.
The EU requires explicit consent for such things. A contract of adhesion EULA is not enough. Exceptions to data privacy must be opt-in, not opt-out.
Passing data about persons on to another party can cause serious liability. You have to know where the data went, exactly who has it, and be able to delete it even if it's now in the hands of another party.
This is EU-wide, and registration with one national data controller (a Government agency which checks for privacy violations) in the EU is usually sufficient. Here's a set of guidelines from the European trade association for online marketing.[2]
The biggest practical implication here is that any data you collect and share about individuals must remain within your reach, because you're responsible for correcting it, blocking it, or deleting it. Mailing lists must now contain info as to where the info was originally collected.
It's not really that bad. Europe has operated under these rules for decades. Deal with it.
[1] http://www.echr.coe.int/Documents/Handbook_data_protection_E... [2] http://www.fedma.org/fileadmin/documents/SelfReg_Codex/FEDMA...
It's really not that simple either. Many businesses, particularly very small ones, depend on external services to be viable in the first place. It's right that those businesses should pay attention to data protection and privacy issues -- I'm a strong believer in such things personally -- but there also has to be some reasonable framework for what can and can't be done by default, without requiring explicit consent for every last detail.
The trouble with opt-ins for everything is that it instantly scales beyond the point of being practical. Just as hardly anyone actually reads the 9,753 page terms and conditions document before checking the box or pays any attention to the "we use cookies" notices, so hardly anyone will pay attention to formulaic "we might export your data outside the EU and foreign governments might spy on you" warnings. Creating a system that no basically reasonable and ethical business can actually comply with in practice will just result in no-one taking the rules seriously and consequently no-one actually enforcing them, again much like the cookie notices and so on.
Ironically, a good solution in this case is easy to see: the US government could make it absolutely clear that interception of or interference with personal data held by US companies can only be done following proper, legal processes, and then the EU governments would need to update the rules about Safe Harbor provisions to allow a reasonable exception for government access to personal data following due process. Throw in mandatory encryption at a level where the shortest path to getting data needed for legitimate government purposes is to just get the appropriate warrant or equivalent and formally request that the business in question hand over the relevant data, and probably most people are happy.
No-one serious about the privacy debate seems to be suggesting that businesses should never have to turn over personal data they have access to in order to comply with something like a proper court order to provide evidence for a case being heard by that court. It's the dubious access to the data outside of proper legal processes and oversight that causes the conflict here, and at least parts of the EU government system take that sort of thing a lot more seriously than most of the US government right now.
That's a feature, not a bug. It means you don't get to use personal information for marketing purposes unless the customer really wants to to and says so. It's the customer's information, not the retailers.
US businesses might think of it as the customer having a property right, like copyright, in their own personal info.
I consider not being able to run an otherwise reasonable business at all a bug.
It means you don't get to use personal information for marketing purposes unless the customer really wants to to and says so.
It also means, for example, that you can't charge them using a US-based payment service, provide whatever product or service they are requesting if it involves interacting with a US supplier and providing their personal details for delivery or authorising access, or use US-based administrative services to help run your business more efficiently, without your customers' explicit consent, even if this is only to provide exactly what they've just asked you to provide.
This is question begging. If your business model depends on openly breaking the law, it's not a reasonable business model.
If the end of slavery causes your cotton business to become unprofitable, it's not an attack on the cotton industry, it's still an attack on slavery.
Alternative possibility: The law is broken.
What if your business model is otherwise perfectly reasonable and acceptable to all of your customers, and it doesn't rely on breaking the law at all, until the very governments who are entrusted with producing reasonable, consistent laws to support their populations are the ones who screw it up? Should we just close down all European companies doing business with US online services right now, today?
As far as I can see, that is technically what this ruling will lead to. Somehow, I don't think most people in either Europe or the US would consider the resulting collapse of both regions' economies to be desirable, and I doubt that was the desired outcome when the European lawmakers established the basic data protection principles at the heart of this. Those same lawmakers, after all, are the ones who saw fit to provide a Safe Harbor mechanism to facilitate reasonable international trade in the first place.
If the end of slavery causes your cotton business to become unprofitable, it's not an attack on the cotton industry, it's still an attack on slavery.
And what about providing exactly the service your customers were asking for, but using say a US-based payment service that is openly disclosed in your privacy policy? Maybe that is now illegal on a technicality, because you didn't get active consent for using that US service to charge their card. What if your Europe-based bank didn't have explicit permission from your customer to communicate with a US-based card scheme to authorise your customer's card, for that matter?
Will it really help to confront customers with yet more mandatory legalese at the online checkout that just describes what everyone expects to be happening anyway? Who is really going to benefit from that? I'm all for reasonable protection of personal data and proper safeguards for privacy, but when you go so far that you stop people transferring personal data in ways that are necessary to provide the exact product or service that a customer is deliberately requesting and would be reasonably expected by that customer, you've lost the plot and your system needs fixing.
Decentralization is a major thing we need right now. Also: the EU gov. agencies are very unlike the US ones in that we have a political power over them.