I must admit, after the NSA stuff, I feel safer without "Safe Harbor".
But I guess a bunch of US companies are pretty scared about the financial implications right now. Kicking out EU citizens or moving their data to the EU.
But I guess a bunch of US companies are pretty scared about the financial implications right now. Kicking out EU citizens or moving their data to the EU.
If your threat model is "government coercion," sure, stay out of the US. But if your threat model is something like "an attacker broke into a cloud provider employee's account" or "the provider didn't take software updates", you're probably safer on the world's larger, more-staffed, more-well-run, etc. services, which are largely (though not entirely) in the US.
The best outcome here, I think, would involve serious, secure competitors to things like AWS being run by European countries in Europe.
If you are contemplating "pan-cloud root compromise", I'd worry more about the probability of that happening and less about in which countries that cloud provider operates. That would push me towards the larger, established provider (perceived lower probability of all-access-root compromise) over a smaller upstart whose value prop was "we ONLY operate in Europe".
Is this true? If Amazon received a US subpoena requiring them to provide a copy of data on EU-West-1, is violating EU privacy laws a reason to deny a seemingly lawful court order? After all, it is against the law in the US to withhold the information.
1. You can still (as a user) avail yourself of user of AWS (aka "you") controlled encryption for most of the relevant data at rest.
2. There is still a legal hurdle for the US to provide a subpoena for data which doesn't reside in the US to be brought into the US and provided. I'm no legal expert, but I doubt that's going to be as simple as "because we said we want to look at it" as this is an issue of sovereignty of the counterpart nation, particularly given that the EU high court has just ruled that the export of this data is contrary to EU law.
Of the two, #1 has significant mathematical assurance.
#2 assumes that the US national security apparatus is playing by international law, which the EU may not want to assume. Like the EU cookie law, regardless of the intentions behind the ruling/law, what matters for me as a developer is what the law thinks I should do to protect my users, not what I think I should do.
My point was that when you're considering what technology/hosting/cloud provider to use, you are balancing a variety of factors and very few people should weigh "can be attacked legally by the US govt" with weight of 1.0 and all other factors with weight 0.0.
Some businesses will weigh the US risk as 0.1; others at 0.001 and even those that weigh it at 0.1 might be better off choosing a provider with a higher risk of that in exchange for a richer catalog of building block services.
[1] https://en.wikipedia.org/wiki/Microsoft_Corporation_v._Unite...
US corporations can be compelled by subpoena to appear before court and turn over documents/evidence they control regardless of what country they are stored in.
No idea about administrative subpoenas which I believe include National Security Letters though. I imagine it is the same as the judicial subpoenas.
If there is big issue in future, you can summon European intelligence at court.
https://en.wikipedia.org/wiki/Five_Eyes
In practice, there's little advantage to living in Europe, being spied on by the NSA who then sends that data to European intelligence agencies.
It makes a difference depending on whether you're OK to be spied upon by a foreign power -- who might damage, take advantage and exploit your country.
Would Americans be OK to be spied by foreign powers while in the US?
And if yes, would the answer still be yes if the US wasn't the top dog, and the other country was, and could hurt them whenever they wanted?
Maybe or maybe not, but they do have a very realistic expectation of it having no consequences to them and the country at large. It's not like China (much less Russia) will do anything to the US (as a land and population). Other countries even less so.
Whereas lesser countries have seen the US (and Russia, especially as USSR and/or China) mess up with their internal politics, even topple legitimate governments and install friendly lackeys in power, assist one or the other party to get in power, help friendly governments prosecute their citizenry (especially during the Cold War), bully them to sign favorable trade and other deals (favorable not for them of course), or downright get to war with them.