The Safe Harbor ruling stems from an earlier decision by an Irish court
washingtonpost.com
washingtonpost.com
This is what I love most about this. Now the EU Commission needs to start from a strict standard of privacy imposed by the highest EU Court. The US government or companies can't lobby their way out of this one anymore. The EC, at least the previous one, was rather notorious for being easily manipulated by the US influences (remember ACTA?)
Whether the new EC likes it or not, it will have to start the negotiations for the new Safe Harbor and Data Protection Directive from the baseline imposed by the Court. Or risk having the new agreements invalidated as well a year or two later. I bet they had already made huge concessions on the new Safe Harbor and Data Protection Directive to the US, but now all of those will have to be canceled.
Also, the US Congress will now be forced to take action against the FISA Amendments Act and the Executive Order 12333, as well. That's another way in which this Safe Harbor "problem" could be fixed from the US side.
Sure they can. They can make sure multinational trade agreements treat privacy laws as unfair trade barriers and allow companies to sue governments for fictional damages in kangaroo courts.
The bad consequences are explained very well here:
>In a nutshell: this was the only reason any modern internet service could keep their primary user data in the United States on services like Amazon EC2 or Heroku.
But shouldn't you be fine if you use EC2 with a European location? (Then you can approximate by using the instance with the lowest ping to the user)
>The harder part is to figure out which user belongs to which jurisdiction.
Does the climbing website have to do store personal information in the first place? Does a random user-name like "a_bonobo" count as private data? An e-mail address? An e-mail address from a throwaway host? Pictures of climbing walls? What constitutes "personal data" here?
Of course, the best possible solution: no jurisdiction can demand data a service doesn't have.
Personal data (and other data) are defined by the EU and probably US. The EU is EU Directive 95/46/EC (citing from wikipedia) "any information relating to an identified or identifiable natural person ("data subject"); an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity;" (art. 2 a).
> ALWAYS STORED in the EU boundaries. which Amazon cannot guarantee.
That makes sense, and I fear of what we'd do to enforce this - full data inspection just to make sure that Amazon doesn't transfer private data to the US?
>n identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity
So a username like "a_bonobo" wouldn't fall under personal data as it's not really identifiable (but what if I research bonobos? My username gives a clue to my job, if that would be my job!). So under gasull's link I think that a lot of what the climbing community would save isn't directly personal data, as you don't need much information from your users to run such a site (except if you want to have Facebook's business model). Or am I wrong? I mean, you can even identify someone based on their writing patterns.
You can't guarantee that AWS is doing. You have to belive it. That's why hospitals & co keep the data in their own servers. And, if in the cloud, they try to avoid US companies as much as they can.
the username if not directly linked to someone (e.g., not an email) usually does not fall into personal data. But, since many usernames are reused by people they may identify the person. This is a a case which, honestly, i would not know how to deal with. I'll try to get an answer.
I assume a lot of businesses are waking up and calling their lawyers.
Not for service providers in the US, but it's a great day for European cloud service providers.
Ultimately I chose (then) Safe Harbor compliant US services, not out of convenience, but because most of them exhibited better security practices (e.g. 2FA) or deliverability (e.g. Mandrill) compared to their European counterparts.
I'm concerned about 2 things mainly:
- being forced to rely on less advanced 3rd parties, potentially less secure, which would not be a win for my users
- later down the road, seeing a backfire from the US telling that I cannot store US customers data in the EU
I have started a discussion over here [2].
[1] https://www.wisecashhq.com [2] http://discuss.bootstrapped.fm/t/concrete-ramifications-of-s...
Only for startups whose business plan consists of plundering EU citizens' data in ways not consistent with the privacy laws of those countries. Those are startups I'm happy to see inconveniences.
Apart from the political implications of this decision, technically, how will global "social" companies decide where each piece of data is stored?
Email providers like Gmail will probably just store a copy in each location (and they can claim fairly accurately that that's a side effect of the protocols being used) but real-time, centralized communications (FB chat , Google Hangouts etc.) seem to already break the logical definitions of a geographic boundary so I have no idea how the data would be logically segregated across these boundaries.
Has this been discussed elsewhere? I couldn't find anything with a quick search, but I'm not sure what terms I should be searching for.
Yep, it's a hit on operations for large companies. But it's not the end of the world. Lots of cash and severe growth mode means they'll just use lawyers to stall while they do some major re-architecture work over the next few years. Not a disaster.
The loss is for small/medium U.S. companies -- the kind of companies that go on to be Facebooks. The kind we need to make the economy grow. They're in a hell of a mess. They don't have the cash or momentum to weather the storm, and competitors overseas are now sitting pretty on a more locked-up local market.
As far as I can tell, this article has exactly nothing to do with U.S. surveillance. In fact, the results of the ruling, if anything, could be said to have exactly opposite effects of those promised in the headline. (Geesh, WP)
The NSA did all of this mass surveillance because it thought it's "easy" and there are "no consequences" - so why not? Now it's learning that there are consequences to such spying.
"Smart judge put Safe Harbor under the right light to be axed by the European Court"
but then if the whole title contains most the content, what's left on page views, mright?
And interestingly what that right light was is in another page altogether, here http://www.washingtonpost.com/blogs/monkey-cage/wp/2014/06/2...
I don't understand why this is a blow against U.S. surveillance, isn't it in fact, the opposite? U.S. law supposedly doesn't allow the NSA to conduct domestic intercept on US citizens except through "legal" means. There is no such protection for the NSA monitoring overseas communications. Didn't the NSA and GCHQ have to get each other to spy on each other's domestic data?
But in a European datacenter, wouldn't the "gloves be off" with respect to NSA intercept? There wouldn't even be a need for a kangaroo FISA court or NSL.
To me, this all seems like a total break with the spirit of the internet. I grew up on the internet in the 80s, where we actually imagined it transcending national concerns and local politics. Remember John Perry Barlow's Cyberspace Declaration of Independence? (https://projects.eff.org/~barlow/Declaration-Final.html)
The whole point around federated decentralized networking, was common carriage of data, non-discrimination, and the fact that you could host a server and serve anyone from all around the world without having to worry about hundreds of different legal regimes stepping on your toes.
Now it seems we've got the exact opposite of the internet imagined in the 80s and 90s, free of political interference. Instead, if you set up a server on the internet these days, you'll have to worry about European "rights to be forgotten" and privacy laws, Chinese or Russia censorship, Thai insults to the King, and on and on.
The simplicity of "here's my site/app, if you don't like it, please don't use it", has been replaced with "please track the geo-ip of your users, make sure you host copies of your server in the EU, Russia, China, and elsewhere, and route traffic appropriately. Be ready to comply with 50 different national internet regulations, some of them contradictory."
The internet of my teen years has become one giant bifurcated mess, and I fear what was once a kind of global village, will become a nation-by-nation silo.
Sure, there may be very good reasons to want these regulations. But it's not clear to me that the ends justifies the means. It's not even clear to me that the state snooping has been as damaging as cyberattacks by criminal gangs stealing people's data. Every week passwords, credit cards, and other information is being compromised by hackers and sold on the black market. Millions of smartphones and PCs are infected with viruses, keyloggers, backdoors. And yet, all of the focus is on the government snoops.
What's the right to privacy and data protection if your data is forced to be hosted locally in your nation, but compromised by hackers, and then sold to governments?
Is the original idea of the internet and web worth preserving, a kind of autonomous zone, a wild wild west, or do we need to lock it down, and turn it into national highways with freeway cops and political speed limits?
To get data from European data centers, the NSA can intercept data from direct network taps in the ground, under the sea, at peering points. They can intercept router or server hardware during data center construction and plant backdoors. In short, they can take all sorts of action that might be illegal domestically, but which they can't be prosecuted for in the US if done overseas.
At best, European police/counter-intelligence could catch them in the act and arrest them as spies. So basically, European data held on domestic US soil has a greater level of bureaucracy get, compared to say, European data held on foreign soil, where all bets are off.
Remember the Echelon scares of the 90s? That was the NSA using SIGINT interception of European cellular traffic with zero oversight or regulation.
My point is, this seems to be solving a non-problem. It makes creating new companies harder and more expensive, won't actually decrease net snooping/surveillance, and threatens to silo the internet.
There are hundreds of datacentera throughout Europe. The equipment necessary to do all that would be very visible. And you would need the cooperation of all the employees to not say anything. You can tap a router or a switch it a server but a datacentet has thousands of these. You can't tap them all. If you did your customers would ask questions and the smart ones would be gone in an hour. We have a disaster recovery plan you know.
American exceptionalism strikes again. How about you read their laws rather than assume ours are better.
Anyone can listen into the airwaves. It's public property. Now they encrypt phone calls. They can do all these extra legal things knowing it's not admissible in court.
You want to do business you follow the law. It's how it's always worked.
Almost every new breakthrough startup in recent years did so by breaking existing conventions and laws. Should Uber or AirBnB not exist because existing regulatory capture by protected industries?
Besides worrying about being sued by any jackass with a shitty patent and a lawyer, now you'll have additional regional specific worry. To me that means, if I was launching a startup today, I'd simply launch it US only.
Don't you love how when music or media services launch in the US, you don't get to watch them in every country? How Netflix or say, Spotify, are blocked for certain regions?
Get ready for a lot more of that, a balkanized internet, where a URL or IP address is no longer a uniform, universal access.
Besides, the European intelligence agencies have been caught snooping on the European internet and giving the data to the NSA, the Germans in particular. Basically, the surveillance is going to continue, with the threat of terrorism in Europe higher than the US, and restive waves of immigration from Muslim countries, do you really think they're going to lay down that capability?
This is just re-arranging the chairs, but changing nothing in practice. So companies that can afford it will host data in European data centers, the NSA will ring up the UK or German intelligence agencies and trade data.
The political system moves extremely slowly, is often targeting conditions which are already obsolete, and is a sledgehammer, not a scalpel when it comes to technology.
Just look at the way anti-hacking laws are abused to put people who do something as innocent as vandalize a college calendar entry in jail. Look at Aaron Schwartz. Can the court or legal system tell the difference between cookies meant for tracking, and cookies meant for single sign-on or mashup authentication? Can politicians write laws to deal with the reality of fast moving web and native platforms without creating loopholes for abuse that result in lawyers abusing the system?
The online communities were self organizing and self regulating. A sort of virtual Burning Man. From the WELL, to USENET, to the Modern Web, we've had 3 decades of "lawless" evolution, in which relatively few people have been harmed by legal behavior.
More people have been imprisoned or had their livelihoods destroyed by "regulation" than those supposedly hurt by ad-tech. The people being Dox'ed, the people being assassinated because of posts on Facebook or Twitter by Mexican drug cartels are not being hurt because of data center hosting policies.
We fought the Communications Decency Act I and II in the US and the Clipper Chip in the 90s, because we didn't feel the government had any business getting involved in online publishing and services. I wrote one of the first anonymizing proxies on the internet to hide publisher locations from the government (http://web.archive.org/web/20011129060515/http://www.clark.n...).
I have watched for decades how laws intended to do good things to protect people on the net have in fact been used to harm people. That makes me deeply skeptical. In software copyright, in software patents, in censorship laws, in cryptography regulation laws, in "privacy" laws (drafted by entities who themselves have a vested interest in state surveillance)