Hacker News Reader

Comment by freedomben | Hacker News Reader

This will have immense ramifications on the ability of US companies to do business overseas. Even if there are no legal barriers erected (which I doubt), there will unquestionably be marketing barriers. If there were a company I did business with that had a home-country ruling like this, I would definitely think twice about how much I trust their government.

View on HN

There already are legal barriers? Even if the Supreme Court decides this is legal, EU and Irish law make it illegal, and Microsoft will be in extremely deep shit if they actually share the data.

That adds a fascinating wrinkle to it, what happens if the EU makes it illegal to share the data, and the US requires it? A company could find themselves in between a rock and a hard place, forced to violate the dictates of at least one powerful governmental force.

Not that interesting, really.

Nobody forces Microsoft to exist in the EU, or to sell their software to EU citizens. They would simply be forced out of that market.

In theory that's what should happen, but the political realities guarantee it will not. Microsoft, Google, <every other major tech company>, <most other multinational companies>, are too politically powerful.

A workaround will be found, or one of the two sets of laws will be changed, or one of the two sets of laws will not be enforced.

Correct, but at the same time what happens to EU companies selling software services in the US? If the EU companies don't fork over data will they get restricted too? I'm not sure if isolating every jurisdiction into its own tech ecosystem is an achievable (let alone sustainable) direction. To a certain extent, Microsoft (and presumably others) are attempting to do this for their data[1] by hiring data trustees in other countries. Essentially, Microsoft still develops the technical services but hires another company, which does not have US presence, to hold that data and is subject to the (presumably stronger) privacy laws of the country it is located in.

I'm not sure how resilient this is to coercion by the US government. Maybe the US government could forbid Microsoft from doing business with the data trustee unless the the trustee gives up user data.

1. https://news.microsoft.com/europe/2015/11/11/45283/

EU companies (typically) don't have a nexus or operating presence in the US, therefore they can't be coerced to release requested data (unless the US Government is going to request three letter agencies to null route their traffic at internet exchanges [or take other adverse actions against their traffic]).

Your shell game you suggest will not withstand the scrutiny of an intelligent judge and an aggressive prosecutor.

Source: A lifetime ago, I was asked as a consultant to spec and site infrastructure out of the reach of the US government with the help of an international law attorney.

What's to keep the US government from fining companies or suspending their ability to do business until they give up user data? For example, London suspending Uber's ability to operate in the city.

While I'd agree that small-ish foreign companies can probably fly under the radar, I don't think any company that receives payments from US customers is immune to coercion from the US. If the US government can impede a company's ability to access US customers then that's an ability to compel a company to give up data.

Worth noting that Uber's licence to operate in the UK is issued to a UK registered company.

a simpler solution could be to outsource the data to locally registered companies (Either, a subsidiary or a shell data owner). That way Microsoft can deny the data as they do not own it.

handling over the data ownership to a companny in EU is the way to go. This already happens between Deutsche Telekom and Microsoft with their Azure Cloud offer in Germany. Deutsche Telekom is the owner/supervisor of the Data and Microsoft has no acces to it.

It is an interesting situation, since it's basically putting companies in a situation where it's impossible not to break the law. The hosting country demands that data be kept private while the country's home country demands that data be given up.

What imagine will happen eventually (be it in the next couple years or next couple decades) is that agreements along the same lines as free trade agreements and extradition agreements will be made between countries. In exchange for the ability to get data from other countries under certain conditions, the US grants the ability for other countries to do the same. Probably these agreements would be made with other liberal democracies; I don't expect China or Russia to hand over data to the US nor vice versa.

Reply on news.ycombinator.com