Hacker News Reader

Comment by wbl | Hacker News Reader

EU based cloud services always could compete before. Now they will compete on the basis of being in the EU instead of being better.

View on HN

I somewhat agree, but it depends on how you define 'better'. Data privacy is better for the end user, and it wasn't something that was properly taken into account before, and users basically had no way to make any difference in the decision.

Nah, what happens is the US-based companies will just geo-wall the data and throw more money at their EU-based AWS and Azure regions.

To me it reads as only walling the data off is insufficient. They will have to incorporate in Europe or in jurisdiction without FISA-like laws and completely split whole operation there.

I believe that it would come down to this as well. The problem is both them being located in the US AND being a US company.

Alternatively they could mirror an approach that Microsoft had with ther Office Online for a while, that is find a European company acting as "trustee" for the data, so that even if the NSA came knocking the US based company would not have any data on any of their infrastructure it could give them.

But this is only viable for very large companies.

One might think that all these extra regulations benefits only the giants and curbs any newcomers.

Only if one has no idea what these cases are about.

This means US government should pass laws to protect EU citizens data, if they feel generous they could apply it to every person regardless of his citizenship,

Or far simpler, revoke section 702 of the Foreign Intelligence Surveillance Act. It's an absolutely insane law anyhow, basically "we can spy on any data of non-American users of American services, without any restrictions"

I agree that section 702 is a bit extreme.

But, at the heart of it, it makes sense. If foreigners can use services in your jurisdiction, you want to see what they do for security purposes.

Nonetheless, it's against the belief of "innocent until proven guilty."

This assumption leads to the conclusion that only services that reside in the same jurisdiction (EU, USA, ...) can be used if legal protection from the state is desired.

If legal protection from the state is enforced (even for other states) this means there need to be wholly separate services in each jurisdiction.

This seems very undesirable, especially for the US with it's multinational web companies.

> This assumption leads to the conclusion that only services that reside in the same jurisdiction (EU, USA, ...) can be used if legal protection from the state is desired.

which is the correct conclusion? As the state can only offer legal protection under its own jurisdiction.

Sure, real life complicates things a bit. (mainly, the jurisdiction of the EU as an institution in and of itself compared to its member states is a messy affair) but it is still a totally valid argument none the less.

>which is the correct conclusion? As the state can only offer legal protection under its own jurisdiction.

Not sure I follow, US gov can't legally protect non US citizens from itself abusing them? It should be as hard for the spying to happen for an US or non US citizen or company.

> But, at the heart of it, it makes sense. If foreigners can use services in your jurisdiction, you want to see what they do for security purposes.

As a "foreigner" in a friendly country I'm understandably not too happy about this. And the logical outcome is that the US will lose business anywhere this is unacceptable.

I completely agree with your statement, and I feel the same!

> If foreigners can use services in your jurisdiction, you want to see what they do for security purposes.

There are a LOT of things that law enforcement agencies want that they should not get. The fact that they want it or that it would be useful to them is not enough of an argument to give it to them. It has to be balanced against other factors, to decide what is best for society as a whole.

I believe that Microsoft is already licensing Azure tech to big European companies to host GDPR-compliant, Azure-compliant regions in Europe. More expensive than regular Azure regions, but still in use for some purposes.

Given that the big 3 cloud providers already have some trouble providing stable operations, I suspect it won't be the pinnacle of reliability, but have no first-hand experience with them.

I checked the Azure Pricing Calculator just now.

Pricing for services in the EU GDPR "Sovereign" safe-zones (e.g. "Germany Central (Sovereign)") is largely the same as for services in other zones:

Azure App Service in Germany Sovereign: $62/mo

Azure App Service in West US: $54/mo

1TB Azure Storage in Germany Sovereign: $21.00

1TB Azure Storage in West US: $20.80/mo

---------------

As for reliability, I haven't noticed any difference in availability and downtime between my Azure resources in any of the zones I've got services in. YMMV. Lately Azure's actually looking pretty good compared to AWS's spate of outages over the past 6 months.

Yep, you’re spot on with this. Even with a geo-wall AWS or Microsoft are still US based companies that have to comply with a FISA order. I work for a SaaS and we’re continuously questioned by our customers about this but we can’t do much as everything we have is architected around one particular US based cloud provider. We tried HYOK/BYOK/EU entity, so both security and legal controls which are insufficient today.

It should be this way anyway. Currently they pay little to no tax on all their European income. They don't even collect VAT which to me is a mystery how they can get away with it, because AFAIK it's already a law they should have to follow.

"throw more money at their EU-based AWS and Azure regions."

Impossible, the mother company is still american.

Interestingly, it's not actually about being in the EU specifically, it's just about being in a jurisdiction with equivalent data protections. It's not a "must be EU" cloud requirement, it's a "must not be USA" requirement.

Canada, Brazil, Japan, India, and many other non-EU countries have GDPR-like data protection regulation that would be totally acceptable I think (IANAL).

The core problem is USA specific - either the USA needs to implement serious data protection laws where they can't blanket surveil foreign user's data, or EU businesses will have to move elsewhere.

I wouldn't be surprised if in future, similar local rulings appear in Canada/Brazil/Japan/Indian/the rest of the world for businesses based there too. It might be a difficult few years for US-based cloud providers.

and this is exactly what makes the EU a player in geopolitics.

This kind of soft power even has a name, the brussels effect[0]

0: https://en.wikipedia.org/wiki/Brussels_effect

Note that the US is absolutely capable of passing a data protection law at any time. I wouldn’t hold my breath, though.

> that would be totally acceptable

There needs to be an official adequacy decision, it's not automatic

https://ec.europa.eu/info/law/law-topic/data-protection/inte...

Canada is indeed covered by one such decision

Ah, good info, thanks! Looks like the full list of 'already approved as adequate' countries for data protection is:

- Andorra

- Argentina

- Canada (commercial organisations)

- Faroe Islands

- Guernsey

- Israel

- Isle of Man

- Japan

- Jersey

- New Zealand

- Republic of Korea

- Switzerland

- the UK

- Uruguay

2022 is a great year to be a cloud provider based in any of those.

Have you considered that being in the EU, with higher data protection standards, makes them better?

Now they will compete _also_ on the basis of being in the EU.

This adds an advantage. It doesn't mean they can be, and need to be competitive in other ways too. And there is not one, but several EU based services that compete with each other.

Reply on news.ycombinator.com