Hacker News Reader

Comment by rini17 | Hacker News Reader

To me it reads as only walling the data off is insufficient. They will have to incorporate in Europe or in jurisdiction without FISA-like laws and completely split whole operation there.

View on HN

I believe that it would come down to this as well. The problem is both them being located in the US AND being a US company.

Alternatively they could mirror an approach that Microsoft had with ther Office Online for a while, that is find a European company acting as "trustee" for the data, so that even if the NSA came knocking the US based company would not have any data on any of their infrastructure it could give them.

But this is only viable for very large companies.

One might think that all these extra regulations benefits only the giants and curbs any newcomers.

Only if one has no idea what these cases are about.

This means US government should pass laws to protect EU citizens data, if they feel generous they could apply it to every person regardless of his citizenship,

Or far simpler, revoke section 702 of the Foreign Intelligence Surveillance Act. It's an absolutely insane law anyhow, basically "we can spy on any data of non-American users of American services, without any restrictions"

I agree that section 702 is a bit extreme.

But, at the heart of it, it makes sense. If foreigners can use services in your jurisdiction, you want to see what they do for security purposes.

Nonetheless, it's against the belief of "innocent until proven guilty."

This assumption leads to the conclusion that only services that reside in the same jurisdiction (EU, USA, ...) can be used if legal protection from the state is desired.

If legal protection from the state is enforced (even for other states) this means there need to be wholly separate services in each jurisdiction.

This seems very undesirable, especially for the US with it's multinational web companies.

> This assumption leads to the conclusion that only services that reside in the same jurisdiction (EU, USA, ...) can be used if legal protection from the state is desired.

which is the correct conclusion? As the state can only offer legal protection under its own jurisdiction.

Sure, real life complicates things a bit. (mainly, the jurisdiction of the EU as an institution in and of itself compared to its member states is a messy affair) but it is still a totally valid argument none the less.

>which is the correct conclusion? As the state can only offer legal protection under its own jurisdiction.

Not sure I follow, US gov can't legally protect non US citizens from itself abusing them? It should be as hard for the spying to happen for an US or non US citizen or company.

> But, at the heart of it, it makes sense. If foreigners can use services in your jurisdiction, you want to see what they do for security purposes.

As a "foreigner" in a friendly country I'm understandably not too happy about this. And the logical outcome is that the US will lose business anywhere this is unacceptable.

I completely agree with your statement, and I feel the same!

> If foreigners can use services in your jurisdiction, you want to see what they do for security purposes.

There are a LOT of things that law enforcement agencies want that they should not get. The fact that they want it or that it would be useful to them is not enough of an argument to give it to them. It has to be balanced against other factors, to decide what is best for society as a whole.

I believe that Microsoft is already licensing Azure tech to big European companies to host GDPR-compliant, Azure-compliant regions in Europe. More expensive than regular Azure regions, but still in use for some purposes.

Given that the big 3 cloud providers already have some trouble providing stable operations, I suspect it won't be the pinnacle of reliability, but have no first-hand experience with them.

I checked the Azure Pricing Calculator just now.

Pricing for services in the EU GDPR "Sovereign" safe-zones (e.g. "Germany Central (Sovereign)") is largely the same as for services in other zones:

Azure App Service in Germany Sovereign: $62/mo

Azure App Service in West US: $54/mo

1TB Azure Storage in Germany Sovereign: $21.00

1TB Azure Storage in West US: $20.80/mo

---------------

As for reliability, I haven't noticed any difference in availability and downtime between my Azure resources in any of the zones I've got services in. YMMV. Lately Azure's actually looking pretty good compared to AWS's spate of outages over the past 6 months.

Yep, you’re spot on with this. Even with a geo-wall AWS or Microsoft are still US based companies that have to comply with a FISA order. I work for a SaaS and we’re continuously questioned by our customers about this but we can’t do much as everything we have is architected around one particular US based cloud provider. We tried HYOK/BYOK/EU entity, so both security and legal controls which are insufficient today.

It should be this way anyway. Currently they pay little to no tax on all their European income. They don't even collect VAT which to me is a mystery how they can get away with it, because AFAIK it's already a law they should have to follow.

Reply on news.ycombinator.com