Hacker News Reader

Comment by jasmer | Hacker News Reader

MSFT should be leading the way.

In what universe do they need to be collecting data from kids, especially that which cannot be kept locally.

Telemetry data (which I suggest is reasonable that they collect) can be stored in local 'log' style DBs. It's not data they need to repatriate.

Although for login and identity management, it might be reasonable to have that quasi centralized for security reasons. While MS could afford to build for each country, almost no other companies could.

Finally, we need to be wary folks: this is ultimately a kind of regulatory capture.

I'm already working with small startups that are struggling with this - they have customers unwilling to have their data stored in other countries and it's a giant problem.

MS and G can afford to deal with it, startups, not so much.

Edit: Gosh I wonder if that's an PaaS opportunity right there, aka 'transparent nationally stored data' ...

View on HN

If the customers are unwilling, how is this regulatory capture vs customer protection?

Customers are the entities subject to the regulations and therefore making the demands.

Notably, a lot of it results from a new shift in perspective aka they are developing internal security policies consistent with those regulations.

None of this is entirely irrational - when the Internet was born, I was actually shocked at the ultra liberalism of it.

I remember thinking Google's objective to 'organize the world's information' to be a big gliby arrogant - because what kind of person would believe that data in other nations was their right to manage?

In hindsight I'm thankful that it was 'open' because my purview was a bit too narrow, that said, I'm having a 25 year 'I Told You So' moment and I do think we need to find an equilibrium.

Data sovereignty is here to stay, no matter the push back from Silicon Valley.

A government would be stupid to hand over all their citizens data to the US via US technology companies.

There should be two directions of attack on this issue. Legislation to try and force US companies to legally protect personal data of citizens from other countries. And to build competitors to Microsoft, Amazon etc.

Obviously creating a viable competitor is hard, and has been badly neglected. Not least because any non-US competitor would have to fight the US Government itself which would attempt to protect the US tech companies dominant positions.

I'll take the GDPR and other countries attempts at the legislative route as a start however.

This is mixing a few streams.

"A government would be stupid to hand over all their citizens data to the US via US technology companies"

They have been for decades in some cases, and where is the problem, specifically?

It is possibly one of national security, less so one of companies selling data for advertising and other reasons because Slack and MSFT are reliably not doing that, and contracts with companies can make that clear. If the contracts are breached those companies can be wiped out - just the same as any other commercial issue.

So yes, it's reasonable for companies to want to have some data hosted within their own countries, but it most cases it will not matter.

For instance, kids classroom telemetry data in the US vs. Germany will make absolutely no difference.

That data is as 'safe' in the US as in Germany so long as there is a contract in place to specify how that data can be used. MSFT has no very special leverage with customer data in the US as opposed to Germany, if they are contractually bound.

GDPR is a lot about protecting users from willy nilly use of their data which is a different question that national security and other legal issues.

Theoretically, there are some concerns about US spy apparatus, but I suggest that if the CIA wants to access data in what the US deems to be in a 'lawful manner' - that having the data hosted in AWS outside the US won't make a huge difference. That kind of protection would require yet another level of thinking.

MS, G, AWS will end up offering local datacenters operated by local companies owned by them. They'll cost a little more.

I'm actually expecting they'll be forced to have local ownership of the datacenters as well, but probably with some kind of peering agreement with the global company. Is this the start of something like datacenter franchising maybe?

Yes, I expect that they'll 51+% own those local companies, maybe not the datacenters (there are plenty of them everywhere.)

MS, G and AWS have locally incorporated entities. Google in Germany is 'German'.

Microsoft tried, using some Deutsche Telekom subsidiary as data processor. They sunset it.

Reply on news.ycombinator.com