Hetzner is terminating contracts with all users who had a Russian postal address | Hacker News Reader

Hetzner is terminating contracts with all users who had a Russian postal address

76 pointscybice125 comments

Just received: We regret to inform you that due to the tense geopolitical situation with Russia, we will be ending our contractual relationship with customers from Russia.

Political decisions have led to changes in the legal regulations that affect our business with Russian-based customers. Unfortunately, we can no longer have contracts with customers with Russian postal addresses. This will affect everyone with a Russian address stored on Hetzner Accounts.

After we analyze the customer databases, we will send the affected customers a notice of termination for all products and services on Friday, 15 December 2023. It will take effect from 31 January 2024. We recommend that you take appropriate measures now.

View on HN

Two years + 6 weeks of notice, that would seem to be enough to make a move. This was in the cards for a long time and I noted in the first weeks of the war that anybody from Russia with assets in the West would be smart to move them because sooner or later they'd be at risk. Note that the real artery isn't hosting but DNS and if there are more similar actions at registrars or even at ICANN (see the 'NameCheap' thread) then that will have as much or more impact. Hosting is usually manageable (unless you are tied into hosting provider unique services, such as AWS).

Is the two years referring to the start of the Ukraine war?

Or did Hetzner announce their termination of Russian customers back in 2021?

Yes. Because it was quite clear that there would be consequences. I think the consensus at the time was that you should get moving if you might be affected, and I also think that the consensus was that by now the war would be over one way or the other. But that hasn't happened and authorities have been coming down ever harder on companies that are still doing business with Russia, Hetzner likely has made an internal re-evaluation of what their exposure is and the legal department has flagged a number of accounts as problematic. This is the kind of thing that got people get jailed for so it isn't surprising that they take it serious. Frankly I'm a bit surprised it took them this long, they should have reacted earlier but with a longer grace period.

This is the sort of thing that keeps Hetzner execs up at night and scared of 4am knocks on their doors:

https://www.swr.de/swraktuell/baden-wuerttemberg/geschaeftsf...

Similar actions all over Europe with the intensity increasing in the last six months. Most of these are about dual use tech and outright sanction busting but hosting doesn't necessarily get a free pass and I figure Hetzner execs are not brave enough to figure out if theirs is the finest line to be drawn around this.

As far as I know most cloud services of US big tech is still functioning in Russia. Including YouTube, Gmail, advertising services etc. Facebook was blocked the Russian government not Facebook itself.

My guess is that the US authorities appreciate the data they can gather from these sources.

That's exactly my reading.

Which US hosting provider sells cloud infrastructure to Russian customers?

AWS for instance. You can't open a new account but the pre-existing ones are afaik still serviced. That may not last though.

But you can't pay for them without workarounds.

SWIFT works in Russia (for selected banks), AFAIK.

A lot of confusion there, so let me chime in and clarify:

1. The war is not an inconvenience, it's a disaster.

2. You had at least 1 year to move elsewhere.

I hope this is not going to be a massive hit for them financially -- I like Hetzner. On the flip side they might have some cheap 'server auction' on the block soon, I've been pondering a cross/upgrade for a little while already :-)

Why do you hope they take a massive financial hit, while liking them?

Edit: missed the "not"

Did you overlook the "not"?

Yup, missed it.

Perhaps parent edited, but there is a "not" in the sentence.

"I hope this is not going to be a massive hit"

I don't think it was edited, still had a very early version of the comment open, but it's easy to misread.

In the times I've checked, their "server auction" things don't really seem any obviously better than their standard options.

What sort of stuff do you look for that seems good?

Last time I checked, their new server are way more than the typical 35 euros mark, which is what I pay at the minute for ~3TB RAID1 quad core with 16GB ram... The current gen of server auction seems already to be quite a nice upgrade to my hardware, if I'm willing to ditch hardware raid...

Ahhh, interesting. Yeah, from that point of view they do look good. :)

Good, maybe Hetzner IP ranges will become a little cleaner :)

good luck. it'll take ages of scrubbing and inactivity for that to happen.

spamhaus doesn't forgive or forget.

So big enough companies that have the resources to relocate elsewhere are safe but random citizens aren't. I understand they did it because they were forced to. Sad to see them go.

Probably Russia is ok with this too. Russian money that was going to the EU (and later used against Russian interests) will now go to somewhere else, maybe to friendlier countries.

> Russian money that was going to the EU (and later used against Russian interests)

One consequence of the current war is that people realized that Russian money going to the EU was actually pretty often used to support Russian interests.

What a surprise... I am sure in contrast American money going to EU are used to support EU's interest, not American's

Does any company fire their American customers because of the calamitous Iraq war and related war crimes? Do companies fire their Israeli customers because of the current bombing campaign? What about Argentinian customers? Melei has contempt for European style democracy. Should Chinese customers get the boot because of the horrific treatment of Uyghurs by the Chinese Party? Should Hetzner also fire their German customers while they're at it because of German arms exports to oppressive regimes?

Isolationism isn't the answer here. We live in a globalized world and by integrating our economies we disincentivize war and strife. Maybe Hetzner is acting out of principle, maybe they choose to do this because of optics. In any case, it's the wrong move both pragmatically and idealistically.

What about... what about... what about... Western Europe really tried after 1990 to integrate with Eastern Europe and it worked pretty well for most former socialist countries, but not with Russia and Belarus. And not for lack of trying on behalf of the Western European countries, if anything the West had been too naive for too long.

I'm pointing out clear hypocrisy. That's not whataboutism.

It can be both at the same time, which I would agree it is. Whataboutism seeks to inject other topics instead of focusing on the one at hand

I'm not inviting people to change the topic with my post. Hetzners actions are clearly because of sanctions against Russia. They say so in their email. My response asks whether "the geopolitical situation" is a good justification, given that there are many comparable geopolitical situations where Europe would never respond with sanctions like these.

There are contradictions in your comments, one example

> Maybe Hetzner is acting out of principle, maybe they choose to do this because of optics.

> Hetzners actions are clearly because of sanctions against Russia. They say so in their email.

> My response asks whether "the geopolitical situation" is a good justification

It's very hard to follow your logic and what you think is the reason Hetzner is cancelling some customers

Either way, your original comment is whataboutism as judged by HN members. Maybe it is not elsewhere, but it seems here it is

We don't know what motivates the Hetzner executives. We only know what their actions are. We don't know whether they agree with the sanctions against Russia. But clearly their actions are because of the sanctions. Hetzner is not going to refuse to do business with an entire country entirely out of their own accord.

As for whataboutism, downvotes here can also represent simple disagreement. The first comment suggested that Europe "really tried", i.e. that Europe is acting with noble and good intentions. I think that's ahistorical, but I can see how people who believe that take offense to my post.

If pointing out hypocrisy is whataboutism, then I see no problem with whataboutism. Pointing out hypocrisy is not a logical fallacy, it is something that should be done more frequently.

If you believe that a country that invades another country should be the target of international sanctions, you believe that the US, along with many other countries, should be the target of international sanctions.

Do the people arguing that Russia should be the target of international sanctions act as if they believe the US should be the target of international sanctions? For the most part, they do not. It makes me question whether the real reason they want sanctions on Russia is because Russia invaded another country. Maybe the real rule is that when countries that you oppose invade another country, they should be the target of sanctions. That seems the be the rule that is actually practiced.

This pretty much describes great power conflict and competition between democracies and authoritarian states. There are fundamental differences that make treating them the same unreasonable to most in the west.

Crying about "whataboutism" is just a cheap rhetorical technique employed to deflect attention away from accusations of hypocrisy. It's the last refuge of the hypocrite especially when it comes to discussing politics. Unfortunately it seems to be a rather effective rhetorical device in that it tends to terminate discussions while allowing the wielder to disappear in a puff of smoke.

The real answer is that this isn't about morality. It's a pretext to roll back globalization, which the Powers that Be were on track to implement since the before Covid times. War is just convenient as a pretext.

Hetzner is acting out of a desire to not go to prison for violating sanctions, not out of principle or optics. There's no hypocrisy in doing business with the customers you're legally allowed to and not doing business with the ones you aren't.

There's a lot of room to criticize the sanctions and what countries they get applied to, but that isn't something that's up to Hetzner.

Yes, companies constantly fire their American customers due to their nationality, or refuse to take Americans as new customers. (Banking and finance, in particular). Now, that's not a moral stance about American wars, it's just the natural outcome of the regulatory environment.

The original message from Hetzner suggests that this is also some kind of compliance issue rather than being driven by some kind of individual opposition to the war.

> Yes, companies constantly fire their American customers due to their nationality, or refuse to take Americans as new customers. (Banking and finance, in particular). Now, that's not a moral stance about American wars, it's just the natural outcome of the regulatory environment.

Specifically due to FATCA and related regulations that require foreign banks to report US citizens and potentially open the kimono if the IRS demands more about what they're up to.

No one outside of the middle east gave a shit about Iraq or Afghanistan enough to take the financial hit from pulling out of the US.

Even with moral shortcomings the US market was too big and too stable to walk away from. The Russian market was marginally stable, corrupt as hell, and mostly a source of raw materials and simple value-adds. For the EU that meant cheap gas, at the cost of funding people who hate you, and not taking steps to better nuclear or renewables.

I already posted this in another thread here. This particular change is not because isolationism. Most likely.

Russian government added Hetzner to the list of companies who must move their infrastructure within Russian borders in order to operate with Russian citizens. Few years ago they introduced a law on how companies have to process personal data. (It is kinda similar to GDPR, but the government might abuse it in the way to get access to data government needs). Obviously Hetzner doesn't want to create infrastructure on Russian soil. It was quite risky even before the war.

You can find the full list of "lucky" companies in here -- https://236-fz.rkn.gov.ru/agents/list (sorry, it's in Russian, but google translate should help you out).

Thanks for that information. I agree with your assessment.

So why now? Almost 2 years after the invasion.

My guess is that Hetzner got tired helping intelligence services bug their customers:

https://www.devever.net/~hl/xmpp-incident

Thanks for mentioning, this is fascinating. The original report is a masterpiece of forensics investigation. Worth a read: https://notes.valdikss.org.ru/jabber.ru-mitm/

There is nothing to do with intelligence. They got on radar of Russian government. Which wanted Hetzner to follow Russian law and move all Russian data to Russia in order to operate with Russian citizens. Means literally Russian government expects companies to open data centers within borders and keep all the data inside the country (they even issued a law for that). Obviously Hetzner doesn't want to do so.

You can find the full list of "lucky" companies in here -- https://236-fz.rkn.gov.ru/agents/list (sorry, it's in Russian, but google translate should help you out).

1 month to migrate is pretty dire.

I would hope that they at least offer some kind of "pay for a year up front" kind of deal so that you can actually plan a migration.

Quiet reminder that the actions of politicians and the actions of businesses/people - while not mutually exclusive - are usually quite disparate.

I do feel for the citizens and business that do not endorse Russian aggression who: by accident of birth, find themselves on the wrong side of history.

I also feel for any ops who may have to do a painful migration over Christmas due to this.

That notion of course does not to take anything away from the victims of the Russian invasion; which is many orders of magnitude worse of course.

EDIT: Downvoted because why?

Whatever legal change happened says they can’t do business with Russians. I doubt there’s a get out clause saying “unless you got a year up front out of them” in that law.

Yeah, I would speculate the same.

However it could also be "Just easier" or that Hetzner doesn't want to deal with Russians anyway.

Normally the way these financial sanctions go is that you are permitted to give service if it has already been paid for but you cannot take new service. Annual contracts are a normal thing but I don't see the option in Hetzner right now, so it could easily be an oversight.

It could easily be that they take monthly billing only (normally) and have no desire to introduce this to bypass the "russians cannot purchase services" style sanction.

OFAC(Office of Foreign Assets Control) sanctions are clear-cut and they can issue very large fines for non-compliance. These sanctions have been in place for a while now. It sounds like someone flagged this to their legal department, who then advised to go nuclear, given the threat of large fines.

You can go to jail for this, it doesn't just stop at fines.

Hetzner is a EU business which only recently started the US expansion.

I am pretty sure Martin Hetzner lives in Germany.

This makes the jail option very unlikely.

As I linked elsewhere in this thread: German business people have already gone to jail over breaking sanctions, it is mostly up to interpretation of the (German) authorities whether or not what Hetzner does qualifies as breaking the sanctions. If I were an exec in this position I'd play it very, very safe.

OFAC seems like a US thing, correct me if I am wrong.

Yes, you are right, but they also serve the US market.

LOCATION. We host our cloud instances in our own data centers in Nuremberg and Falkenstein (Germany) and in Helsinki (Finland). In Ashburn, Virginia and Hillsboro, Oregon (USA), we also provide AMD-based cloud servers and cloud features.

It's two years and 6 weeks (almost 7), not 1 month.

> It will take effect from 31 January 2024

that's under 6 (working) weeks from today.

I'm trying to read where you got 2 years from, but I can't find it.

Was there an additional warning from before? or are you suggesting that when the Russian military invaded Ukraine that every Russian business and citizen should have pulled out of using European services?

There was a massive thread on HN at the time and the general consensus was that if you are a Russian entity relying on Western infrastructure that you should probably activate your contingency plans. The writing has been on the wall for all that time and with authorities coming down harder and harder on companies that are still doing business with Russia it is in a way surprising it took Hetzner this long to act.

ok, so you're saying there was an implied warning, not that there actually was one.

Which is what I suspected. A formal warning is the only one that matters in terms of actual notice.

No, there actually was a warning: plenty of countries have (in the meantime) put official sanctions in place but it has taken a while (and longer than expected) for that to ramp up to the point where actual legal action was taken against those busting the sanctions. More and more companies are figuring out that what they are doing may very well be interpreted as sanction busting and obviously the first to be addressed are the ones that are in the weapons and dual use trades. Where hosting falls on that scale I couldn't tell you but I do know that I'm risk averse enough not to want to figure out whether I know more than the authorities on where that line lies.

Likely some of the more recent arrests in Germany have woken up Hetzner to the possibility that what they are doing may well be interpreted as illegal even if it wasn't spelled out to them in a way that they heard it, or maybe they figured the war would be over before it was their turn. Who is to know? The fact that they turn around now is possibly reflective of direct pressure on them or it may be their own reasoning, someone downthread suggests that Hetzner may well have lost its usefulness in terms of being an intercept. The possibilities are endless and it is all just speculation, I'd take the letter at face value and leave it at that.

>are you suggesting that when the Russian military invaded Ukraine that every Russian business and citizen should have pulled out of using European services?

A ton of Western companies started pulling out of Russia in short order. It should have been obvious to anyone that even if their particular Western supplier continued to provide services for the time being that was at high risk of termination at any time--even absent a specific public statement. So, yes, the rational plan would have been to pull out of using European services or at least have a contingency plan to rapidly do so.

I think one of the reasons people might be harping on you is because the "Special military operation" started on 2022 February 24, which is 652 days < 1.8 years ago. In particular, even after you add 6 weeks to it, it's still less than 2 years.

I assume you mean T + 6 weeks, where T is the time since the invasion and T is approximately 2 years, even though T + 6 weeks is still less than 2 years?

> We recommend that you take appropriate measures now.

Change your postal address if it's (still) Russian?

As per some Russian devs I know, this worked for the vast majority of service providers that issued similar statements in the past. As cynical as it sounds.

With luck this would work. I think a lot of people who emigrated would not necesarily bother updating the postal address details, so this email might just remind them to do the update.

I imagine getting them to provide a proof of new address (which I think is what Hetzner requires from all customers) would be enough. On the other hand, if they just close the accounts for having lived in Russia at a certain point in the past, that would be quite shitty.

Unfortunately, a lot of russian companies (especially the dodgy ones) are registered in Cyprus

Yes, that's true, and likely it will be one of the last safe-havens for many reasons. Cyprus has been a problem for decades but it's a very hard nut to crack on account of Turkish and Greek relations with the EU as well as the fact that if it ever does get rolled up it will make the Panama Papers look like a boy scout outing.

And UAE

I mean yeah... that was kind of expected.

Quite a few of Russians have been using Hetzner's servers to host VPN services for personal use, for their family members, friends...

/sarcasm on

Thank you Hetzner, for making it so much easier for Putin and his Goebbelses to brainwash

Russians and turn them into North Korean zombies..

/sarcasm off

Roskomnadzor keeps blocking sites in Russia en masse, and Western governments keep enacting policies that keep us from accessing the truth and fighting the state propaganda.

Hetzner's decision won't hurt Putin and his regime in the slightest. In fact, it will make it even stronger..

Much sympathy. My spouse had a 401K with a portion of it in "Mediterranean assets". She got a letter saying those were Russian assets in reality. All gone, sorry.

It however worked out better by default. She was so infuriated she closed the 401K and bought an investment property which we work on together. I haven't seen her this excited in a while. We work on the property on the weekend together.

Ouch, that sucks. But you may well have cause to go after whoever sold you that bill of goods. Props to you for how you handled it, I hope it wasn't too much money. Over the years I've become more and more conservative as an investor, in part on account of stories like yours. If it's a REIT I want to see an assets list. Note that the fact that it is 'all gone' may well be an indication that you are being defrauded, it's not 'gone' nor is the asset manager off the hook. So I'd definitely look into recovery options and if you are the only one or one of a few to do that there is some chance you'll see some of your money back. Best of luck!!

Some assets were traded by US buyers in 2022, https://markets.businessinsider.com/news/bonds/russian-bonds...

so even if postal address is changed, it will still mean termination, why?

I think Hetzner asks for a real ID and address proof when you create an account. So, may be if a user could provide a change of address proof, then they might be able to save their account..

> I think Hetzner asks for a real ID and address proof when you create an account.

I created an account last week (and rented a server), and it didn't ask for much of anything. I think I filled in my address (not sure), but certainly not an ID or proof of address. Could have filled in anything I wanted.

Because they're not idiots? Hetzner doesn't want to end up in the cross hairs of authorities coming down on companies doing business with sanctioned entities. This is their legal department speaking, not the technicians and a change in postal address is so transparent that it will not work.

> Because they're not idiots?

Corporations are simultaneously sophisticated and idiots. Sometimes the output of sophisticated compliance pipeline is plainly idiotic.

Yes, but for Hetzner execs there is more at stake than $ here and they are more than aware of seeing a change of address in light of this notice as a fig leaf without substance. Not everybody is incompetent, even if some are.

...and execs in western world paid consequences of their illegal decisions when, recently?

All over Europe, in fact.

Quite a few arrests and already a bunch of convictions.

they're are, they're.

They're some ppl that moved to germany/baltics and are legal residents there. Does this mean their account will be terminated? That's what I meant

No, they should be fine, they can easily document their residency, those that moved to Turkey as well. But just setting up a letterbox will likely not work and may even backfire.

Reply on news.ycombinator.com