Hacker News Reader

Comment by whatever1 | Hacker News Reader

I don’t understand why this is the case though.

Could MS create a new EU based company in which it just owns shares ?

Or is the US cloud act so wide that they can demand data from all the companies a us based company has equity in?

MSFT already operates in Europe via subsidiaries for a whole host of reasons. But hiving certain assets off in a subsidiary is very rarely effective to avoid laws and regulations that apply to the parent. The parent controls the subsidiary so a court or regulator having jurisdiction over the parent could order it to get what it needs from the subsidiary. This is particularly so in the US, which is kind of known for enacting overreaching extraterritorial laws.

So let’s say I am eu citizen I own a data center company in Brussels.

I sell 1 stock to MS USA. Can they at any point demand all my data ?

They can try, but presumably as a tiny shareholder you would tell them to go f themselves. Subsidiaries don't have that luxury.

The laws I have read used the term “effective control”; if a shareholder is able to control the org (eg can replace the CEO or board), they are obliged to comply with government orders regarding that org.

> The parent controls the subsidiary so a court or regulator having jurisdiction over the parent could order it to get what it needs from the subsidiary.

But what if the parent’s jurisdiction orders the parent to order the subsidiary to do something illegal in the subsidiary’s jurisdiction? If local management obey the order, they risk being prosecuted by their jurisdiction’s authorities-so they’ll likely refuse. What is the parent going to do then? Fire them? But will any replacement act any differently? “Is this job worth going to prison over?” Most people answer “no”, and people who answer “yes” won’t last, because you can’t run a subsidiary from a prison cell.

I think the real issue here is that the US gets away with it because the EU is still so dependent on the US (see NATO) they can’t push back fully, at some point a political calculation takes over. So it could be that the US parent orders the subsidiary to do something illegal under EU law, and then the EU authorities choose to ignore it.

Well, firing someone because he refuses to do something illegal is itself illegal.

There are attempts to lösen the control from the U.S. side like a cooperation between Microsoft/Azure and SAP or Google and T-Systems (deutsche Telekom) where the German side would run an "air gapped" region of those cloud stacks.

However I believe the rates in the end were too high to win notable contracts, but I haven't followed along in a while.

https://www.heise.de/news/Digitale-Souveraenitaet-Microsoft-...

https://t3n.de/news/t-systems-sovereign-cloud-google-verwalt...

I'd be surprised if this isn't already the case. The extent to which you can do business in the EU without legal presence is limited.

It is not a huge amount of protection though. I mean we've already established that selling to 'terrorists' can be sanctioned even when selling through an intermediary. So what's stopping the US from ordering Microsoft to stop selling licenses to the ICC?

And then we've not touched on who is in control of the closed source of the many proprietary applications.

It's not about having a subsidiary, it's about the technical structure of 365 meaning Microsoft US has access to Microsoft EU servers and thus US employees can be compelled to follow US court orders.

They simply don't separate the infrastructure this way AFAIK.

Oh I see the point. So MS US has credentials for the infra in EU.

So no reason to deal with any European citizen or court. You just threaten the US IT guy to give you the EU credentials.

Yes, and the Cloud Act pretty much forces upper management to ensure that there is always a US IT guy that can be compelled to implement the wishes of The US Federal Government, as the penalties apply to executives of US companies, too.

We can quibble about whether the term "threaten", which implies some moral wrong doing, is correct though. It's a law with defined criminal penalties. That's how criminal law works

> Could MS create a new EU based company in which it just owns shares ?

That would be a seperate company, plus if its licensing tech from MS then it's still vulnerable to supply chain attacks.

If you’re Microsoft do you really want to anger the federal government? Companies aren’t as cavalier about taking them on as they used to be. They’re likely Microsoft’s largest customer by far, and they have the power to end you (which they nearly did once).

Reply on news.ycombinator.com