Hacker News Reader

Comment by boramalper | Hacker News Reader

Microsoft admitted that it 'cannot guarantee' data sovereignty [0] "on June 18 before a [French] Senate inquiry into public procurement and the role it plays in European digital sovereignty" as the CLOUD Act "gives the US government authority to obtain digital data held by US-based tech corporations irrespective of whether that data is stored on servers at home or on foreign soil."

It'd be great if they could clarify in their FAQ [1] if and how the CLOUD Act affects them.

[0] https://www.theregister.com/2025/07/25/microsoft_admits_it_c...

[1] https://aws.eu/faq/

View on HN

It seems like the entire point is precisely to get around the CLOUD Act.

By setting it up with a European governance structure, Amazon can tell the US government "hey we told them give us the data, but they refused because that would send them to jail under EU law, and they're a legally separate entity so there's nothing we can do."

This is very intentionally not just a regular foreign subsidiary owned by the parent company.

> so there's nothing we can do

And US law will just let it go?

There are several options for AWS. They can simply just obfuscate command to local employees. Or fly US employees there just for this one task. "EU law" will find out after they are back in US - if ever. There is no way to escape CLOUD Act if it is US owned.

There must already be protocols in place that prevent any random Amazon employee from getting access to sensitive data (like, the folks in the warehouses can’t just walk in to the AWS datacenters, I assume).

That’s who those US employees would be, from the point of view of the EU branch… no reason to assume they’d let them in. Flying people over to do crimes seems like a risky idea.

"Obfuscating commands" isn't a thing. EU employees know if they are retrieving data or not. And they don't blindly run commands like they're dummies or something.

And if they fly American employees over, what makes you think they'd be let in the building, or under what credentials do you think they'd be accessing the system? Legally speaking, those Americans are simply from a partner company. Just because you're doing business with a partner company doesn't mean you let them into your building.

The point is that AWS is intentionally making it so they don't have options.

So yes, US law lets it go. The law is limited in terms of what it can affect outside US borders. If the EU doesn't want to cooperate, and the US isn't willing to engage in sanctions or war against the EU, then yeah the US is out of options.

It will use the same software infrastructure and physical hardware that’s used in the rest of AWS. Hooped confident are you that he partitions are resilient enough ?

Can engineers be dual eu/us citizens ? AWS uses a lot of ex military and US citizens with government clearance levels for their US govcloud. I don’t see an equivalent here

Amazon can promise the moon and the sky but if I wanted digital sovereignty within the eu it would not be with Amazon any more than I would trust tencent

It would seem like the problem is one of the business layout and technical layout.

Organize your business and your tech correctly and you can have an owned foreign subsidiary that can comply with local laws. But things would have to be quite separate.

> Organize your business and your tech correctly and you can have an owned foreign subsidiary that can comply with local laws.

I doubt it, a majority owned subsidiary is usually passed through for many legal purposes.

Yep, to the extent that short (at best, cause they are potentially fallible) of a warrant canary getting snuffled it is very possible that a company could set up a subsidiary for appearances.

Or, just buy bits of control interest outright (CryptoAG?)

If there's one thing I believe in, it's the ability of the rich to fabricate creative corporate structures to evade the laws of a particular jurisdiction, especially with the aid of a second jurisdiction with interest in that evasion.

Just make it complex enough to confuse juries beyond a prosecutors famously low appetite for losing and you'll be absolutely fine.

> as the CLOUD Act "gives the US government authority to obtain digital data

AWS maintains a similar stance, too [0]?

  The CLOUD Act clarified that if a service provider is compelled to produce data under one of the limited exceptions, such as a search warrant for content data, the data to be produced can include data stored in the U.S. or outside the U.S.

> Microsoft admitted that it 'cannot guarantee' data sovereignty

Hm. As for AWS, they say that if the customer sets up proper security boundaries [0], they'll ensure will keep their end of the bargain [2][3]:

  As part of the technical design, access to the AWS European Sovereign Cloud physical infrastructure and logical system is managed by Qualified AWS European Sovereign Cloud Staff and can only be granted to Qualified AWS European Sovereign Cloud Staff located in the EU. AWS European Sovereign Cloud-restricted data will not be accessible, including to AWS employees, from outside the EU.

  All computing on Amazon Elastic Compute Cloud (Amazon EC2) in the AWS European Sovereign Cloud will run on the Nitro System, which eliminates any mechanisms for AWS employees to access customer data on EC2. An independent third party (the UK-based NCC Group) completed a design review confirming the security controls of the Nitro System (“As a matter of design, NCC Group found no gaps in the Nitro System that would compromise these security claims”), and AWS updated its service terms to assure customers “there are no technical means or APIs available to AWS personnel to read, copy, extract, modify, or otherwise access” customer content on the EC2 Nitro System.

  Customers also have additional mechanisms to prevent access to their data using cryptography. AWS provides advanced encryption, key management services, and hardware security modules that customers can use to protect their content further. Customers have a range of options to encrypt data in transit and at rest, including options to bring their own keys and use external key stores. Encrypted content is rendered useless without the applicable decryption keys.

  The AWS European Sovereign Cloud will also benefit from AWS transparency protections over data movement. We commit in the AWS Service Terms that access to the EC2 Nitro System APIs is "always logged, and always requires authentication and authorization." The AWS European Sovereign Cloud also offers immutable, validated logs that make it impossible to modify, delete, or forge AWS CloudTrail log files without detection.

[0] https://aws.amazon.com/compliance/cloud-act/

[1] https://aws.amazon.com/compliance/shared-responsibility-mode...

[2] https://d1.awsstatic.com/onedam/marketing-channels/website/a...

[3] https://aws.eu/esca/

Reply on news.ycombinator.com