Hacker News Reader

Comment by harrytuttle | Hacker News Reader

Actually in our case, it's for compliance and confidence purposes and hatred of American politics and government policy, not the American people.

Not one single company in the financial sector in the UK wants their kit anywhere near the US or in any datacentres with US ownership any more simply because of the PATRIOT act and PRISM etc.

We just moved 2 tonnes of kit into a wholly UK owned DC away from two large primarily US based DC's. We've also cancelled our Amazon S3 storage option and migrated over 540Gb of data back to our kit.

People have paid for all this voluntarily because being responsble for being fucked over by the US government is a big concern. Would you want all your mortgage, insurance and credit scoring data in the hands of a foreign government who religiously ignore data protection laws?

View on HN

Not one single company in the financial sector in the UK wants their kit anywhere near the US or in any datacentres with US ownership any more simply because of the PATRIOT act and PRISM etc.

It's odd because it seems that the British government and the USA have a sharing agreement (from what I understand of the PRISM story, which I don't follow a lot, I admit) which doesn't make it any safer to move hosting from the US to the UK.

Also, we happen to have many customers in the finance industry, including in the UK, and I never heard a single one of them telling me they're moving their servers from the US because of politics (or any other reason for that matter).

It would even be impossible for most of them as they have office in NYC and need to have IT there.

Would you want all your mortgage, insurance and credit scoring data in the hands of a foreign government who religiously ignore data protection laws?

Actually I'm more worried about credit companies and banks who also ignore the laws and share this data. I think it's a bigger problem.

We still require a warrant in the UK which is the major issue. In the US this is probably still required but is by fact not honoured. The data centre we have moved to has financial guarantees that they won't let anyone in without a warrant and will inform us if anyone issues one immediately. The datacentre also don't have access to our cages (they are locked) so only forced entry is possible which requires a warrant issued.

Also we can drop the SAN fabric encryption keys remotely or on network events (such as peer disconnection) which will warrant the cluster useless until someone physically reloads the keys off the KMS.

This all puts the onus on the authorities to prove access is warranted and necessary.

This is what our clients want.

You are saying "including the UK". We deal with ONLY wholly UK based companies as we are very specialist.

Credit companies and banks in the UK do not share this data voluntarily. Sometimes there are leaks and cock ups but they are surprisingly rare.

The worst people for data leaks are utility companies.

The NSA does not require a warrant to spy on you in the UK and has pretty much been doing it since their inception.

We still require a warrant in the UK which is the major issue.

I'd just about be willing to bet money that it will eventually come out that your GCHQ is doing all the same things as the NSA. So far it's already emerged that they are pretty solidly in bed with the NSA, so I don't even think that would be a surprising revelation. And consider that the UK has already been out in front of the USA in terms of openly advocating a "surveillance state". Isn't the statistic that the UK has more surveillance cameras, per capita, than any other country? Or something to that effect?

they won't let anyone in without a warrant and will inform us if anyone issues one immediately.

So far as you know right now.

Credit companies and banks in the UK do not share this data voluntarily.

So far as you know right now.

Probably are.

CCTV statistics are rubbish. Most of them are in private hands and/or are for traffic management.

As I said there is a financial penalty and we have motion tracking webcams in the cage so any unauthorised access, we know about straight away.

We do know because we're responsible for making sure stuff like that doesn't happen.

This is certainly the case for businesses with proprietary data, for an open-source community like we're discussing it's just another (admittedly rather useless) online backup service :)

Until someone things it's ok to meddle with your infrastructure and codebase without a warrant...

If you think only the US is capable of these kind of shenanigans you have another think coming.

I don't think anyone is labouring under the illusion that only the U.S. is capable of that sort of thing, but they have been very clearly proven to be doing so already. There's a huge difference between `could do' and `already known to do'.

Reply on news.ycombinator.com