Slashdot Mirror
Europe Frightened By US 'Cloud Act', Fearing National Security Risks (straitstimes.com)
"A foreign power with possible unbridled access to Europe's data is causing alarm in the region. No, it's not China. It's the U.S.," writes Bloomberg (in an article shared by hackingbear).
"As the U.S. pushes ahead with the 'Cloud Act' it enacted about a year ago, Europe is scrambling to curb its reach." Under the act, all U.S. cloud service providers, from Microsoft and IBM to Amazon -- when ordered -- have to provide American authorities with data stored on their servers, regardless of where it's housed. With those providers controlling much of the cloud market in Europe, the act could potentially give the US the right to access information on large swaths of the region's people and companies.
The U.S. says the act is aimed at aiding investigations. But some people are drawing parallels between the legislation and the National Intelligence Law that China put in place in 2017 requiring all its organisations and citizens to assist authorities with access to information. The Chinese law, which the US says is a tool for espionage, is cited by President Donald Trump's administration as a reason to avoid doing business with companies like Huawei Technologies. "I don't mean to compare US and Chinese laws, because obviously they aren't the same, but what we see is that on both sides, Chinese and American, there is clearly a push to have extraterritorial access to data," said Ms Laure de la Raudiere, a French lawmaker who co-heads a parliamentary cyber-security and sovereignty group. "This must be a wake up call for Europe to accelerate its own, sovereign offer in the data sector."
"As the U.S. pushes ahead with the 'Cloud Act' it enacted about a year ago, Europe is scrambling to curb its reach." Under the act, all U.S. cloud service providers, from Microsoft and IBM to Amazon -- when ordered -- have to provide American authorities with data stored on their servers, regardless of where it's housed. With those providers controlling much of the cloud market in Europe, the act could potentially give the US the right to access information on large swaths of the region's people and companies.
The U.S. says the act is aimed at aiding investigations. But some people are drawing parallels between the legislation and the National Intelligence Law that China put in place in 2017 requiring all its organisations and citizens to assist authorities with access to information. The Chinese law, which the US says is a tool for espionage, is cited by President Donald Trump's administration as a reason to avoid doing business with companies like Huawei Technologies. "I don't mean to compare US and Chinese laws, because obviously they aren't the same, but what we see is that on both sides, Chinese and American, there is clearly a push to have extraterritorial access to data," said Ms Laure de la Raudiere, a French lawmaker who co-heads a parliamentary cyber-security and sovereignty group. "This must be a wake up call for Europe to accelerate its own, sovereign offer in the data sector."
When you put your data elsewhere than on your own iron, expect it to be as good as public. Everybody has known this since the beginning of the internet. Security-conscious IT folks don't do cloud, even if it costs more.
In my opinion, the Cloud Act is just an official recognition of what's already going on.
"A door is what a dog is perpetually on the wrong side of" - Ogden Nash
"Under the act, all U.S. cloud service providers, from Microsoft and IBM to Amazon -- when ordered"
;)
Guess if you have already move on board(to the cloud) you have some thinking to do. Your data is in someone elses hands.
Just my 2 cents
Every fucking article on China controlling state is written like they are bad guys and we are good guys.
No, fucking morons. Our leaders are exactly the same.
I have to agree, it sounds a lot/too dang much like China. My data used to be mine.
As I look at what today says about the future, I'm profoundly grateful to be old now, having enjoyed my youth when it was still fun. I don't believe today's crop of eager, ambitious, hopeful young people have a real idea of what their future holds. The Cold War scared me a lot when I was that age, and now the Cold War looks very tame. The climate we old folks have made for them, the surveillance society that's evolving, and similar scary sh...tuff ought to scare the crap outta young people.
-Fight it, while you still can! Good luck, kids!
America has NO RIGHT doing this. It was what Russia did within USSR and CHina does. Now, we are becoming no different than other dictatorial nations.
I prefer the "u" in honour as it seems to be missing these days.
Hardly news, and this has been "news" in the computer world since the beginning.
This is not a new concern. People have been renting out hardware long before Amazon was invented, computer time has been rented out . Back in the 1960s and 1970s many mid-sized banks were hesitant to avoid computers not because they didn't trust or couldn't afford the machines, but because they didn't trust the companies who owned the machines or the governments where the computers were located. IBM with locations around the globe was the biggest and generally considered most trustworthy, but (looking up history online) you could rent computer access from Honeywell, Sperry Rand, Siemens, EMI, Olivetti, and others. Noting their location, that could mean you were subject to US laws, or UK laws, or Germany or France or Italy or wherever the computing center was located.
I recall discussions a decade ago asking how much we valued hosting our own data, if we were willing to sacrifice the security of controlling it versus the convenience of letting Google Docs control access to all our documents. There are companies who trust every bit of their digital data to Amazon or Google or other companies. They figure that the cost savings is a benefit, and they don't care about (or don't realize) the security implications.
There are companies that decide that maintaining control is important. For them, even if it would be cheaper or easier to lease out hardware remotely the value of maintaining control is greater than any cost savings.
//TODO: Think of witty sig statement
...is that companies, organisations, & individuals outside the US can't do business with US data farm companies if they value their privacy, R&D secrets, & IP. Add this to the revelations outed by Edward Snowden & it's a wonder that anyone in their right mind would want to get entangled in that mess.
Isn't this in combination with the GDPR just going to make it plain illegal for European data controllers to put their data on US owned servers?
... we need some way of obfuscating data with secrets that are not stored on the cloud provider ... we could call it ENCRYPTION.
Say it ain't so!!!
So, just make it impossible for even the vendor to read the (unencrypted) data. The most the vendor could do is hand over encrypted data, leaving authorities to try to decrypt it without the key. Or try to force the owner to give up the key.
One such new offering is IBM Hyper Protect DBAAS:
Hyper Protect DBaaS: the evolution of cloud databases
Getting started with IBM Cloud Hyper Protect DBaaS
BTW, this doesn't run on Intel hardware. It runs on IBM Z hardware, on dedicated cores per instance, which should minimize the potential for Spectre-type attacks.
IBM is rolling this out aggressively. How aggressively?
For now, they are handing out well-provisioned Postgres (8G memory, 80G data) and MongoDB (8G memory, 40G data) experimental instances for free.
Only reason I am not taking them up on this is that I know we won't be able to afford the price, once it is not free. I'll stick with out 1G memory Databases for PostgreSql instance for our little educational app.
Hyper Protect DBaaS (pricing)
Not an IBM shill. Just happy to not be drinking the AWS kool aid.
Yeah, I'm sure if Putin was never in the picture, all the Democrat and Republican politicians would just be double super good.
Damn you Putin!
The flip side of this is that if you're European and can evade being identified locally, you can use American hosts to protect your speech since federal law protects American hosts from being taken to court for speech that is legal under the first amendment.
In a previous life, pretending to be a bog-data person, we could use US-based Google BigTables only because
- the most sensitive information had to be published in a political-contributors report later, and
- the personal (personally identifying) information was only kept there for the duration of the election campaign.
Otherwise, we would have had to store it in Canada on equipment we owned.
davecb@spamcop.net
Nope. He does not hate China. He is just using them hoping to take attention away from his treason.
HOWEVER, he was doing the right thing with CHina. We will see what happens down the road. I suspect that his deal with China will be a joke and a half, and fix nothing.
I prefer the "u" in honour as it seems to be missing these days.
This Putin guy must be some superhero. He singlehandedly took over the west while sitting on a failed second-world impoverished country's chair.
In a word, no. There could be some concerns in some cases, but generally not an issue.
The Cloud Act relates to what a warrant or subpeona may reach, and doesn't change anything - it just affirms what existing law, stating explicitly what had been implicit.
It says that the pre-existing power of US courts to order US companies to turn over data material to a case cannot be thwarted by the US company stashing the bits on disks which are physically overseas. That was already a bit of a "duh, no shit" to anyone who has studied law, but Congress saw fit to state it explicitly.
GDPR doesn't say you can't comply with a subpoena or warrant. It explicitly says you can comply. So no problem, there, no conflict between Cloud Act and GDPR, generally.
The one wrinkle is that GDPR says when you send data to another country, one of two things needs to be in place
A mutual legal assistance agreement
Or
The other country has approved privacy law
The US has both. A new data privacy safe harbor agreement with the US was approved by the EU in 2016, after the previous one was found lacking. We also have a Mutual Legal Assistance Agreement (MLAA).
There could be cases, however, in which a subpoena is issued which doesn't comply with the MLAA. Then one could argue complying with that particular subpeona could violate GDPR. Except we ALSO have the 2016 safe harbor agreement, so the MLAA isn't actually necessary anyway.
So in rare cases you could argue that there might be a conflict, but you'd probably lose that argument.
What's stopping the EU from taking the position that they have similar access to users data stored on American servers? Google/Facebook provide services to Europeans, Europe has the right to access their data to support 'investigations'.
First of all, I don't see any definitions of the extent of the US law. Does it only apply to the data of US persons in support of a US investigation? Then I don't see a problem with granting the EU the same sorts of access to EU persons for the same reasons. Nowhere is it stated that the US wants to go on fishing expeditions through non US persons data. But if this is the case, then I don't see where European officials shouldn't have the same rights.
Have gnu, will travel.
But there is a huge difference between China and the USA govts.
In China, when you disagree with the govt, you and your family disappear, cannot travel, don't get a lawyer and often aren't seen for a yr. If you appeal, you get re-sentenced to death.
In the USA, you get a lawyer, can usually fight back, appeal any decision.
A few quick reminders:
Xi is
* a dictator for life
* sends millions of Chinese to "re-education camps"
* no freedom of speech
* no freedom of travel
* China uses tanks against their own people.
* Religious re-education cities with 1M+ people.
* smartphones **must** have govt tracking software
* Your social network posts are tracked by the govt and rated. A poor rating can block rights and travel.
* don't recognize international waters as ruled by world-wide govts
* Currency manipulation
* intellectual property stealer / Hacker of companies and govts world-wide
* Highly selective enforcement for any laws; usually against foreign companies and Chinese companies that cause large number of deaths
* Tibet takeover
* Tienanmen Square; they admit to killing over 1,022 civilians. Other estimates are over 10,000 deaths.
* Check your server logs, most attacks are probably from Chinese IP ranges.
* Their elections are fixed - only approved party members can be on the ballot. So, would you like Bernie or Clinton or Gore or Dukakis?
Like any of those are even a different choice from the others. Well, freakin' terrible vs really, really, bad is a choice, I suppose.
* Police in China behave like thugs. Ok, sometimes that happens in the USA too.
* Taiwan, cough.
Don't forget what China is and how they behave.
---
Cisco and Motorola caught Huawei stealing their intellectual property.
https://www.wsj.com/articles/S...
Huawei Admits Copying Code From Cisco in Router Software
https://www.reuters.com/articl...
---
Motorola sues Huawei for trade secret theft
Huawei physically stole parts in 2014 from a testing robot during a
visit to T-Mobile. The robot was used to ensure buttons on phones would last.
---
https://www.nytimes.com/2016/1...
China hacked more than 245 companies and agencies, including US Navy and NASA.
Ref: https://arstechnica.com/tech-p...
This happened while The US/China economic espionage pact was in-force beginning in 2016.
The USA isn't perfect, but it isn't China. Not by a long shot. If you refuse to decrypt data at the US border, they keep the data and you can sue to have it returned. Canada, UK, Australia, France, Thailand, and 50 other countries would demand you unlock it at the border without any reasonable cause. It is illegal to refuse, a crime.
DuPont is American, founded in Delaware.
"First they came for the slanderers and i said nothing."
That law is a prime example of slippery slope. The USA controls a lot of Internet resources and to make reaching laws gives other countries precedence to do exactly the same and now we just have clouds that don't pass territorial lines. Granted the spying was most likely happening anyway since nobody can trust their own country let alone each others countries anymore. At least though we didn't have a law saying we're going to f'n spy on you no matter where your data is.
Trump is just that weak.
They can punish multinationals for not complying though.
Playing chicken requires some balls and a lack of care for the consequences to win, the EU has no balls and the US is ruled by someone who doesn't give a shit about consequences. So in a game of chicken the US always wins.
When push comes to shove the EU will not impose liabilities on multinationals for complying with the Cloud act, but the US prosecutors would for not complying. The multinationals know this, so EU law is irrelevant and the Cloud act reigns supreme.
When push comes to shove the EU will not impose liabilities on multinationals for complying with the Cloud act
In before "OMG, EU is just fining US companies to get free money!"
Also, the solution is going to be that "Microsoft Cloud US" and "Microsoft Cloud EU" are two completely different companies that has nothing to do with each other more than both having the same owner.
One will comply with US rules and one will comply with EU rules.
There will also be a "Microsoft Cloud CH" where you for some reason can't have files named Winnie.
In effect, that would mean that cloud services are only allowed to work with data from their own country. Or businesses would have to keep stuff on their own servers, as they did for, oh, 30 years or so before the data services in question became common?
C - the footgun of programming languages
Hey smart guy, did you miss that little caveat about "if you can evade being identified locally?"
UK law enforcement has no legal standing in the US on this issue. That means that if you are in the UK and want to host edgy commentary all you have to do is find a host in the US that you like. If UK police send a subpoena, the American host is going to laugh hysterically and respond "stop wasting our time, limey pig."
I'm going to guess that when you saw the term "safe harbor" you thought of the safe harbor provisions of the DMCA, or some other law you are familiar with. Many laws have safe harbor provisions - including GDPR.
GDPR Article 47 states that companies outside the EEA that adopt "binding corporate rules" for data protection are exempt from GDPR Article 45, if their adoption is "approved by a competent supervisory authority".
Such "binding corporate rules" was first laid down in the EU-US Safe Harbour Principles (2000-2015), which was later renamed (with minor changes) as the EU-US Privacy Shield Framework (2016).
Nor do you know what security by obscurity means and why it's rubbish.
All your screed there is bullshit. Why do you think cameras are recording in Malls? Stealing still happens, but the POSSIBILITY of getting caught puts people off and the number of attempts to actually stop reduce. Same with open source code: many are put off because if they DO get caught, they not only lose the access, they also get known as a black hat.
Meanwhile closed source can pretend there isn't a problem, and can even refuse to look for problems so that they can plausibly deny any culpability when the problem arises.
Protecting the US economy does however imply not fucking over America's IT industry, which the inane data access laws are likely to do.
Australian companies are already losing business or migrating key operations to other countries because the Australian government enacted idiotic laws. Spanish media screamed when the government enacted the idiotic laws they asked for because they lost so much business.
Governments are struggling to understand that technology makes it easy to avoid damaging laws.
It was ended in 2015, then re-done in 2016.
It's possible something happened in the last few weeks that I'm unaware of.