7 ms·

In my main job we provide SaaS services. We get more and more requests for "EU located" services. A new trend I see is that some customers even rule out using

In my main job we provide SaaS services. We get more and more requests for "EU located" services. A new trend I see is that some customers even rule out using EU located servers that are owned/run by US companies (such as the AWS Dublin or Franfurt locations).

croes 2y ago
Of course they do. Because of the CloudAct the location of the server doesn’t matter. A US company has to give access to the data on their servers to the authorities no matter where the servers are located. They can go to court to prevent it but aren’t allowed to inform their customer. That violates EU law on multiple levels.
- dathinab 2y ago
  Also EU daughter companies of US tech giants are still legally EU companies (owned by US companies) legally they have to strictly comply with EU law and it matters shit what US law says (from the EU legislative POV) so this puts them into a huge problem spot.
  - croes 2y ago
    It’s a problem without solution. That have to break one side’s law.
  - foepys 2y ago
    Didn't Microsoft argue this in a US court and lost?
  - tzs 2y ago
    An EU company, even if it is owned by a US company, would not be subject to the Cloud Act and so should not find itself on the spot. The Cloud Act applies to whoever owns the data on the server, not to whoever owns the server. Here's the situation it was designed to deal with. You've got a US company that has some documents. Law enforcement gets a subpoena requiring the company to turn over copies of those documents. If the company has used some third party cloud storage provider to store those documents it has to retrieve them. It does this using the exact same procedure it would use if it was retrieving the documents for its own use. To the cloud storage provider this is just a routine data retrieval of a customer's data by the customer. As far as I know if someone outside the EU buys cloud storage from an EU cloud storage provider, stores some files there, and later retrieves those files the EU provider will not get in trouble if that customer later did something with the files that would not be legal in the EU. I'd be surprised if most countries don't have something equivalent. For example when German prosecutors were investigating VW after VW's emissions test cheating came to light if they had used whatever the German equivalent of a subpoena is to ask for copies of the emission system source code, would VW have been able to say "Sorry, we've got those in a private Github repository which happens to be hosted outside of the EU, so we can't get them for you"? I suspect that the only reason the US actually had to have something like the Cloud Act and others don't is because only in the US could you have actually had a chance to succeed in saying that you cannot be compelled to turn over a document that you control and can legally retrieve at any time just because you happen to have it currently stored somewhere that the compelling government does not have jurisdiction over.
    - dathinab 2y ago
      > The Cloud Act applies applies explicitly to daughter companies of US parents no matter which country they are based in
yibg 2y ago
How would that even work if fully enforced? Are there even enough EU owned cloud and SaaS services to fill in for all the US owned ones?
- rsynnott 2y ago
  At present, no, of course not. No company maintains surplus capacity sufficient to absorb its competitors' business if they withdraw from or are excluded from the market. You'd assume in practice there'd have to be a transition period, during which the likes of Hetzner would be... busy. (More likely, there's another round of negotiation, and some new bandaid solution is produced; not like it's the first time. No-one, or almost no-one, really _wants_ this to break down entirely; the fallout would be widespread.) It does seem reasonable to expect that the rate of companies moving stuff out of US-based infrastructure providers will increase, though; the whole thing is very fragile.
  - pjc50 2y ago
    I don't think you can rely on "no one will smash US institution X because that would be bad for everyone" any more.
    - rsynnott 2y ago
      You've got to imagine there are limits, tho. I note that Trump backed off most tariffs, at least for now, when the markets got unhappy (I mean, you could believe it was due to symbolic troop movements if you wanted, I suppose?) And cloud services to Europe are _big_ business; it would not be a small market shock. If there were to be a major migration from AWS and Azure to the likes of Hetzner, OVH and friends, also, that would likely be _permanently_ lost business for US megacorps; no-one does that sort of migration unless they really have to, so it's improbable that anyone would move back if and when the situation was resolved.
      - pjc50 2y ago
        I thought he only backed off the Canadian tariffs, and only because there were retaliatory tariffs plus some symbolic concession? The China ones and the de minimis change are still in place. Bezos turning up at the inauguration and directing the WaPo to not endorse Harris are strong hints that Amazon is probably going to be fine, but I would say that nothing is certain when dealing with someone who's deliberately unpredictable and willing to threaten allies.

croes 2y ago

Of course they do. Because of the CloudAct the location of the server doesn’t matter. A US company has to give access to the data on their servers to the authorities no matter where the servers are located. They can go to court to prevent it but aren’t allowed to inform their customer. That violates EU law on multiple levels.

dathinab 2y ago
Also EU daughter companies of US tech giants are still legally EU companies (owned by US companies) legally they have to strictly comply with EU law and it matters shit what US law says (from the EU legislative POV) so this puts them into a huge problem spot.
- croes 2y ago
  It’s a problem without solution. That have to break one side’s law.
- foepys 2y ago
  Didn't Microsoft argue this in a US court and lost?
- tzs 2y ago
  An EU company, even if it is owned by a US company, would not be subject to the Cloud Act and so should not find itself on the spot. The Cloud Act applies to whoever owns the data on the server, not to whoever owns the server. Here's the situation it was designed to deal with. You've got a US company that has some documents. Law enforcement gets a subpoena requiring the company to turn over copies of those documents. If the company has used some third party cloud storage provider to store those documents it has to retrieve them. It does this using the exact same procedure it would use if it was retrieving the documents for its own use. To the cloud storage provider this is just a routine data retrieval of a customer's data by the customer. As far as I know if someone outside the EU buys cloud storage from an EU cloud storage provider, stores some files there, and later retrieves those files the EU provider will not get in trouble if that customer later did something with the files that would not be legal in the EU. I'd be surprised if most countries don't have something equivalent. For example when German prosecutors were investigating VW after VW's emissions test cheating came to light if they had used whatever the German equivalent of a subpoena is to ask for copies of the emission system source code, would VW have been able to say "Sorry, we've got those in a private Github repository which happens to be hosted outside of the EU, so we can't get them for you"? I suspect that the only reason the US actually had to have something like the Cloud Act and others don't is because only in the US could you have actually had a chance to succeed in saying that you cannot be compelled to turn over a document that you control and can legally retrieve at any time just because you happen to have it currently stored somewhere that the compelling government does not have jurisdiction over.
  - dathinab 2y ago
    > The Cloud Act applies applies explicitly to daughter companies of US parents no matter which country they are based in

yibg 2y ago

How would that even work if fully enforced? Are there even enough EU owned cloud and SaaS services to fill in for all the US owned ones?

rsynnott 2y ago
At present, no, of course not. No company maintains surplus capacity sufficient to absorb its competitors' business if they withdraw from or are excluded from the market. You'd assume in practice there'd have to be a transition period, during which the likes of Hetzner would be... busy. (More likely, there's another round of negotiation, and some new bandaid solution is produced; not like it's the first time. No-one, or almost no-one, really _wants_ this to break down entirely; the fallout would be widespread.) It does seem reasonable to expect that the rate of companies moving stuff out of US-based infrastructure providers will increase, though; the whole thing is very fragile.
- pjc50 2y ago
  I don't think you can rely on "no one will smash US institution X because that would be bad for everyone" any more.
  - rsynnott 2y ago
    You've got to imagine there are limits, tho. I note that Trump backed off most tariffs, at least for now, when the markets got unhappy (I mean, you could believe it was due to symbolic troop movements if you wanted, I suppose?) And cloud services to Europe are _big_ business; it would not be a small market shock. If there were to be a major migration from AWS and Azure to the likes of Hetzner, OVH and friends, also, that would likely be _permanently_ lost business for US megacorps; no-one does that sort of migration unless they really have to, so it's improbable that anyone would move back if and when the situation was resolved.
    - pjc50 2y ago
      I thought he only backed off the Canadian tariffs, and only because there were retaliatory tariffs plus some symbolic concession? The China ones and the de minimis change are still in place. Bezos turning up at the inauguration and directing the WaPo to not endorse Harris are strong hints that Amazon is probably going to be fine, but I would say that nothing is certain when dealing with someone who's deliberately unpredictable and willing to threaten allies.