11 ms·

Microsoft Can't Keep EU Data Safe from US Authorities

299 points by Mossy9 11mo ago

giuliomagnifico 11mo ago
It’s an old new (July 22)
throwawayffffas 11mo ago
> Carniaux did say that the situation had never arisen. That's what he would say if the company was under a gag order in the US. So I would take anything they say with a mountain of salt.
- alwayseasy 11mo ago
  Specifically here, he is under oath in France so an American gag order wouldn't protect him from the French justice system. This make it less likely he's lying. It could be possible Microsoft France has a "rogue" employee system where a key person only obeys to Microsoft US orders rather than his French boss and French law. Then the boss can swear to the Senate that they're complying. This is exactly the system the US Congress accused TikTok of having set up.
  - hyghjiyhu 11mo ago
    If the data center is operated by a "trusted subsidiary" as the article mentions and everyone in key roles is a French citizen with no connection to the US then there is no one to give a gag order. In practice the US HQ could mandate a security update that secretly uploads all data to the US but that's a whole other can of worms that I don't think anyone is ready to open.
    - dathinab 11mo ago
      the data center which runs software written and controlled by the US companies and likely has a 24/7 software related support team which is distributed across the world.... in a modern cloud dater center you don't need someone physically plugging a USB stick in a server, you just need a back door in a cloud software stack many times the size then any modern operating system which often even involves custom firmware for very low level components and where the attacker has the capabilities to convince your CPU vendor to help them...
      - spwa4 11mo ago
        ... a backdoor that is a necessity anyway, because it is constantly used to upgrade the cluster software.
    - fsckboy 11mo ago
      >In practice the US HQ could mandate a security update that secretly uploads all data to the US but that's a whole other can of worms that I don't think anyone is ready to open. incredibly ambiguous/unsatisfying sentence. if this french hearing is concerned about french data security, then asking a question about your "in practice" is exactly a can of worms the french would like to open.
      - hyghjiyhu 11mo ago
        Everyone and everything is automatically downloading updates of US software. It's a door that is impossible to close in the short term.
  - dathinab 11mo ago
    Until this happened MS was still going around trying to convince lawyers to use their Cloud and telling them that there is no issue. Including certain contractual "standard"(1) agreements which would make some of their higher management _personally_ liable for undue data access even under Cloud act from the US!!! (1) As in standard agreements for providers which store lawyer data, including highly sensitive details about ongoing cases etc. So you can't really trust MS anymore at all, even if personal liability (e.g. lying under oath) is at stack. And the max ceiling for the penalties for lying under oath seem less then what you can run into in the previous mentioned case... You also have to look a bit closer at what it even means if "the french MS CEO swears they are complying" it means he doesn't know about non compliance and did tell his employees to comply and hired someone to verify it etc. But the US doesn't need the French CEO to know, they just need to gain access to the French/EU server through US employees, which given that most of the infra software is written in the US and international admin teams for 24/7 support is really not that hard... And even if you want to sue the French CEO after a breach/he (hypothetically) lied he would just say he didn't because he also was lied too leading to an endless goose chase and "upsi" by now the French CEO somehow is living in the US. And that is if you ever learn about it happening, but thanks to the US having pretty bad gag orders/secret court stuff the chance for that is very low. So from my POV it looks like MS has knowingly and systematically lying and deceiving customer, including such with highly sensitive data, and EU governments about how "safe" the data is even if it lead to personal legal liabilities of management. And I mind to remember that AWS was giving similar guarantees they most most likely can't hold, but I'm not fully sure. Idk. about Google. Oh and if you hope that the whole Sovereign Cloud things will help, it wont. It's a huge mage pretend theater moving millions over millions into the hands of US cloud providers while not providing a realistic solutions to the problem it is supposed to solve and neglecting local competition which actually could make a difference, smh.
    - impossiblefork 11mo ago
      The max penalty for things like this is actually life inprisonment though. If you, to aid a foreign power without authorization gather certain types of information, it's espionage. There wouldn't be any lawsuit. If you do this kind of things you get arrested, get a trial and then you are in prison forever.
  - MengerSponge 11mo ago
    > This is exactly the system the US Congress accused TikTok of having set up. "Every accusation is a confession" remains undefeated
    - Nevermark 11mo ago
      Agreed. -- As a side rant: "Specious accusations are often confessions." I understand the psychology and casual use of absolutely worded reactions, and that their extreme expression is not taken literally, but as emphasis. But I still prefer balanced wording. A surprisingly large number of people tragically clash and talk past each other over charged non-issues, that normal undramatic language would render moot. I.e. "We must believe all X", vs. "We should listen to all X", ... and many more. "Black Lives Matter Too", isn't as pithy. Nor should the last word be necessary for anyone to understand the three word version. But the fourth word, nodding to the wider context, pre-counters a lot of ridiculous responses to the original line. Not actually suggesting a sea change in a well recognized movement banner line. But it is a widely observed example of how any lack of pedantic clarity is seized upon by motivated reactionaries, to achieve politically significant impact via obtuse reinterpretation. A little verbal pedantry is an effective speed bump against the siren song of motivated or inadvertent polarization.
      - MengerSponge 11mo ago
        It's naive or foolish to think that the problem with "Black Lives Matter" was insufficient specificity. People who are not operating in good faith won't operate in good faith. There were thousands of words written on the phenomenon protested by BLM, but those are easily ignored. Three words are twisted and co-opted by propagandists. Consider a function that describes "comprehension by bigots" as a function of word count. We know that 0 words yields 0 comprehension. Evidence suggests that 10k words also yields 0 comprehension. There is no evidence that this Laffer curve will ever achieve anything other than zero. It's possible to reach and change bigots' minds, but it requires human connections. Not sloganeering, prose, or reels.
        Nevermark 11mo ago
  - jacquesm 11mo ago
    Less likely doesn't say much though. He may have simply weighed the chances of the French government ever finding out that he lied. > It could be possible Microsoft France has a "rogue" employee system where a key person only obeys to Microsoft US orders rather than his French boss and French law. I would think that is not just a possibility, but a certainty.
  - throwawayffffas 11mo ago
    > This make it less likely he's lying. It could be possible Microsoft France has a "rogue" employee system where a key person only obeys to Microsoft US orders rather than his French boss and French law. Then the boss can swear to the Senate that they're complying. It's also possible that US employees had access to French servers without anyone in France knowing.
shevy-java 11mo ago
Time to pull away all EU data from the Trump USA.
- embedding-shape 11mo ago
  I think many already started, the only reason it's starting to appear in the news is because people are making progress with the moves, and US companies are noticing it, but it's been planned and organized for a lot longer than just the last year.
  - mk89 11mo ago
    I think starting from the day after CLOUD act was approved (2018). Crazy to even think that such a law exists.
- deleted 11mo ago
  [deleted]
- spookie 11mo ago
  Can assure you it has been happening for a while.
varispeed 11mo ago
Governments are not exempt from Cloud Act and US providers can be under gag order, so from EU or UK government perspective, they will never know if data has been accessed by 3rd country and what happened to it. This is actually amazing that all the tenders have not been rejected under national security grounds or simply security services (yet again) have not done the job tax payers pay them to do.
- immibis 11mo ago
  > they will never know if data has been accessed by 3rd country and what happened to it. They should have arranged to get a 100 euro refund every time it happens, or 440 euros if the UK does it.
1123581321 11mo ago
I wouldn't think "sovereign" EU data would be protected from US snooping either, unless the Five Eyes Plus alliance is going to be dissolved. Even then...
- GTP 11mo ago
  Well, not relying on US cloud would already be a giant step in the right direction, by making it significantly harder to snoop on the data.
  - 1123581321 11mo ago
    I don't believe that's the case because the intelligence pooling is meant to remove cross-border friction. A general breakdown of western alliances would probably be required (and maybe that's where we're headed.)
    - dboreham 11mo ago
      > A general breakdown of western alliances would probably be required Hearing a distant shout of "hold my beer" from the White House...
    - timeon 11mo ago
      Not just headed, it is already in the process.
- blibble 11mo ago
  I suspect the other 4 eyes are somewhat less willing to do the US regime's bidding these days
  - emodendroket 11mo ago
    On what basis?
    - fragmede 11mo ago
jmyeet 11mo ago
An inevitable consequence of this administration destroying US foreign influence and power at an unprecedented rate is that (IMHO) it is inevitable that the EU builds their own cloud and mandates its use for EU data. It is becoming a matter of national security. The interesting thing is that the US is acting in the exact way that they accuse China of acting. Companies like Huawei are forbidden from installing telecom infrastructure for "national security" reasons [1]. One of justifications for first banning then forcing a sale of Tiktok was because of possible Chinese government interference. It's only a matter of time before the EU and China start making the same determination against US tech giants (eg Meta executive brags about silencing dissent [2]). This administration really is killing the golden goose. [1]: https://www.reuters.com/business/media-telecom/us-fcc-bans-equipment-sales-imports-zte-huawei-over-national-security-risk-2022-11-25/ https://www.reuters.com/business/media-telecom/us-fcc-bans-e... [2]: https://www.youtube.com/watch?v=7eO8byuv6PE https://www.youtube.com/watch?v=7eO8byuv6PE
- spongebobstoes 11mo ago
  I don't think that YouTube video is a good supporting piece for your point. The spokesperson says they don't want to propagate harmful stereotypes. "brag about silencing dissent" seems like a strawman interpretation A better faith interpretation is that people are free to criticize Israel and Zionism on Meta, just not using racist tropes.
  - jmyeet 11mo ago
    Oh if that were only true. It's been made apparent in the last 2 years in particular that fighting antisemitism from the perspective of the ADL and figures like Jordana Cutler (who previously worked for the Israeli Prime Minister's Office) simply means silencing critcism of Israel, even when that means siding with actual antisemites (up to and including neo_nazis and outright Nazis). Examples: - Ben Shapiro excuses antisemitic remarks by Ann Coulter because she's pro-Israel [1]; - ADL defends Elon Musk for making the Nazi salute (twice) on stage [2] - We brutalized people with the police for organizing peaceful protests to say "maybe we shouldn't bomb children" or to get their respective universities to divest their endowments from the state doing the bombing; - We went so far as trying to deport legal permanent residents for organizing said peaceful protests (ie Mahmoud Khalil); and - The IHRA definition of antisemitism includes criticisms of the state of Israel. [1]: https://x.com/benshapiro/status/644505141299671041 https://x.com/benshapiro/status/644505141299671041 [2]: https://www.aljazeera.com/news/2025/1/22/adl-faces-backlash-for-defending-elon-musks-raised-arm-gesture https://www.aljazeera.com/news/2025/1/22/adl-faces-backlash-...
schuyler2d 11mo ago
I can't imagine the Cloud Act being effective without Microsoft (and French gov) complicity. If they can make successful tax shelters they can architect the entities and the architecture to remove this option. There's some 9-eyes thing where this is a feature not a bug
- kmeisthax 11mo ago
  Microsoft tried architecting a "surveillance shelter" in Ireland. It worked. That's actually why the CLOUD Act even exists[0]: it was passed specifically to prohibit Microsoft from doing this. [0] https://en.wikipedia.org/wiki/Microsoft_Corp._v._United_States https://en.wikipedia.org/wiki/Microsoft_Corp._v._United_Stat...
pkstn 11mo ago
Luckily we have great European cloud companies like UpCloud https://upcloud.com https://upcloud.com
- jeffrallen 11mo ago
  With 3 data centers in the USA, seems like they are probably subject to the CLOUD act.
josephh 11mo ago
But then who can? No global cloud providers, including Hetzner and OVH, are free from CLOUD act because they have US presence[1]. 1. https://us.ovhcloud.com/legal/faqs/cloud-act/ https://us.ovhcloud.com/legal/faqs/cloud-act/
- dboreham 11mo ago
  I'm guessing: Russia?
- blackoil 11mo ago
  https://www.alibabacloud.com/en?_p_lc=1 https://www.alibabacloud.com/en?_p_lc=1
- immibis 11mo ago
  Possibly only their US subsidiaries though?
- Sayrus 11mo ago
  OVHCloud US is a different company from the rest of the world. https://blog.ovhcloud.com/cloud-data-act/ https://blog.ovhcloud.com/cloud-data-act/
  - josephh 11mo ago
    You can't just spin up an LLC and call it a separate company. OVHCloud is still OVHCloud US' subsidiary company. From the FAQ page I linked: > In accordance with our Privacy Policy, OVHcloud will comply with lawful requests from public authorities. Under the CLOUD Act, that could include data stored outside of the United States. OVHcloud will consider the availability of legal mechanisms to quash or modify requests as permitted by the CLOUD Act.
    - kgwgk 11mo ago
      > OVHCloud is still OVHCloud US' subsidiary company. It’s the other way around. > From the FAQ page I linked: Which is for the US company.
blibble 11mo ago
after this whopping great vulnerability in Azure, anything there prior to that being fixed should be considered public anyway: https://dirkjanm.io/obtaining-global-admin-in-every-entra-id-tenant-with-actor-tokens/ https://dirkjanm.io/obtaining-global-admin-in-every-entra-id...
- conception 11mo ago
  Don't forget when Azure had it's root cert compromised. Which... maybe is still a thing?
emodendroket 11mo ago
A bit of a "hoist by their own petard" situation since the US has been raising this specter about Chinese tech for quite some time.
- jacquesm 11mo ago
  Yes. For Europe there isn't a real alternative other than to painstakingly re-grow our independence. That will take a long time.
eeasss 11mo ago
This is known. The problem is that the EU is hooked on us technology. I don’t see this untangling soon which is a big strategic weakness
- BiteCode_dev 11mo ago
  Pretty much yes. From Saas to authentication systems to OS to chips. The EU infra is entirely dependent on the US. All documents, emails, chat messages, and most forms of storage are directly or indirectly linked to an American service. On top of that, the US can update it all remotely, including the hardware now thanks to things like intel ME. Let's hope we never get into a conflict with them, because even without bombs, they can basically shut us down with a few keystrokes: https://www.bitecode.dev/p/the-eu-can-be-shut-down-with-a-few https://www.bitecode.dev/p/the-eu-can-be-shut-down-with-a-fe... Or at least have everything they need to develop such a capability. And it's not like the current people in power care much about alienating other countries.
  - autoexec 11mo ago
    > From Saas to authentication systems to OS to chips. The EU infra is entirely dependent on the US. I would absolutely love to see the EU invest in developing processors and operating systems. It'd benefit us all to have real competition in those spaces, and it's the only way the EU can ever keep their data out of the hands of the US government.
  - cesarb 11mo ago
    > the US can update it all remotely, including the hardware now thanks to things like intel ME Let's not be excessively alarmist; AFAIK, the Intel ME is not (unless you're using things like vPro) exposed directly to the network, you need the cooperation of the operating system to reach the ME. Of course, said operating system is usually Microsoft Windows, which can be updated remotely... (and even Linux users often use USA-based distributions).
    - BiteCode_dev 11mo ago
      According to its specs, but since it's a black box for which we have neither the source nor the design documents, and given that implementing back doors is a regular request from governments, it's a logical concern.
tempodox 11mo ago
Of course they can’t. U.S. companies are under U.S. jurisdiction, no matter where their data centers are located.
- bluGill 11mo ago
  This is a French company owned by a US company though which makes things complex.
radiator 11mo ago
What difference, at this point, does it make? The EU has already surrendered any notion of sovereignty to the US in the fields of military and energy.
deleted 11mo ago
[deleted]
Havoc 11mo ago
The whole concept of big cloud somehow setting up sovereign clouds in Europe seems incredibly naive to me. Every AWS employee knows where his bread is buttered - Seattle not Brussels
- anthem2025 11mo ago
  [dead]
- rdtsc 11mo ago
  Yup. I always thought it was a way just to get business in EU. Do some performative dance of "hey, look! a separate DC building with EU employees only" and then hope nobody would ask too many questions. Then the next level is regulators in EU also have to care and can't just say "ok, you have a separate DC building with EU employees only. Good. My job is done, I checked" and move on.
- mk89 11mo ago
  Apparently someone buys it, otherwise AWS would not invest 8+ billions in Germany: https://www.aboutamazon.eu/news/aws/aws-plans-to-invest-7-8-billion-into-the-aws-european-sovereign-cloud https://www.aboutamazon.eu/news/aws/aws-plans-to-invest-7-8-... "If it's certified, it must be good".
  - Havoc 11mo ago
    They buy it because it's enough to tick the corporate compliance box. Decisions made by people that don't actually give a F
    - mk89 11mo ago
      It's all because of something that started years ago: the move to the cloud. Companies started to move to cloud like there was no tomorrow. Their on-prem products became maintenance or zombies. Now you want the self hosted? Good luck. What's the alternative for a SaaS provider? Support all the possible cloud alternatives? That's nearly impossible, so some companies (mainly big organizations) provide their software/SaaS in AWS gov regions and so be it. (Or... be smart, see the trend and start selling your software again in self-hosted solutions!) For a consumer (gov, for example) this means: you don't have that feature, you give in, or you build it/let it build (open source). This is the only reason why we saw the recent announcement of the Austrian govt that was able to migrate from MS to Nextcloud. Without an alternative, ... they couldn't have done anything.
csense 11mo ago
This applies to any company, doesn't it? Your home country can tell you "Give us your data" and you have to comply. "I will never give up customer data" is a very tough promise to keep, if the government threatens you with your business license being revoked, your servers and domains being forcibly seized by the police, and you personally going to jail. (Under the current US administration, we can add "A close examination of the immigration status of all foreign nationals employed by your company, followed by probable deportation or jail" to the list of potential consequences for resisting the government.)
- satellite2 11mo ago
  Of course. But what if the holding lives in a country that don't enforce this (or is too weak to). Then all the subsidiaries are really sovereign from the host country perspective. It seems the solution is ages old. Don't have the holding incorporated in an empire...
  - vladvasiliu 11mo ago
    How would this work in practice? If the empire wants to get at your data, why do you think it would shy away from pressuring a country so weak that it can't afford to enforce this on their companies?
  - stetrain 11mo ago
    Then the empire just says that they want the data or you won't be allowed to operate in the empire, which would be bad for profits and anger shareholders.
- autoexec 11mo ago
  The trick is to collect as little data as possible and to get rid of what you need to collect as quickly as you can. This is in direct opposition to the practices of companies like Microsoft which wants to spy on their users and profit from the data they collect though. There's also an open question of how possible it is to run a system that doesn't collect/store data in a way that makes it possible to be collected by the government. The US government can force companies to compromise their systems or shut down their services if they refuse. In the past they've even threatened that shutting down a service instead of compromising it could still get operators in legal trouble. At this point anyone who wants to keep the US government out of their data should avoid using any US company.
jeppester 11mo ago
Anyone who's read the law has known this for years. The GDPR is incompatible with the Cloud Act, and so the only legal (or so it should be) way to use US companies is to treat them like unsafe third countries - no matter the data center location. But everyone wants to continue like before. Having to ensure that Amazon and Azure never touches unincrypted personal data is hard. So one "compromise" after another has been tried - never solving the actual problem. As a EU citizen I think it's entirely embarrassing. Either the EU should have the power to force European subsidiaries to be exempted from the cloud act, or everyone should be forced to abide the law, which would greatly boost EU tech. Instead we are just rolling over.
penguin_booze 11mo ago
> U.S. companies can be forced to hand over data, regardless of where it is stored s/U.S./Chinese/ Tomato <=> Tomato
nashashmi 11mo ago
US cloud act is definitely an overreach. Suddenly private infrastructure is now an extension of the government surveillance complex. This is the equivalent of the govt being able to put a camera on your building because they want to observe the public/private area around it.
Agingcoder 11mo ago
Maybe I’m misunderstanding something - if I store my data elsewhere , am I not supposed to encrypt it anyway, with my keys ? If the crypto is strong enough then surely cloud providers can’t do anything with it ?
- cesarb 11mo ago
  > Maybe I’m misunderstanding something - if I store my data elsewhere , am I not supposed to encrypt it anyway "Cloud" is not only for storage; it's also for compute. Doing compute directly on encrypted data (homomorphic encryption) is very slow and very complicated, so when using a cloud, the data is usually either unencrypted, or encrypted but the key is elsewhere in the same cloud.
  - Agingcoder 11mo ago
    Thanks. I get that FHE is not realistic today, but can’t I use ( if it’s really critical) a combination of confidential vms and an external hsm ? I understand I’ll be limited to traditional workloads , and not managed services though. I asked the wrong question, what I really meant was ‘if I run in a less trusted environment, am I not supposed to use all possible crypto mechanisms available to make that environment more trustworthy , so that I can’t be deceived by my cloud operator sending my data to the us government’
    - fragmede 11mo ago
      That's just not possible. It's why detractors never got on board with the Cloud. Until FHE is feasible, the decryption keys and plaintext have to exists in RAM eventually at some point in order even if only took be re-encrypted, if any complex work is to be done on it. Because eg, Amazon, has access to your hardware, there's simply no way to prevent them from reading your secrets out of your VM that's using their RAM. Absolutely do what you can, but understand that it's futile to defend against your own cloud provider.
      - Agingcoder 11mo ago
riskable 11mo ago
Another take: Microsoft admitted under oath in France that the US government doesn't care enough about French data to ever have requested any. I'm sure if you asked the current administration what they think of France, they'd reply, "all they do is wine!"
- thefz 11mo ago
  The current administration will have difficulties pointing to France on a map.
thinkindie 11mo ago
I wonder why people are surprised, as this is an open secret nobody is willing to admit. And it's basically the reason we had Schrim I and Schrim II. At the same time a massive migration from US cloud in EU to EU cloud would be a massive pain for a lot of companies in the EU.

299 points by Mossy9 11mo ago

It’s an old new (July 22)

> Carniaux did say that the situation had never arisen. That's what he would say if the company was under a gag order in the US. So I would take anything they say with a mountain of salt.

alwayseasy 11mo ago
Specifically here, he is under oath in France so an American gag order wouldn't protect him from the French justice system. This make it less likely he's lying. It could be possible Microsoft France has a "rogue" employee system where a key person only obeys to Microsoft US orders rather than his French boss and French law. Then the boss can swear to the Senate that they're complying. This is exactly the system the US Congress accused TikTok of having set up.
- hyghjiyhu 11mo ago
  If the data center is operated by a "trusted subsidiary" as the article mentions and everyone in key roles is a French citizen with no connection to the US then there is no one to give a gag order. In practice the US HQ could mandate a security update that secretly uploads all data to the US but that's a whole other can of worms that I don't think anyone is ready to open.
  - dathinab 11mo ago
    the data center which runs software written and controlled by the US companies and likely has a 24/7 software related support team which is distributed across the world.... in a modern cloud dater center you don't need someone physically plugging a USB stick in a server, you just need a back door in a cloud software stack many times the size then any modern operating system which often even involves custom firmware for very low level components and where the attacker has the capabilities to convince your CPU vendor to help them...
    - spwa4 11mo ago
      ... a backdoor that is a necessity anyway, because it is constantly used to upgrade the cluster software.
  - fsckboy 11mo ago
    >In practice the US HQ could mandate a security update that secretly uploads all data to the US but that's a whole other can of worms that I don't think anyone is ready to open. incredibly ambiguous/unsatisfying sentence. if this french hearing is concerned about french data security, then asking a question about your "in practice" is exactly a can of worms the french would like to open.
    - hyghjiyhu 11mo ago
      Everyone and everything is automatically downloading updates of US software. It's a door that is impossible to close in the short term.
- dathinab 11mo ago
  Until this happened MS was still going around trying to convince lawyers to use their Cloud and telling them that there is no issue. Including certain contractual "standard"(1) agreements which would make some of their higher management _personally_ liable for undue data access even under Cloud act from the US!!! (1) As in standard agreements for providers which store lawyer data, including highly sensitive details about ongoing cases etc. So you can't really trust MS anymore at all, even if personal liability (e.g. lying under oath) is at stack. And the max ceiling for the penalties for lying under oath seem less then what you can run into in the previous mentioned case... You also have to look a bit closer at what it even means if "the french MS CEO swears they are complying" it means he doesn't know about non compliance and did tell his employees to comply and hired someone to verify it etc. But the US doesn't need the French CEO to know, they just need to gain access to the French/EU server through US employees, which given that most of the infra software is written in the US and international admin teams for 24/7 support is really not that hard... And even if you want to sue the French CEO after a breach/he (hypothetically) lied he would just say he didn't because he also was lied too leading to an endless goose chase and "upsi" by now the French CEO somehow is living in the US. And that is if you ever learn about it happening, but thanks to the US having pretty bad gag orders/secret court stuff the chance for that is very low. So from my POV it looks like MS has knowingly and systematically lying and deceiving customer, including such with highly sensitive data, and EU governments about how "safe" the data is even if it lead to personal legal liabilities of management. And I mind to remember that AWS was giving similar guarantees they most most likely can't hold, but I'm not fully sure. Idk. about Google. Oh and if you hope that the whole Sovereign Cloud things will help, it wont. It's a huge mage pretend theater moving millions over millions into the hands of US cloud providers while not providing a realistic solutions to the problem it is supposed to solve and neglecting local competition which actually could make a difference, smh.
  - impossiblefork 11mo ago
    The max penalty for things like this is actually life inprisonment though. If you, to aid a foreign power without authorization gather certain types of information, it's espionage. There wouldn't be any lawsuit. If you do this kind of things you get arrested, get a trial and then you are in prison forever.
- MengerSponge 11mo ago
  > This is exactly the system the US Congress accused TikTok of having set up. "Every accusation is a confession" remains undefeated
  - Nevermark 11mo ago
    Agreed. -- As a side rant: "Specious accusations are often confessions." I understand the psychology and casual use of absolutely worded reactions, and that their extreme expression is not taken literally, but as emphasis. But I still prefer balanced wording. A surprisingly large number of people tragically clash and talk past each other over charged non-issues, that normal undramatic language would render moot. I.e. "We must believe all X", vs. "We should listen to all X", ... and many more. "Black Lives Matter Too", isn't as pithy. Nor should the last word be necessary for anyone to understand the three word version. But the fourth word, nodding to the wider context, pre-counters a lot of ridiculous responses to the original line. Not actually suggesting a sea change in a well recognized movement banner line. But it is a widely observed example of how any lack of pedantic clarity is seized upon by motivated reactionaries, to achieve politically significant impact via obtuse reinterpretation. A little verbal pedantry is an effective speed bump against the siren song of motivated or inadvertent polarization.
    - MengerSponge 11mo ago
      It's naive or foolish to think that the problem with "Black Lives Matter" was insufficient specificity. People who are not operating in good faith won't operate in good faith. There were thousands of words written on the phenomenon protested by BLM, but those are easily ignored. Three words are twisted and co-opted by propagandists. Consider a function that describes "comprehension by bigots" as a function of word count. We know that 0 words yields 0 comprehension. Evidence suggests that 10k words also yields 0 comprehension. There is no evidence that this Laffer curve will ever achieve anything other than zero. It's possible to reach and change bigots' minds, but it requires human connections. Not sloganeering, prose, or reels.
      - Nevermark 11mo ago
- jacquesm 11mo ago
  Less likely doesn't say much though. He may have simply weighed the chances of the French government ever finding out that he lied. > It could be possible Microsoft France has a "rogue" employee system where a key person only obeys to Microsoft US orders rather than his French boss and French law. I would think that is not just a possibility, but a certainty.
- throwawayffffas 11mo ago
  > This make it less likely he's lying. It could be possible Microsoft France has a "rogue" employee system where a key person only obeys to Microsoft US orders rather than his French boss and French law. Then the boss can swear to the Senate that they're complying. It's also possible that US employees had access to French servers without anyone in France knowing.

shevy-java 11mo ago

Time to pull away all EU data from the Trump USA.

embedding-shape 11mo ago
I think many already started, the only reason it's starting to appear in the news is because people are making progress with the moves, and US companies are noticing it, but it's been planned and organized for a lot longer than just the last year.
- mk89 11mo ago
  I think starting from the day after CLOUD act was approved (2018). Crazy to even think that such a law exists.
deleted 11mo ago
[deleted]
spookie 11mo ago
Can assure you it has been happening for a while.

varispeed 11mo ago

Governments are not exempt from Cloud Act and US providers can be under gag order, so from EU or UK government perspective, they will never know if data has been accessed by 3rd country and what happened to it. This is actually amazing that all the tenders have not been rejected under national security grounds or simply security services (yet again) have not done the job tax payers pay them to do.

immibis 11mo ago
> they will never know if data has been accessed by 3rd country and what happened to it. They should have arranged to get a 100 euro refund every time it happens, or 440 euros if the UK does it.

1123581321 11mo ago

I wouldn't think "sovereign" EU data would be protected from US snooping either, unless the Five Eyes Plus alliance is going to be dissolved. Even then...

GTP 11mo ago
Well, not relying on US cloud would already be a giant step in the right direction, by making it significantly harder to snoop on the data.
- 1123581321 11mo ago
  I don't believe that's the case because the intelligence pooling is meant to remove cross-border friction. A general breakdown of western alliances would probably be required (and maybe that's where we're headed.)
  - dboreham 11mo ago
    > A general breakdown of western alliances would probably be required Hearing a distant shout of "hold my beer" from the White House...
  - timeon 11mo ago
    Not just headed, it is already in the process.
blibble 11mo ago
I suspect the other 4 eyes are somewhat less willing to do the US regime's bidding these days
- emodendroket 11mo ago
  On what basis?
  - fragmede 11mo ago

jmyeet 11mo ago

An inevitable consequence of this administration destroying US foreign influence and power at an unprecedented rate is that (IMHO) it is inevitable that the EU builds their own cloud and mandates its use for EU data. It is becoming a matter of national security. The interesting thing is that the US is acting in the exact way that they accuse China of acting. Companies like Huawei are forbidden from installing telecom infrastructure for "national security" reasons [1]. One of justifications for first banning then forcing a sale of Tiktok was because of possible Chinese government interference. It's only a matter of time before the EU and China start making the same determination against US tech giants (eg Meta executive brags about silencing dissent [2]). This administration really is killing the golden goose. [1]: https://www.reuters.com/business/media-telecom/us-fcc-bans-equipment-sales-imports-zte-huawei-over-national-security-risk-2022-11-25/ https://www.reuters.com/business/media-telecom/us-fcc-bans-e... [2]: https://www.youtube.com/watch?v=7eO8byuv6PE https://www.youtube.com/watch?v=7eO8byuv6PE

spongebobstoes 11mo ago
I don't think that YouTube video is a good supporting piece for your point. The spokesperson says they don't want to propagate harmful stereotypes. "brag about silencing dissent" seems like a strawman interpretation A better faith interpretation is that people are free to criticize Israel and Zionism on Meta, just not using racist tropes.
- jmyeet 11mo ago
  Oh if that were only true. It's been made apparent in the last 2 years in particular that fighting antisemitism from the perspective of the ADL and figures like Jordana Cutler (who previously worked for the Israeli Prime Minister's Office) simply means silencing critcism of Israel, even when that means siding with actual antisemites (up to and including neo_nazis and outright Nazis). Examples: - Ben Shapiro excuses antisemitic remarks by Ann Coulter because she's pro-Israel [1]; - ADL defends Elon Musk for making the Nazi salute (twice) on stage [2] - We brutalized people with the police for organizing peaceful protests to say "maybe we shouldn't bomb children" or to get their respective universities to divest their endowments from the state doing the bombing; - We went so far as trying to deport legal permanent residents for organizing said peaceful protests (ie Mahmoud Khalil); and - The IHRA definition of antisemitism includes criticisms of the state of Israel. [1]: https://x.com/benshapiro/status/644505141299671041 https://x.com/benshapiro/status/644505141299671041 [2]: https://www.aljazeera.com/news/2025/1/22/adl-faces-backlash-for-defending-elon-musks-raised-arm-gesture https://www.aljazeera.com/news/2025/1/22/adl-faces-backlash-...

schuyler2d 11mo ago

I can't imagine the Cloud Act being effective without Microsoft (and French gov) complicity. If they can make successful tax shelters they can architect the entities and the architecture to remove this option. There's some 9-eyes thing where this is a feature not a bug

kmeisthax 11mo ago
Microsoft tried architecting a "surveillance shelter" in Ireland. It worked. That's actually why the CLOUD Act even exists[0]: it was passed specifically to prohibit Microsoft from doing this. [0] https://en.wikipedia.org/wiki/Microsoft_Corp._v._United_States https://en.wikipedia.org/wiki/Microsoft_Corp._v._United_Stat...

pkstn 11mo ago

Luckily we have great European cloud companies like UpCloud https://upcloud.com https://upcloud.com

jeffrallen 11mo ago
With 3 data centers in the USA, seems like they are probably subject to the CLOUD act.

josephh 11mo ago

But then who can? No global cloud providers, including Hetzner and OVH, are free from CLOUD act because they have US presence[1]. 1. https://us.ovhcloud.com/legal/faqs/cloud-act/ https://us.ovhcloud.com/legal/faqs/cloud-act/

dboreham 11mo ago
I'm guessing: Russia?
blackoil 11mo ago
https://www.alibabacloud.com/en?_p_lc=1 https://www.alibabacloud.com/en?_p_lc=1
immibis 11mo ago
Possibly only their US subsidiaries though?
Sayrus 11mo ago
OVHCloud US is a different company from the rest of the world. https://blog.ovhcloud.com/cloud-data-act/ https://blog.ovhcloud.com/cloud-data-act/
- josephh 11mo ago
  You can't just spin up an LLC and call it a separate company. OVHCloud is still OVHCloud US' subsidiary company. From the FAQ page I linked: > In accordance with our Privacy Policy, OVHcloud will comply with lawful requests from public authorities. Under the CLOUD Act, that could include data stored outside of the United States. OVHcloud will consider the availability of legal mechanisms to quash or modify requests as permitted by the CLOUD Act.
  - kgwgk 11mo ago
    > OVHCloud is still OVHCloud US' subsidiary company. It’s the other way around. > From the FAQ page I linked: Which is for the US company.

blibble 11mo ago

after this whopping great vulnerability in Azure, anything there prior to that being fixed should be considered public anyway: https://dirkjanm.io/obtaining-global-admin-in-every-entra-id-tenant-with-actor-tokens/ https://dirkjanm.io/obtaining-global-admin-in-every-entra-id...

conception 11mo ago
Don't forget when Azure had it's root cert compromised. Which... maybe is still a thing?

emodendroket 11mo ago

A bit of a "hoist by their own petard" situation since the US has been raising this specter about Chinese tech for quite some time.

jacquesm 11mo ago
Yes. For Europe there isn't a real alternative other than to painstakingly re-grow our independence. That will take a long time.

eeasss 11mo ago

This is known. The problem is that the EU is hooked on us technology. I don’t see this untangling soon which is a big strategic weakness

BiteCode_dev 11mo ago
Pretty much yes. From Saas to authentication systems to OS to chips. The EU infra is entirely dependent on the US. All documents, emails, chat messages, and most forms of storage are directly or indirectly linked to an American service. On top of that, the US can update it all remotely, including the hardware now thanks to things like intel ME. Let's hope we never get into a conflict with them, because even without bombs, they can basically shut us down with a few keystrokes: https://www.bitecode.dev/p/the-eu-can-be-shut-down-with-a-few https://www.bitecode.dev/p/the-eu-can-be-shut-down-with-a-fe... Or at least have everything they need to develop such a capability. And it's not like the current people in power care much about alienating other countries.
- autoexec 11mo ago
  > From Saas to authentication systems to OS to chips. The EU infra is entirely dependent on the US. I would absolutely love to see the EU invest in developing processors and operating systems. It'd benefit us all to have real competition in those spaces, and it's the only way the EU can ever keep their data out of the hands of the US government.
- cesarb 11mo ago
  > the US can update it all remotely, including the hardware now thanks to things like intel ME Let's not be excessively alarmist; AFAIK, the Intel ME is not (unless you're using things like vPro) exposed directly to the network, you need the cooperation of the operating system to reach the ME. Of course, said operating system is usually Microsoft Windows, which can be updated remotely... (and even Linux users often use USA-based distributions).
  - BiteCode_dev 11mo ago
    According to its specs, but since it's a black box for which we have neither the source nor the design documents, and given that implementing back doors is a regular request from governments, it's a logical concern.

tempodox 11mo ago

Of course they can’t. U.S. companies are under U.S. jurisdiction, no matter where their data centers are located.

bluGill 11mo ago
This is a French company owned by a US company though which makes things complex.

radiator 11mo ago

What difference, at this point, does it make? The EU has already surrendered any notion of sovereignty to the US in the fields of military and energy.

deleted 11mo ago

[deleted]

Havoc 11mo ago

The whole concept of big cloud somehow setting up sovereign clouds in Europe seems incredibly naive to me. Every AWS employee knows where his bread is buttered - Seattle not Brussels

anthem2025 11mo ago
[dead]
rdtsc 11mo ago
Yup. I always thought it was a way just to get business in EU. Do some performative dance of "hey, look! a separate DC building with EU employees only" and then hope nobody would ask too many questions. Then the next level is regulators in EU also have to care and can't just say "ok, you have a separate DC building with EU employees only. Good. My job is done, I checked" and move on.
mk89 11mo ago
Apparently someone buys it, otherwise AWS would not invest 8+ billions in Germany: https://www.aboutamazon.eu/news/aws/aws-plans-to-invest-7-8-billion-into-the-aws-european-sovereign-cloud https://www.aboutamazon.eu/news/aws/aws-plans-to-invest-7-8-... "If it's certified, it must be good".
- Havoc 11mo ago
  They buy it because it's enough to tick the corporate compliance box. Decisions made by people that don't actually give a F
  - mk89 11mo ago
    It's all because of something that started years ago: the move to the cloud. Companies started to move to cloud like there was no tomorrow. Their on-prem products became maintenance or zombies. Now you want the self hosted? Good luck. What's the alternative for a SaaS provider? Support all the possible cloud alternatives? That's nearly impossible, so some companies (mainly big organizations) provide their software/SaaS in AWS gov regions and so be it. (Or... be smart, see the trend and start selling your software again in self-hosted solutions!) For a consumer (gov, for example) this means: you don't have that feature, you give in, or you build it/let it build (open source). This is the only reason why we saw the recent announcement of the Austrian govt that was able to migrate from MS to Nextcloud. Without an alternative, ... they couldn't have done anything.

csense 11mo ago

This applies to any company, doesn't it? Your home country can tell you "Give us your data" and you have to comply. "I will never give up customer data" is a very tough promise to keep, if the government threatens you with your business license being revoked, your servers and domains being forcibly seized by the police, and you personally going to jail. (Under the current US administration, we can add "A close examination of the immigration status of all foreign nationals employed by your company, followed by probable deportation or jail" to the list of potential consequences for resisting the government.)

satellite2 11mo ago
Of course. But what if the holding lives in a country that don't enforce this (or is too weak to). Then all the subsidiaries are really sovereign from the host country perspective. It seems the solution is ages old. Don't have the holding incorporated in an empire...
- vladvasiliu 11mo ago
  How would this work in practice? If the empire wants to get at your data, why do you think it would shy away from pressuring a country so weak that it can't afford to enforce this on their companies?
- stetrain 11mo ago
  Then the empire just says that they want the data or you won't be allowed to operate in the empire, which would be bad for profits and anger shareholders.
autoexec 11mo ago
The trick is to collect as little data as possible and to get rid of what you need to collect as quickly as you can. This is in direct opposition to the practices of companies like Microsoft which wants to spy on their users and profit from the data they collect though. There's also an open question of how possible it is to run a system that doesn't collect/store data in a way that makes it possible to be collected by the government. The US government can force companies to compromise their systems or shut down their services if they refuse. In the past they've even threatened that shutting down a service instead of compromising it could still get operators in legal trouble. At this point anyone who wants to keep the US government out of their data should avoid using any US company.

jeppester 11mo ago

Anyone who's read the law has known this for years. The GDPR is incompatible with the Cloud Act, and so the only legal (or so it should be) way to use US companies is to treat them like unsafe third countries - no matter the data center location. But everyone wants to continue like before. Having to ensure that Amazon and Azure never touches unincrypted personal data is hard. So one "compromise" after another has been tried - never solving the actual problem. As a EU citizen I think it's entirely embarrassing. Either the EU should have the power to force European subsidiaries to be exempted from the cloud act, or everyone should be forced to abide the law, which would greatly boost EU tech. Instead we are just rolling over.

penguin_booze 11mo ago

> U.S. companies can be forced to hand over data, regardless of where it is stored s/U.S./Chinese/ Tomato <=> Tomato

nashashmi 11mo ago

US cloud act is definitely an overreach. Suddenly private infrastructure is now an extension of the government surveillance complex. This is the equivalent of the govt being able to put a camera on your building because they want to observe the public/private area around it.

Agingcoder 11mo ago

Maybe I’m misunderstanding something - if I store my data elsewhere , am I not supposed to encrypt it anyway, with my keys ? If the crypto is strong enough then surely cloud providers can’t do anything with it ?

cesarb 11mo ago
> Maybe I’m misunderstanding something - if I store my data elsewhere , am I not supposed to encrypt it anyway "Cloud" is not only for storage; it's also for compute. Doing compute directly on encrypted data (homomorphic encryption) is very slow and very complicated, so when using a cloud, the data is usually either unencrypted, or encrypted but the key is elsewhere in the same cloud.
- Agingcoder 11mo ago
  Thanks. I get that FHE is not realistic today, but can’t I use ( if it’s really critical) a combination of confidential vms and an external hsm ? I understand I’ll be limited to traditional workloads , and not managed services though. I asked the wrong question, what I really meant was ‘if I run in a less trusted environment, am I not supposed to use all possible crypto mechanisms available to make that environment more trustworthy , so that I can’t be deceived by my cloud operator sending my data to the us government’
  - fragmede 11mo ago
    That's just not possible. It's why detractors never got on board with the Cloud. Until FHE is feasible, the decryption keys and plaintext have to exists in RAM eventually at some point in order even if only took be re-encrypted, if any complex work is to be done on it. Because eg, Amazon, has access to your hardware, there's simply no way to prevent them from reading your secrets out of your VM that's using their RAM. Absolutely do what you can, but understand that it's futile to defend against your own cloud provider.
    - Agingcoder 11mo ago

riskable 11mo ago

Another take: Microsoft admitted under oath in France that the US government doesn't care enough about French data to ever have requested any. I'm sure if you asked the current administration what they think of France, they'd reply, "all they do is wine!"

thefz 11mo ago
The current administration will have difficulties pointing to France on a map.

thinkindie 11mo ago

I wonder why people are surprised, as this is an open secret nobody is willing to admit. And it's basically the reason we had Schrim I and Schrim II. At the same time a massive migration from US cloud in EU to EU cloud would be a massive pain for a lot of companies in the EU.