5 ms·

Does this still apply if there are separate legal entities for US & EU operations? Take Hetzner as an example. They have a separate US company to deal with thei

Does this still apply if there are separate legal entities for US & EU operations? Take Hetzner as an example. They have a separate US company to deal with their US data center. Would their EU servers be vulnerable to the CLOUD Act?

jacquesm 1mo ago
Well, for sure they can pressure them but I highly doubt Hetzner would break the law in Europe to satisfy the US government, they are a lot more to lose here than there. I realize that that is not proof.
- yread 1mo ago
  I dont share your optimism: The US can just say: let us access this one customer or we will ruin your vpcs in the US. What can you do about it? FDE? Can you keep the keys away from Hetzner? How much hacking would they need to do to get them? Can US government break SecureBoot? Im just happy my business is not important enough
  - kazen44 1mo ago
    the alternative being hetzner giving away EU based information to the US? which would absolutely destroy their reputation in the EU. (which is a far larger market for them). The only way to spin this as hetzner is to go public with this and make it a political point for geopolitics between the EU and the US, and take the loss /call the bluff on the US threat.
    - jacquesm 1mo ago
      Let me tell you about that time when I walked around in a DC in NL and ran into an unaccompanied FBI liaison officer... I don't think any of us have the total picture, but the bits that I do have are sufficient to worry me about the degree to which I am automatically breaking the NDAs I sign by using a computer, email, online data rooms and so on.
  - inigyou 1mo ago
    Hetzner US would have no power over Hetzner EU, that's the point. All they can do is beg their parent company the same way law enforcement could beg them directly.
    - yread 1mo ago
      Sorry I wasn't clear. I meant I would expect US government to approach Hetzner EU and say "nice Hetzner US business you got going over here, it would be a shame if got hit by a tax inspection. Businesses make tax mistakes all the time you know? We could make sure that doesn't happen if you help us with this law-breaking customer of yours"
kvemkon 1mo ago
> Take Hetzner as an example. Similar happened already with OVH Canada vs France. > In an affidavit, Xavier Barriere, corporate counsel at OVH in Paris, describes the dramatic situation: If the important proponent of European data sovereignty were to comply with the Canadian order, those responsible in France would be committing a criminal offense. They face up to six months in prison and fines of up to 90,000 euros per violation. However, if OVH ignores the Canadian court, it faces contempt of court proceedings in Ontario, which can also lead to severe sanctions. https://www.heise.de/en/news/Canadian-Court-OVHcloud-from-France-must-hand-over-user-data-11092029.html https://www.heise.de/en/news/Canadian-Court-OVHcloud-from-Fr... And one comment here: https://news.ycombinator.com/item?id=46060903 https://news.ycombinator.com/item?id=46060903
inigyou 1mo ago
The relevant fact about Hetzner is that it's an EU company with US branch, not a US company with an EU branch.
- usr1106 1mo ago
  No. Did you read the OVH story linked by user kvemkom? https://www.heise.de/en/news/Canadian-Court-OVHcloud-from-France-must-hand-over-user-data-11092029.html https://www.heise.de/en/news/Canadian-Court-OVHcloud-from-Fr... A difference could be that Germany might not have such blocking law as France. At least I have never heard of it.
  - jacquesm 1mo ago
    Canadian judges can rule whatever they want, it isn't going to make a difference in practice: if Canada or a Canadian entity wants data from an EU company they're going to have to go through the proper channels to do so. Taking shortcuts like this, even with the backing of a judge just isn't going to fly.
    - inigyou 1mo ago
      Yes. Canada only gets to affect the Canadian subsidiary of OVH. Otherwise they can't do a whole lot. Maybe they can do enough though - maybe they can seize the profits from the subsidiary going to the parent company, which the parent company would want to avoid. They have no direct control though. If it had been the European one that was the subsidiary, then Canada could order the OVH parent company to order the subsidiary to do things.

jacquesm 1mo ago

Well, for sure they can pressure them but I highly doubt Hetzner would break the law in Europe to satisfy the US government, they are a lot more to lose here than there. I realize that that is not proof.

yread 1mo ago
I dont share your optimism: The US can just say: let us access this one customer or we will ruin your vpcs in the US. What can you do about it? FDE? Can you keep the keys away from Hetzner? How much hacking would they need to do to get them? Can US government break SecureBoot? Im just happy my business is not important enough
- kazen44 1mo ago
  the alternative being hetzner giving away EU based information to the US? which would absolutely destroy their reputation in the EU. (which is a far larger market for them). The only way to spin this as hetzner is to go public with this and make it a political point for geopolitics between the EU and the US, and take the loss /call the bluff on the US threat.
  - jacquesm 1mo ago
    Let me tell you about that time when I walked around in a DC in NL and ran into an unaccompanied FBI liaison officer... I don't think any of us have the total picture, but the bits that I do have are sufficient to worry me about the degree to which I am automatically breaking the NDAs I sign by using a computer, email, online data rooms and so on.
- inigyou 1mo ago
  Hetzner US would have no power over Hetzner EU, that's the point. All they can do is beg their parent company the same way law enforcement could beg them directly.
  - yread 1mo ago
    Sorry I wasn't clear. I meant I would expect US government to approach Hetzner EU and say "nice Hetzner US business you got going over here, it would be a shame if got hit by a tax inspection. Businesses make tax mistakes all the time you know? We could make sure that doesn't happen if you help us with this law-breaking customer of yours"

kvemkon 1mo ago

> Take Hetzner as an example. Similar happened already with OVH Canada vs France. > In an affidavit, Xavier Barriere, corporate counsel at OVH in Paris, describes the dramatic situation: If the important proponent of European data sovereignty were to comply with the Canadian order, those responsible in France would be committing a criminal offense. They face up to six months in prison and fines of up to 90,000 euros per violation. However, if OVH ignores the Canadian court, it faces contempt of court proceedings in Ontario, which can also lead to severe sanctions. https://www.heise.de/en/news/Canadian-Court-OVHcloud-from-France-must-hand-over-user-data-11092029.html https://www.heise.de/en/news/Canadian-Court-OVHcloud-from-Fr... And one comment here: https://news.ycombinator.com/item?id=46060903 https://news.ycombinator.com/item?id=46060903

inigyou 1mo ago

The relevant fact about Hetzner is that it's an EU company with US branch, not a US company with an EU branch.

usr1106 1mo ago
No. Did you read the OVH story linked by user kvemkom? https://www.heise.de/en/news/Canadian-Court-OVHcloud-from-France-must-hand-over-user-data-11092029.html https://www.heise.de/en/news/Canadian-Court-OVHcloud-from-Fr... A difference could be that Germany might not have such blocking law as France. At least I have never heard of it.
- jacquesm 1mo ago
  Canadian judges can rule whatever they want, it isn't going to make a difference in practice: if Canada or a Canadian entity wants data from an EU company they're going to have to go through the proper channels to do so. Taking shortcuts like this, even with the backing of a judge just isn't going to fly.
  - inigyou 1mo ago
    Yes. Canada only gets to affect the Canadian subsidiary of OVH. Otherwise they can't do a whole lot. Maybe they can do enough though - maybe they can seize the profits from the subsidiary going to the parent company, which the parent company would want to avoid. They have no direct control though. If it had been the European one that was the subsidiary, then Canada could order the OVH parent company to order the subsidiary to do things.