The Collapse of the US-EU Safe Harbor

http://blogs.microsoft.com/on-the-issues/2015/10/20/the-collapse-of-the-us-eu-safe-harbor-solving-the-new-privacy-rubiks-cube/

by twsted • 11 years ago

142 83 11 years ago

blogs.microsoft.com

jacquesm4• 11 years ago

Color me impressed with the no-nonsense and respectful way in which Microsoft tackles this. Looking forward to other tech giants following suit.

The 'privacy is dead' crowd should really take notice of this article.

jmnicolas2• 11 years ago

You know I really wanted to believe in the new Microsoft ... then I started to notice the new telemetry patches in Windows update.

They can say whatever they want about privacy, as long as they sneakily collect data about my computer usage I won't believe a word of what they say.

jacquesm4• 11 years ago

I try very hard to never use Microsoft products, that's for sure let there be no mis-understandings about that. So I can't comment on what the most recent incarnation of Windows does but I'm well aware that Skype did not change for the better after MS took over.

Even so, saying this as not exactly a Microsoft fan (to put it very mildly) their words (not necessarily their deeds) are spot on, this is really what is needed and privacy really is a fundamental human right.

Now if they will actually act on these words it will count for something.

leppr• 11 years ago

I hope you realize a huge multi-billion dollar company such as Microsoft isn't one unified entity. Chances are the PR/politics guys never even talked to the team responsible for that telemetry update and have very different agendas.

Furthermore, this kind of article is the last place where they would want to bullshit you, seeing how it is a prime target for their critics.

mtgx3• 11 years ago

Which reminds me, I assume now Microsoft can't collect most if not all of that data through Windows 10 from EU citizens?

I just hope it won't use that "third-party trick", where it routes the data through another EU company first, because that would definitely be illegal under the recent ruling, too, but Microsoft may wrongfully believe it's "grey area", so it might just do that. If it does try to use that trick, and then later it's once again confirmed that what it's been doing is illegal, I hope it's sued for all its worth.

Mickydtron2• 11 years ago

I was also overall impressed with the tone of the article. However, there were a few phrases which somewhat worried me. Specifically, "there is a broad recognition on both sides of the Atlantic that we live in dangerous times" and "if governments are going to prevent and investigate threats to public safety in the real world, they need timely and appropriate access to data that is stored online".

The first is somewhat debatable (there obviously is danger, but more or less than there used to be?), and even if completely true, "dangerous times" have been used to justify a lot of very bad things, so nebulous references worry me.

The second is also a sentence that by itself is fairly straightforward and uncontroversial, but is highly dependent on "timely" and "appropriate". After all, if "timely" means "as soon as we need/want it", and "appropriate" means "we swear we won't look at it unless we need to, honest", then many NSA programs could be loosely described as a way to get "timely and appropriate access to data that is stored online".

It is possible that neither of these sentences is meant to weasel in these sorts of meanings, and that I'm simply reacting to anti-privacy advocates having used otherwise innocuous phrases to justify bad behavior.

buro9• 11 years ago

The proposals do not address the elephant in the room and the very reason Safe Harbor collapsed: The NSA and the ability of the US government to override any treaty to access any data using secret warrants.

It is that which killed Safe Harbor, and none of the proposals at the end of the article would be immune to that weakness again.

It would remain the case that the proposals made would not be in line with the clear ruling that the European court gave if the US government can continue to override international treaties and their own courts.

Zach_the_Lizard4• 11 years ago

The European intelligence agencies were trading info with the NSA, so European companies can be under the same sorts of threats. It's a red herring.

Personally I think this is really about protectionism and the NSA provides a convenient excuse given European intelligence agency involvement.

mtgx3• 11 years ago

Eh, I could see the Commission doing it for protectionist purposes, but why would the highest Court care about that? If it's "protectionist" it's for EU citizens' data, not for economic purposes. I've seen no evidence to the contrary so far.

If anything, it's the Commission that has been much more willing to give the US government and companies "some slack" about collecting all this data. Luckily, the Commission's hands are now tied, and the ruling sets a rather clear roadmap for the minimum requirements of privacy in any sort of new EU law or agreement with the US.

Zigurd• 11 years ago

Not all of Europe is part of the Five Eyes, or even it's outer orbits. And if they are, the relationship is not symmetric. They don't have first-party access to US government communications, never mind, say, POTUS's cell phone.

"They all do it" is meaningless if one nation has an NSA and Greece has a sketchy looking guy with black shoes and no socks and a tape recorder.

icebraining2• 11 years ago

The European intelligence agencies were trading info with the NSA, so European companies can be under the same sorts of threats. It's a red herring.

But the court wasn't asked to decide about the actions of the intelligence agencies, it was asked to decide on a complaint against Facebook.

Personally I think this is really about protectionism and the NSA provides a convenient excuse given European intelligence agency involvement.

On the contrary; if anything, it was the Safe Harbour process that was supported on a convenient excuse, which the Commission allowed despite being clear from the start that the US didn't offer the necessary privacy protections to comply with the Directive. The court has just stated the obvious.

rmc• 11 years ago

EU intelligence agencies are under EU law (more or less). The US Gov/NSA is not under EU law. So you can't say that data in the US is compatible with EU law.

avenueb• 11 years ago

Absolutely agree. The EU data regulators consistently ignore their own governments intelligence gathering activities and powers.

makeitsuckless• 11 years ago

It's embarrassing that the tin foil hat suggestion that the European Court has a political agenda isn't downvoted into oblivion.

Not to mention the simple fact that through this ruling the court actually struck down a treaty supported by the EU politicians.

rwmj• 11 years ago

TBH as soon as you're using a cloud that you don't control anywhere you've lost control of your data.

toomuchtodo• 11 years ago

https://www.stickermule.com/marketplace/3442-there-is-no-clo...

Aloisius2• 11 years ago

Even if the US passed identical data protection laws as the EU, the NSA would still have the ability to do what they did legally since EU data protection laws have exceptions for national defense and national security.

It appears that the EU wants the US to pass laws that are stronger than their own.

M2Ys4U2• 11 years ago

There are exemptions for national security, but they have to be proportionate (and if you read the judgment of the court, they're pointing at a high bar there) and non-discriminatory with regards to citizenship.

Part of the problem with SH was the fact that there was no legal recourse at all for EU citizens.

Also, let's not forget that the CJEU stuck down the Data Retention Directive recently - so they are enforcing this human right against EU member states. They just have to wait for the right referral to their court.

Mickydtron2• 11 years ago

I think it would be very interesting if the civil courts of the US and EU each forced the other entity into passing stronger privacy protections than they have currently. Specifically, I'm thinking of a scenario where the collapse of Safe Harbor helps force Congress into passing meaningful privacy legislation and drastically curtailing the NSAs overbroad powers and mandates, and the US then turns around to the EU and says "ok, now it's your turn. If we can't spy on everybody, then neither can you."

kefka• 11 years ago

The only effective solution to the problem of "NSA and the ability of the US government to override any treaty to access any data" is the furtherance of study, and application of Homomorphic encryption.

Homomorphic encryption is a type of encryption done on data, and sent to a remove server (cloud), and the data is processed in an encrypted form. It never is unencrypted during any part of processing. And when it is transmitted back to the originator, they can decrypt when they choose.

Unfortunately, right now the speed is very slow, but work in this area can allow all sorts of data to be processed in the cloud securely.

BuildTheRobots3• 11 years ago

Site seems down. Copy/paste from google-cache here (too big to submit as a comment): http://pastebin.com/0jLCA65D

spython• 11 years ago

"Legal rules that were written at the dawn of the personal computer are no longer adequate for an era with ubiquitous mobile devices connected to my butt." Are you sure it's from google cache?

BuildTheRobots3• 11 years ago

Ah, ok. Apparently I still have the cloud-to-butt extension installed o_0

SideburnsOfDoom• 11 years ago

On reading that, I had to check if I had the "cloud to butt" extension installed. ;)

I don't, so it must be the paster, BuildTheRobots.

comex2• 11 years ago

To be fair, at this very moment a large number of people have their mobile device in their back pocket, separated from their butt by only a thin layer of clothing, and in fact can feel it there.

mtgx3• 11 years ago

Government officials in Washington and Brussels will need to act quickly, and we should all hope that Congress will enact promptly the Judicial Redress Act, so European citizens have appropriate access to American courts.

Well, Microsoft is wrong here to believe that the Judicial Redress Act [1] will be sufficient. The CJEU has required "essentially equivalent" privacy protections for EU citizens as they get in the EU.

The US Privacy Act does not give them that, so this Judicial Redress Act is a hit and a miss.

The US needs to pass a much stronger privacy law that is "at least" as good as the one in the EU, if it wants its companies to continue to get EU citizen data (and I assume it does). It can start by finally reforming the ECPA for the 21st century.

[1] http://judiciary.house.gov/index.cfm/press-releases?id=9455F...

estel• 11 years ago

From the rest of the article, I don't think he's suggesting that only the Judicial Redress Act is sufficient as a replacement for Safe Harbour? Just that it's a useful first step that congress can take soon.

hopeless2• 11 years ago

Microsoft are at the centre of another case which will really decide how badly EU-US trade is affected:

Microsoft stands in contempt of court right now for refusing to hand over to US authorities, emails held in its Irish data centre. This case will surely go to the Supreme Court and will be an extremely important determination for the cloud business, and any company or individual using data centre storage. If Microsoft loses, US multinationals will be left scrambling to somehow, legally firewall off their EU-based data centres from US government reach.

— from http://www.irishtimes.com/business/ecj-ruling-on-irish-priva...

At the moment, data can be held within the EU by US companies and it's all ok. If Microsoft is forced to hand over emails stored within the EU to the US government, then all bets are off.

In that future, it may not even be enough to have an EU-based subsidiary of a US company hold data within the EU, since it'll have been shown that the U.S. government can coerce them.

And we like to talk about large companies like Microsoft, Apple, Facebook, Google etc. But they can throw money, lawyers and engineers at this problem. But the thousands of US-based SaaS apps do not have that luxury. Likewise, there are thousands of EU-based small SaaS app that will have everything from their hosting stack, to their bug tracker, to their communications tools taken off them.

fpgeek• 11 years ago

In that future, even an EU company may not be enough if that company does business in the US (or, in the most extreme case, accepts and/or makes a significant amount of USD payments). The US government can coerce them too (and in some cases already does today e.g. sanctions and FATCA).

TazeTSchnitzel• 11 years ago

In that future, it may not even be enough to have an EU-based subsidiary of a US company hold data within the EU, since it'll have been shown that the U.S. government can coerce them.

Wouldn't the other way round be more sensible, then? Make Microsoft be technically headquartered in the EU and have its main operations handled by a US subsidiary. Wouldn't that work?

(Not familiar with legal/financial/etc. reasons this would be a problem.)

_delirium• 11 years ago

In this case, the U.S. isn't trying to get Microsoft to coerce their European subsidiary into handing over the data; it's trying to get Microsoft U.S. itself to hand over the data. The problem for Microsoft is that the parent company in the U.S. has direct access to the data, without having to involve any employees of the European subsidiary, even though the data is stored on European servers. Therefore the U.S. government's position is that a search warrant is valid and not extraterritorial: it's being served on a U.S. company, asking U.S.-based employees to turn over data they have direct access to.

Microsoft would be in a stronger position if the data on its EU servers were only accessible by employees of its European subsidiary. Then Microsoft's U.S. branch could respond to a search warrant by truthfully saying that they don't have that data, and the request must be redirected to its European subsidiary. But that would complicate its technical infrastructure, so it would rather not do that. However, if the case turns out adversely, that's one possible response. They could segregate access, so that credentials for access to EU-based data are only given to EU-based Microsoft employees.

hopeless2• 11 years ago

Thanks for making that clearer.

I'm not yet convinced that a multinational could have strong enough controls that 1 person on a team has the password but another person doesn't. In reality, this stuff get's mixed around a lot, even if there are official policies in place

pfortuny• 11 years ago

The excuse that the legal rules are obsolete is a red herring.

It depends on the rules.

For example: privacy of communications has no intrinsic dependence on technology. Security of personal data requires the verification of said security (or the commitment to it), etc...

I do not know about this specific law. But just because a law is old does not mean that it is bad. And this is what Microsoft is saying.

After hundreds of years of slavery, it was abolished in the US in a single day. So what? Is this bad?

grabcocque• 11 years ago

The ECJ was simply responding to a fairly obvious and fundamental problem: your private data IS NOT SAFE in the US. The US government doesn't care and has no intention of changing this, so expect the ECJ's ruling to stand for a long time.

linkregister2• 11 years ago

Google cache: http://webcache.googleusercontent.com/search?q=cache:0BKIRj9...

I'm getting an Internal Server Error on the original page.

devy• 11 years ago

To me the key idea from Brad Smith's post, which I don't neccessarily agree with, was this:

        Third, there should be an exception to this approach for citizens who move physically
	across the Atlantic. For example, the U.S. government should be permitted to turn
	solely to its own courts under U.S. law to obtain data about EU citizens that move to
	the United States...

What he really arguing is that EU should not invalidate the Safe Harbor in that it breaks the Internet and Microsoft will provide its customers data access for U.S. and EU governments under "in the most limited circumstances". In that sense, it's not something out of ordinary than what typical Microsoft's position is in this issue. They can certainly do better than that, I.E. throwing away the server side encryption key like Apple does for iOS devices so that they don't have the technical capability to give out user data even if summoned to.

jvdh• 11 years ago

To me the quote you use from the original post talks about people who move (physically) from the EU to the US. These people remain EU citizens, but can hardly be distinguished from US people, as they have a US address. As EU citizens they have more rights to privacy than their US neighbors.

forgotAgain6• 11 years ago

He makes the issue more complex than necessary for the benefit of his employer. There is no reason why private information needs to move across borders without the express consent of the individual involved. At that point the individual agrees to be bound by the rules of the country where the data is going or no transaction is done.

Let each country have it's own set of rules and have all countries respect those rules for data located in the hosting country.

The idea that each country must be exactly the same and data is by default available for transmission across borders is only to the benefit of multinational companies.

richmarr4• 11 years ago

At that point the individual agrees to be bound by the rules of the country where the data is going or no transaction is done

What does this look like? Another section in a EULA? A popup/banner thing like for cookies? An extra tickbox on the registration page?

To me this feels like moving the problem of choosing sensible data protection juristiction onto the customer, rather than making a sensible choice yourself.

Personally I prefer to keep all personal data within the EU and avoid bothering my end users with this stuff, and that rules out any services that aren't available here... reducing choice & competition, which sucks. In that respect I was a fan of the Safe Harbour.

forgotAgain6• 11 years ago

I think you're overestimating the amount of times that data needs to move across borders to complete a transaction.

As an example, you're buying an airline ticket to a foreign destination. There is a check box next to the purchase button. The check box says that to complete the transaction you agree that information will be transferred to the destination country.

aidenn0• 11 years ago

In many jurisdictions, some rights cannot be legally signed away. Often the requirements on a non-negotiated contract are even higher. Lastly the US government is currently trying to coerce Microsoft into revealing data stored overseas, so even storing data in the country of origin may be insufficient protection.

forgotAgain6• 11 years ago

I'm not saying that no changes are needed. What I am saying is that the proposals put forth by Smith are more complex than necessary and that the purpose of the added complexity is to benefit his employer and not individuals.

In many jurisdictions, some rights cannot be legally signed away

In those jurisdictions there would have to be changes to allow individuals to provide permission to move their information across borders.

Lastly the US government is currently trying to coerce Microsoft into revealing data stored overseas, so even storing data in the country of origin may be insufficient protection.

Which is why I said "Let each country have it's own set of rules and have all countries respect those rules for data located in the hosting country."

vidarh2• 11 years ago

At that point the individual agrees to be bound by the rules of the country where the data is going or no transaction is done.

I'm not sure there's any opening in EU law for the individual signing away their rights like that.

jfoutz• 11 years ago

Does routing work like that? I mean once data is stable on a machine, it won't move, but getting that data there, man that seems hard. I mean, copying a file between 2 London datacenters might go through New York, if conditions are right.

I always thought moving between two machines to the fastest route, not the shortest route. I guess you could set up some fancy geolocation rules to ensure IPs of a certain range are only routable to other specific IPs. Still, there's no guarantee about the physical location of a given address.

forgotAgain6• 11 years ago

You make a good point. Changes to routing tables would be an added costs.

comex2• 11 years ago

It is to the benefit of anyone running an interactive website that wants to accept visitors from outside the hosting country. Multinationals, which have a physical presence in many countries that could handle local hosting if necessary, and the legal resources to work through the privacy laws of N different countries, are in many ways the least affected.

ChuckMcM2• 11 years ago

I think we'll look back at this and say "That is when the whole house of cards collapsed." The notions of the Internet being "somewhere else" and the rules being coded by the body legislating the person who is accessing it, is untenable. I expect a lot of churn on the privacy, tax, and access (censorship) policies which have grown up over the years.

Consider:

   * France (and China) trying to impose content
     restrictions on Google results. [1]

   * The EU invalidating the safe harbor privacy rules.[2]

   * The recent invalidation of tax strategies in the
     Netherlands and Luxembourg. [3]

These are all soverign issues. And for anyone who has ever looked at the Internet as a "place" intuitively understands how impractical it is to have the rules be based on that origin of the connection in meat space.

The depth and complexity of this particular confluence of concepts is really staggering. I can not even imagine how you would establish an institution to "rule" the Internet. I might even go so far as to assert it isn't possible. What I fear is that what is possible is the Chinese model where every country has its own "Internet" and your ability to access it from outside, or to leave it from inside, will be governed by some electronic equivalent of a passport. And that idea brings the whole "identity" question really out to the forefront of the discussion.

Very interesting challenges ahead.

[1] http://www.teleread.com/chris-meadows/france-demands-google-...

[2] http://www.natlawreview.com/article/european-court-justice-i...

[3] http://www.thisismoney.co.uk/money/news/article-3062128/Appl...

http://www.wsj.com/articles/googles-tax-setup-faces-french-c...

http://www.reuters.com/article/2015/10/21/us-eu-taxavoidance...

JoBrad2• 11 years ago

On the other hand, it could lead to a more fractured web, that is highly segregated based on where the host is that is serving up the data. Like US Corporate law, it could lead to a mass of companies deciding to place most or all of their servers in what would otherwise be very silly locations.

ChuckMcM2• 11 years ago

I completely agree, it could actually make "Data Havens" practical simply because the laws regarding them would be easier to parse. I've done a cursory scan of the whitepapers of various think tanks but I haven't found any that really dig into this question. If anyone sees one please link it here.

sbov• 11 years ago

As a small company, stuff like this scares the shit out of me. It would be expensive, but companies like Microsoft can survive things like this. But how can a small company do anything but ignore it?

stoolpigeon• 11 years ago

I work for a missions organization with ministries all over the world. We are trying to centralize for cost and due to lack of resources but everything we collect is pretty sensitive since it gets tied back to religious stuff. I think we'll need to hire lawyers in every EU country to get an idea of what we need to do - and then we'll probably need to duplicate a lot of effort to comply and we may just not use certain tools because it will become impossible.

The Collapse of the US-EU Safe Harbor

Related Stories