New Twist in International Relations: Corporate Keep-My-Data-Out-of-U.S. Clause

http://www.bloomberg.com/news/2013-12-24/a-new-twist-in-international-relations-the-corporate-keep-my-data-out-of-the-u-s-clause.html

by RougeFemme • 13 years ago

156 100 13 years ago

bloomberg.com

xacaxulu• 13 years ago

The inevitable backlash. Bullies only last so long.

robomartin8• 13 years ago

I've probably devoted more time on HN to discuss the reality of politics and government than to cover technology issues. At times I feel pretty bad about this. I've also been subject to a partial new post hell-ban which may still be in place (surprisingly enough, most of my new submissions are tech related). And, yes, I've felt bad about this from time to time, to the point of limiting myself to reading HN and not posting for weeks at a time.

As I have watched all of this NSA, IRS, ACA/Obamacare and big-broken-government nonsense has developed over the last, say, ten years or so, I can't help but think that the tech community needs to be shaken-up like this in order to finally abandon ship and start really using their brains politically rather than acting as mindless sheep following who knows what.

I'll issue a blanket statement and say that everyone reading HN is smart. About technology. Not necessarily about politics and the ways in which the world turns. And yes, I'll say it, there's a wide swath of HN'ers who have been indoctrinated by the left-leaning academia, media and the echo chamber of the circles they frequent and identify themselves with that they've stopped applying critical reasoning skills to their political life.

As I said here [0], you have to be smart about your politics if you want to succeed in business in general. If you are not, you run the risk of incompetent moronic government-originated factors affecting your playing field in small and major ways. And, by the way, it really doesn't matter if you are an employee or an entrepreneur, a union or non-unionized worker. When things like this start happening they affect EVERYONE and there's a chain reaction that will make things suck in a big way for all involved, at any layer and at every station in life.

What you want, in order to succeed, is as little meddling and interference as possible. No, I am not suggesting anarchy. That's bad. No, I am not suggesting no government. That's worst. What I am saying is that you want a small non-intrusive government at all levels, from local to federal. You want a government that truly has our long term best interests at heart and not one that is a partisan prostitute acting almost exclusively to keep their sick species and party alive at the expense of the opposition and, what's worst, you, me, our families and our very country. We might just be entering into a phase where we might just realize that terrorism can't even begin to match the level of destruction bad governments and their policies are capable of producing.

Yes, yes. Crazy talk. I really don't like talking this way. It's just that sometimes I feel like people need a collective slap on the face with a well timed "Snap out of it!" before they'll wake up and see what is really going on. Snap out of it! Get involved!

[0] https://news.ycombinator.com/item?id=6961005

lambda• 13 years ago

rather than acting as mindless sheep following who knows what.

I'll tell you right now, that anyone who uses that phrase is more of a "mindless sheep" than those he criticizes.

What I am saying is that you want a small non-intrusive government at all levels, from local to federal.

Not particularly. There is no intrinsic reason to want a "small government" over a large one (or vice versa). What you want is an effective government, that best matches your interests. Of course, everyone has their own interests, so the best rough metric that we've come up for maximizing the effectiveness of the government across the whole population, and minimizing its harm, are democratic institutions with various protections in place to prevent various types of abuses.

Likewise, you don't necessarily want small corporations or large ones. A large corporation has more power and is able to abuse that power more; but it is also frequently more efficient than having lots of small actors, as lots of transactions between independent actors can add friction and cost.

Distributed systems have problems, as they can exhibit lots of complex behaviors that can cause destabilizing feedback, and they can be inefficient. Centralized systems have problems, because they provide single points of failure or points of corruption that can be exploited for gain. Some balance between the two of them is necessary, and it's also necessary to spend effort on simply fixing problems that come up rather than thinking that every problem can be solved by adhering to some philosophy of "big government" vs. "small government".

mindless sheep ... wake up and see what is really going on.

Did you really just write a long winded "wake up sheeple" post? Are you trying to be a self-parody?

robomartin8• 13 years ago

I'll tell you right now, that anyone who uses that phrase is more of a "mindless sheep" than those he criticizes.

Why?

There is no intrinsic reason to want a "small government" over a large one (or vice versa). What you want is an effective government, that best matches your interests.

You would have a point there if "big government" was used to convey the literal meaning of the phrase by Libertarians. It is not. In proper context "big government" refers to size, reach, complexity, all of the above and sometimes even more. It is generally about government that has grown beyond some boundary.

This is just like saying "big brother is watching". This doesn't literally mean that your eldest brother or a some kind of a giant person is watching you.

You do get that, right?

Big government: wants to touch, manipulate and regulate everything and wants to have a say in everything in your life, from how much soda you can drink to which doctors you can see and more. It spends money inefficiently and with damaging results. It thinks it has power over people and that our rights are granted by government and their laws.

Small government: stays out of the way and lets market forces act. It enacts and enforces just enough regulations to create protections from extremes and to protect and support those in need. It certainly stays the hell out of your diet, home, sex life and medical choices. It operates within a strict balanced budget framework that ensures our financial stability and well being as a nation. It knows that they derive their ability to act from the will of the people and that our rights cannot be trampled.

In this context, yes, you do want small government.

chris_wot• 13 years ago

> rather than acting as mindless sheep following who knows what.
I'll tell you right now, that anyone who uses that phrase is more of a "mindless sheep" than those he criticizes.

Does accusing someone of being a mindless sheep because they call others mindless sheep make you a mindless sheep? For that matter, sheep aren't mindless but if they were then if I described them as mindless sheep then how could I then be a mindless sheep? By the very nature of describing their mindlessness I show that I have a mind. Plus, I am a human and cannot be shorn, so I'm clearly not a sheep.

Ponder on that.

Nursie4• 13 years ago

> Did you really just write a long winded "wake up sheeple" post? Are you trying to be a self-parody?

At this point internet libertarianism is a form of performance art, I'm sure of it!

alan_cx• 13 years ago

Sorry, this small government lark is nonsense and irrelevant in this.

The Americans seem to bang on about small government constantly, and I cant imagine that in actual reality, the US government can't be proportionally as big as say the German or , I dunno, Japanese government, where they don't particularly bang on about small government in anything like the same way. If it is, as big or bigger, I suspect that is largely down to the insane huge military the same people who bang on about small government totally adore and idolise.

Interesting too that for some bizarre reason, you have managed to get in some Obama and health care stuff in too. Sorry, but most of the rest of the civilised planet has some form of universal health care. I dont see what that has to do with anything in this debate. If Americans don't want to look after their poorest, weakest and most vulnerable, then fine. Its not my country. But its got nothing to do with industrial spying.

Oh, I note you have not placed any blame on any republicans who were just a responsible for all this. I dont remember GWB being all liberal about freedoms.

Sorry, but from what I can see, the subtext in your post is basically a poorly cloaked attempt at a right wing agenda. And frankly I don't see that as any sort of credible answer.

EdSharkey4• 13 years ago

I would prefer a more powerful local city and state government and a far weaker federal government. Having my pols closer means there's a neck to wring if need be.

A little nit: Republicans and George W. Bush? They're either irrelevant and/or gone for years. You need to update your hate list; your being outside the states is no excuse for ignorance. The current demons are "tea-baggers" and "Ted Cruz".

robomartin8• 13 years ago

The Obamacare mess is the most visible example of what is wrong with government at nearly every level. Of course I am going to use it. This is the best example we have and one that nearly every American now understands or most certainly will within the next year. Nobody is saying that a better approach to healthcare isn't necessary. The ACA is NOT a better approach.

This has nothing to do with a right wing agenda. Call it a moderate libertarian agenda if you want to be closer to reality. Both major parties have blood on their hands, it's just different for each group. It just so happens that we've wasted five valuable years chasing after a somewhat extreme left-wing agenda...and here we are. We are walking into national debt that will exceed twenty trillion dollars and, if economic damage wasn't enough we are undermining our tech industry in ways that could shift technology out of the US in so many ways it is hard to imagine.

OK, call me a moron and a zealot. Please explain a few things to me then:

First, if over twenty trillion dollars in national debt isn't a problem, how much would be? Is there a limit or we get to go like this forever with no consequences whatsoever?

Once you explain that, please elaborate on what could happen to our tech industry if the world turns against us for such things as the brutal intrusion into everyone's lives by the NSA and other yet-to-be-identified players? Are there consequences to this if we change nothing? Ever?

Finally, we are continuing to see the disaster that the ACA/Obamacare is proving to be. The other day an article came out, I believe in Forbes, explaining how MILLIONS of Americans are --without realizing it-- assigning their property --their homes-- to the government when they sign up for the ACA and end-up going for Medicare. It is one thing to want healthcare for everyone. For reason's sake, let's do it right! This is nonsense. Can you please explain how the ACA is a good thing when premiums double --or worst--, deductibles skyrocket, access to doctors, facilities and drugs is limited and, on top of that, you might have signed your estate over to the state without even knowing it?

I don't know. I could be a moron. Still, I think the above issues stand on their own, having nothing to do with the messenger or the political alignment of anyone involved.

The fact is that the tech industry is under attack by our own government in more ways than one. Never mind me. Mind reality.

jmspring• 13 years ago

An interesting idea to conform to and one I am researching for a service I've been building. There is data in transit and data at rest. For many people I know, North America (I assume Canada and the US are one and the same, at this point) is the primary market/closest entry point. Do regulations require tracking data in transit thT may eventually be stored somewhere other than the US?

Maxious• 13 years ago

This has been around for a while under the guise of "data sovereignty".

If you look back at search results for that term, there are now laughable comments particularly by Microsoft that your data is safe in the US because even the Patriot Act requires warrants right? Little did they know...

f_salmon2• 13 years ago

Little did they know...

I'd argue that a company that explicitly agrees to work with the NSA, for example by handing them over Windows security holes to be exploited by the NSA (and potentially other hackers), knows exactly the kinds of things that are going on.

swombat• 13 years ago

Even more ironic are the "digital safe harbour" provisions that cloud providers have been operating under, telling their clients that the law requires the US government to treat servers put under those provisions as not located in the US.

The irony being that since the servers are "not located in the US", they are even more easily targeted by the NSA since the NSA considers the rest of the world to be sub-humans without any rights.

pilsetnieks2• 13 years ago

To nitpick somewhat, at least in the case of the US-EU safe harbor protection, it meant that certified providers were to provide the same protection to European data as it would have in the EU under the relevant EU directive, it doesn't have anything to do with location of the servers. The certification, however, is a complete joke since companies can self-assess and register themselves as safe harbor compliant.

partoutok• 13 years ago

Interesting thing to notice. Probably just a coincidence but if it was set in purpose it would be really genius evil.

codex• 13 years ago

It's a bit laughable to presume that the NSA would be interested in a random company's laundry, or would divulge it to anyone else. Snowden's leaks do not contain any evidence of this, and yet it is well known that the Chinese, in fact, do spy for corporate gain.

rgj3• 13 years ago

There is not much evidence of commercial espionage indeed. But it's not about company's laundry. It's about the laundry of the users, stored by the company. If NSA access to that hits the press, a EU company will lose a lot of customers.

perlpimp• 13 years ago

just because it was not aired particularly what kind of economic espionage was happening - it does not mean that it is not happening.

salient4• 13 years ago

Maybe you just aren't paying attention:

http://www.cnbc.com/id/101291247

http://www.theguardian.com/world/2013/sep/09/nsa-spying-braz...

http://www.washingtonsblog.com/2013/10/nsa-busted-conducting...

There are a lot of things that we thought it would be "outrageous" for NSA to do, and yet we found out later they're doing them. If anything, NSA is more interested in spying on corporations for the purpose of economic espionage than anything else. Why else would Germany be spied upon by the NSA as much as China is?

http://www.theverge.com/2013/6/30/4481670/nsa-spying-in-germ...

zaroth5• 13 years ago

Worst possible knee-jerk reaction.

Data outside the US is the easiest for the NSA to access. It's only data that never leaves the US which in theory you can argue is subject to warrants.

Of course, since it's so easy to redirect your traffic outside the US using BGP, it's not really a defense no matter where you are storing your data, but the clause is certainly pointless.

bjelkeman-again5• 13 years ago

For international customers it is rather pointless to talk about data that never leaves the US. If this is a bad reaction, then what is a meaningful reaction?

skrebbel• 13 years ago

Wait, so the NSA can walk into a German hosting provider's office and force them to install a box and no we won't tell you what it does?

You're mistaken. The NSA might have more legal space to hack into systems outside the US, but their main snooping appears to happen in (forced) cooperation with US companies.

So it's a pretty decent reaction.

inerte• 13 years ago

The article is about US corporations. Doesn't matter where Cisco hosts the data, the NSA can knock on its door and ask for access.

Do you really think Cisco is going to reply: 'Nope can't do, this data is "on" Germany!'?, when the NSA spies on Merkel herself?

zebra• 13 years ago

Given that NSA tapped the phone of the Chancellor, it's not unlikely.

zaroth5• 13 years ago

Wait, so the NSA can walk into a German hosting provider's office and force them to install a box and no we won't tell you what it does?

The equivalent in the US requires a warrant, and it would be the FBI not the NSA. For example an NSL or warrant with a gag order similar to what Lavabit saw. These warrants at least give the provider the option to shutdown. Also see similar situation to PrivateSky (UK-based). The fact that these cases are news, and even moving through the courts on appeal, is a Good Thing (TM).

This is a significantly different attack model than NSA hacking your network and picking data off your internal pipes (like what happened to Google), Firewire/Thunderbolt ports (commercial off-the-shelf products sold to law enforcement do this through DMA access granted by Firewire/Thunderbolt), or hell, even stealing keys through the ground potential of your chassis . Those techniques, sans warrant, are claimed to be "legal" only because they happen overseas.

If you think the NSA doesn't have access to all your traffic just because you're in Germany, I'm saying, IMO the NSA has better access to your traffic, indeed all your gear, because it's in Germany.

For international customers it is rather pointless to talk about data that never leaves the US. If this is a bad reaction, then what is a meaningful reaction?

This is a great point. I think the most meaningful reaction would be an increase in self-hosted SaaS models which are open source but not MIT/GPL as in, auditable but not free. Continuing the evolution of systems like Docker, and maybe even to an extent things like node-webkit, you might get to a future where grandma can single-click self-host all the apps she needs on any OS she happens to be running.

I'm so disappointed that such approaches are assumed to be doomed. You can't convince the CEO that people won't just comment out the license check rather than pay the license. I know GPL is supposed to provide "freedom" to the user, but I don't think there's anything inherently wrong with providing access to the source while still legally requiring a end-user or commercial license, and not just in the form of a support contract. In fact, I really wish more companies would try this, because I think it would ultimately be very successful and if it can jump the shark as an acceptable approach, it would benefit the entire industry. I plan on trying it myself with a few products, and I'll definitely report my progress.

In short, we need to increase investment in designing, deploying, and maintaining secure systems and architectures, combined with demanding real end-user ownership and control over your own data, which means self-hosting the service and open source. In my opinion, moving the server to international data centers doesn't provide any demonstrable value, and I believe just makes matters worse.

salient4• 13 years ago

No, it's the best possible reaction (not for US, obviously, but they deserve it). This sends a message to US and US companies.

Also, in case you haven't paid attention the US government was hacking into one of the biggest US companies already - Google and Yahoo, while they had deals to get pre-encryption data with Microsoft and others.

Also, NSA themselves said all encrypted data is captured, regardless of where is coming from, "just to be sure".

zaroth5• 13 years ago

As a political statement it has power, that is one aspect I definitely agree with. However, I don't think it's a security measure, and in fact could decrease security.

You make a good point that encrypted data is retained longer by the NSA, and even domestic encrypted communication is kept without any nexus to an international person of interest or 50% confidence that at least one party is not a US citizen. But as we know well, the encryption is the absolute last thing which is going to fail or be broken independent of some other action.

NSA can fill their hard drives with all the cipher text they want. If that ciphertext ever somehow becomes valuable on its own -- for example, without getting a warrant for the key - then the crypto-apocalypse has arrived and the whole discussion about which data center the server runs in is completely pointless.

We haven't seen any Snowden leaks indicating NSA is walking into US data centers without a warrant and busting servers. On the other hand, their entire modus operandi is to do exactly that overseas. Wait, or is that the CIA... Generally speaking, if you have something they really want and it's on a US server, you get agents at the door with warrants. If you have something they really want and it's on a non-US server, they just hack or steal the damn server.

See my earlier reply about the Google packet sniffing, done only for data which left the US as far as we know. There would be a much stronger case that such packet interception was illegal and unconstitutional under current US law if it was happening to traffic running within US only WANs.

By the way, there's nothing you can do if the service provider decides to just accept the warrant and provide the data, regardless of where the server is colocated, which is why I think self-hosted SaaS is so important. You might not be able to stop them getting the data, but if it's on your server, you probably will know they have taken it, or otherwise you'll have a great case to argue in front of the Supreme Court (as in, an EFF pro bono spectacle, not necessarily that you will prevail).

The people that put these surveillance systems in place don't give two fucks about the economic impact, and the people that do consider the economic impact aren't invited to the meetings.

tl;dr People should be really screaming mad angry about what the US government is doing, but foot shooting is perhaps exactly the response they are looking for.

sentenza• 13 years ago

Oh, so since me and my company are _physically_ outside of the US, we're fucked then?

But your point, of course, stands. Maybe avoid sending the data to the US and in addition punishing providing access to the NSA as treason? (I know. Won't happen.)

throwaway_yy2Di• 13 years ago

"Worst possible knee-jerk reaction. Data outside the US is the easiest for the NSA to access. It's only data that never leaves the US which in theory you can argue is subject to warrants."

Nonsense. If they're even talking about keeping data out of the US, they are probably non-US citizens. Under NSA law (the parts that have been publicly leaked), NSA feels perfectly free to seize their data when it is stored in the US, or makes transit into or through the US. A non-American sending their data into the US does not thereby protect it from US spies. (Really, that's common sense). The only data that is maybe safe is that of clearly-identified US citizens communicating with themselves in the US. These can still still be intercepted and stored, but the leaked secret laws say that the NSA does not allow its analysts to read it.

zaroth5• 13 years ago

I'm a bit confused, you say nonsense, but then you apparently agree with two key assumptions.

I'm definitely not saying it's a good situation we find ourselves in here, or that data is 'safe' anywhere. But I would want anyone to think very long and hard before moving servers outside the US and claiming that provides some sort of benefit, other than as a political statement... It actually sounds like you agree with that.

Maybe r/Worst possible/A dangerous/ would be better. But I do appreciate reading the opposing opinions.

SideburnsOfDoom3• 13 years ago

It's only data that never leaves the US

It seems to me that the NSA finds it a lot harder to get at data that never enters the US at all.

I have doubts about sending data to the US in any way - I work for a European tech company, and some co-workers want us to use private repos on GitHub for our source control. I am personally against this simply because it sends important data into the US. That kind of thing should be kept on-site.

zaroth5• 13 years ago

It seems to me that the NSA finds it a lot harder to get at data that never enters the US at all.

Could you please explain why you think that?

That kind of thing should be kept on-site.

I could not agree more.

adventured• 13 years ago

US companies would be lucky if all this did is reduce their international sales. That's just the tip of the iceberg.

By far the worst damage is all that lost capital is going to flow into helping to generate a vast supply of new and bigger competition overseas. So not only will the US companies lose sales in the immediate future, they'll face amplified competition that will hit sales even more so long term. Even if the US Government has cleaned up this mess by the end of the decade, it won't matter, the financial consequences will just keep rolling.

When it's all tallied up, I think the NSA and US Government abuses will cost the economy trillions of dollars in value over the course of a few decades. Something akin financially to a hundred September 11th attacks in damages. Oh the staggering brilliance of the DC machine.

001sky• 13 years ago

Something akin financially to a hundred September 11th attacks in damages

not to mention the waste of resources that spurnrd this on...

Systemic33• 13 years ago

Ye, the NSA information trawling takes some serious amount of money to work, and they don't exactly employ just a hand full of analysts, more like a an army of them.

salient4• 13 years ago

I agree. I don't know how that number was reached, but if the potential for losses is $180 billion already, then the long term losses might reach $1 trillion, maybe more. There are so many companies that change so slowly. They probably won't give up on the US products and services within 6 months. It might take them 2 years, 3 years, or even 5 years. So there are probably many more foreign customers thinking about dumping US companies, but they just can't do it yet. But that doesn't mean they will get their future contracts if nothing (radically) changes until then.

EdSharkey4• 13 years ago

Seems to me that the reality is that big businesses hold the leash of the US government, so this is as much a repudiation of them as it is the NSA, the Obama admin et al.

Microsoft, Google, Facebook, RSA and the rest deserve the shame and scorn they are receiving right now. I'm sorry if my techie friends working at those places are hurt by this, but I feel very betrayed by these companies' complicity in and taking moneys for all the surveillance and backdooring, etc. So, shame on you, I hope your brands aren't totally ruined.

rgj3• 13 years ago

The customers of the Dutch cloud-services conpany I work for haven been demanding this for at least ten years. Snowden didn't change much there, it's been going on since the Patriot act. European Union privacy legislation demands that sensitive data is stored within the EU. Storing data in other countries is only permitted if a satisfactory level of protection can be offered. This was used in marketing by EU companies in order to promote their own services, effectively creating FUD around US-based services.

When the Amsterdam Internet Exchange (AMS-IX) recently opened up an office in NYC there was a big fuss about it, because it would make the entire Dutch internet traffic subject to the Patriot act, since it applies to any company with an office on American soil.

bjelkeman-again5• 13 years ago

So what did AMS-IX say?

rgj3• 13 years ago

http://translate.google.com/translate?sl=nl&tl=en&u=http%3A/...

thisone• 13 years ago

I've been dealing with this for what seems like ages now. At my last job I actually had to go a get a new service shut down because the people who provisioned it didn't realise or understand that it was a problem that all the PID was being stored in the US.

I've read the Safe Harbor rules and audit information and I don't trust it one bit. I really can't blame corporations, especially EU ones, from stating very plainly that they don't want their data stored in the US.

draugadrotten• 13 years ago

European Union privacy legislation demands that sensitive data is stored within the EU

While this may be officially promoted as a way of protecting against EU citizens against NSA (US access) to the data, it is also a way for the EU to ensure that EU can get to the data when the EU wants access.

Nursie4• 13 years ago

> effectively creating FUD around US-based services.

FUD?

No, it's been explicit in law for some time that people's data was protected in Europe in ways it wasn't in the US.

bjelkeman-again5• 13 years ago

Everyone in Europe I talk to about online data agrees that this isn't empty talk. Practically it really isn't possible today to in a meaningful way avoid some of your data or data about your usage of the Internet to end up in the US.

But, I would argue that this is more of a change in mindset and awareness at this point, which eventually will force changes. Companies or local government will want their data to be stored in a jurisdiction where they at least have an influence over how it is protected. Balkanisation may be the result, or ineffectual laws and regulations, maybe even something useful. But I believe something will happen.

tombrossman• 13 years ago

I'm surprised to see the focus on jurisdiction versus other more effective methods, like open-source encrypting locally prior to moving the data off-site. Key control and eliminating the need to trust third-parties is the way forward, not trusting that some government somewhere is going to follow the rules perfectly. This also has the added benefit of protecting against unauthorised third parties gaining access via back doors or hacking, etc.

These ineffectual laws and regulations you warn about are already in place. That's a dead end. It is time for people and corporations to take charge and make their data safe before it leaves their control. We've seen this happen on a big scale with Google now supposedly encrypting data between data centers, and on a (much) smaller scale with people like me using EncFS to encrypt before moving online backups to Dropbox.

zachrose• 13 years ago

I agree that encryption could mitigate the actual threat posed by government mass surveillance, but I also wonder how much of the new language in contracts is about consumer perception and boycotting.

yxhuvud2• 13 years ago

Then you obviously didn't talk to the Swedish legislator that was perfectly fine with the fact that foreign surveillance agencies could read her email.

bjelkeman-again5• 13 years ago

No I didn't talk to her. Who was it and is there a reference?

drone• 13 years ago

That cuts both ways. As an US citizen, I have no reason to believe my data is safe, say, in Germany, and certainly not in France who have been caught using their spy agencies to spy on US companies before. What enforceable mechanism has the EU provided US citizens regarding data safety? How can I, as a US Citizen, audit what access an EU government has had to my data?

So, yes, Balkanization is the only likely outcome, without a one-world-government and one-world-policing.

Paul123455343• 13 years ago

Spying is an age-old game and it's not just the US doing it ;) I'd love to see some leaks out of Russia and China. It doesn't matter where your data is stored if it's off-premises. If you were putting it in the cloud unencrypted, you were already at risk, Snowden or not. Intelligence agencies around the world recruit workers in tech companies, the company need not overtly cooperate to get screwed.

Countries around the world slurp up data over the wire, they just haven't been caught with their hand in the cookie jar yet. At least the NSA's massive data caches won't be easily hacked. Verint (just one of many companies in the surveillance space) has 75 countries as customers. There's a ton of sh*t going on under the radar. You may hate surveillance and want more transparency but nobody can pretend it's just the US doing this stuff.

Paul123455343• 13 years ago

On top of that, I suspect some of the anti-US stuff posted is for the express purpose of gaining customers away from the US. (this may get downvoted, people may disagree, but I have no doubt it's happening)

dspillett2• 13 years ago

No, that is definitely a factor here: non-US companies are taking advantage of the recent growth in anti-US feeling to make themselves look more attractive to potential customers and investors. No one should really be surprised by this: it simply makes good business sense.

The politicians will be on the ball too, at at least those whose remit covers national/international business or who have a constituency with a large workforce that could benefit. You can see a push in the other direction too: the "buy American" campaigns state-side have grown in volume, more so than can be explained purely by economic factors (which have been the key driver for that sort of thing since 2008) and an interest in protecting manufacturing jobs. If the large (relatively affluent) American market can be discouraged from buying goods/services without a US connection, companies will be discouraged from distancing themselves from US interests.

Of course there has always been a certain amount of keeping business information in particular places. Some regulated industries have to by law and have had to for a long time (you can't properly regulate something if you allow it to move out of your jurisdiction), and all businesses should be aware of the issue (though sadly many aren't) when dealing with personal data. In the UK the Data Protection Act has clauses covering information security which mean you need to be care careful not only how you store personal data but where, and I assume most countries have something equivalent. A little healthy paranoia always snook in to: if the data is more local to you there is less chance you will loose access due to either technical, political, or local issues.

The big difference right now compared to a-year-or-two ago is that the US has fallen off the secondary safe location list for many, and for EU based companies (and individuals) the balance in "I'd rather it be local, but if we can save a bit by hosting in the US, where market scale currently makes it cheaper, I might" has changed.

dspillett2• 13 years ago

(BTW: the main reason you are getting downvoted in this case is likely to be unnecccessarily talking about voting patterns)

Paul123455343• 13 years ago

Salamat for the downvotes. You could comment on your reasoning ;)

bluecalm• 13 years ago

It's not safe/unsafe 0-1 game. Unless you have some information not available to the public you would be crazy to think it's good idea to store anything sensitive in US comparing to some European countries (if you have a choice) as of today at least. If anything there aren't many countries out there with comparable resources dedicated to spying and no countries have that extensive history of using military and intelligence information for economic gains.

drdaeman• 13 years ago

No reason to leak anything from Russia. It's not a secret but a law here that SORM-2 devices are mandatory to install by each ISP (very small ISPs may wait for up to two years, though). It must have full access to mirrored traffic crossing the AS border and RADIUS traffic (in case of TACACS+ ISPs are also asked to reveal encryption keys).

While I suspect they're mostly laying dormant and don't think they're secretly massively abused in mass-surveillance, no idea what those black boxes are doing, though. The point is, they're here, they have full access, and they technically could be abused anytime, so don't transfer any sensitive data to or through Russia unencrypted. Like with any other country, possibly except for Equestria.

Disclaimer: I work for an ISP.

pilsetnieks2• 13 years ago

it's not just the US doing it

Oh, so it's ok then.

loomio• 13 years ago

What will the alternative cloud solutions be? I assume that many will rush to fill the gap as clients vacate US providers, offering increased privacy as a specific selling point.

As a non-US startup, we're still using Heroku and AWS because we don't have the resources to make the jump to something more secure, even though we'd really like to. As soon as an accessible alternative appears we'd switch in a heartbeat.

beloch• 13 years ago

Other HN readers are making some assumptions that I have to take issue with.

A1: Stories about this kind of thing are posted by people who want to take business away from the U.S..

This is possible, but there are a lot of people who value privacy too, and I suspect they are in the majority. Want to prove me wrong? Get polling.

A2: Everybody else is doing it, but only the NSA got caught.

First, this doesn't make it acceptable. Second, it's entirely possible not everybody else is doing it. Third, even if everybody is doing it, the U.S. has more money to pour into black-op projects than any other nation on Earth, so it's a safe bet that the NSA is, by far, the worst offender.

A3: Countries like China spy for corporate gain, but the U.S. would never do such a thing.

Right, the U.S. has never staged a coup or conducted a war that benefited U.S. corporations, and certainly wouldn't need intelligence to help with that sort of thing in the future...

-----

If you're okay with what the NSA has been doing, here's something to consider. Several years ago Sony got a lot of bad press for putting rootkits onto audio CD's. They wanted to stop piracy. Honest customers had nothing to fear from Sony! However, honest customers did have something to fear from viruses, malware, etc. that were subsequently written to exploit the security holes created by the root-kit.

The NSA is collecting data on you. You trust the NSA and your nation, so you're not worried about how they'll use that data. Fine. Do you trust everyone who works for them? You probably shouldn't. They certainly don't trust their own employees and they still got burned by Snowden! The NSA might not be looking at your data until you do something terroristy, but who else could have access to the NSA's data-stores? Would anyone know Snowden had stolen all those files if he kept quiet about them? Probably not. Odds are you're pretty boring and nobody is interested in what the NSA has on you. What if you were actually really interesting, and your enemies had a lot of money? Do you plan on becoming interesting at some point in the future, or are you firmly committed to being a bore until you die?

seanccox2• 13 years ago

Several good points here...

For me, it boils down to a simple question: If the NSA doesn't intend to use my data or data about me for some malicious purpose, then why do they need it?

slashdotaccount• 13 years ago

NSA doesn't intend to use the data about you just now because you are not a person of interest for them. But they need it in case if you find yourself on their way in some point in the future (i.e. you find a proof that the event x/xx was a false-flag attack or there is a little gray alien in president's attic) then they will use it against you.

PavlovsCat• 13 years ago

When people say "I have nothing to hide" I hear "history schmistory" and "I won't speak truth to power, ever".

Zigurd• 13 years ago

I am particularly annoyed at the "everyone is doing it" excuse. Everyone may want to be rolling with ten carrier battle groups in their navy, each equipped with an air wing capable of air-superiority, but only one country actually spends the kind of money to make that real.

Every government might have control freaks in it who WANT to implement pervasive surveillance. But most places don't have the budget for it.

fauigerzigerk• 13 years ago

That's right, but one of the corporations mentioned in the article is a UK grocery chain. The UK must be the most surveillance happy country in the world and we know that GCHQ cooperates closely with the NSA.

So I would love to hear an explanation from the people who put that clause in the contract. Maybe it's some kind of protest, but if it is meant seriously, it would be the most ridiculous thing I have heard in a long time.

Unless terrorism is actually just a cover for the NSA's true purpose of doing industrial espionage on behalf of US corporations. But if the meaning of the word "conspiracy theory" hadn't changed so dramatically recently, I could swear this is one ;-)

bananacurve• 13 years ago

it's entirely possible not everybody else is doing it.

Only to the extent that intelligence has been outsourced to the US, at least in the West.

http://cphpost.dk/news/denmark-is-one-of-the-nsas-9-eyes.761...

Outsourcing some defense and intelligence makes sense because the West is united and why waste money on redundant systems. The real problem is that America is not a superpower it is a hyper power. As Bill Gates said recently:

"Nation-state competition is not zero-sum competition. It was not good for the world for the United States to be so far ahead, for 5 percent of the global population to generate 30 percent of the economic activity and 60 percent of the scientific R&D."

But we don't want the world to catch up by the US slowing down but by the world speeding up, that way progress is more rapid.

Silhouette2• 13 years ago

The real problem is that America is not a superpower it is a hyper power.

Is it? Really?

I can't help thinking that many of the less welcome trends in recent years, security-related or otherwise, could be explained by (a) the US no longer being a superpower in one sense or another, or not likely to remain so beyond the near future, and (b) senior US political and business figures finally noticing this.

From the outside, the modern United States of America looks a lot like some of its long-standing tech giants: some wise/lucky moves in the past brought success and created a vast amount of resources to use today, but if you keep squandering those resources on little things that aren't done properly and then add occasional big misses, sooner or later your fortunes will inevitably change.

US culture has long been obsessed with military matters and more recently with security, and clearly the US is still the world's leading military power in numerical terms. But at some point, you have enough firepower to level the planet a few times over, and adding another 0 doesn't really make any meaningful difference.

Meanwhile, among other things, a substantial part of the US population does not have access to effective healthcare, a noticeable proportion of US children appear to be learning more in school about religion than science (and their parents are OK with that), some of the big businesses generating all that economic activity Gates mentioned also managed to trigger the biggest global economic crisis in living memory, US workers have some of the worst conditions of any first world country (including so little paid time off in a year that sometimes even doubled it would still be illegal in many places), a cavalier attitude to energy consumption and damaging the environment is pervasive in both political and business leadership, and childish squabbling at the highest levels of federal government recently brought huge parts of that government to a standstill with adverse consequences for millions of ordinary people.

I'm not sure more rapid progress toward the US approach to these kinds of things is something any of us should aspire to. If anything, public sentiment and media commentary in other first world countries seems to be turning more to the attitude that the US is toxic and the best thing to do is distance yourself as much as possible, in security-related matters and otherwise. This article is interesting because it's the first obvious, practical embodiment of that sentiment I've seen, but I'll be very surprised if it's the last.

bjornsing• 13 years ago

Just wanted to contribute a data point regarding A3: In Sweden there's a widely known inventor (or patent troll depending on your view of patent enforcement by non-operating entities) called Håkan Lans. Back in the 90ties he sued Hitachi for infringing on his computer color graphics patent. According to a documentary recently broadcast on Swedish television one of the reasons he was able to win that lawsuit was that someone in the US intelligence community (in a formal or informal capacity) helped him with background information on Hitachi's expert witnesses. The motivation was said to be that US felt threatened by Japan in general, and IBM by Hitachi in particular.

There where many other accusations brought in the same documentary, some of which I'm sceptical about, but this particular one seemed plausible. I can't find anything about it online, but the documentary presented it rather matter-of-factly with lots of interviews etc. So for the ambitious it might be an opportunity to document a concrete case of A3.

Spooky23• 13 years ago

I think NSA is a red herring here -- it may gave turned up the volume, but these are problems that exist no matter what.

If you are handling any data of significant value, storing it outside of the regulatory jurisdiction of your company and/or customers will increase risk and cost. Compliance requirements have already made it impossible for EU individual customer information to be stored in the US. Vice versa compliance has made it difficult for most healthcare or local US government data in Europe.

parag_c_mehta• 13 years ago

Just imagine ramifications of this on person level too. You use Facebook ? Google ? Dropbox ? SkyDrive ? you are already under NSA Scanner :)

I just hope corporates put pressure on US government to back out of NSA treachery.

atmosx• 13 years ago

I agree with most comments here. This was expected, these are not empty threats and no one is over-reacting. Everyone is just re-acting as they were expected too. Except maybe the Obama administration, which has to do some hard decisions. Snowden is growing stronger by the day now.

The part that caught my eye though was this:

It's not all doom and gloom, however. Thompson's comments show that some U.S. firms stand to benefit from distrust of the U.S. government, and that a new model may be in the offing for protecting sensitive data from the NSA's prying eyes.

Apparently, Bloomberg sticks to the Liberal mantra that says more or less that when a market dies a new one emerges.

Maybe the 5% of affected population, in terms of companies, will build a new business model but how this is good news is beyond me. It's like when you listen people saying that YOU can now create a startup in TV because they saw a Steve Jobs 2-minute video documentary on Apple. People apparently don't know that for every successful startup there are 1.000.000 failed for no apparent reason.

bryanlarsen• 13 years ago

This is good news in the same way that a broken window is good news to the glazier. The broken windows fallacy is alive and well in the media. Journalists are also trained to show "both sides" of the story even if the other side of the story is complete nonsense.

bowlofpetunias• 13 years ago

This trend pre-dates the NSA scandal, at least from my European perspective. The US government has legally given it's intelligence and security agencies the right to secretly claim access to data stored by American companies including data not physically stored in the US.

As a result, it's not just a matter of non-US companies and citizens not wanting to store data with US companies, in many if not most cases it's not even legal for them to do so.

As a European company, I have to give certain guarantees about the protection and usages of privacy sensitive data. Storing it under the jurisdiction of a country that does not respect that is out of the question.

This has nothing to do with any illegal activities by the NSA or their non-American counterparts. This is the existing legal regime of the US.

Of course the NSA scandal has highlighted the facts that any guarantees the US so far has given about not abusing this are null and void. From the US can get use data, it has now become the US will us your data. That will significantly and irreversibly speed up the process of taking data out of US companies.

But the process itself had already started, it is just a very slow process (no corporation or government can drastically alter their IT infrastructure within a short term). The real effects won't be felt until another five to ten years, if not more.

cpfohl• 13 years ago

Well...if Americans cant get things changed with votes in their own democratic society, at least non-Americans can get things changed with their own wallets. (Debated using quotes around democratic...left 'em off after all...but it was close). Americans obviously can change things with their wallets, but it's more difficult, and involves a lot more steps like encrypting before sending, etc.

puppetmaster3• 13 years ago

Predictable. This will make Silicon Valley into Detroit, and my job. Thank you corrupt congress w/ your 10% approval.

csense• 13 years ago

Actually the NSA's overreach is more a problem with the executive branch.

Congress tried to establish checks and balances over the intelligence community by establishing FISA after Watergate, but it wasn't enough. Judge Leon's ruling [1] actually discusses the shortcomings of the FISA court.

[1] http://legaltimes.typepad.com/files/obamansa.pdf

polskibus• 13 years ago

As far as I know, similar data locality guarantees are now hot topic in Germany and are often mentioned during sales pitches of SaaS platforms. USA shot itself in the foot and it is competition's holy duty to its shareholders to exploit it.

devrelm• 13 years ago

This has been going on for at least a few years. Large financial institutions in Europe have contracts with vendors stating that servers cannot be hosted in the US because of all the warrantless snooping.

stcredzero• 13 years ago

Could this be a possible benefit of the Google Barge? Could they be trying to get data out of the jurisdiction of the US government?

New Twist in International Relations: Corporate Keep-My-Data-Out-of-U.S. Clause

Related Stories