Reply to topic  [ 10 posts ] 
Safe Harbor no longer valid 
Author Message
What's a life?
User avatar

Joined: Thu Apr 23, 2009 8:25 pm
Posts: 10691
Location: Bramsche
Reply with quote
http://www.theregister.co.uk/2015/10/06 ... ling_down/

Stuff that in the NSA's pipe and let them choke on it.

It seems the USA is intent on destroying its IT businesses.

_________________
"Do you know what this is? Hmm? No, I can see you do not. You have that vacant look in your eyes, which says hold my head to your ear, you will hear the sea!" - Londo Molari

Executive Producer No Agenda Show 246


Tue Oct 06, 2015 10:59 am
Profile ICQ
What's a life?
User avatar

Joined: Thu Apr 23, 2009 7:26 pm
Posts: 17040
Reply with quote
Not really. 'Safe Harbour' of itself is no longer legally enough in the EU but 'safe harbour plus a few other things' is. And quite a few US cloud providers already do 'the other things' anyway, so EU based businesses are fine to carry on using them.

The reality is US cloud providers will have to make a couple of changes which will be enough to comply with the judgement and then things will carry on as before.

'Destroying it's IT business'? Not at all. Allow a few contract lawyers to buy slightly bigger yachts? probably. Anyway, imagine if the legislation that came out of the judgement was so draconian that customers in EU countries couldn't use US based cloud services at all, that would only leave the whole of North America, South America, Africa, Russia, the far east and possibly China (if providers were willing to play by their rules) to sell to. How would they ever survive?

A lot of geeks got very excited about this but it was never going to be an apocalypse, just a readjustment.


Tue Oct 06, 2015 3:03 pm
Profile
Site Admin
User avatar

Joined: Fri Apr 24, 2009 6:12 am
Posts: 7011
Location: Wiltshire
Reply with quote
Time will tell and certainly worth watching, I have a meeting with some senior MS people tomorrow regarding 365 etc etc, I raise it for some fun. 8-)

_________________
<input type="pickmeup" name="coffee" value="espresso" />


Tue Oct 06, 2015 4:01 pm
Profile WWW
What's a life?
User avatar

Joined: Thu Apr 23, 2009 7:26 pm
Posts: 17040
Reply with quote
They'll probably just point you here

As I say, to believe this has caught any large US corporation completely on the hop and they're all running aroudn waving their arms in the air is foolish.


Tue Oct 06, 2015 4:27 pm
Profile
What's a life?
User avatar

Joined: Thu Apr 23, 2009 8:25 pm
Posts: 10691
Location: Bramsche
Reply with quote
Quote:
The EU’s data protection laws restrict exporting personal data from the European Economic Area. The Model Clauses, standard contractual clauses approved by the European Commission, are a preferred way to legitimize the transfer of personal data outside the European Economic Area.

Global cloud service providers offering enterprise-level service, availability, and performance, along with ancillary services such as 24/7 customer and technical support, need flexibility to move personal data of an EU customer outside of the EU in the course of providing the cloud service.

While Microsoft and our customers may rely on the “Safe Harbor” framework to legitimize the transfer of personal data from the EU, some European data protection regulators have said the Safe Harbor framework may not be sufficient for an enterprise cloud services environment.

The problem is, that model clause was developed before the court decision that Safe Harbor is no longer valid.

The problem is, even if the provider uses Safe Harbor, under the PRISM programme they still have to hand that data over. They have a decision, do they break the law for their EU customers or do they break the law and earn the wrath of their home government? And that is what the EU ruled. As long as Safe Harbor doesn't protect against PRISM and US search warrants, it isn't worth the toilet paper it was scrawled on.

This is more of a problem, in the first instance, for companies like Facebook and the public cloud services from Microsoft, Apple and Google. It will also cause problems with corporate data. Microsoft isn't so badly affected as Facebook in the first instance, because they tend to keep EU data in the EU - hence the current case between Microsoft and the US Justice department, if Microsoft lose that case, then it will be the end of US based cloud services outside the continental USA.

But this is still a severe blow for their image and means that they will have to come up with new ideas. I expect the EU will have to revisit the Model Clause, now that Safe Harbor has been deemed legally invalid.

_________________
"Do you know what this is? Hmm? No, I can see you do not. You have that vacant look in your eyes, which says hold my head to your ear, you will hear the sea!" - Londo Molari

Executive Producer No Agenda Show 246


Wed Oct 07, 2015 3:56 am
Profile ICQ
What's a life?
User avatar

Joined: Thu Apr 23, 2009 8:25 pm
Posts: 10691
Location: Bramsche
Reply with quote
jonbwfc wrote:
'Destroying it's IT business'? Not at all. Allow a few contract lawyers to buy slightly bigger yachts? probably. Anyway, imagine if the legislation that came out of the judgement was so draconian that customers in EU countries couldn't use US based cloud services at all, that would only leave the whole of North America, South America, Africa, Russia, the far east and possibly China (if providers were willing to play by their rules) to sell to. How would they ever survive?

A lot of geeks got very excited about this but it was never going to be an apocalypse, just a readjustment.

I would expect, that if the services are deemed illegal in the EU, because the US Government is "illegally" syphoning data off of these services, it won't take long before those services are a pariah in most countries.

The US Justice versus Microsoft issue will be the real nail in the coffin, because they are claiming that US law trumps EU law, even when data is still held in the EU by an EU based company (in this case, on Irish servers, belonging to an Irish company on Irish soil, but wholly owned by Microsoft USA). The US Justice department argue that Microsoft Ireland must disregard Irish and EU data protection law and hand over the data to the US Justice department, because USA.

Edit: http://www.theregister.co.uk/2015/10/06 ... _analysis/

Quote:
"Safe Harbour is dead - but Safe Harbour been dead for a long time," one privacy advisor told us this morning. "It's a zombie that's put on stage when people start asking awkward questions," he says. "It's the been the big white fat elephant in Silicon Valley boardrooms for years."

Experts say that the Schrems decision nukes the uncomfortable political compromise of creating a "safe harbour" for data exports that the EU and the USA thrashed out in 2000, that became untenable after former NSA sysadmin Edward Snowden spilled the beans. No matter how much Brussels bureaucrats want their latest Safe Harbour fudge to work - the cat's out of the bag. US companies that export data are fundamentally illegal in Europe.


Quote:
Safe Harbour allowed the EU to pretend that Europeans' data was still subject to European-standard protection, and US data processing giants like Facebook and Google to pretend they were still legal in Europe. But two factors made the pretence untenable. One was the introduction of anti-terror legislation in the USA, and the second was Edward Snowden. Peter Houppermans, a privacy advisor based in Switzerland, explains:

Quote:
"Safe Harbour has been broken for years - but it’s only now visible. But really it's broken since 9-11. American legislation created so many back doors that there’s no due diligence or scrutiny of law enforcement - so any one can walk in. Safe Harbour was just a political sticking plaster. As a result there's no US entity in the world that can credibly guarantee the privacy of your information. It's legally impossible.


He illustrates with a practical example of how US companies are now in breach of EU rights.

Quote:
Imagine you’re a UK resident business, and you're using Google for email. What happens when I email you? You'll receive my message on US-owned infrastructure. Before you've gained my permission, you've exported my personal data - and maybe it’s even privileged information - to a third party entity.


That's because the recipient of the email - in this case you - export the data to a third party without the sender's permission.


Quote:
The reason Humpty can't be put back together again - and this is vital to understanding the story - is the United States' view of territoriality.

Crudely put, the US doesn't recognise an "abroad" - and fears that if it starts to do so, it will open a Pandora's Box of criminal evasion. This is being fought in Europe, where Microsoft is challenging a US Court order to access emails stored in Ireland. The DoJ fears that a future Enron would store its data offshore, and claim data protection.

Houppermans notes:

Quote:
Technically, it's possible to secure information, but the biggest data safe is of no use if you can legally be ordered to open it, which is what is happening in Microsoft vs DoJ. This is where encrypted platforms where the data owner holds the key are better, but that depends on whose technology you trust.

_________________
"Do you know what this is? Hmm? No, I can see you do not. You have that vacant look in your eyes, which says hold my head to your ear, you will hear the sea!" - Londo Molari

Executive Producer No Agenda Show 246


Wed Oct 07, 2015 4:01 am
Profile ICQ
What's a life?
User avatar

Joined: Thu Apr 23, 2009 8:25 pm
Posts: 10691
Location: Bramsche
Reply with quote
A slightly less bleak view:

Quote:
Mike Weston, CEO of data science consultancy Profusion said the decision was not surprising, but “it will still have a profound impact on the global tech industry. American companies are going to have to restructure how they manage, store and use data in Europe and this will take a lot of time and money”.

“The biggest casualties will not be companies such as Google and Facebook – as they already have significant data centre infrastructure in countries such as the Republic of Ireland – it will be medium-sized, data-heavy tech companies that don’t have the resources to react to this decision," said Weston.

"Many of these businesses will reconsider how and whether they operate in Europe, which is bad news for everyone,” added Weston, who also warned about the possibility of “retaliation from US authorities”


http://www.theregister.co.uk/2015/10/06 ... a_sharing/

Quote:
“Safe Harbor was flawed in principle and flawed in practice,” said Joe McNamee, executive director of European Digital Rights group, EDRi. “After last year’s data retention ruling, this is the second time in two years that the ECJ has struck down an instrument that the European Commission had spent years defending.”

“In reality, however, the case is much deeper than 'just' mass surveillance. The European Commission has never had the political courage to recognise that Safe Harbor was never safe. Even before the Snowden revelations, reports from the Commission itself and from independent research showed over and over again that the entire framework was inadequate,” said McNamee.

_________________
"Do you know what this is? Hmm? No, I can see you do not. You have that vacant look in your eyes, which says hold my head to your ear, you will hear the sea!" - Londo Molari

Executive Producer No Agenda Show 246


Wed Oct 07, 2015 5:51 am
Profile ICQ
I haven't seen my friends in so long
User avatar

Joined: Fri Apr 24, 2009 6:06 pm
Posts: 6355
Location: IoW
Reply with quote
jonbwfc wrote:
They'll probably just point you here

As I say, to believe this has caught any large US corporation completely on the hop and they're all running aroudn waving their arms in the air is foolish.

And yet...

Image

;)

_________________
Before you judge a man, walk a mile in his shoes; after that, who cares?! He's a mile away and you've got his shoes!


Wed Oct 07, 2015 7:54 am
Profile
What's a life?
User avatar

Joined: Thu Apr 23, 2009 7:26 pm
Posts: 17040
Reply with quote
Right, because newspaper headlines are always 100% accurate and complete.


Wed Oct 07, 2015 10:54 am
Profile
I haven't seen my friends in so long
User avatar

Joined: Fri Apr 24, 2009 6:06 pm
Posts: 6355
Location: IoW
Reply with quote
jonbwfc wrote:
Right, because newspaper headlines are always 100% accurate and complete.

I thought it was amusing - chill out, chap.

_________________
Before you judge a man, walk a mile in his shoes; after that, who cares?! He's a mile away and you've got his shoes!


Wed Oct 07, 2015 11:01 am
Profile
Display posts from previous:  Sort by  
Reply to topic   [ 10 posts ] 

Who is online

Users browsing this forum: No registered users and 4 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum

Search for:
Jump to:  
Powered by phpBB® Forum Software © phpBB Group
Designed by ST Software.