Hacker News Reader

Comment by buro9 | Hacker News Reader

The proposals do not address the elephant in the room and the very reason Safe Harbor collapsed: The NSA and the ability of the US government to override any treaty to access any data using secret warrants.

It is that which killed Safe Harbor, and none of the proposals at the end of the article would be immune to that weakness again.

It would remain the case that the proposals made would not be in line with the clear ruling that the European court gave if the US government can continue to override international treaties and their own courts.

View on HN

The European intelligence agencies were trading info with the NSA, so European companies can be under the same sorts of threats. It's a red herring.

Personally I think this is really about protectionism and the NSA provides a convenient excuse given European intelligence agency involvement.

Eh, I could see the Commission doing it for protectionist purposes, but why would the highest Court care about that? If it's "protectionist" it's for EU citizens' data, not for economic purposes. I've seen no evidence to the contrary so far.

If anything, it's the Commission that has been much more willing to give the US government and companies "some slack" about collecting all this data. Luckily, the Commission's hands are now tied, and the ruling sets a rather clear roadmap for the minimum requirements of privacy in any sort of new EU law or agreement with the US.

Not all of Europe is part of the Five Eyes, or even it's outer orbits. And if they are, the relationship is not symmetric. They don't have first-party access to US government communications, never mind, say, POTUS's cell phone.

"They all do it" is meaningless if one nation has an NSA and Greece has a sketchy looking guy with black shoes and no socks and a tape recorder.

>Not all of Europe is part of the Five Eyes, or even it's outer orbits.

Five Eyes is only one such intelligence alliance. Germany, for instance, cooperated with the NSA despite not being part of FVEY: http://www.spiegel.de/international/germany/german-intellige...

The Dutch, again not part of Five Eyes, tapped phone calls to pass to the US. We don't know the full extent of which nations played a role. I'm willing to bet it's more than have so far been revealed.

>They don't have first-party access to US government communications, never mind, say, POTUS's cell phone.

Germany wasn't exactly giving the US access to their government's communications either, "just" private citizens. They did assist the US in getting access to the French leadership, though.

>"They all do it" is meaningless if one nation has an NSA and Greece has a sketchy looking guy with black shoes and no socks and a tape recorder.

When the large European nations are aggressively spying on their own citizens and then passing that info around to foreign governments in exchange for special software or information, it sort of renders their complaints about the NSA kind of moot. Yeah, the NSA spied on your citizens, but you helped them.

For those nations that didn't engage in this, I have a feeling not having your data in America isn't going to prevent the NSA from getting it if they desire it. Especially since much of that data will end up in the sorts of European nations that are spying on their citizens and trading data with the NSA anyways.

> Yeah, the NSA spied on your citizens, but you helped them.

I did not help them.

Either the German government did or the BND and VS did without orders from the German government. This needs to be investigated and punished accordingly. That is very unlikely, but at least we have parliamentary commision (NSA Untersuchungsausschuss, NSAUA) to investigate these wrongdoings. Some interesting things were already uncovered by the NSAUA.

Well, I (a person) didn't directly help the NSA, either. I didn't vote for the people who did it, either. But "I" (a citizen of the United States) did help them in that I am part of the US, and I generally support the form of government that we have.

I doubt that the BND acted without orders from the Chancellor's office, just as the NSA didn't and hasn't acted without orders from the President.

You're right, they don't spy on POTUS's phone, just USSecState's phone.

http://www.theguardian.com/world/2014/aug/16/germany-spied-j...

Snark aside, I agree that there isn't full reciprocity when it comes to espionage capabilities, but BND is a capable spy agency with the resources to perform its mission.

The European intelligence agencies were trading info with the NSA, so European companies can be under the same sorts of threats. It's a red herring.

But the court wasn't asked to decide about the actions of the intelligence agencies, it was asked to decide on a complaint against Facebook.

Personally I think this is really about protectionism and the NSA provides a convenient excuse given European intelligence agency involvement.

On the contrary; if anything, it was the Safe Harbour process that was supported on a convenient excuse, which the Commission allowed despite being clear from the start that the US didn't offer the necessary privacy protections to comply with the Directive. The court has just stated the obvious.

>But the court wasn't asked to decide about the actions of the intelligence agencies, it was asked to decide on a lawsuit against Facebook.

You're right, and as the basis of its ruling it decided that intelligence agency action caused a violation of the law. Given that intelligence agencies in the EU were willing partners in NSA spying in clear violation of US and EU law it stands to reason that much of the EU is similarly incompatible with these laws. Why can we store data in Germany when the BND is shipping your data to the NSA, but not America, where the NSA is doing it first hand (and might be doing it on its own in Germany anyways)?

Why can we store data in Germany when the BND is shipping your data to the NSA, but not America, where the NSA is doing it first hand (and might be doing it on its own in Germany anyways)?

For the same reason we could store data in the US right until this decision.

The legal action has only just got going: https://www.amnesty.org/en/press-releases/2015/04/amnesty-in...

Because a German citizen has several ways to make the BND accountable through the legal system, including voting to change such legal system; but he has no recourse against the NSA (short of starting a war).

You are mixing political responsibility and legal responsibility.

I'm not entirely clear on the EU's legal structure. Does an Italian citizen have ways to hold the BND accountable for accessing their personal data held in Germany?

I assume an Italian citizen can't vote to change Germany's legal system.

An Italian citizen can hold Germany accountable for implementing and enforcing EU privacy laws and directives (through the EU courts). If that doesn't give him sufficient legal standing he can vote for representatives to pass stricter EU legislation.

If the BND is allowed to do things that places Germany in violation of EU law, then that is an issue, yes, but it is an issue that was out of scope of what the court was asked to consider.

EU intelligence agencies are under EU law (more or less). The US Gov/NSA is not under EU law. So you can't say that data in the US is compatible with EU law.

Both the NSA and various EU intelligence agencies were violating their various laws. Or, if you're a lawyer for one of these agencies, they had found convenient loopholes that violated the spirit of the laws and rendered them meaningless.

So if we apply the standard of intelligence agencies violating the laws mean a country is unfit for storing EU data, then many EU nations are now unfit to store this data.

> So if we apply the standard of intelligence agencies violating the laws mean a country is unfit for storing EU data, then many EU nations are now unfit to store this data

The difference is that EU citizens can hold "unfit" actors responsible, if they are from their own country (or even continent, via the ECJ); but they cannot do anything against the NSA.

Absolutely agree. The EU data regulators consistently ignore their own governments intelligence gathering activities and powers.

Which, to be fair, they are absolutely allowed to do. That "everyone does it" doesn't make it acceptable that the NSA does do it. And if that also makes for a convenient excuse to pry some of the data currently stored on US-based servers out of the US and into the EU where it can drive local economies, so much the better from their perspective.

The EU regulators are being selfish jerks and forcing Facebook and Google to spend their hard earned cash on a datacenter in Antwerp or whatever. That's... hardly the worst evil afoot.

It's embarrassing that the tin foil hat suggestion that the European Court has a political agenda isn't downvoted into oblivion.

Not to mention the simple fact that through this ruling the court actually struck down a treaty supported by the EU politicians.

Even if the US passed identical data protection laws as the EU, the NSA would still have the ability to do what they did legally since EU data protection laws have exceptions for national defense and national security.

It appears that the EU wants the US to pass laws that are stronger than their own.

There are exemptions for national security, but they have to be proportionate (and if you read the judgment of the court, they're pointing at a high bar there) and non-discriminatory with regards to citizenship.

Part of the problem with SH was the fact that there was no legal recourse at all for EU citizens.

Also, let's not forget that the CJEU stuck down the Data Retention Directive recently - so they are enforcing this human right against EU member states. They just have to wait for the right referral to their court.

I think it would be very interesting if the civil courts of the US and EU each forced the other entity into passing stronger privacy protections than they have currently. Specifically, I'm thinking of a scenario where the collapse of Safe Harbor helps force Congress into passing meaningful privacy legislation and drastically curtailing the NSAs overbroad powers and mandates, and the US then turns around to the EU and says "ok, now it's your turn. If we can't spy on everybody, then neither can you."

The only effective solution to the problem of "NSA and the ability of the US government to override any treaty to access any data" is the furtherance of study, and application of Homomorphic encryption.

Homomorphic encryption is a type of encryption done on data, and sent to a remove server (cloud), and the data is processed in an encrypted form. It never is unencrypted during any part of processing. And when it is transmitted back to the originator, they can decrypt when they choose.

Unfortunately, right now the speed is very slow, but work in this area can allow all sorts of data to be processed in the cloud securely.

TBH as soon as you're using a cloud that you don't control anywhere you've lost control of your data.

https://www.stickermule.com/marketplace/3442-there-is-no-clo...

Reply on news.ycombinator.com