Comment by hopeless | Hacker News Reader

Comment by hopeless | Hacker News Reader

Microsoft are at the centre of another case which will really decide how badly EU-US trade is affected:

> Microsoft stands in contempt of court right now for refusing to hand over to US authorities, emails held in its Irish data centre. This case will surely go to the Supreme Court and will be an extremely important determination for the cloud business, and any company or individual using data centre storage. If Microsoft loses, US multinationals will be left scrambling to somehow, legally firewall off their EU-based data centres from US government reach.

— from http://www.irishtimes.com/business/ecj-ruling-on-irish-priva...

At the moment, data can be held within the EU by US companies and it's all ok. If Microsoft is forced to hand over emails stored within the EU to the US government, then all bets are off.

In that future, it may not even be enough to have an EU-based subsidiary of a US company hold data within the EU, since it'll have been shown that the U.S. government can coerce them.

And we like to talk about large companies like Microsoft, Apple, Facebook, Google etc. But they can throw money, lawyers and engineers at this problem. But the thousands of US-based SaaS apps do not have that luxury. Likewise, there are thousands of EU-based small SaaS app that will have everything from their hosting stack, to their bug tracker, to their communications tools taken off them.

In this case, the U.S. isn't trying to get Microsoft to coerce their European subsidiary into handing over the data; it's trying to get Microsoft U.S. itself to hand over the data. The problem for Microsoft is that the parent company in the U.S. has direct access to the data, without having to involve any employees of the European subsidiary, even though the data is stored on European servers. Therefore the U.S. government's position is that a search warrant is valid and not extraterritorial: it's being served on a U.S. company, asking U.S.-based employees to turn over data they have direct access to.

Microsoft would be in a stronger position if the data on its EU servers were only accessible by employees of its European subsidiary. Then Microsoft's U.S. branch could respond to a search warrant by truthfully saying that they don't have that data, and the request must be redirected to its European subsidiary. But that would complicate its technical infrastructure, so it would rather not do that. However, if the case turns out adversely, that's one possible response. They could segregate access, so that credentials for access to EU-based data are only given to EU-based Microsoft employees.

Thanks for making that clearer.

I'm not yet convinced that a multinational could have strong enough controls that 1 person on a team has the password but another person doesn't. In reality, this stuff get's mixed around a lot, even if there are official policies in place

> In that future, it may not even be enough to have an EU-based subsidiary of a US company hold data within the EU, since it'll have been shown that the U.S. government can coerce them.

Wouldn't the other way round be more sensible, then? Make Microsoft be technically headquartered in the EU and have its main operations handled by a US subsidiary. Wouldn't that work?

(Not familiar with legal/financial/etc. reasons this would be a problem.)

In that future, even an EU company may not be enough if that company does business in the US (or, in the most extreme case, accepts and/or makes a significant amount of USD payments). The US government can coerce them too (and in some cases already does today e.g. sanctions and FATCA).

Reply on news.ycombinator.com