Hacker News Reader

Comment by arbie | Hacker News Reader

This reinforces the fact that the internet is decoupled from geography.

In my view it reinforces that the internet is dominated by the US. All data stored at any of the large cloud providers falls under US jurisdictions.

EDIT: it also appears asymmetric. I doubt a French court can issue a warrant that forces OVH to turn over data stored at their Canadian data centre (similar with OVH and Finland).

> I doubt a French court can issue a warrant that forces OVH to turn over data

On the other hand: GDPR.

All countries try to pull the same moves on the internet, from Russia to Pakistan to the US and Europe. The difference is that a small market has little leverage. The EU already has data-retention laws that could be extended, and at that point any EU government would have quite a lot of leverage. It's politically unpalatable for now, but things change.

GDPR is the other way around. It applies to non-EU companies that deal with EU citizens (or people living there). It doesn't gain access to data stored by a Canadian company in Canada on servers owned and run by OVH.

It generally doesn't grant access to prosecutors, it tries to protect consumers and can lead to fines in case of violation.

The point is that it's basically a "global law". Non-EU companies could choose to ignore it, but they would risk losing access to the EU market, which is too big to ignore, and so they comply. A company could forego this or that individual nation, possibly even a big one; but the entirety of the EU market is simply too large to accept the risk.

Similarly, a US company could relocate to Iceland and thumb its nose at the PATRIOT Act and so on, but then "good luck doing any business" in the huge US market. The principle is the same: big markets can impose rules that more or less the entire world ends up following.

But you can choose to restrict your compliance to the GDPR to your EU clients. It's not the same as a law that applies to all your clients.

You've just rediscovered the jurisprudence of the Commerce Clause and the power of Federalism. Alexander Hamilton would be proud.

Lets talk about the actual facts of the case here.

Its important to note that United States v Microsoft involved a US company (Microsoft) controlling and storing data (emails) on behalf of a US citizen. The emails were physically stored on a server that was located in Ireland. MS argued that a US judge doesn't have the authority to issue a warrant for data that is stored outside the United States and the FBI needed to go through cross-boarder channels.

I haven't read the bill but everything I read about the CLOUD Act seems to indicate that the act is meant to apply to US companies and US persons, not to foreigners as a rule. It's an extremely unjustified jump to conclude that "all data stored at any of the large cloud providers fall[s] under US jurisdictions." Unless you have more information than me that you aren't sharing.

I referred to "any of the large cloud providers" because they're all US companies (Amazon, Google, Microsoft, DigitalOcean, Linode, Vultr). Not sure if the case would've been very different if it had been for data of a foreign citizen. But from what I read, the fact that Microsoft had sole control of the data was important, and that would apply to EU citizens as well. But that might change under the Cloud Act.

If OVH the company has a presence in France, I don't see why not.

This reinforces the fact that US power is decoupled from geography.

This is the right formulation. Alternatively, that the US is the only global power. Although I can't imagine the US could try something similar in China.

The real leverage it has is the base of US users.

Brave New Imperialism.

Reply on news.ycombinator.com