Hacker News Reader

Comment by sentenza | Hacker News Reader

I am kind of surprised how many people on HN try to downplay the PRISM thing. The recent revelations and controversy directly affect the business prospects of any US firm that stores data.

A couple of months ago I was on an education business fair in Germany and the first thing I heared at the booth of many data-handling businesses was: "We don't store anything in the United States. All our servers are in Europe/Germany."

I now wonder if next year, some will advertise that they don't even have a US subsidiary and are thus not under US jurisdiction.

View on HN

That, exactly.

Google, Apple, Facebook and friends go to great lengths to evade taxes. When it comes to tax matters, those companies have no hesitation to use all the tricks available to a trans-national company. And they pay very smart people to invent schemes that ensure a maximum amount of money is kept out of the US IRS hands.

If Google, Facebook and friends were truly serious about protecting their users' privacy, they would. They would pay very smart people to invent schemes that ensure a maximum amount of user data is kept out of the US NSA hands.

But they don't.

Maybe you can have one but not the other. These guys contract big consulting firms to be the middlemen between them and the government when it comes to tax laws. But I suspect you have to "give" something in return.

It's one thing to have a bankaccount in the Netherlands, that's easy. A whole data-center? A data-center with all the infrastructure to support it and employees and it still needs to be fast enough that we can't see a slowdown from moving it out of USA? That's a different undertaking.

Google actually has many data centers outside the US (in addition to those it has inside the US).

Yeah I know. To do what the parent comment is asking, there can't be any US data-centers. That's not realistic.

What if I insinuated that certain multinational companies already choose which data centers get certain products due to tax reasons? As in, "product X can go into building #1 but not building #3, and product Y can go into #3 but not #1".

I doubt this is really an issue. Maybe some knee jerk anti-American types might spew nonsense like this but Europeans with a little more sense and insight and who actually care about this stuff are well aware that:

1. By law all European telecom providers, including ISPs, are required to provide a backdoor for everything that goes on on their networks (the infamous Data Retention Directive)

and

2. All European security agencies cooperate quite willingly with their American counterparts. Some more so than others (the ones from the former Eastern Block are particularly notorious in this regard) so if an American three letter agency wants your data, it'll get it.

I'm surprised how many people think this is news.

It's simple: if it's passed through the USA, if you store it on a server in the USA or if it contains tags served from the USA you can bet that it's being tracked by one or more three letter agencies. To assume anything less would be folly given the amount of smoke that has been generated to date. To infer there is a fire somewhere is no feat of deduction.

The fact that there is now proof that at least some of these programs are real is only going to convince the last hold-outs, or at least, so I'd hope.

...in Germany and the first thing I heared at the booth of many data-handling businesses was: "We don't store anything in the United States. All our servers are in Europe/Germany."

There is a very simple reason why that is a marketing point, and any of those vendors would have been happy to expand on it, and probably do on their websites. That reason is that compliance with German law requires certification that all steps you take with data comply with German law, which is much easier to do with a vendor which exists in a jurisdiction that has similar data privacy laws, and is easiest if that vendor is German.

For a random example, see http://www.perspecsys.com/how-we-help/cloud-data-privacy/ger....

Now before you cheer Germany for this stance, stop and think. Normally HN is very supportive of anything that reduces red tape barriers to small startups trying to innovate. The kind of regulations that we're talking about both protect users, and make life a lot harder for startups.

If you stored data in the USA, you were already subject to all these things - search warrants from the FBI, FISA requests for a user's data, etc. The law has not changed.

If your servers are in Germany, then they are the subject of German law - and all of their similar, respective search and data laws.

If you weren't aware of this before, you either weren't large enough for anyone to ask for your data, you were lucky enough to never have to deal with this request (or your software isn't really used for communication or data storage), or you were simply ignorant of the legal situation

Obviously. But the USA and Germany are light years apart on questions of user privacy.

Reply on news.ycombinator.com