Well, this is the usual thing about whether you're worried about the NSA or you're worried about more mundane threats.

If your threat model is "government coercion," sure, stay out of the US. But if your threat model is something like "an attacker broke into a cloud provider employee's account" or "the provider didn't take software updates", you're probably safer on the world's larger, more-staffed, more-well-run, etc. services, which are largely (though not entirely) in the US.

The best outcome here, I think, would involve serious, secure competitors to things like AWS being run by European countries in Europe.

You can already choose AWS services and ensure that they stay located only in a single region (that you decide), so you can pick EU-West-1 (Ireland) or EU-Central-1 (Germany) and be assured that Amazon won't move your data into another region.

If you are contemplating "pan-cloud root compromise", I'd worry more about the probability of that happening and less about in which countries that cloud provider operates. That would push me towards the larger, established provider (perceived lower probability of all-access-root compromise) over a smaller upstart whose value prop was "we ONLY operate in Europe".

> and be assured that Amazon won't move your data into another region.

Is this true? If Amazon received a US subpoena requiring them to provide a copy of data on EU-West-1, is violating EU privacy laws a reason to deny a seemingly lawful court order? After all, it is against the law in the US to withhold the information.

The U.S. did exactly that with some data Microsoft had stored on Irish servers, which was subpoenaed by an American court. Microsoft lost initially, because while the data was in Europe, the subpoena was only served to Microsoft US, which had access to the data, and could therefore validly be required to hand it over under US law. The appeal is still being litigated [1]. Microsoft is very interested in fighting the case, because they've been heavily advertising cloud services to European customers on the promise that the data will be stored in Europe and accessed only according to European laws. If they lose, they may have to either give up that claim, or move to a more fully segmented model where access credentials to data in EU-based datacenters are restricted to EU-based employees.

[1] https://en.wikipedia.org/wiki/Microsoft_Corporation_v._Unite...

The Microsoft case is about extraterritorial limits of search warrants, not subpoenas.

US corporations can be compelled by subpoena to appear before court and turn over documents/evidence they control regardless of what country they are stored in.

No idea about administrative subpoenas which I believe include National Security Letters though. I imagine it is the same as the judicial subpoenas.

Spot on. If Microsoft lose this case then both Azure and AWS have major problems. I do wonder though whether they can simply restructure their corporations so that they have a European arm that is completely independent legally from the US one. Maybe that will solve the NSA and EU legal problems.

Fair question. I'd respond two ways:

1. You can still (as a user) avail yourself of user of AWS (aka "you") controlled encryption for most of the relevant data at rest.

2. There is still a legal hurdle for the US to provide a subpoena for data which doesn't reside in the US to be brought into the US and provided. I'm no legal expert, but I doubt that's going to be as simple as "because we said we want to look at it" as this is an issue of sovereignty of the counterpart nation, particularly given that the EU high court has just ruled that the export of this data is contrary to EU law.

Of the two, #1 has significant mathematical assurance.

#1 doesn't really help if you also want to use EC2, Lambda, etc.

#2 assumes that the US national security apparatus is playing by international law, which the EU may not want to assume. Like the EU cookie law, regardless of the intentions behind the ruling/law, what matters for me as a developer is what the law thinks I should do to protect my users, not what I think I should do.

If you want to use lambda, going to a small EU-based cloud provider also doesn't work...

Yeah, but there's unfortunately a difference between wanting to use Lambda and needing to use Lambda, and I'm pretty sure that even an EU court can tell the difference. "We hosted in America because only Amazon supports Lambda." "OK, and what does Lambda do?" "It runs code for us when we tell it to." "And there are no European services that run code for you when you tell them to?" "Uhh...."

Agreed. I missed making my point.

My point was that when you're considering what technology/hosting/cloud provider to use, you are balancing a variety of factors and very few people should weigh "can be attacked legally by the US govt" with weight of 1.0 and all other factors with weight 0.0.

Some businesses will weigh the US risk as 0.1; others at 0.001 and even those that weigh it at 0.1 might be better off choosing a provider with a higher risk of that in exchange for a richer catalog of building block services.

I think Armin makes a good point that European intelligence services have as little, or even less, regards for EU citizens' privacy as the NSA. Getting spied upon by GCHQ, the EU branch of the NSA, or by the mothership itself, makes little difference in practice.

Point is intelligence based in Europe is still under legal control, NSA is not.

If there is big issue in future, you can summon European intelligence at court.

You're not wrong, but with Five Eyes, the OP's point still stands strong as ever.

https://en.wikipedia.org/wiki/Five_Eyes

In practice, there's little advantage to living in Europe, being spied on by the NSA who then sends that data to European intelligence agencies.

Considering that France recently voted a law to make retroactively legal existing practices, I'd say this legal control is most often a farce (and it's not like the new law introduces strong judicial supervision, either).

GCHQ's operation legality has been put under question more than once.

That hasn't happened in past does not mean it won't happen in future.

>Getting spied upon by GCHQ, the EU branch of the NSA, or by the mothership itself, makes little difference in practice.

It makes a difference depending on whether you're OK to be spied upon by a foreign power -- who might damage, take advantage and exploit your country.

Would Americans be OK to be spied by foreign powers while in the US?

And if yes, would the answer still be yes if the US wasn't the top dog, and the other country was, and could hurt them whenever they wanted?

Do Americans have a realistic expectation on not being spied upon by foreign powers over the internet? A cursory look at securelist.com reveals that multiple nation-states conduct campaigns against U.S. targets (and also reveals apparent U.S. gov campaigns against targets in other countries).

>Do Americans have a realistic expectation on not being spied upon by foreign powers over the internet?

Maybe or maybe not, but they do have a very realistic expectation of it having no consequences to them and the country at large. It's not like China (much less Russia) will do anything to the US (as a land and population). Other countries even less so.

Whereas lesser countries have seen the US (and Russia, especially as USSR and/or China) mess up with their internal politics, even topple legitimate governments and install friendly lackeys in power, assist one or the other party to get in power, help friendly governments prosecute their citizenry (especially during the Cold War), bully them to sign favorable trade and other deals (favorable not for them of course), or downright get to war with them.

I don't know a lot about international electronic communication surveillance, but wouldn't GCHQ be responsible to the United Kingdom, whereas Germany would spy through the BND and France would spy through the Brigade de Renseignement?

Do we actually know whether any of the Five Eyes nations are any better than the US in this regard?

If they're in the Five Eyes then no, they aren't any better.