What incentive does Amazon have to fight against the government on your behalf?

I left open a proxy by mistake on an ovh server years ago, for 4 days. People found it and used it for fraud.

A few months later, all my personal gmail account are seized and I reveive an email (that I could read after changing my password) from a police department in god fuck knows where middle of nowhere countryside asking me for data on the proxy usage.

Sadly I had revoked the server subscription since I didnt need it anymore (and probably hadnt kept any logs anyway since I was just playing aroud with a server) but I really really wanted to help.

I mean, it s rare the police would call you for a legitimate usage and political suppression. They call you for fraud with damage and it s awful being responsible in small part but unable to help... I was not mad they read all my emails, I was sorry someone lost money because of my mistake.

> left open a proxy .. People found it and used it for fraud

Maybe I haven't had enough coffee, but I'm failing to connect how leaving a proxy open was a major enabler for fraud. What kind of fraud?

The trust of their customers?

Afaik the US Government is a big Amazon customer.

I would imagine that particular customer would rather Amazon not quietly honor, say, a Russian subpoena for their data.

does it mean you have to put your data into Yandex or Alibaba Cloud if you wanna avoid USG quietly getting it?

The problem for an Amazon hosted server is US subpoenas, not Russian or European or whatever...

Amazon has AWS regions in six continents.

Ha ha ha ha ha...

Amazon? Trust? People trust Amazon to exist and to bill. Providing services to those who pay the bills is almost incidental.

Any company's legal department is like HR, it's role is to protect the company, not the employees and certainly not the customers.

Even more so for non-paying users, as in gmail or facebook.

Especially when the companies are already happily selling account metadata.

Getting a reputation for handing customer data over to the government without a fight seems like the sort of thing that would damage a hosting company.

Having a poor data security reputation?

It didn't effect Experian.

https://www.cpomagazine.com/cyber-security/another-data-leak...

It didn't effect Yahoo.

https://www.yahoo.com/entertainment/might-mother-password-le...

It didn't effect Sony.

https://www.buzzfeednews.com/article/tomgara/sony-hack

It didn't effect AT&T.

https://www.wired.com/2011/09/911-surveillance/

>It didn't effect Experian.

You, as a consumer don't really get to choose experian or not.

>It didn't effect Yahoo.

Who says it didn't?

>It didn't effect Sony.

So a bunch of internal business documents got leaked. As a consumer I couldn't care less.

>It didn't effect AT&T.

If every provider was mandated to do this, then I wouldn't call it "poor data security reputation".

It’s probably better than you think. You’ll need a competent lawyer but beyond that you’ll depend on the court system, which attempts to put you and the government on equal footing.

Depending on the legal issue at stake, it might also be possible to access additional legal expertise pro bono, or through an organization like the ACLU.

Amazon probably won’t even try.

They’ve clearly and openly committed to trying for years. https://www.computerworld.com/article/2705826/amazon-web-ser...

Even Twitter doesn’t like to roll over, and they’ve got a lot less at stake. https://www.latimes.com/politics/story/2021-05-17/twitter-fi...

But your ability to delete the data is substantially higher than your ability to get Amazon to delete it.

If you are hosted on AWS, it is really easy to delete your data.

Also, you can encrypt it with keys that they will NOT use to decrypt.

The data will also NOT leave the region (or country) that you specify

What guarantee do you have that Amazon will delete it when you tell them to, though? It doesn't even necessarily come down to whether you trust Amazon ethically and legally, but also whether you trust their internal processes.

Shredding the data on your own hard drive gives you a pretty good guarantee. Drilling a big gaping hole through it afterwards gives you an even better one.

Is the "NOT" due to process, or technical constraints? Because it's very easy to make an exception to normal process, if the right people are asking

Quite the opposite.

Ability and willingness are two different things.