I hope you are aware that "the cloud" is not some secret, mysterious piece of technology that the EU can't figure out. We have software engineers as well as data centers and EU-based cloud companies. Digital consumer networks were established here long before the U.S and the internet was invented here. Your arrogance is grating.

> the internet was invented here

In Europe?

They mean the WWW, which is really what the Internet has always been about. And yes, it was invented in Europe.

The web browser which actually made the web usable and popularized it was Mosaic.

"Mosaic was developed at the National Center for Supercomputing Applications (NCSA) at the University of Illinois at Urbana–Champaign beginning in late 1992." -- Wikipedia

Other than Linux's European origin, Europe has not produced any viable operating system or browser. It continues to rely on key software of American origin, like the rest of the world.

This is one of those "pizza was invented in New York City" arguments. Popularized and refined != invent.

The Brit Tim Berners-Lee designed the architecture, wrote the first browser and web server, and wrote the first HTML spec at CERN around 1989. Mosaic was released in like 1993 after Berners-Lee released his specs and source.

To claim the internet was invented in Europe is equally absurd.

> which is really what the Internet has always been about

Internet created 1983. WWW created 1989.

Well the Web if you prefer.

They're two different things. The Internet was invented in the US. I'm European as well, but not sure why you'd need to overreach to claim we invented the Internet.

packet based networking was invented in the US...

The internet was created by meshing many different networks together (mostly ARPANET and SFNET).

Networks which now form the backbone of the internet also existed in europe at the time, mainly in britain and france.

Yes we are all aware they are different things, I made a semantic leap because the terms are used interchangeably in common parlance. I should have known a technical forum would take me up on that.

Right, and the goal of this sort of ruling is to make sure that those EU-based engineers have work and get paid. It has nothing to do with consumer protection or privacy. If it did, EU companies that have servers in the US would be banned from processing EU user data for the exact reason spelled out in this ruling.

I'm European and I'll happily admit there is no EU alternative to AWS, GCP, Azure. The breadth of services _on_, and the amount of engineers able to work _with_ these platforms is incredible and can't be beat by the likes of Hetzner and OVH. We are so behind that we won't catch up. The arrogance is warranted in this case.

I like privacy, but the business person in me is very frustrated by these GDPR rulings as they make the life of European startups even harder than it already is.

I mean I'm really enjoying Scaleway for all of the things I'd use AWS for: EKS, managed DBs, and cloud M1 Macs are all accounted for.

But you realize that all tightly integrated high-level services like IAM, Kinesis, Lambda, DynamoDB, CloudWatch (just to name a few from AWS), make the cloud a joy to work with? AWS had VMs and Managed DBs in 2009(!).

My personal experience with IAM is that it makes AWS awful to work with. I honestly wish it was replaced with an service far simpler in design. CloudWatch is similarly obtuse.

I think you have a point with Lambda though I don't use serverless much. How does Knative compare?

I personally have no experience with Knative. In my view, you open up a different can of worms by dragging in k8s. Either do everything natively on your cloud provider or go all-in with k8s.

Lidl: https://www.stackit.de/en/

Are you joking? The products page is laughable compared to the big cloud providers. Hell, it has "We create custom-fit solutions" on the landing page. If anything screams non-cloud it's that.

> Digital consumer networks were established here long before the U.S

Really? In some places in Europe, people were starting to get excited about dial-up BBSes in the mid nineties, a decade after they were on their way out in North America.

In 1994 I was doing contract work in Vancouver on a website with paying subscribers.

> Really? In some places in Europe, people were starting to get excited about dial-up BBSes in the mid nineties.

What is your point exactly? Half of europe was still transitioning to a market economy or in a (civil) war/conflict in the 90's.

I am also sure, that a lot of places in the US didn't have internet access in the 90's.

> Half of europe was still transitioning to a market economy

Sure, but not, oh, Sweden.

This is rich coming from America.

America engages at global level surveillance. American corporations can be coerced with a single national security level to spy on their customers. Ergo they are untrustworthy and should not be used.

Honestly, nationally-owned spin-offs aren't an issue. If that's all that doing business with China entailed, I think people wouldn't be so mad, but unfortunately there are other practical and moral compromises needed. The EU may be challenging in certain ways, but at least they play by their rulebook and champion public interest a lot of the time.

Those US companies are free to not be on the EU market, just saying

This sword cuts both ways. US can also stop sales of Airbuses, Volkswagens, IKEA furniture etc. under some fishy premise. If EU does that to US companies, why shouldn’t US do it to EU ones? This kind of tit for tat trade war would be a loss to everyone compared to cooperation, but is still preferred to cooperating with a defector.

How on earth is "the US is able to demand personal data of EU citizens without due process" a fishy premise?

Isn’t this the case with all sovereign countries, though? You can never guarantee that a government won’t demand a company in that country to hand over data, that is what it means to be sovereign.

Generally speaking, we look at the legal system in the country and decide whether it is /legal/ for the state to do such a thing, and whether there are appropriate safeguards to prevent it from doing so. Yes, they could change the law - and at that point it would become illegal for companies in that country to do business in the EU.

Usually most countries are smart enough not to damage themselves economically by preventing their companies from selling to a large, reasonably rich union.

> Yes, they could change the law

They could also just not follow the law

Indeed. A country which fails to follow its own law on privacy would likely be considered a country which does not have appropriate law on privacy.

There is no tit for tat, we european citizens don't want our personal data to be accessible to the US government and their respective secret agencies.

The US government will not back up from their policy and so we do neither but since we otherwise enjoy a great partnership and alliance, we take this issue pretty "dry and emotionless", trust me, there are no hard feelings or ill intentions.

Comparable move could be for US to forbid using EU hosted services to ie. store medical records of US citizens etc., no?

No, because Germany doesn't have that big of an IT space. Aerospace and automotive would be good sectors to hit back with because they are more relatively important to Germany as IT is for the US.

So you're essentially admitting that this is about revenge because Germany cares about its citizen's privacy and due process.

I'm saying that if Europe decides it wants to block off parts of its economy, the US would be perfectly justified in doing the same (to everyone's detriment).

I could imagine a US based law that banned the sale of any durable goods produced by a company headquartered in a country that still got more than 5% of its power from lignite coal due to a strong climate commitment. That's tailored basically only to impact Germany. Is that fair?

OK but not wanting our personal records to be arbitrarily sized by the US government is very reasonable. Your government made a law that lets it spy on us... that's your problem.

I don't think it's reasonable that I'm paying more than my share of taxes for the defense capabilities that allows Europe free access to a stable world market and roughly rules based international order that underpins the export economy of Germany in particular. If Europe would fix that, I'd feel a lot worse about the spying.

No one’s making the US do that. Just stop the military spending.

Of course that means the US will no longer be a global superpower, but the US can freely choose that.

Complete and utter non-sequitur but I'll humour you.

I never understood American magical thinking that blames Europe for US military spending. In the end, if you want to cut military spending, you can.

Regardless, you're the hegemon. I don't accept that you don't benefit from that position.

I don't think it is a non-sequitur. The spying is part of the overall defense structure that enables the German export economy to function.

EDIT: It's like saying "This thing you're giving me that allows my whole economy to function, I don't like the consequences of how you're doing it."

Why should they? Europe signed free trade agreements and promised they would open their markets to the USA if the USA reciprocated. Excluding American companies from doing business seems a pretty big violation of this. I guess EU is free to cancel those free trade agreements, but they aren't free to just ignore them and just make it illegal for American companies to do business in Europe because of privacy rules that exclude American companies purely on the fact that they are American.

American cloud companies spy on European citizens on behalf of American government. This is illegal under European law.

> Europe signed free trade agreements and promised they would open their markets to the USA if the USA reciprocated.

I'm unaware of any free trade agreements with the US: https://en.wikipedia.org/wiki/European_Union_free_trade_agre...

The US only has free trade agreements with some American countries and South Korea/Australia outside: https://en.wikipedia.org/wiki/United_States_free-trade_agree...

But this is all irrelevant because free trade doesn't trump rights (privacy/due process/etc).

Safe trusting an US based company with data _at the very least_ requires that US doesn't have a law that allows them to spy on us.

How does this not compute for Americans, I cannot even comprehend.

Sorry to be so blunt but every EU competitor sucks ass. So if the EU has it their way, it is us Europeans the ones getting fucked.

It’ll be bad for a while, but alternatives will pop up. There’s plenty of money to be made.

Europe is Apple’s third largest market, making $90 billion last year alone. You don’t think other companies will step up for even a tiny percent of that?

Why haven't they? OVH is probably in the best spot to do so but their offerings are trash compared to Amazon/Google/Microsoft's.

It’s way easier to set up a business and get funding in the US, with a lot less bureaucracy.

If those US companies were to go away however, the market will adjust to Europe/Asia grown companies.

No?

This is the obvious outcome of the US government’s repeated and explicit statement that non-US residents do not have any due process rights and thus no warrant requirements, followed by - when companies tried to compensate for this abuse by creating subsidiaries in the EU - stating that the US government also had access to all subsidiaries data, again with no due process protections.

What did the US government think would happen when they made it clear that no US company could provide due process protections for any EU data that they possessed?

This has nothing to do with the “IP theft”, but rather the inability of US companies to comply with universally applicable EU law.

True, this is the crux of it

If you let all subsidiaries of M/G/A within reach of US courts (including customer data) don't get surprised when other countries treat it as toxic

The US gov would never accept this in procurement, so why should other countries?

On the case in question, it seems the company changed the tender document to take out some (protection) clauses

Yeah, the late (post acceptance?) changes seem questionable on their own. Presumably they were reminded that the US gov argued and won with the Supreme Court, that they have unfettered access to all non-us-resident customer data of all US companies, and said companies subsidiaries, regardless of local laws. After all, as we know the US Declaration of Independence says "We hold these truths to be self-evident, that all residents of the united states are created equal, that they are endowed by their Creator with certain unalienable Rights".

This is about US legislation and jurisdiction extending to foreign territory and thus conflicting with local legislation and corporations subsequently failing to comply with legislation regulating that market.

I wouldn't say so.

Restricting the sale or transfer of personal data to a foreign-held company that can and will obey foreign laws with regards to that data is, I think, perfectly fair.

The dances companies go through to appear local or non-local with shell companies is an abuse of the intent of many laws.

Microsoft/Google/Amazon/etc. probably can figure out how to operate in Europe to comply with the intent of the law, but it might require a rather large actual separation of interests rather than a shallow apparent one.

Many (if not the majority) of open source projects that are used to power the whole spectacle have originated in Europe and now have a majority of international contributors.

But the power centers (foundations etc.) are in the USA. International contributors are expected to bow to U.S. cultural dominance and follow the latest whims.

OSS has been stolen by the USA.

Also noted elsewhere is that US tech companies are hand in hand with the US intelligence apparatus.

> Except now, the EU is more or less forcing American companies to sell unaffiliated spin-offs to the EU to continue doing business there.

Isn't that what happened with TikTok?

Both China and the US have laws that force global subsidiaries of Chinese/American companies to hand over data held overseas.

I would argue China-US relationships are not that of allies or friends. There isn't a war or cold war going on, but I wouldn't pretend that the relations between China and the US are peaceful and represent trustful tranquility.

I would argue the relationship between Europe and US are substantially better, although not without frustrations from both sides, some warranted and some not.

At the very least, several countries are in a formal defensive alliance with the US and each other (NATO).

NATO membership is also true for Turkey, which is not always considered friendly with the EU and US.

Turkey is a very interesting case, and is rooted in the Cold War.

But I do agree Turkey is less friendly dly and is on my personal no-go zone for safety reasons.

Turkey's status is (or should be) always about who is at the helm. It is an interestingly "supreme leader" type of a culture, and with Erdogan you can see how that plays out. Heart breaking, in my opinion, as they had a reasonable shot at becoming a properly European country (read: culture & rule of law wise especially).

For example, you would have had an amazing time 20 years ago with a level of security comparable to other European countries. Nowadays? Personal no-go zone is a wise decision, to say the least. If I didn't have my biological family there; I would have done the same in an instant.

It's rich to accuse the EU of copying China when it's the US who copied China's "National Intelligence Law" as the "CLOUD Act"; laws which compel Chinese and Americans to act as spies outside their countries when it comes to data.

This is germany still, not the whole of the EU.

But it does show how an all-reaching law like gdpr can have stramge consequences…

isn't the crux of the matter the all-reaching laws of the US that allows their intelligence agencies to order EU-subsidiaries of US companies to offer up their data..?

I would be frankly shocked if EU countries did not have the same laws on the book. If German court serves Volkswagen AG a warrant for data kept by Volkswagen America, can Volkswagen AG just not comply?

A German court can not, in fact, serve a court order to Volkswagen America. (Technically it can, but the order is not enforceable.) A German court is also forbidden to force Volkswagen AG to reach into Volkswagen America because these are separate legal entities.

A German court would use judicial assistance and ask US law enforcement to help. US law enforcement would then adhere to local laws and protect the rights of US citizens while trying to help.

This is named Mutual legal assistance: https://en.wikipedia.org/wiki/Mutual_legal_assistance_treaty .

Pretty sure EU countries cannot in fact (in general) demand personal data of anyone from EU companies without due process. If you can find law to the contrary, let me know.

The warrant is due process.

The procedure and requirements for obtaining a warrant under the CLOUD Act is not sufficient due process according to EU law - which is law which matters when operating a commercial business in the EU.

Sure, and US can pass a law saying that safety regulations of Airbus planes made in France are not sufficient either. Americans just don’t like flying in unsafe planes!

If you talk to actual people in Europe, outside of HN, you’ll find that overwhelming majority of people do not give a flying fuck about the “safety of their data” from US government. They just blissfully post shit on Facebook with no care in the world. This matter is a concern mostly to politicians and to activist hacker types.

This is not to say that this is not a valid concern to have, but I’d like people to spare me pretending that it’s about politicians caring about people’s rights, when just past few years they trampled all the rights in the interest of fighting coronavirus (and if you want to argue that it was all worth it, because the goal justified the means, keep in mind that the US government can say the exact same thing about its data access!). This is just standard power politics, a protectionist trade war whitewashed with talk about “rights” and “privacy”, only surprising thing is how people on HN are gobbling it up. I guess maybe that’s just willful ignorance - by pretending you don’t understand why EU actually attacks American companies like that, you might actually get some extra privacy protections you care about.

> Sure, and US can pass a law saying that safety regulations of Airbus planes made in France are not sufficient either. Americans just don’t like flying in unsafe planes!

That would be rather awkard for Boeing, who would have to strip out half the engines on its 787s and all its 737-MAXes for being certified by the same "insufficient" safety standards.

> Sure, and US can pass a law saying that safety regulations of Airbus planes made in France are not sufficient either. Americans just don’t like flying in unsafe planes!

If you cannot see the difference between this and the GDPR, I have no idea why we're talking. The GDPR is some pretty reasonable law, for the most part - if we had carve-outs for Americans who don't have to adhere to it, it would be entirely pointless.

The US is very welcome to end this by repealing their spy law.

Actually, it would be worse than pointless - it would advantage american firms over local ones, since only the local ones would have to obey the privacy laws, thereby allowing US ones to undercut local firms with funds obtained from selling user data.

The US specifically passed the law to bypass due process.

If you think a warrant should apply from an outside jurisdiction imagine Mississippi issuing a warrant to arrest a Californian abortion doctor.

They can fight in an american court. The issue is the cloud act which was passed explicitly to fight eu companies fighting in eu courts us govt data requests.

The crux is that in most cases the EU subsidiaries are not even set up to prevent that. They just roll over. Someone else tracked down the AWS GDPR compliance document the court case cites a few times, any governmental agency can request data transfers out of the EU. The document isn't even specific on which government and as far as I understand the North Korean government could request all EU users data and AWS would provide a download link without even thinking twice.

Doesn't seem strange to me; I'm surprised it got to court.

They're taking a hard stance on the on-selling of user data. Since they can't influence Washington to do the same, do they have any other option?

Given American companies have been, to put it most graciously, cavalier, with user data, and that we at the beginning of a revolution where user tracking in retail spaces becomes ubiquitous, is it fair to characterize this move as a profit-oriented one primarily?

I think it is more about the US flaunting in everybodies else face once too often that humans are not equal and that even when it comes to very basic rights, there is the US- and the other-human.

If you cared about your fellow citizens, you could have the same. But judging by the hordes of mentally ill people wandering aimlessly around your cities harassing strangers (including visitors such as myself)—you don't.

If you don't like it then take your business elsewhere.

FWIW I live in Europe now and am enjoying it XD, but I still call a spade a spade.

I just hope Germany pulls its head of its ass before it supports China's ascension to global supremacy. We told them not to overly rely on Russian gas for like 40 years but ¯\_(ツ)_/¯

I'm sure. It's really a lovely place full of lovely people. And the standard of living is still relatively high. They are their own worst enemies sadly.