Well, for sure they can pressure them but I highly doubt Hetzner would break the law in Europe to satisfy the US government, they are a lot more to lose here than there. I realize that that is not proof.

I dont share your optimism: The US can just say: let us access this one customer or we will ruin your vpcs in the US.

What can you do about it? FDE? Can you keep the keys away from Hetzner? How much hacking would they need to do to get them? Can US government break SecureBoot?

Im just happy my business is not important enough

the alternative being hetzner giving away EU based information to the US? which would absolutely destroy their reputation in the EU. (which is a far larger market for them).

The only way to spin this as hetzner is to go public with this and make it a political point for geopolitics between the EU and the US, and take the loss /call the bluff on the US threat.

Let me tell you about that time when I walked around in a DC in NL and ran into an unaccompanied FBI liaison officer...

I don't think any of us have the total picture, but the bits that I do have are sufficient to worry me about the degree to which I am automatically breaking the NDAs I sign by using a computer, email, online data rooms and so on.

Hetzner US would have no power over Hetzner EU, that's the point. All they can do is beg their parent company the same way law enforcement could beg them directly.

Sorry I wasn't clear. I meant I would expect US government to approach Hetzner EU and say "nice Hetzner US business you got going over here, it would be a shame if got hit by a tax inspection. Businesses make tax mistakes all the time you know? We could make sure that doesn't happen if you help us with this law-breaking customer of yours"

> Take Hetzner as an example.

Similar happened already with OVH Canada vs France.

> In an affidavit, Xavier Barriere, corporate counsel at OVH in Paris, describes the dramatic situation: If the important proponent of European data sovereignty were to comply with the Canadian order, those responsible in France would be committing a criminal offense. They face up to six months in prison and fines of up to 90,000 euros per violation. However, if OVH ignores the Canadian court, it faces contempt of court proceedings in Ontario, which can also lead to severe sanctions.

https://www.heise.de/en/news/Canadian-Court-OVHcloud-from-Fr...

And one comment here: https://news.ycombinator.com/item?id=46060903

The relevant fact about Hetzner is that it's an EU company with US branch, not a US company with an EU branch.

No. Did you read the OVH story linked by user kvemkom? https://www.heise.de/en/news/Canadian-Court-OVHcloud-from-Fr...

A difference could be that Germany might not have such blocking law as France. At least I have never heard of it.

Canadian judges can rule whatever they want, it isn't going to make a difference in practice: if Canada or a Canadian entity wants data from an EU company they're going to have to go through the proper channels to do so. Taking shortcuts like this, even with the backing of a judge just isn't going to fly.

Yes. Canada only gets to affect the Canadian subsidiary of OVH. Otherwise they can't do a whole lot. Maybe they can do enough though - maybe they can seize the profits from the subsidiary going to the parent company, which the parent company would want to avoid. They have no direct control though.

If it had been the European one that was the subsidiary, then Canada could order the OVH parent company to order the subsidiary to do things.