The price differential between buying the hw/sw & staffing a professional (or team of professionals) to curate and maintain it 24/7/365, or simply off-loading it all to an outside party, could be huge -- I'd dare say huge enough to make or break a company. From an executive POV, why care about data safety, when hosting it yourself makes your business model non-viable?

I realize there are lots of problems with this line of thinking, and I'm not advocating it at all, but I'm willing to bet this has been the case for some.

Building a government you can trust will take several generations, with each generation providing hundreds of thousands ENTIRE LIVES to the cause. It might be efficient in the grand scheme of things, but from an individual or even corporative point of view, it's terribly inefficient in any timeframe you might consider.

They use custom Apple/Mac software for all their POS equipment. You know how many people run an IT department that is charge of that much equipment, people, inventory and software?

TWO.

Scale that up to five thousand seats. Five thousand seats is big? Not really.

Every day a piece of hardware dies. Every month someone rolls out a new software package. There are many different user profiles, accounting, sales, warehouse, IT, marketing, executive. Then there's that one guy that needs that program that only runs on XP SP1....

Every IT department has to justify its cost per user. Once you get above 1K seats, a lot of things that seem like overkill start to make sense really quickly.

All Amazon is offering is a managed version of what larger companies have been doing internally for years. Just like their server business, it seems expensive until you actually work out how much it would cost to do it yourself.

Because they offer better security than I can build in to my own home (at least not without significant effort) and they offer guarantees should my money go missing under many (but not all) circumstances (for example, the savings guarantee if a UK bank goes bust).

Do cloud providers offer the same? The guarantees may vary dependent upon service contracts (uptime, backups etc), but the idea that their data-centre was better secured than my company server-room was supposedly a given (at least for most small to medium organisations).

EDIT: added qualification to last sentence

The insurance is just an incentive to keep my stuff safe (and in the case of savings guarantees, an incentive to keep consumer-facing banks from going bust).

If you have a secret, why would you even store on the Internet? If you are worrying about conversations with your friends, that kind of privacy, don't log it. If you can't trust Google/Skype, you have to find your own solution.

For me, I got a lot of cat photos and I don't know what NSA could do with my cat photos.

There is also a Safe Harbor scheme that is intended to overcome this problem so working with US businesses is still possible if they provide additional safeguards. However, it's now clear that no business operating in the United States can actually offer the required guarantees, no matter how sincerely they might wish to. It is therefore unclear whether a European business relying on Safe Harbor to cover its rear would actually have much of a case in court if one of its customers were actually damaged as a result.

I've seen a lot of businesses at least considering pulling out of US services, cloud or otherwise, for this reason in recent months. Some are sticking with it, on the grounds that there is safety in numbers: no government regulator really wants to damage global trade by making examples of businesses who are just trying to do their work and acting in good faith, and if you're dealing with a similarly honest business from the US then the odds of an actual customer complaint are probably low enough that it might be considered an acceptable business risk. Others seem to have lawyers who are more wary and fear the penalties of something like a mass leak across the pond that would come back to bite their clients back home.

In addition, some nations in Europe are a lot more concerned about privacy both legally and culturally than the US, for obvious historical reasons if nothing else, and they may have stronger laws still.

Can you provide more data on that?

I'm 'only' a system administrator, but I'm working for a company that is doing business in the both US and UK.

Real Soon now we're going to be standing up a stack in the UK .. but I'd like to know what safeguards I can't guarantee so when I'm dealing with _two_ data sets and _two_ code bases and squared complexity I know _why_.

It will help at 3 a.m.

I don't know anything special that hasn't been all over the news anyway.

Basically, the US government seems to be actively trying to compromise data held by US businesses on non-US citizens. That same US government has made it clear in public statements from the highest levels that they don't consider foreigners to have any privacy rights at all that should prevent this.

Given that this all happens in secret, any promise made by any business operating in the US that they will safeguard personal data of non-US citizens to the standards required by European law is now known to be worthless, even if it was made with complete sincerity.

This is now common knowledge, and anyone controlling personal data in Europe would have to take it into consideration when applying the general data protection principles. In other words, any legal cover afforded by the Safe Harbor scheme may not be worth anything any more. (In case your question was intended to be about the Safe Harbor programme itself: This was created so that US businesses can be used to process personal data from Europe, as long as the US business promises to uphold similar data protection standards to those required by law of European businesses.)

So the bottom line is that as a European business, if you don't have adequate disclosure when you collect any personal information that basically says it might be exported to somewhere without any safeguards on how it's used, and you don't get prior informed consent from everyone whose personal data you are dealing with, you might be on the hook legally for regulatory non-compliance as well as for any actual damages that result from any breach. Whether it's possible to give prior informed consent to a carte blanche handling of the data is itself debatable.

(Just to be clear, my comments in this thread are based on the perception of the current situation as I have encountered it anecdotally in a few cases. Some of the people I've spoken with may have taken legal advice, but what I've described here is not based on formal legal advice I or any of my own companies have received. Please consider these notes as food for thought only and for goodness' sake don't rely on them instead of taking proper advice if these kinds of issues might actually affect you.)

Understood.

Also, thank you very much.

It's hard to know exactly what the US law is too because it's classified. I would not trust that any country is safe from snooping--always assume it will happen.

That was what led the initial opposition to the Patriot Act, FISA Amendments, etc. was that they would make NSA programs like the ones that have hit the news substantially (if not completely) legal. That's apparently not what Sensenbrenner had intended when he drafted Patriot Act, but it was exactly this kind of issue that was raised at the time by privacy groups and promptly ignored by policymakers.

US law is very tied to court precedents, so a secret court with secret precedents is "secret law".

http://www.nytimes.com/2013/07/07/us/in-secret-court-vastly-...

> In more than a dozen classified rulings, the nation’s surveillance court has created a secret body of law giving the National Security Agency the power to amass vast collections of data on Americans while pursuing not only terrorism suspects, but also people possibly involved in nuclear proliferation, espionage and cyberattacks, officials say.

> But since major changes in legislation and greater judicial oversight of intelligence operations were instituted six years ago, it has quietly become almost a parallel Supreme Court

> “We’ve seen a growing body of law from the court,” a former intelligence official said. “What you have is a common law that develops where the court is issuing orders involving particular types of surveillance, particular types of targets.”

Etc etc.

The safe and conservative option is to assume that the executive is doing literally anything permitted by the public law without the aid of 'activist judges' (as the GOP would say) on your side of the argument. This is exactly why it is so important to be judicious in crafting legislation, as the judges will operate by what's in the written law not contrary to the Constitution when the law is clear. They only start worrying about "what the legislators meant" when the law is fuzzy.

That's also why it is important to quickly get a legal framework around foreign surveillance that includes recognition of the fact that the Internet is global while the Fourth Amendment is domestic. MUSCULAR is a pretty shocking breach of what we all understand the Fourth Amendment to mean, but I guarantee that it's technically legal. It shouldn't be, but the Fourth Amendment has long been known to effectively not apply at all outside of CONUS.

EDIT: well, I guess I'm sorta wrong. The whole thing looks complicated. Making sure you don't violate German data protection laws is confusing [0][1].

[0] http://www.thomashelbing.com/en/analysis-data-protection-aut...

[1] http://blogs.computerworlduk.com/cloud-vision/2012/04/cloud-...

The Safe Harbour program is a weak attempt at saving face: as long as the Patriot Act exists, no US-based company will ever be able to comply with EU privacy laws as they stand. Being "compliant with Safe Harbour provisions" only means that they're making promises they won't be able to keep.

Legally it's not allowed, but you have to have ten lawyers backing you to make people in your company believe you that Office 365 and other SAAS Software isn't legally usable... Google Apps for Business, ZenDesk... We've just faced this situation with a customer who we've shown several lawyer inquiries we've sent about this topic and he flatout replied: "Well i guess your lawyers aren't very good then."

Those guys pitched at the Pioneers Festival in Vienna two weeks ago, and there's really something to the idea of a private, plug- and play box in your office which hosts something like a cloud. They are from Germany, too. It's too expensive for our uses, though.

So actually just another us-too product from big corp. Next Google news in 3, 2, 1....

I am looking forward to see more of those initiatives. This growing distance between one and ones data is a dangerous path anyways, see also the rise of appliances and the decline of full access pc. it takes responsibilty away and media competence.