Nonsense. If they're even talking about keeping data out of the US, they are probably non-US citizens. Under NSA law (the parts that have been publicly leaked), NSA feels perfectly free to seize their data when it is stored in the US, or makes transit into or through the US. A non-American sending their data into the US does not thereby protect it from US spies. (Really, that's common sense). The only data that is maybe safe is that of clearly-identified US citizens communicating with themselves in the US. These can still still be intercepted and stored, but the leaked secret laws say that the NSA does not allow its analysts to read it.
I'm definitely not saying it's a good situation we find ourselves in here, or that data is 'safe' anywhere. But I would want anyone to think very long and hard before moving servers outside the US and claiming that provides some sort of benefit, other than as a political statement... It actually sounds like you agree with that.
Maybe r/Worst possible/A dangerous/ would be better. But I do appreciate reading the opposing opinions.
You're mistaken. The NSA might have more legal space to hack into systems outside the US, but their main snooping appears to happen in (forced) cooperation with US companies.
So it's a pretty decent reaction.
Do you really think Cisco is going to reply: 'Nope can't do, this data is "on" Germany!'?, when the NSA spies on Merkel herself?
At least if US passes such laws, they know that instead of risking losing all of its foreign customers, Cisco would rather sue the US government next time, backed by those new laws. This is why this reaction is such a good thing. It's exactly what's supposed to happen to end forced backdoors by the NSA into products bought by foreigners.
Thing is, neither the Constitution nor the law was respected, as we've learned. So why should anybody have trust in some politician or President who declares a new law? For agencies like the CIA and the NSA, there is no law.
Also, in case you haven't paid attention the US government was hacking into one of the biggest US companies already - Google and Yahoo, while they had deals to get pre-encryption data with Microsoft and others.
Also, NSA themselves said all encrypted data is captured, regardless of where is coming from, "just to be sure".
You make a good point that encrypted data is retained longer by the NSA, and even domestic encrypted communication is kept without any nexus to an international person of interest or 50% confidence that at least one party is not a US citizen. But as we know well, the encryption is the absolute last thing which is going to fail or be broken independent of some other action.
NSA can fill their hard drives with all the cipher text they want. If that ciphertext ever somehow becomes valuable on its own -- for example, without getting a warrant for the key - then the crypto-apocalypse has arrived and the whole discussion about which data center the server runs in is completely pointless.
We haven't seen any Snowden leaks indicating NSA is walking into US data centers without a warrant and busting servers. On the other hand, their entire modus operandi is to do exactly that overseas. Wait, or is that the CIA... Generally speaking, if you have something they really want and it's on a US server, you get agents at the door with warrants. If you have something they really want and it's on a non-US server, they just hack or steal the damn server.
See my earlier reply about the Google packet sniffing, done only for data which left the US as far as we know. There would be a much stronger case that such packet interception was illegal and unconstitutional under current US law if it was happening to traffic running within US only WANs.
By the way, there's nothing you can do if the service provider decides to just accept the warrant and provide the data, regardless of where the server is colocated, which is why I think self-hosted SaaS is so important. You might not be able to stop them getting the data, but if it's on your server, you probably will know they have taken it, or otherwise you'll have a great case to argue in front of the Supreme Court (as in, an EFF pro bono spectacle, not necessarily that you will prevail).
The people that put these surveillance systems in place don't give two fucks about the economic impact, and the people that do consider the economic impact aren't invited to the meetings.
tl;dr People should be really screaming mad angry about what the US government is doing, but foot shooting is perhaps exactly the response they are looking for.
Let's not fool ourselves here, we might be friends we're not family though. I'd rather 'trust' an EU company with my data than a US one.
Hopefully that economic punishment might be enough to wake up your high ups, but if not it's still good for us.
We can't let you have all the fun in one place.
It seems to me that the NSA finds it a lot harder to get at data that never enters the US at all.
I have doubts about sending data to the US in any way - I work for a European tech company, and some co-workers want us to use private repos on GitHub for our source control. I am personally against this simply because it sends important data into the US. That kind of thing should be kept on-site.
Could you please explain why you think that?
> That kind of thing should be kept on-site.
I could not agree more.
This may be naive, and if it is please elaborate; but as the NSA is a branch of the USA's government, it has legal power over companies in the USA and over infrastructure in the USA. Their legal writ does not hold in Germany for instance. I'm interested in seeing how this whole "broke German law on German soil" thing plays out: http://www.cbc.ca/news/world/nsa-s-alleged-spying-on-merkel-...
The NSA's methods of surveiling the internet seems to have been to tap into "destination" data centres in the USA, and to tap into all passing traffic as it crosses US borders. If internet traffic passes through neither of those checkpoints (e.g. originates in Leipzig, goes to a server in Berlin) then the NSA will find it a lot harder to tap it. Not impossible, but a lot harder to do it and lot harder to make a convincing legal justification.
This leaves aside the impact of the sharing agreements between the "five eyes", that basically the UK et al are doing the same thing as the NSA here.
The second problem is of "American" companies which operate worldwide. Even if the server is in Berlin, no doubt the US government will lean on the US parent company, if there is one. Which is why we're seeing stories like this one.
Of course, you're still vulnerable to hacking, physical intrusion, and blackmail or bribery of insiders by the NSA. And whatever the local equivalent of the NSA is. And secretive international agreements.
Yep. That's what I mean by "tap into "destination" data centres in the US". e.g. what was going to happen to Lavabit.
I'm not sure why people are having difficulty grasping the whole concept of "US legal power is much lessened outside of the USA". (see also here https://news.ycombinator.com/item?id=6944880 )
> Of course, you're still vulnerable to hacking, physical intrusion, and blackmail or bribery of insiders by the NSA
Yes, or by any other rogue actor. But any government that does that on a mass scale on notionally "friendly" territory is playing a dangerous game if and when they get found out.
But your point, of course, stands. Maybe avoid sending the data to the US and in addition punishing providing access to the NSA as treason? (I know. Won't happen.)
The equivalent in the US requires a warrant, and it would be the FBI not the NSA. For example an NSL or warrant with a gag order similar to what Lavabit saw. These warrants at least give the provider the option to shutdown. Also see similar situation to PrivateSky (UK-based). The fact that these cases are news, and even moving through the courts on appeal, is a Good Thing (TM).
This is a significantly different attack model than NSA hacking your network and picking data off your internal pipes (like what happened to Google), Firewire/Thunderbolt ports (commercial off-the-shelf products sold to law enforcement do this through DMA access granted by Firewire/Thunderbolt), or hell, even stealing keys through the ground potential of your chassis . Those techniques, sans warrant, are claimed to be "legal" only because they happen overseas.
If you think the NSA doesn't have access to all your traffic just because you're in Germany, I'm saying, IMO the NSA has better access to your traffic, indeed all your gear, because it's in Germany.
> For international customers it is rather pointless to talk about data that never leaves the US. If this is a bad reaction, then what is a meaningful reaction?
This is a great point. I think the most meaningful reaction would be an increase in self-hosted SaaS models which are open source but not MIT/GPL as in, auditable but not free. Continuing the evolution of systems like Docker, and maybe even to an extent things like node-webkit, you might get to a future where grandma can single-click self-host all the apps she needs on any OS she happens to be running.
I'm so disappointed that such approaches are assumed to be doomed. You can't convince the CEO that people won't just comment out the license check rather than pay the license. I know GPL is supposed to provide "freedom" to the user, but I don't think there's anything inherently wrong with providing access to the source while still legally requiring a end-user or commercial license, and not just in the form of a support contract. In fact, I really wish more companies would try this, because I think it would ultimately be very successful and if it can jump the shark as an acceptable approach, it would benefit the entire industry. I plan on trying it myself with a few products, and I'll definitely report my progress.
In short, we need to increase investment in designing, deploying, and maintaining secure systems and architectures, combined with demanding real end-user ownership and control over your own data, which means self-hosting the service and open source. In my opinion, moving the server to international data centers doesn't provide any demonstrable value, and I believe just makes matters worse.
Data outside the US is the easiest for the NSA to access. It's only data that never leaves the US which in theory you can argue is subject to warrants.
Of course, since it's so easy to redirect your traffic outside the US using BGP, it's not really a defense no matter where you are storing your data, but the clause is certainly pointless.