New Twist in International Relations: Corporate Keep-My-Data-Out-of-U.S. Clause

Re:New Twist in International Relations: Corporate Keep-My-D... by michaelt on Friday December 27, 2013 @02:19PM (#6972135)

Even if your servers are patched, firewalled etc and you encrypt all traffic travelling between data centres, if the data is decrypted on your internal network for processing or use you're vulnerable to "host is subpoenaed by the NSA", "black box installed on network by NSA" and "insiders work with NSA out of patriotism" which non-US suppliers may protect you from. Even if you self-host and have no employees, it's difficult to stop a legal subpoena from the NSA for your SSL private key except by making sure you and it never enter the US courts' jurisdiction.

Of course, you're still vulnerable to hacking, physical intrusion, and blackmail or bribery of insiders by the NSA. And whatever the local equivalent of the NSA is. And secretive international agreements.

[ Parent | on HN ]

Re:New Twist in International Relations: Corporate Keep-My-D... by SideburnsOfDoom on Saturday December 28, 2013 @02:02AM (#6974266)

> In the USA ... you're vulnerable to "host is subpoenaed by the NSA", "black box installed on network by NSA" and "insiders work with NSA out of patriotism"

Yep. That's what I mean by "tap into "destination" data centres in the US". e.g. what was going to happen to Lavabit.

I'm not sure why people are having difficulty grasping the whole concept of "US legal power is much lessened outside of the USA". (see also here https://news.ycombinator.com/item?id=6944880 )

> Of course, you're still vulnerable to hacking, physical intrusion, and blackmail or bribery of insiders by the NSA

Yes, or by any other rogue actor. But any government that does that on a mass scale on notionally "friendly" territory is playing a dangerous game if and when they get found out.

[ Parent | on HN ]