Data security in USA

[Andrew_C]

Avoiding the politics of what is happening in the US at the moment; is anyone getting the heebee-gebbies about the risk of processing / storage where Musk's teams can steam in and download everything and anything they like?

[Chris_Cook]

I think they are about to get a lesson in why we have data protection laws.

[dmj]

This is the argument the EU was having with Microsoft, and all those 'bans' on 0365 a couple of years ago - because MS couldn't guarantee they processed the data legally. Essentially because they also have to abide by US law too.

 

https://www.edps.europa.eu/system/files/2024-03/24-03-08-edps-investigation-ec-microsoft365_en.pdf

[pete]

On top of the Musk problem.....

 

The bipartisan oversight committee that's part of the requirements for the EU-US data sharing (and the UK-US data bridge agreement, as it builds off the EU-US one) is no longer bipartisan as of 23rd Jan.

 

There's ~30 days or so until that becomes a "OK, you all need to setup model contracts with Microsoft, Google, etc" problem that the EU has to take notice of.

 

To invoke a Lion King trope, it depends whether Scar is aware of the risk of being eaten alive by the tech hyenas (MS, Google, Meta, Amazon) should he let that happen.

[sigma]

Also consider what might happen to icloud storage "in the UK"

[mikes]

Didn't a great part of "celebgate" where intimate photos of celebrities got leaked, happened because some technicians who worked at Apple accessed these celebrities accounts and took the images (that the celeb in question had no idea was being auto backed up to the cloud) ? I know some were phishing victims / password reset victims (i.e. using public data such as their middle name as reset password questions) - but I am sure I read internal tech support people at Apple in one of their outsourced depts had full access to the icloud storage and stole the intimate data, and they were trading it internally for years before someone decided to sell it (which upset another user who leaked it for free to stop the other guy profiting)

 

Now with the politics going on in the USA - at the moment our o365 data is being held either in the UK or the EU (can't remember but it complies with GDPR) - but who knows what might happen, Trump and Elon might decide all this data law is a waste of time and things could change next week. Almost makes me think maybe running our own mailserver wasn't such a bad thing after all (actually it was a mare with all the attacks and running your own spamfilter etc)

[PotNoodleTech]

Basically if your data is in the US then you have no data security.

[dmj]

 

Now with the politics going on in the USA - at the moment our o365 data is being held either in the UK or the EU (can't remember but it complies with GDPR)

 

It doesn't comply with GDPR due to the points given in the investigation

But anyway it's moot because nobody cares and nobody is enforcing it.

[mikes]

It doesn't comply with GDPR due to the points given in the investigation

But anyway it's moot because nobody cares and nobody is enforcing it.

 

actually I think I read about this in Slashdot but for a US centric audience - even though they said they were hosting e.g. medical data on servers in the USA, it turned out they were hosting it in India and in Eastern Europe. Thanks for the PDF will have a scan through it - do you know of anything similar with Google as I haven't heard anything on Slashdot or El Reg about Google doing something similar?

[jthompson]

In Google Workspace, I have Region for storing data at rest set to Europe. To what extent does that solve this hypothetical?

[dmj]

https://berthub.eu/articles/posts/you-can-no-longer-base-your-government-and-society-on-us-clouds/

It is no longer safe to move our governments and societies to US clouds

Edited February 23, 2025 by dmj