Microsoft says it can't promise data sovereignty for EU firms
  • OutlierBlue@lemmy.caEnglish
    72·
    27 days ago

    Anyone wonder where your country’s health records about all their citizens are stored? I’m guessing it’s all on either MS, AWS, or Google. That means Trump could get access to your medical history.

    This is important because of his attacks on LGBTQ people, vaccines, abortion, autism, and who knows what other nonsense he wants to persecute.

    And here in Canada the Liberal government is putting forth bill C-2, which opens up even more access to the US to get even records stored in Canada by Canadian companies.

    https://www.eff.org/deeplinks/2025/07/canadas-bill-c-2-opens-floodgates-us-surveillance

    Feel safe yet?

    • lemonskate@lemmy.worldEnglish
      9·
      27 days ago

      Only if they aren’t using customer provided encryption keys (is using blob/bucket storage) or an equivalent approach to encryption at rest, and make sure they’re doing standard TLS for encryption in flight.

      It’s absolutely possible, and standard for any decent organization, to build their cloud architectures to fully account for the cloud provider potentially accessing your data without authorization. I’ve personally had such design conversations multiple times.

      • cley_faye@lemmy.worldEnglish
        3·
        27 days ago

        It is possible to do things correctly. The question is, is it done often, and is it done on hardware you can trust. I’m somewhat confident if I run my services on bare metal, the provider would have a hard time getting my encryption keys, although it’s not impossible even in this situation. How many people do so with VPS and managed instances, where snooping around the runtime and exfiltrating data unbeknownst to the user is trivial?

        Also, beyond that, how many fall for the convenience of things like SSE, whether it’s with customer provided keys or not? That should be a red flag, but people find it oh so convenient.

        We’re bound to see stuff bubble out where “we did all the right things” boils down to clicking a checkbox in some web UI and be done with it in the future.

    • smiletolerantly@awful.systemsEnglish
      7·
      27 days ago

      In the case of Germany: confidential computing tech ensures all data is encrypted in storage and in memory, shielded even against data center employees / hosting providers. I imagine that’s become the standard for most countries.

      • cley_faye@lemmy.worldEnglish
        51·
        27 days ago

        Hmm. Policies might say so. Not every business follow policies, whether they are their own or imposed ones, though. Business going all “it’s ok, our provider have the correct certifications for data handling” are definitely a thing.

        • smiletolerantly@awful.systemsEnglish
          1·
          27 days ago

          Again for Germany, it’s handled by a single provider, and they absolutely do utilize CoCo tech. (Source: I work at one of the involved companies, sorry, not going to be more specific)

        • boonhet@sopuli.xyzEnglish
          1·
          27 days ago

          Most EU countries are single payer healthcare. Businesses develop the software, but it’s vetted by a government entity before acceptance.

  • MisterFrog@lemmy.worldEnglish
    6·
    26 days ago

    It’s SO funny how apparently for almost 20 years we (as in the west outside the USA) decided that using Chinese cloud platforms or networking hardware was dangerous and to be avoided, but private US companies? Nothing to see here!

    Silver lining of the orange man is that maybe countries will wake up and smell the digital sovereignty that we sorely lack.

  • TomMasz@piefed.socialEnglish
    173·
    27 days ago

    There’s no telling if that hasn’t already happened. Europe needs to drop Microsoft ASAP.

  • emax_gomax@lemmy.worldEnglish
    321·
    27 days ago

    I thought gdpr forced companies to store data securely in the eu. Are they saying they’ll transfer that data to the us to give Trump access, cause that’s a gdpr violation and should result in fines and eventual removal from the eu market.

    • cley_faye@lemmy.worldEnglish
      3·
      27 days ago

      There are provisions. I don’t remember the exact name of it, but basically, the US says “yah, these business are legit ok, you see?” and the EU is like “oh, ok, deal”. This includes the big providers and a handful of others, obviously.

      And yes, it is a farce.

    • Auli@lemmy.caEnglish
      1·
      26 days ago

      It’s still on their servers. They just give government access to data.

    • Noxy@pawb.socialEnglish
      11·
      27 days ago

      The first sentence and the first paragraph of the article:

      even if that data is stored overseas

  • ArmchairAce1944@discuss.onlineEnglish
    21·
    26 days ago

    I have been saying this for more than a decade. Shit like this is why privacy laws and stuff regarding warrants and other stuff need to be expanded to private entities as much, if not more so, than government agencies. In the past the idea of a company having that much access to people’s information was unthinkable, and in almost everyone’s mind it was governments we needed to be worried about.

    But that hasn’t been true since the 90s at least with credit cards being used for most stuff and internet purchases being the norm for almost everything.

    Governments in the past needed something to ask for permission to look into you… but companies never did, and since the only thing governments need to do is either buy it or ask nicely it makes many protections kinda moot. The fact that many countries want a strict surveillance state over everyone means even the classic protections we had for a brief while are disappearing, too.

    If there ever is a 2nd enlightenment with protections for people it needs to make the stuff written in the 18th and 19th century look like children’s toys in comparison.

    If you say ‘but what about terrorism and bad people?’ Look around you. They still exist and still rarely get caught unless they fuck up badly. Most of the time it still due to informants and people talking to authorities. In the US the murder rate resolution is only 50% (and that is just arrested and charged, not convicted) and this is because there is a massive distrust of the police. In other countries people are more likely to assist the police and/or they take their jobs far more seriously in terms of forensics… and on top of that they usually have a far lower murder rate which allows more time and resources to be funneled into solving major crimes.

    Better to let 100 guilty men go than 1 innocent person convicted is the usual motto, but they don’t believe that in practice. In reality they are very much kill them all and let God sort out his own. And we can’t keep allowing that shit to happen.

  • Njos2SQEZtPVRhH@piefed.socialEnglish
    21·
    26 days ago

    If the EU doesn’t combine forces to get out of this tech-dependency, than what do we have the EU for? I am a big fan the EU, it’s doing many things for us already, but I’m really hoping we can work our way out of this together, and I hope we choose the FOSS-route so that we significantly help the world forward

    • raspberriesareyummy@lemmy.worldEnglish
      6·
      26 days ago

      I think our problem is a mix of corruption and tech illiteracy in the European parliament. People are either too deep in the pockets of silicon valley, or they are lazy fucks who don’t understand anything about computers and are unwilling to learn, so they keep believing “Windows is easier”.

  • pfizer_dose@lemmy.worldEnglish
    3·
    27 days ago

    And I’m assuming anywhere else that microsoft operates (the entire world) would be the same too, no? I don’t know why this rhetoric would be specific to the EU.

    • octopus_ink@slrpnk.netOPEnglish
      92·
      27 days ago

      I’m guessing the admits part and of course Trump is the current (quite jutified) bogeyman.

      • uranibaba@lemmy.worldEnglish
        2·
        27 days ago

        Didn’t Microsoft say not too long ago not to worry, because they didn’t have to give access to data?

      • x00z@lemmy.worldEnglish
        4·
        27 days ago

        Continuing to do business in the US after the CLOUD act already implied enough.

  • flop_leash_973@lemmy.worldEnglish
    4·
    26 days ago

    Then those EU firms should immediately make getting out of anything and everything Microsoft a top priority. As a US citizen, all our government and companies understand is personal profit and personal data hording. So make it hurt where they will feel it.