|
I need a bit of hive mind help. I'm working on a proposal and one of the client requirements is that they accept the hosted solution but the data must be kept within the confines of the EU. Specifically the data must not be held anywhere under US jurisdiction.
Now, we intend to use Amazon EC2 services in eu-west region. Now, I know logically this is referencing the Irish data centre, but can we be sure that it will be physically there? The client wants some sort of assurance from us and short of getting into a slinging match with Amazon support, I hoped someone here might have a definitive answer.
veni bibi saltavi
|
|
|
|
|
Nagy Vilmos wrote: they accept the hosted solution but the data must be kept within the confines of the EU. Specifically the data must not be held anywhere under US jurisdiction.
By default, no matter where the data is held, because Amazon is a corporate entity with its head office in the USA, the data is in US jurisdiction. That's the practical effect of the Patriot Act, and is one of the biggest bones of contention. You can have Amazon based in Dublin and hosting data in Germany, for instance, but if the US government invokes the Patriot Act for details about a person/entity, Amazon have to supply information from that subentity.
This space for rent
|
|
|
|
|
That may be an embugerement, but thanks anyway. I will have to discuss this with daboss.
veni bibi saltavi
|
|
|
|
|
Nagy Vilmos wrote: embugerement
or rather: emelephantment!
... such stuff as dreams are made on
|
|
|
|
|
That jurisdiction because of headquarters has not survived court challenges. And, the one test case has been challenged so far, by Microsoft. They pointed out the risks if it were to apply in reverse.
I've been staying away from US-headquartered firms because of this, regardless.
|
|
|
|
|
Pete O'Hanlon states:
"By default, no matter where the data is held, because Amazon is a corporate entity with its head office in the USA, the data is in US jurisdiction. That's the practical effect of the Patriot Act, and is one of the biggest bones of contention. You can have Amazon based in Dublin and hosting data in Germany, for instance, but if the US government invokes the Patriot Act for details about a person/entity, Amazon have to supply information from that subentity."
However;
Didn't Microsoft just win a lawsuit against the US Government that said they did not have to disclose details of emails stored on their Dublin servers? Admittedly they were trying to use the 'Stored Communication Act' and not the Patriot Act (not sure if the former is part of the latter) I'm no lawyer but doesn't that set a precedent that could be successfully used to prevent access to the Amazon data?
|
|
|
|
|
Patriot Act superseded the Stored Communication Act as the SCA is an earlier, "weaker", set of legislation.
This space for rent
|
|
|
|
|
Irish data centre in the confides of EU. Lucky there's no Brexit to worry about.. Oh wait
|
|
|
|
|
It's a European firm, so Irish or German makes no difference. UK hosting might be a problemette 
veni bibi saltavi
|
|
|
|
|
There is no definitive answer, as at the end lawyers are involved...
However - according to Amazon:
Quote: Q: Where is my data stored?
A: You specify a region when you create your Amazon S3 bucket. Within that region, your objects are redundantly stored on multiple devices across multiple facilities. Please refer to Regional Products and Services for details of Amazon S3 service availability by region.
Q: How do I decide which region to store my data in?
A: There are several factors to consider based on your specific application. You may want to store your data in a region that…
...is near to your customers, your data centers, or your other AWS resources in order to reduce data access latencies.
...is remote from your other operations for geographic redundancy and disaster recovery purposes.
...enables you to address specific legal and regulatory requirements.
...allows you to reduce storage costs. You can choose a lower priced region to save money. For S3 pricing information, please visit the S3 pricing page.
Skipper: We'll fix it.
Alex: Fix it? How you gonna fix this?
Skipper: Grit, spit and a whole lotta duct tape.
|
|
|
|
|
I guess in light of POH's comment you are going to be looking for a purely EU hosting organisation with absolutely no ties to the US, good luck with that.
Never underestimate the power of human stupidity
RAH
|
|
|
|
|
Maybe this links answers your question: EU Data Protection - Amazon Web Services (AWS)[^]:
Quote: Customers can replicate and back up content in more than one Region, but AWS does not move customer content outside of the customer’s chosen Region(s), except to provide services as requested by customers or comply with applicable law.
|
|
|
|
|
How much data are we talking about? I could probably store it at the back of my garage for you now I've had a clear out.
Some men are born mediocre, some men achieve mediocrity, and some men have mediocrity thrust upon them.
|
|
|
|
|
It sounds like it may only be a couple of boxes, but you know what it's like - you agree to a kilo and get a ton.
veni bibi saltavi
|
|
|
|
|
As an american company Amazon is subject to FISA Court warrants. Unlike the public cases (Microsoft and Ireland) FISA warrants are secret and carry gag orders. If there's a way to get to the data from a US location then it doesn't matter where the disks drives reside. amazon cna be compelled, in secret, to deliver whatever the Court wants. And being a FISA warrant, you don't even know the data has been seized.
Just to make it more interesting, the FISA court almost never turns down a warrant request from US security agancies. Don't count on checks or balances, but if you wan't any asurances from the US you have to "pay to play", which involves donations to special foundations and speaking contracts in the multi-millions USD.
Your data would be safer in Russia. At least there you can just pay off a few people to leave you alone. It's a lot cheaper.
|
|
|
|
|
It's not just the EU that likes to keep its data close. Many countries try to place similar constraints on software houses. This means cloud hosting must be based in the country that owns the data. Seems sensible but it really cramps our style.
We're philosophical about power outages here. A.C. come, A.C. go.
|
|
|
|
|
I'd look for a non US company. A quick search got me this link in Quora where they discuss the best non-US cloud providers:
[^]
Cheers 
|
|
|
|
|
Can you dodge the issue of finding a full service host and use something like iSCSI to access data off stores owned and managed by the client? Yeah, performance is going to suck, and security is a concern, but maybe the design can mitigate them enough to make it work.
We can program with only 1's, but if all you've got are zeros, you've got nothing.
|
|
|
|
|
No, I'm not looking for validation or someone going "no Pete, you're clever". That's not what this post is about. Whenever I look at topics around quantum theory, I realise just how little I actually know - it's a humbling but liberating feeling, knowing that there's much more to learn. So, today's bit of quantum wizadry... quantum entanglement gives rise to wormholes[^]. Check out the explanation of gravity as an effect of entanglement.
This space for rent
|
|
|
|
|
Not just you either: in a Sixth Form Physics lecture (not part of the syllabus, but QM was the teacher's special interest) we had an hour long lecture on "the effective mass of a hole*" which I still don't understand!
* "hole" - i.e. somewhere that an electron wasn't.
Bad command or file name. Bad, bad command! Sit! Stay! Staaaay...
|
|
|
|
|
If this was the SB I'd reference around 140kg on a Friday night in Cardiff but, as we are in the Lounge, I'll refrain from the comment.
veni bibi saltavi
|
|
|
|
|
And I'm so glad you refrained!
Bad command or file name. Bad, bad command! Sit! Stay! Staaaay...
|
|
|
|
|
I believe this should explain everything more clearly
Pterry. Equal Rites: “Cutangle: While I'm still confused and uncertain, it's on a much higher plane, d'you see, and at least I know I'm bewildered about the really fundamental and important facts of the universe.
Treatle: I hadn't looked at it like that, but you're absolutely right. He's really pushed back the boundaries of ignorance.
They both savoured the strange warm glow of being much more ignorant than ordinary people, who were only ignorant of ordinary things.”
Bold is my own for emphasis. 
veni bibi saltavi
|
|
|
|
|
Nagy Vilmos wrote: being much more ignorant than ordinary people
That made me think of this[^]! (SFW) 
Anything that is unrelated to elephants is irrelephant
Anonymous
-
The problem with quotes on the internet is that you can never tell if they're genuine
Winston Churchill, 1944
-
I'd just like a chance to prove that money can't make me happy.
Me, all the time
|
|
|
|
|
Please never again, even by mistake, associate anything by Pterrymayherestinpeaceandofflerlookoverhimforeternity with that sans-comic
veni bibi saltavi
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
