This is why I still prefer Signal; this practice seems to be their modus operandi even though they, too, were affected by AWS us-east-1 catastrophe

> Not all countries have an equivalent to the USA CLOUD Act.

Not yet, anyway. Unfortunately, pretty much every country seems to be getting less and less open and free over time. Some are better than others, but it does feel like everyone is regrettably rowing in same direction.

How would this work in practice? If the empire wants to get at your data, why do you think it would shy away from pressuring a country so weak that it can't afford to enforce this on their companies?

Then the empire just says that they want the data or you won't be allowed to operate in the empire, which would be bad for profits and anger shareholders.

Nice theory, that even on US isn't really working nowadays.

What would stop them from doing that?

> If you don't have a spine, sure

I've never understood this take. A lot of people were saying this sort of thing when Proton Mail turned over some user data to authorities in Europe a while back.

If you're running a tech company and run afoul of the law in some or another jurisdiction, it doesn't matter how much spine you think you have. When a group of men with guns, i.e. the police, shows up at your door and gives you the option of turning over some customer data or spending the next 10 years of your life in a steel cage, I'm betting that practically no one is going to choose the cage, spine or not.

The only way to keep user data safe is to not collect it in the first place.

If the data center is operated by a "trusted subsidiary" as the article mentions and everyone in key roles is a French citizen with no connection to the US then there is no one to give a gag order.

In practice the US HQ could mandate a security update that secretly uploads all data to the US but that's a whole other can of worms that I don't think anyone is ready to open.

> This is exactly the system the US Congress accused TikTok of having set up.

"Every accusation is a confession" remains undefeated

Until this happened MS was still going around trying to convince lawyers to use their Cloud and telling them that there is no issue.

Including certain contractual "standard"(1) agreements which would make some of their higher management _personally_ liable for undue data access even under Cloud act from the US!!!

(1) As in standard agreements for providers which store lawyer data, including highly sensitive details about ongoing cases etc.

So you can't really trust MS anymore at all, even if personal liability (e.g. lying under oath) is at stack. And the max ceiling for the penalties for lying under oath seem less then what you can run into in the previous mentioned case...

You also have to look a bit closer at what it even means if "the french MS CEO swears they are complying" it means he doesn't know about non compliance and did tell his employees to comply and hired someone to verify it etc.

But the US doesn't need the French CEO to know, they just need to gain access to the French/EU server through US employees, which given that most of the infra software is written in the US and international admin teams for 24/7 support is really not that hard...

And even if you want to sue the French CEO after a breach/he (hypothetically) lied he would just say he didn't because he also was lied too leading to an endless goose chase and "upsi" by now the French CEO somehow is living in the US.

And that is if you ever learn about it happening, but thanks to the US having pretty bad gag orders/secret court stuff the chance for that is very low.

So from my POV it looks like MS has knowingly and systematically lying and deceiving customer, including such with highly sensitive data, and EU governments about how "safe" the data is even if it lead to personal legal liabilities of management.

And I mind to remember that AWS was giving similar guarantees they most most likely can't hold, but I'm not fully sure. Idk. about Google.

Oh and if you hope that the whole Sovereign Cloud things will help, it wont. It's a huge mage pretend theater moving millions over millions into the hands of US cloud providers while not providing a realistic solutions to the problem it is supposed to solve and neglecting local competition which actually could make a difference, smh.

> This make it less likely he's lying. It could be possible Microsoft France has a "rogue" employee system where a key person only obeys to Microsoft US orders rather than his French boss and French law. Then the boss can swear to the Senate that they're complying.

It's also possible that US employees had access to French servers without anyone in France knowing.

Less likely doesn't say much though. He may have simply weighed the chances of the French government ever finding out that he lied.

> It could be possible Microsoft France has a "rogue" employee system where a key person only obeys to Microsoft US orders rather than his French boss and French law.

I would think that is not just a possibility, but a certainty.

Yeaah! God forbid anyone trades with those whom the US targets. But the US sending 70% of the bombs Israel used to murder children is okay though...

Oh if that were only true. It's been made apparent in the last 2 years in particular that fighting antisemitism from the perspective of the ADL and figures like Jordana Cutler (who previously worked for the Israeli Prime Minister's Office) simply means silencing critcism of Israel, even when that means siding with actual antisemites (up to and including neo_nazis and outright Nazis). Examples:

- Ben Shapiro excuses antisemitic remarks by Ann Coulter because she's pro-Israel [1];

- ADL defends Elon Musk for making the Nazi salute (twice) on stage [2]

- We brutalized people with the police for organizing peaceful protests to say "maybe we shouldn't bomb children" or to get their respective universities to divest their endowments from the state doing the bombing;

- We went so far as trying to deport legal permanent residents for organizing said peaceful protests (ie Mahmoud Khalil); and

- The IHRA definition of antisemitism includes criticisms of the state of Israel.

[1]: https://x.com/benshapiro/status/644505141299671041

[2]: https://www.aljazeera.com/news/2025/1/22/adl-faces-backlash-...

Some of us remember Americans going ape shit over that Kirk guy lmao.

The separation is even in the URLs, all the locales are using paths, except the US, which lives under us.ovhcloud.com. All locales use a customer console hosted at ovh.com, except the US, which has it under us.ovhcloud.com.

You can't just spin up an LLC and call it a separate company. OVHCloud is still OVHCloud US' subsidiary company.

From the FAQ page I linked:

> In accordance with our Privacy Policy, OVHcloud will comply with lawful requests from public authorities. Under the CLOUD Act, that could include data stored outside of the United States. OVHcloud will consider the availability of legal mechanisms to quash or modify requests as permitted by the CLOUD Act.

I think we'll see a lot of companies moving away from public cloud providers in the future, but I don't think it'll be because of any privacy-related concerns.

It rarely makes economic sense to deploy workloads onto the public cloud unless you have critical uptime requirements or need massive elasticity.

FISA and the Stored Communications Act as modified by the CLOUD Act don't distinguish between (i) parent company overseas + US subsidiary and (ii) parent company in US + foreign subsidiary. In both instances the US asserts personal jurisdiction, extending to wherever the data is stored geographically.

They buy it because it's enough to tick the corporate compliance box. Decisions made by people that don't actually give a F

Well no, but Bezos, Zuckerberg and Tim Apple will come grovelling when they are called... that's all it takes.

If you do something that the EU doesn't like it's response will be relatively rational and proportional. While the US government is currently run by unpredictable and volatile people. So risk/reward wise it's rather obvious whose orders they will be following.

> the US can update it all remotely, including the hardware now thanks to things like intel ME

Let's not be excessively alarmist; AFAIK, the Intel ME is not (unless you're using things like vPro) exposed directly to the network, you need the cooperation of the operating system to reach the ME.

Of course, said operating system is usually Microsoft Windows, which can be updated remotely... (and even Linux users often use USA-based distributions).

> From Saas to authentication systems to OS to chips. The EU infra is entirely dependent on the US.

I would absolutely love to see the EU invest in developing processors and operating systems. It'd benefit us all to have real competition in those spaces, and it's the only way the EU can ever keep their data out of the hands of the US government.

I don't believe that's the case because the intelligence pooling is meant to remove cross-border friction. A general breakdown of western alliances would probably be required (and maybe that's where we're headed.)

"Plus" is key - Five Eyes Plus includes EU members France and Germany, at minimum. It's a comfortable informal relationship between Five Eyes and highly trusted nations that have almost joined Five Eyes in the past. France was closest to becoming the official sixth eye under Obama. Japan is another of these nations.

On what basis?

Thanks.

I get that FHE is not realistic today, but can’t I use ( if it’s really critical) a combination of confidential vms and an external hsm ? I understand I’ll be limited to traditional workloads , and not managed services though.

I asked the wrong question, what I really meant was ‘if I run in a less trusted environment, am I not supposed to use all possible crypto mechanisms available to make that environment more trustworthy , so that I can’t be deceived by my cloud operator sending my data to the us government’

I think starting from the day after CLOUD act was approved (2018).

Crazy to even think that such a law exists.