The Dutch Cloud Community sent an urgent letter to the Amsterdam police this week, after a server was seized in an Amsterdam data center at the request of U.S. authorities.

Repartage — contenu de Joseph Benguira

The Dutch Cloud Community sent an urgent letter to the Amsterdam police this week, after a server was seized in an Amsterdam data center at the request of U.S. authorities.

The server belonged to Autistici/Inventati, an Italian provider of free email and hosting used by about 20,000 organizations. The Amsterdam public prosecutor says it acted under the mutual legal assistance treaty between the Netherlands and the U.S., saw no ground for refusal, and has not shared the data yet. The DCC wants to know who reviewed the request, and on what legal basis.

I won't argue the case itself. The lesson for anyone buying cloud in Europe is simpler: the country where your server sits does not decide who can reach it. Treaties, the nationality of the company operating it, and who holds the encryption keys decide it.

I run a managed cloud company incorporated in Ireland, and these are the questions I would ask any provider this week, us included. Where is the company that operates my servers legally established, and which foreign laws can compel it? If a request arrives, will I be told, and who reviews it before anything leaves the building? And who holds the keys to my data at rest, the provider or me?

The last one matters most. A seized disk encrypted with a key only the customer holds is a very short conversation.

"Without a clear Dutch review, the Netherlands loses the trust of the organizations and companies that store their data here," the DCC wrote. Swap "Dutch" for any European country and the sentence still holds.

Which of those three questions has your provider actually answered in writing?

#DataSovereignty #CloudComputing #GDPR #CyberSecurity #DigitalSovereignty

230

35

36

230 reactions

Sources LinkedIn

• Profil : Pierre Jean Duvivier dit Sage (LinkedIn)
• Auteur partagé : Joseph Benguira (LinkedIn)