US lobbyists commission report dismissing proposed EU cloud regulations
- Reference: 1678124590
- News link: https://www.theregister.co.uk/2023/03/06/proposed_eu_cloud_regulation/
- Source link:
The European Cybersecurity Certification Scheme for Cloud Services (EUCS) is intended to put in place an EU-wide certification framework for IT services.
However, the proposals would also impose "sovereignty" requirements that force cloud providers to host services for EU customers on infrastructure sited within the EU, and to demonstrate their "immunity" from foreign law enforcement authorities demanding access to data.
[1]
The proposals have already met with [2]opposition from the US , with a number of industry associations issuing a statement in December claiming that such rules would hamper big US cloud providers such as Amazon, Google, and Microsoft from doing business in Europe.
[3]
[4]
Now a report has been issued by the European Centre for International Political Economy (ECIPE) criticizing the EUCS proposals. It calls for the EU's Cybersecurity Agency (ENISA) and the European Commission to abandon the immunity requirements in EUCS, warning that it could "open a Pandora's box" by empowering the European Commission and individual member states to exclude foreign businesses from domestic cloud services markets.
The report, " [5]Building Resilience? The Cybersecurity, Economic & Trade Impacts of Cloud Immunity Requirements ", makes lots of claims about the proposed EU legislation. For example, that it could increase the exposure of cloud adopters to cybersecurity risks, that EU suppliers are "in no position to manage a broad-based transition to cloud," and that the new rules would "delay significant efficiency and security gains that current foreign suppliers could offer."
[6]
But the report itself was commissioned by the Computer & Communications Industry Association ( [7]CCIA ), which is an international non-profit advocacy organization based in Washington DC to represent the interests of the IT and communications industries.
To be fair to ECIPE, it claims to be an independent and non-profit body, and that the opinions offered are "purely those of the author," but readers would be amazed how often such independent reports just happen to align very closely with the views of the organization that commissioned them.
For example, it claims that the immunity requirements in the EUCS are "discriminatory by design" and could provoke retaliatory measures against the EU by trading partners (meaning the US, of course). This might take the form of retaliatory tariffs of 25 percent on up to $12 billion of EU goods exports, based on an assumption that an immunity provision would effectively ban services from the three biggest cloud providers worth $2.9 billion, the report states. Alternatively, equivalent restrictions might be applied on EU services exports to the US.
75% European cloud? You're joking
The report is perhaps correct when it states that European providers are currently in no position to manage the EU's goal of 75 percent cloud adoption rate for enterprises, and this is because US companies currently serve more than 75 percent of the EU market, with the big three cloud providers alone [8]accounting for 72 percent , according to figures from Synergy Research Group last year.
[9]US government sets a 30-day deadline for wiping TikTok from feds' phones
[10]Europe to consult on making Big Tech pay for the networks it floods
[11]EU lawmakers argue against signing US data-transfer pact
[12]Euronext says non, nein to US cloud providers services as rivals sign up
But European companies have themselves complained about anticompetitive practices from the big cloud providers, in particular Microsoft, which last year [13]offered concessions in a bid to appease regulators.
Microsoft has also been taking steps to offer greater “data sovereignty” capabilities to EU users, in particular the introduction of an [14]EU “Data Boundary” at the start of this year, which provided customers with the ability to store and process their customer data entirely within the EU for certain cloud services.
[15]
Meanwhile, enterprise spending on cloud services is [16]growing, but at a reduced rate than in recent years , as organizations try to control costs amid rising inflation and a growing view by some that cloud investments may have not delivered on the promised results. ®
Get our [17]Tech Resources
[1] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offprem/paasiaas&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2ZAZwmFUHml2c4XFEFnYuJAAAAEI&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[2] https://www.theregister.com/2022/12/02/us_eu_cloud_regulation/
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offprem/paasiaas&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZAZwmFUHml2c4XFEFnYuJAAAAEI&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offprem/paasiaas&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZAZwmFUHml2c4XFEFnYuJAAAAEI&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://ecipe.org/publications/resilience-cybersecurity-economic-trade-impacts-cloud-immunity/
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offprem/paasiaas&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZAZwmFUHml2c4XFEFnYuJAAAAEI&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[7] https://ccianet.org/
[8] https://www.theregister.com/2022/09/29/aws_microsoft_google_european_cloud_spend/
[9] https://www.theregister.com/2023/03/01/government_tiktok_ban/
[10] https://www.theregister.com/2023/02/24/europe_gigabit_transformation_consultation/
[11] https://www.theregister.com/2023/02/17/adequacy_decision_us_data_transfer/
[12] https://www.theregister.com/2023/02/10/euronext_says_non_nein_to/
[13] https://www.theregister.com/2022/05/18/microsoft_cloud_concessions/
[14] https://www.theregister.com/2022/12/15/microsoft_launches_eu_data_boundary/
[15] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offprem/paasiaas&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZAZwmFUHml2c4XFEFnYuJAAAAEI&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[16] https://www.theregister.com/2023/02/07/big_three_cloud_market/
[17] https://whitepapers.theregister.com/
Does that sum it up accurately?
Yup, that's about right. When we do it we're the good guys, but when China does it they're a brutal dictatorship.
but when China does it they're a brutal dictatorship.
But it's kind of true though.
It is time to call out all US cloud operators in Europe as nothing more than spy machines for the Uncle Sam. If US companies want to operate in Europe they can obey the rules or they can leave.
Optional by Default
...would hamper big US cloud providers such as Amazon, Google, and Microsoft from doing business in Europe.
As with so much of Tech innovation and initiatives, I cannot think of any way this would impact me for good or evil.
Apart from a general avoidance of US companies ---- yes in part due to their loathsome greedy hoovering up of data --- I utterly avoid Amazon, use Google only for Search ( even as it's usefulness steadily diminishes ), and would no more utilize anything Microsoft than I would the products of those fictional societies of the Fin-de-Siecle , occult and tortuous and occasionally criminal.
Obviously others more consequential than I shall differ; and it is possible than other American companies not devoted to evil may overtake these three, but these are what we have got.
All your data are belong to US!
Can someone please explain the point of Microsoft’s EU Data Boundary with all the data being on EU land, where the US can just CLOUD act them into access?
Didn’t something like that happen with Ireland and some email? Or was that why CLOUD came into being?
So the EU are denying access to customers with the proposal, more like the US government is forcing EU hands.
Maybe the US should also implement a no data gathering thing too where we may be more likely to play.
Think of it as resilience.
If you insist that your cloud provider is subject to the laws of a single country, that's a single point of failure. Clouds aren't supposed to have those. You need to fix your cloud.
It still seems pretty uncontroversial to me that no country can expect its laws to trump those of another when the business is conducted in the other. Think of it as "No legislation without representation.". Do I have a representative in your legislature? Nope? Well your laws aren't worth shit in my country then.
@Ken Hagan - Re: Think of it as resilience.
Tell this to US government and prepare for the consequences.
Don't we all feel sorry for Microsoft, Amazon, Google they might loose a few dollars if they can't hoover up all the data from their EU users, if they need to set up a independent separate business in the EU to do business there and not send it all back to their US data slurping parent companies.
So it's OK for the US to restrict access of Chinese firms because the Chinese govt. could lean on them to extract data but it's not OK for the EU to restrict access for US firms because the US govt could lean on them to extract data. Does that sum it up accurately?