UK urged to unplug from US tech giants as digital sovereignty fears grow

The Open Rights Group is warning politicians that the UK is leaning far too heavily on US tech companies to run critical systems, and wants the Cybersecurity and Resilience Bill to force a rethink. The digital rights outfit says the bill, which is due to receive its second reading in the House of Commons today, represents a …

[Doctor Syntax]

Now might be a good time for el Reg to follow up on the Danish govt. dept. switching from Microsoft and a similar recent stories. I'm sure Denmark is treating this very seriously indeed. The way things are going they might be looking for the rest of the EU and NATO to stand up with them unless Trump's attention span runs out over Greenland and he heads off in some other direction.

[Pascal Monett]

It doesn't matter what direction Trump heads off to

The USA has proven, beyond any semblance of doubt, that it can no longer be depended on as a serious partner and ally in the long term. Even if Obama got re-elected, it wouldn't change that fact.

As things stand now, it's not even certain that Trump would order US forces to defend Taiwan if (when ?) China tries to invade.

Since this absolute absence of intelligence has been re-elected by all the Democrats not bothering to vote, his mantra has been "why pay US dollars for everyone else's benefit ?". What is beyond his single-neuron mind is that the US is not paying for everyone else, it is ensuring global peace. That is a position that people vastly more intelligent that him (Eisenhower, to start with) have understood since decades, but given that His Orangeness fires anyone who gives him a headache, there's a fair chance that Xi is going to have a good shot at taking over the world's prime CPU manufacturer.

Since the orange shitgibbon prefers McDonalds, he won't see the problem and won't care about any consequences since he won't feel any.

[I could be a dog really]

Re: It doesn't matter what direction Trump heads off to

As things stand now, it's not even certain that Trump would order US forces to defend Taiwan if (when ?) China tries to invade

And the events in Venezuela have now given the green light to Chine to invade Taiwan, and for Russia to invade ... well anywhere, and Israel to invade Gaza, and ...

In the office today, we were speculating on what this lot are doing here. Denmark was mentioned and we were thinking about Greenland - but perhaps they intend to rendition Mette Frederiksen as punishment for trying to ditch Microsoft ?

[martinusher]

Re: It doesn't matter what direction Trump heads off to

Our (US) forces effectively have the run of the UK. It started in WW2 and apart from a pause 1945-48 they've been a constant presence in what has been dubbed "The Unsinkable Aircraft Carrier". Actual use of bases ebbs and flows depending on technology, logistics and the level of global confrontation (we got rid of a whole lot of bases after 1991, for example) but we still maintain key assets in the UK which we use as staging areas for global power projection. Obviously the UK maintains the fiction of independence, especially for local consumption, but realistically if you look at the numbers and force availability any partnership is definitely one sided.

Europe is at a bit of a crossroads. As you've noticed with Venezuela you're only tolerated as far as you behave like a colony, a component of Empire. Obviously as Americans we don't do the old fashioned Imperial thing (although Trump's rather gauche taste is trending in that direction), the dominance is economic. The problem is, though, as we run ever deeper deficits we need countries in our sphere of influence to effectively subsidize us but the level of subsidy compared to the overall productivity of countries like the UK makes it increasingly difficult to sell our model of 'security' to local populations. Smart politicians would have seen this and taken steps to mitigate the consequences of the eventual reckoning but unfortunately our politicians aren't that smart. Trump is just first among equals -- there's plenty more where he came from.

I reckon we're all in for a bumpy ride. We'd be smart to listen to Denmark -- a country or region needs autonomy because its best interests aren't necessarily (say) the US's. We're obsessed with China over here (Russia is just a side show which is why we need to wind things down there ASAP.) China's particularly dangerous because it might well be catching.

[Anonymous Coward]

Re: It doesn't matter what direction Trump heads off to

> Obviously the UK maintains the fiction of independence, especially for local consumption, but realistically if you look at the numbers and force availability any partnership is definitely one sided.

The defense spending numbers were certainly one sided. How much extra would the British taxpayer have had to cough up over the decades if not integrated so close under the US defense umbrella?

And then there's the (pre-Brexit) matter of the Anglo-American relationship carrying a lot of weight in continental Europe, much to the dismay of their politicians and diplomats. The Brits have always had an much easier job of rallying US leaders to their position than any other nation on the continent.

[Like a badger]

Re: It doesn't matter what direction Trump heads off to

The Brits have always had an much easier job of rallying US leaders to their position than any other nation on the continent.

Really? The "special relationship" between the US and the UK has always been a fiction. The US does what is in its interests, and the UK acquiesces and our gormless politicians keep chuntering on about this special relationship. Having relied so heavily on the US for defence (not just the US presence in the UK and Europe, but enthusiastically buying US defence products) the British government have no way of relinquishing that reliance anytime in the next few decades.

Coming back to topic, the British government are so accustomed to being a vassal state that the term "data sovereignty" is barely in the British government lexicon. The Secretary of State for Science, Innovation and Technology (Kendall) is a history graduate and so wouldn't understand the concept, or indeed anything else technical, the junior minister responsible (Lloyd) has a degree in history and law, and the Permanent Secretary (Mian) has a law degree. And to compound the problem, every government department is falling over-itself to adopt AI, so they have no idea what is being exfiltrated to US servers, just so that some junior servant can tug their forelock to Starmer's promise that "AI will transform the lives of working people".

[werdsmith]

Re: It doesn't matter what direction Trump heads off to

The presence of US military in defence of Europe has always been US self interest. The paranoia about the commie reds at the start when Europe was wrecked and rebuilding. then later, part of foreign policy where "partner" nations were cultivated as customers for US big business, so the US could suck revenue out of these nations. We now have ubiquitous presence of US big business overshadowing local enterprise.

But it's starting to fail. The rise of China and the start of the decline of manufacturing in the US, along with the move to reduce fossil fuel use has people like Trump worried. So where before US foreign policy was conducted with the gun in the holster, Trump having to point his gun around. The obvious response to the reduced trust is to lower dependency on US business as customers and turn to local business, turn to China who are by far the lesser evil, less of a threat and less belligerent.

[Ken G]

Re: It doesn't matter what direction Trump heads off to

Th US military have the run of Greenland, the base there was about 10 times larger at the height of the Cold War and there is no problem if the US wants to expand it's defense infrastructure there to protect it's NATO partners. Taking it over is about exploiting the resources not about "Russian and Chinese ships" sailing nearby.

[SundogUK]

Re: It doesn't matter what direction Trump heads off to

"And the events in Venezuela have now given the green light to Chine to invade Taiwan, and for Russia to invade..."

Bollocks. The US operation in Venezuela has just shown China et al that all the shiny military technology they have paid for is worth zip against the US. You can be sure the CCP are scrapping all their current invasion plans and starting again from scratch.

[I could be a dog really]

Re: It doesn't matter what direction Trump heads off to

I think you missed the point.

Up to now, it's been a thing - whether international law or just consensus of agreement across almost all countries - that one country doesn't invade another without international agreement (e.g. getting a UN mandate for it as has happened in the past). In "the west", we've been happy to hold the moral high ground and criticise other countries that do that.

Trump has just blasted away not just the pedestal, but the foundations as well, of that. Basically he's signalled that it's perfectly OK to invade another country if you can justify it for $[reasons]. So if China does decide it want Taiwan "because $[reasons]", we in the West can't criticise them as we appear to be fine with what Trump has done. Russia invaded Ukraine for $[reasons] - it's hard to hold the moral high ground in criticising Russia if we don't also criticise the USA.

So, if we accept that it's OK for the USA to invade Venezuela and impose a regime change because $[reasons] - why is it not OK for China to invade Taiwan and impose regime change "because $[reasons]", or Russia invade Ukraine and impose regime change "because $[reasons]" ? At the moment it seems to be a case of whether we agree with $[reasons] which is always subjective, not whether we consider the invasion (without a UN mandate) to be acceptable which our UK government at least seems to now accept as OK given that we're not saying anything negative about Trump's actions.

[Andy 73]

Not enough

This needs to be more than a wish for open source technology. This needs to be a presumption in favour of domestic suppliers, physical infrastructure and home-grown solutions.

Europe has been following these policies for decades - particularly when it comes to foreign ownership of companies - and are at least resisting the heavy lobbying and commercial pressures of US influence. We cannot claim to be so resilient.

The UK doesn't have a meaningful industrial strategy in this area, and has watched as chips, cars, drones, manufacturing, robots and many other areas where we could excel have been 'offshored' to America, China and now India. Without a serious change, we're essentially in a state of managed (or unmanaged!) decline.

[Anonymous Coward]

Re: Not enough

Sad it's come to that. We used to be able to presume a special relationship and a certain trust which just died after 2016, which once upon a time, used to extend to things even more foundational than IT policy.

But suspicion and distrust are now warranted, and as history shows, everybody is better off when that's not the case.

[Irongut]

Re: Not enough

Don't fool yourself. The special relationship was bullshit in the 70s when I was a kid and I would suggest that goes all the way back to WW2 when they leased us tanks.

The US has never cared about the UK as anything more than a convenient place to sell crap.

[Anonymous Coward]

Re: Not enough

What's bollocks and where you're fooling yourself is not appreciating the impacts on policy when the people here and their leaders widely believed it for so long, and how bad it is when that shifts to now being a dismissed concern, and the base cheers it. The right-wing commentators have gone from protecting NATO and free trade to using Andrew and Harry as a punchline. That does impact policy.

Name one former US president who didn't give a damn if Europe was gobbled up by the Russians.

Might want to skip the WWII (and post) reference. Many might remember a geographically-isolated country sending on over more than just machinery.

[Anonymous Coward]

Re: Not enough

"The US has never cared about the UK as anything more than a convenient place to sell crap."

Not really. During the Cold War, the US cared about having the UK as its unsinkable aircraft carrier in the North Sea.

Apart from junk food, the US can't even export or manufacture crap these days. They've got fuck all the rest of the world wants to buy.

[Laura Kerr]

Re: Not enough

"Apart from junk food, the US can't even export or manufacture crap these days"

They still make some decent guitars but I won't be buying any more. Not now.

[Rich 2]

Re: Not enough

…and more than a few over expensive over-hyped guitars too. Gibs… [cough cough]

[Michael Strorm]

Re: Not enough

British political leaders like the idea of the "special relationship" because they can flatter themselves with the idea that, although Britain's Empire-enabled dominance is long behind it, they retain power and influence via this supposed friendship with the US, i.e. the leaders of the post-WW2/Suez hegemony.

In practice this can be exploited. The obvious example for me is the Blair government's cooperation with Bush and the US during the Iraq War era. Blair was clearly in thrall to the idea, suggested by many at the time, that by going along with the invasion, Britain and himself maintained a level of control and moderating influence over the US.

In reality, it was blindingly obvious to even the most remotely sceptical observer that the US was just doing what it would have done regardless, and got Britain's support and legitimisation in exchange for a few photo opportunities and warm words of flattery.

Many within the US government were already admitting this privately at the time or not long after, and they more openly said so a few years ago.

[Rich 2]

Re: Not enough

It makes me feel quite queasy every time I hear that saccharin “special relationship” bollox. There has never been any such thing except in the minds of some wishful-thinking British politicians. I do note that those politicians rarely use the term these days though

[Doctor Syntax]

Re: Not enough

Basically it amounted to nothing more than speaking vaguely similar languages.

[Andy 73]

Re: Not enough

...and before anyone gets too excited blaming recent events and world leaders, it should be pointed out that this has been the state since the eighties when we relaxed the rules about corporate ownership, and handed over most of our computer industry to America.

[Doctor Syntax]

Re: Not enough

handed over most of our computer industry to America or Japan.

[Anonymous Coward]

Re: Not enough

But it used to be broad consensus here that Brits were our best friends. It was usually the case that a bit of protest through the right channels would make things right. Financial ties were deep. Trust was there.

"You can always count on Americans to do the right thing - after they've tried everything else." - Winston Churchill

What changed recently was 1/3 of the US electorate being willing to cheer whatever one leader does, even if it screws over our best friends. The attitude on the street here now is rightfully alarming.

We're now to the point where one NATO member is threatening to seize territory from another, and the US public cheers that, too. That seems far more alarming than something like AI being trained on private data in violation of UK law.

Count on us, anymore, even in the end?

[Andy 73]

Re: Not enough

Sure, the atmosphere has been more convivial, but that doesn't mean we were doing the right thing by handing everything over to our very nice friends.

The turn in politics has made everyone nervous, but the problems have been embedding themselves for years - like the heart attack victim blaming the attempt to run a marathon and not the three decades of eating cake beforehand.

[Anonymous Coward]

Re: Not enough

But there's also a hard line versus a soft line approach to tech sovereignty. The hard line approach looks at borders, while the soft line approach is willing to also consider friendships.

Consider how US big tech is utterly dependent on Taiwan, South Korea, and The Netherlands. The US made itself dependent there, which might have been a concern, but wasn't a danger until US leaders started turning their backs on friends.

That's where recent alarming actions make such a difference. Recent actions in Venezuela have created a geopolitical permission structure which puts Taiwan at severe risk. Recent comments about seizing NATO territory have alarmed the Dutch. If the Brits have a complaint about US tech policy, it's now guaranteed to fall on deaf ears. This administration disdains diplomacy and the rules-based international order, and that's putting the entire tech sector at risk because of just how global and big-scale tech is. Instability is now breeding further instability in a self-perpetuating loop.

But much of that is also downstream from UK domestic issues.

Consider things like high-value AI development and all the datacenters which come with it.

What's the price of a kWh in the UK and how long does it take to get planning permission?

[Doctor Syntax]

Re: Not enough

Agreed the problems have been building for years but politicians - and others - usually only look at the short term. It's taken the turn in politics to make the issue immediate. Even now I'm not sure it's sufficiently immediately obvious to get govt. attention.

On the other topic, I have never had any intention of running marathons.

[Anonymous Coward]

Re: Not enough

" handed over most of our computer industry"

What computer industry? Fushitsu/ICL? Sinclair? er...? I'm struggling to remember the names of other UK based computer manufacturers.

[Henry Hallan]

Re: Not enough

There was a company called Acorn. They'd probably be a distant memory except that you can almost certainly reach out and touch a device using their RISC architecture.

There's a good chance you're reading this on one - I'm certainly writing on one.

[Anonymous Coward]

Re: Not enough

Their desktop OS in the mid-1990s was also miles ahead of the competitors.

[jpennycook]

Re: Not enough

PSION, before it became Canadian, apparently considered buying AMSTRAD

[werdsmith]

Re: Not enough

PSion acquired Teklogix, not the other way round. Psion was eventually eaten up by Motorola.

[Rich 2]

Re: Not enough

And most of our electricity supply, water supply, phone systems…..

[vogon00]

Re: Not enough

"The UK doesn't have a meaningful industrial strategy in this area

Empirically, I think you'll find it does have one, and it is the same as most capitalist ones - the race to the bottom, where everything is decided on price.

Every time an industry is in trouble, it always seems to be because what it makes can be sourced from elsewhere for less cost. Business financials these days dictate that If its cheaper to buy in what you need,then why make it yourself? It's the easiest way to either trim costs so you can (a) pay dividends to stockholders, (b) ease pressure on you margins. If that means you have to let people go, then so be it....tough luck, but the balance sheet doesn't lie when it comes to cost centers.

ISTR being told by a local fisherman that he's take the boat out and fish UK waters, but it was cheaper (or more profitable) to land the catch in Europe and have it transported back here¹.

What the balance sheet doesn't hold is a measure of value. We all know that, when competing, you have to add value...and one of the big values you can have is in-house skills relating to your products or services. What we've got here now is a whole bunch of SMB 'manufacturers' (Box shifters/VARs, not *real* manufacturing!) who's core competence is biased towards 'in/out/ shipping logistics, rather than actually knowing their product.

There's a lot of UK stuff that's been sold over the years to foreign buyers or investments...water/sewage companies etc., electricity distribution @ DNO level² and so on. We've sold a lot of our competence away:-)

_{[1] I trust the guy, but this was a while ago now so may no longer be true!}

_{[2] The tech angle on this story is that my DNO, UK Power Networks, is owned by CK Hutchison who do/did the '3' mobile phone network here.}

[Doctor Syntax]

Re: Not enough

" We all know that, when competing, you have to add value...and one of the big values you can have is in-house skills relating to your products or services."

In manglement thinking adding value has been replaced by cutting costs. There really ought to be scope for businesses who opt to add value to prosper.

[Goodwin Sands]

Re: Not enough

>told by a local fisherman

That's interesting but it doesn't make sense.

British fisherman either sell at auction at the port they land their catch, or they already have contracted with buyers who are waiting with their lorries at the quayside - and many of those lorries then drive directly over to the Continent which is where the greatest demand is. Been that way for decades now.

Fishermen themselves just don't get involved in trucking fish across borders. That's a specialist niche industry.

And cost of landing a catch is small and is going to be about the same whereever you do it.

Only way I can suggest the fisherman's story makes sense would be if he had landed his catch in a Continental port because that's where he could get the best price - and that very often is the case. And the bit about transported back to the UK he wasn't meaning he'd be doing it himself but was assuming it would happen after processing.

[Doctor Syntax]

Re: Not enough

"Only way I can suggest the fisherman's story makes sense would be if he had landed his catch in a Continental port because that's where he could get the best price"

I believe that happened quite a bit, especially with species where the continental market was better. Then the fish processor's son got all riled up about Johnny Foreigner fishing in British waters and supported Brexit without thinking that that would have to stop. I believe the obvious consequence came as a bit of a surprise to many who'd voted for it.

[Anonymous Coward]

strategy? what strategy?

The UK doesn't have a meaningful strategy in any area.

FTFY.

[Doctor Syntax]

Re: strategy? what strategy?

It has, but nobody knows what it is, least of all successive governments.

[Anonymous Coward]

Please Do

I'm a Yank who won't do a damn thing with US tech giants.

Personal mail/sever in Europe.

Don't keep your data in Trumpistan. Even Europe's extreme right doesn't trust Trump with their data.

[smudge]

Re: Please Do

Personal mail/sever in Europe.

Won't that mean that the NSA is copying everything coming to you and going from you?

[Anonymous Coward]

Re: Please Do

They're not as good at breaking modern encryption as you think they are.

And right now the US government is more interested in arresting people for being brown than encryption.

[Anonymous Coward]

Re: Please Do

Precisely.

And if "the best available practices" are that easily breakable, then that would be a much bigger, global-IT-panic inducing state secret than anything in my personal email.

Much smarter to keep exploits like that secret until they really count.

[smudge]

Re: Please Do

They're not as good at breaking modern encryption as you think they are.

Maybe not, but - like many other agencies - they will be storing it until they can.

Recent-past data that can be searched automatically can still be incriminating.

[VoiceOfTruth]

Re: Please Do

I am glad that somebody else is aware of this, because it seems that some people (who should know better) are not.

Not so long ago I explained to somebody that within their short working life, DES, 3DES, MD5, and SHA-1, were all considered secure then no longer secure. If some TLA happens to have a copy of something that Bob sent encrypted with MD5 a few years ago, it should now be considered visible.

The same goes for encryption today. It can, in some circumstances, be considered secure for now.

[Anonymous Coward]

Re: Please Do

MD5 isn't encryption. 3DES, while broken by a cryptographer's definition, still isn't known to be vulnerable to the sort of magic wand attack you think exists.

ssh or TLS 1.3, configured correctly, are not vulnerable by any reasonable definition of the term.

[VoiceOfTruth]

Re: Please Do

A simple search, even on wikipedia, will show you otherwise. For example.

>> MD5 can be used as a checksum to verify data integrity against unintentional corruption. Historically it was widely used as a cryptographic hash function; however it has been found to suffer from extensive vulnerabilities.

SSH. From wikipedia:

>> SSH-2 also adds stronger encryption methods like AES which eventually replaced weaker and compromised ciphers from the previous standard like 3DES

You are the sort of person who I gave such information to a few years ago. You think you know what you are talking about.

[Anonymous Coward]

Re: Please Do

> encrypted with MD5 a few years ago

Perhaps you should lightly skim those Wiki articles which you clearly didn't.

> it should now be considered visible.

"Visible" is not what happens when someone successfully attacks MD5.

Helps to have even the most basic clue what you're talking about.

[VoiceOfTruth]

Re: Please Do

I put that information for there for you to get started with, because evidently at the moment your knowledge is near zero.

I'l give you something I have seen. Files which were encrypted, and the passwords for that encryption was stored in MD5 hashes.

I won't bother responding to any more of your nonsense.

[Anonymous Coward]

Re: Please Do

> I put that information for there for you to get started with, because evidently at the moment your knowledge is near zero.

I got started with Applied Cryptography in 1995. Take a seat.

> I'l give you something I have seen. Files which were encrypted, and the passwords for that encryption was stored in MD5 hashes.

"Stored" isn't how that works and MD5 doesn't "encrypt" a damn thing. A CHF can be used for key derivation and/or password validation, but ultimately, another algorithm is necessarily doing the lifting.

While MD5 is short, weak, and collision prone, the input to a successful preimage attack against the stored validation value does not guarantee that input was the same one passed to the key derivation function. The probability is high only for weak passwords, which is also why we don't use MD5 to ensure data integrity. Weak passwords get cracked even when fed to secure CHFs, too.

A quality password will produce a stream of false positives of no use as input to the KDF.

[doublelayer]

Re: Please Do

You don't appear to know what the vulnerabilities in MD5 let someone do or how hard it is to do those things in practice. Cryptography is by design very panicky, and as soon as problems begin to appear, cryptographers look to make a better algorithm that will resist them. This is what they should be doing, but it can lead you to overestimate how broken they are.

This doesn't disprove your original point that people with the access to copy encrypted data may store it up to decrypt later, but it does change how practical it can be. They don't need to wait in the hope of finding a complete vulnerability if they're willing to brute force it right now, but that would be expensive. Most of the vulnerabilities found in cryptographic algorithms would reduce the expense but starting from such a high point that it's still not worth doing for most data. For example, DES is indeed considered too weak to use and can be cracked, but that's because it uses tiny keys. Effectively, DES is insecure because computers are cheap enough that it isn't too costly to throw a bunch of them at it, not its other weaknesses.

If you can avoid surveillance, that's great and probably worth doing, but if you can't, it's not quite as over as your summary suggests.

[Goodwin Sands]

Re: Please Do

>Don't keep your data in Trumpistan

You're a Yank but you don't say where you are. If you're in the US then I suggest you'd be wiser to use a mail server in the US. That way, to legally get their mitts on you data your govt agencies have to jump through various legal hoops and get authorisations signed off. Whereas if you use a mail server outside the US then it's a free for all and those agencies can & do legally help themselves to your & anyone else's data, anyway they're able. Deep packet inspection is likely to be happening automatically everytime you connect from the US to your European mail server. And of course same applies to Britons using mail servers abroad - GCHQ will be watching.

Best thing to do is run your own mail server.

Second best is use a reputable mail server within your own borders.

>Even Europe's extreme right doesn't trust Trump with their data.

Piffle! How on earth do you know that?

I very much doubt anyone who could be described as "Europe's extreme right" are any more clued up about this subject than the rest of the public.

[Anonymous Coward]

Re: Please Do

> If you're in the US then I suggest you'd be wiser to use a mail server in the US. That way, to legally get their mitts on you data your govt agencies have to jump through various legal hoops and get authorisations signed off. Whereas if you use a mail server outside the US then it's a free for all and those agencies can & do legally help themselves to your & anyone else's data, anyway they're able.

Those authorisations, at best, have become nothing more than a rubber stamp if one official in one county fills out a form promising it's legal, they swear!

In theory, the provider's lawyer could work with mine and it might be possible to quash it in court.

But no provider will do that for non-enterprise customers. Consider total revenue versus the hourly cost of a lawyer.

> I very much doubt anyone who could be described as "Europe's extreme right" are any more clued up about this subject than the rest of the public.

Clued up and trust are two different things. Those operating on facts consider trust alongside truth. The extremes who are operating on trust, but choosing ideology over facts, still speak up for data sovereignty every time issues like this intersect US <-> European politics. If Washington wanted Big Tech to keep walking the line between ok and dodgy, they at least shouldn't have pissed off our friends with dangerous, dishonest, and quite frankly, unstable behavior.

[Doctor Syntax]

Re: Please Do

The whole CLOUD Act thing seems to have come about because US law enforcement weren't prepared (in one or more senses of the word) to do the work that had to be done to go through the legal channels in Ireland where it obviously wasn't just a rubber stamping exercise. That in itself should have been a good enough warning to European customers of large US service providers.

[Anonymous Coward]

Re: Please Do

That's not what happened. US approached MS in the US "via the usual channels". MS didn't want to comply so only involved MS Ireland in an attempt to complicate and ultimately frustrate things. It didn't work.

[Doctor Syntax]

Re: Please Do

I don't know about the "usual" channels by which MS might have been approached but the appropriate channel would have been those agreed by treaty which would allow them to get a warrant in Ireland. Such a warrant would have overridden the provisions of GDPR. It would, however, have required provision of a modicum of evidence to justify the warrant. They obviously weren't prepared to do that. Who knows why? They didn't have the evidence? They weren't prepared to disclose it?* They were too used to getting evidence with a minimum of work and didn't want to make the effort that would have been required in Ireland let alone the extra work of dealing with a transatlantic jurisdiction?

MS would naturally have had to fight the approach because of the GDPR implications for their EU operations. Certainly Brad Smith welcomed the Act as it gave them clarity, or words to that effect which I take as meaning that it relieved them from having to fight.

* IME some police officers seem to be reluctant to confide even in those whose cooperation they need.

[Goodwin Sands]

Re: Please Do

>Those authorisations, at best

You're completely missing the point.

It's not particularly about authorisations, it's about the fact non-targeted surveillance of domestic traffic within the US is not legal whereas non-targeted surveillance of any & all traffic to/from the US, or entirely outside the US, is legal under US law and is happening on a vast industrial scale.

Hence my earlier suggestion that our Yank friend switches to using a mail server within the US.

[I could be a dog really]

Re: Please Do

the fact non-targeted surveillance of domestic traffic within the US is not legal

And that restrains some agencies does it ?

[Anonymous Coward]

Re: Please Do

the fact non-targeted surveillance of domestic traffic within the US is not legal...

is there any limit on how defined a target needs to be?

I'm sure that "every person above the age of 1" would be a desirable target (although a bit broad)

[Anonymous Coward]

Re: Please Do

Mass surveillance doesn't give them any insight into that server other than I push a lot of properly-secured SSH traffic to it.

I understand the law as well as the capabilities of adversaries. Snooping on the wire won't get Eve or Mallory anything, and there's no clandestine back door built in by agreement with a US hyperscaler.

My threat model considers targeted attacks. I have zero reason to worry about a state-targeted break-in. The risk is that a lack of US due process exposes private data (including as part of illegal harassment/doxxing, or someone using stolen law enforcement credentials). The best solution for that is Europe and providers who give a damn.

[Alumoi]

Re: Please Do

Since when the law applies to US government?

[cookiecutter]

british government???!

shurely shome mishtake!

A british government actually put this country first rather than shovel billions to indian or US firms?

that will genuinely be a first... they're still shovel things to oracle cloud now as well, just to genuinely hand over as much of our data and sovereignty as they can

[Anonymous Coward]

Re: british government???!

just to genuinely hand over as much of our data and sovereignty as they can

That's an outcome, but not the driver. The British government (specifically politicians, and senior civil servants) don't understand the issues of data sovereignty. They're blundering on as though US cloud is some magic efficiency lever that will restore the nation's broken finances, and as though the US are a trustworthy ally. Anything that can be outsourced is, and the purpose of government remains what it always was - to try and garner acceptable coverage in the government's favoured new source (so for the Tories it was all about the Daily Mail, for Labour it is all about the Guardian).

[JohnSheeran]

Another Headline from the "Well, Duh Gazette"

Honestly, who here believes that they should have dependency on things that are completely out of their control to run their country? ALL tech giants are not reliable in this sense. Diversity is the key word here and our entire society seems to moving away from it in almost all aspects.

[Doctor Syntax]

Re: Another Headline from the "Well, Duh Gazette"

The UK govt. believe that but if by "here" you mean el Reg then they're not here so they need to be told. Whether they'll listen before it's too late remains to be seen but I have a nasty feeling they won't.

[JohnSheeran]

Re: Another Headline from the "Well, Duh Gazette"

Well, by "here" I meant the readers of this article that are also reading comments.

The UK government may say they believe that but if they actually do anything about it (that's difficult and expensive BTW) remains to be seen. Your nasty feeling is likely reality. It seems to be an unwritten rule that nobody does anything unless they are forced to after it fails.

[BobD77]

Missing a big one

> ...what it sees as a strategic blind spot: the UK's reliance on companies such as Amazon, Google, Microsoft, and data analytics biz Palantir for everything from cloud hosting to sensitive public sector systems.

Where's Oracle on that list? They need to be called out more often.

[Doctor Syntax]

Re: Missing a big one

They do, but not necessarily on this topic. Are they actually running DCs with customers' data on them? That's the critical factor here.

[Anonymous Coward]

Re: Oracle

They might not be running DC's but how much of UK Local Government runs their crappy software? They could easily shut it all down by say, trippling licence fees and watch while they all go TITSUP.

They are the enemy inside.

[IGotOut]

Sure...but never going to happen.

Unless we ban MPs and Lords from working for foreign owned companies whilst working as an MP / Peer and then for 5 years after leaving their post, this just isn't going to happen. It's bad enough when your other half owns huge outsourcing companies.

They take bribes (sorry lobbying) knowing full well there will be a nice cushy job after.

[abend0c4]

Raise the royal standard?

I suspect there could be a lot of interest in the development and adoption of common standards for IT services that would both help level the playing field for new entrants (though being a new entrant is always going to be some disadvantage) and create genuine competition by making it possible to move services to other providers without a vast effort - though it would have to be a serious effort and not simple tokenism.

We already have some - the UK government is supposed to prefer ODF for government documents, for example - but the determination to ensure compliance seems to be woefully lacking. The big win would be in getting some cloud computing standards and mandating them in procurement - although it would be a big effort, it doesn't need to be done all at once and the mere threat could well result in a shift in supplier attitudes.

There is a bit of a mixed history in creating technical standards that deliver genuine value, but the very different experience of the development of the mobile phone system on each side of the Atlantic does demonstrate that done right it can result in some big wins.

We're also at an ideal point in respect of AI: we're not yet dependent on it and there are sufficient doubts about its deployment (accuracy, remuneration of content providers, psychological and environmental harm) to reasonably justify a "research only" moratorium until these are resolved. That alone might be sufficient to finally burst the AI bubble and demonstrate that the suppliers are also more vulnerable than they imagine.

I don't see much real enthusiasm to confront the US administration on this, but failing to confront them on other issues seems only to have emboldened them so I don't really see we have anything to lose.

[Anonymous Coward]

Re: Raise the royal standard?

We already have some - the UK government is supposed to prefer ODF for government documents, for example

Does it ? Or does it just demand "open standards" - which is why MS spent a lot of effort stuffing national standards bodies to push it's "open only in name but not really all that open" proprietary standards through to an ISO standard.

I see zero interest or effort to avoid proprietary lock-in - quite the reverse in my little corner of the machine. Everything is based on driving as fast as possible down the path to more vendor (especially MS) lock-in. Even to the point where IT policy is effectively dictated by MS.

What is really worrying is that even if our government decided to stand up to Trump, they couldn't risk it since he could effectively shut down the UK (central gov, civil service, all those quangos, local government, NHS, ...)

[abend0c4]

The policy (at least for the gov.uk website) is unambiguous - the reality, less so.

[Disgusted of Cheltenham]

Jerry's last words on that thread in 2014 were:

Once the policy has been fully implemented, PDFs should not be used for collection of data in the way you describe (“completion of forms”).

So why have I just been using pdf P87, R185 and all those other forms from the school of "let us spread this over so many pages in large font for you to print out, sign and return by non-reply-paid-post"?

[elsergiovolador]

Secrets

The US thanks to Cloud Act knows everything about government skeletons and private communications too.

If any politicians dares to step out of the line, I can imagine there is already a info packet to run by the press.

This is all because our security services have been sleeping at the wheel.

[Anonymous Coward]

Cutting ties to the USA

is long past due.

The Trump dictatorship is out to conquer the world by any means possible. The 'Usual Suspects' [1] control so much of our lives that disentanglement is next to impossible without the backing of European Governments.

We can all do a bit. Stop using their services especially ones in the [cough][cough] cloud. Keep your data close to yourself. Change all passwords, lock down everything. etc etc.

[1] The usual suspects : Microsoft, Google, Oracle, Amazon, All Social Media especially X and TikTok, any Thiel company and a few others that are household names.

[Anonymous Coward]

Disassociating

I now have a reason to use that word in a sentence.

I am disassociating from everything US.

You know, it feels good too.