Microsoft admits it 'cannot guarantee' data #sovereignty - https://www.theregister.com/2025/07/25/microsoft_admits_it_cannot_guarantee/ "Under oath in French Senate, exec says it would be compelled – however unlikely – to pass local customer info to US admin" and there we have it... #trump
Microsoft admits it 'cannot guarantee' data sovereignty

Updated: Under oath in French Senate, exec says it would be compelled – however unlikely – to pass local customer info to US admin

The Register

@glynmoody

A direct result of the #patriotact , which was a bad idea at the time but now its evil has been compounded by a fascist administration.

@Ehay2k as we warned might happen
@glynmoody Countries concerned over this could benefit by stepping away from Microsoft and sending the money they would have paid MS to the open source projects they replace it with.
@SouthFresh they should have done this years ago
@glynmoody Agreed, but there's no better time to start than now.
@glynmoody @SouthFresh The best time to plant a tree was 30 years ago, the second best time is now.

@glynmoody

My decision to ditch #Windows last year is looking more rational every single day.

@glynmoody Reading this, you could easily confuse US Cloud and Patriot Acts with China's Data Security Law - often lambasted by US politicians
@glynmoody Nor do they care... their business model is selling information, tracking and advertising and all of the above.
@glynmoody This should be old news. Some of us have been worried about this since the PATRIOT and the CLOUD acts...
People seem to wake up to this, finally, but years too late.
@drchaos you're right, it should be...

@glynmoody #Microsoft does have one viable solution, and it would require relinquishing some control. It would work like this:

  • Pay a European law firm to create an independent (i.e., non-subsidiary—not owned or controlled by Microsoft or any of its officers) #EU corporation; call it something like "Microsoft Europe." That corporation must have solely EU-resident EU citizens constituting its officers (board, directors, and voting shareholders).
  • Irrevocably license all Microsoft [US] IP involved in software or services used by EU principals to Microsoft Europe, as part of a contractual agreement requiring Microsoft Europe to follow Microsoft [US] direction except as contraindicated by EU or member-state law. Agree to allow Microsoft Europe to relicense under EU, rather than US, law, whenever providing products or services to EU customers, then have Microsoft Europe do so.
  • Include with the license all complete and corresponding source code (by the #GPL definition), and include in the contract an NDA prohibiting any reuse or redistribution of all but the open-source parts of that source code except as strictly necessary (by the #GDPR definition) to fulfil license or contractual obligations to EU customers or to comply with EU or member state law.
  • Charge licensing feeds to Microsoft Europe equal to everything in excess of their operating costs (just enough personnel to fulfil licenses and contracts to EU suppliers and customers, plus EU-based insurance and legal services). Then Microsoft [US] is out no more revenue than necessary to run an office.
  • As the foregoing isolate Microsoft Europe legally and through disjoint org charts, isolate digital systems through cryptography. Make it mathematically impossible for Microsoft [US] to violate EU or member state law regarding EU data, as only Microsoft Europe would be able to access the cryptographic keys controlling confidentiality, availability, or integrity of EU data.
  • The net effect: for the cost of perhaps a few to several million Euros, is that Microsoft [US] could maintain status quo the EU, except insofar as becoming unable to violate EU or member state law at the behest of the US government. The same model can be replicated in other jurisdictions, such as #Canada, and by other multinational digital services providers, such as #Alphabet (Google).

    To make this happen, EU (and other) governments can require it as a condition of continuing to do business with Microsoft (and other multinationals).

    Maintaining a monolithic multinational corporation is the legal equivalent of maintaining a flat network. Internationally federating a multinational corporation is the legal equivalent of maintaining a well segmented network. In the coming years, US-based Big Tech companies will need to firewall their non-US operations off from themselves, as outline above. And non-US governments will need to mandate that. The sanctioning of the #ICC was already proof of that necessity.

    @deFractal I think ms would prefer the current system, and hopes that EU remains complacent

    @glynmoody Of course they would. Hence: "To make this happen, EU (and other) governments can require it as a condition of continuing to do business with Microsoft (and other multinationals)."

    If they develop, publish, and budget for a plausible plan to transition off all #Microsoft software and infrastructure over the next, say, four or five years, that can be the shot across the bow. If they do so not by naming Microsoft, but by characterizing in legislation digital infrastructure suppliers based on their headquarters, the nationality and residence of their officers, and the nationality and residence of their shareholders, they give Microsoft an intentional loophole. Then the only way to retain that revenue is to restructure, as outlined above.

    @deFractal but then trump will whine, and demand it be rescinded as part of a trade deal...
    @glynmoody Yep. That’s why governments dealing with the US need to stop acting in isolation on US-related policy, and start coordinating their legislation around common interests. Solidarity is not just for labour unions.