[alwayseasy]

Specifically here, he is under oath in France so an American gag order wouldn't protect him from the French justice system.

This make it less likely he's lying. It could be possible Microsoft France has a "rogue" employee system where a key person only obeys to Microsoft US orders rather than his French boss and French law. Then the boss can swear to the Senate that they're complying.

This is exactly the system the US Congress accused TikTok of having set up.

[hyghjiyhu]

If the data center is operated by a "trusted subsidiary" as the article mentions and everyone in key roles is a French citizen with no connection to the US then there is no one to give a gag order.

In practice the US HQ could mandate a security update that secretly uploads all data to the US but that's a whole other can of worms that I don't think anyone is ready to open.

[dathinab]

the data center which runs software written and controlled by the US companies and likely has a 24/7 software related support team which is distributed across the world....

in a modern cloud dater center you don't need someone physically plugging a USB stick in a server, you just need a back door in a cloud software stack many times the size then any modern operating system which often even involves custom firmware for very low level components and where the attacker has the capabilities to convince your CPU vendor to help them...

[spwa4]

... a backdoor that is a necessity anyway, because it is constantly used to upgrade the cluster software.

[fsckboy]

>In practice the US HQ could mandate a security update that secretly uploads all data to the US but that's a whole other can of worms that I don't think anyone is ready to open.

incredibly ambiguous/unsatisfying sentence. if this french hearing is concerned about french data security, then asking a question about your "in practice" is exactly a can of worms the french would like to open.

[hyghjiyhu]

Everyone and everything is automatically downloading updates of US software. It's a door that is impossible to close in the short term.

[MengerSponge]

> This is exactly the system the US Congress accused TikTok of having set up.

"Every accusation is a confession" remains undefeated

[Nevermark]

Agreed.

--

As a side rant:

"Specious accusations are often confessions."

I understand the psychology and casual use of absolutely worded reactions, and that their extreme expression is not taken literally, but as emphasis. But I still prefer balanced wording.

A surprisingly large number of people tragically clash and talk past each other over charged non-issues, that normal undramatic language would render moot.

I.e. "We must believe all X", vs. "We should listen to all X", ... and many more.

"Black Lives Matter Too", isn't as pithy. Nor should the last word be necessary for anyone to understand the three word version. But the fourth word, nodding to the wider context, pre-counters a lot of ridiculous responses to the original line. Not actually suggesting a sea change in a well recognized movement banner line. But it is a widely observed example of how any lack of pedantic clarity is seized upon by motivated reactionaries, to achieve politically significant impact via obtuse reinterpretation.

A little verbal pedantry is an effective speed bump against the siren song of motivated or inadvertent polarization.

[MengerSponge]

It's naive or foolish to think that the problem with "Black Lives Matter" was insufficient specificity.

People who are not operating in good faith won't operate in good faith. There were thousands of words written on the phenomenon protested by BLM, but those are easily ignored. Three words are twisted and co-opted by propagandists. Consider a function that describes "comprehension by bigots" as a function of word count. We know that 0 words yields 0 comprehension. Evidence suggests that 10k words also yields 0 comprehension. There is no evidence that this Laffer curve will ever achieve anything other than zero.

It's possible to reach and change bigots' minds, but it requires human connections. Not sloganeering, prose, or reels.

[Nevermark]

I agree.

I wasn’t making a hard argument.

Words are not everything. Still, they matter.

To the degree that pushback against anti-minority mistreatment can be framed as pro-universal (reciprocal) respect, I think it helps. Given the latter is in fact the real, most general, and most relevant principle.

That avoids the framing created and imposed by biases. I.e. that somehow, race or other category is the question, instead of (logically and morally) irrelevant to the value of reciprocal respect. Not forgetting the point of it all, avoids actual or perceived reverse biasing. Minority rights and equality being interpreted by either side as anti-majority, or being at the expense of anyone.

Some shrill minority defenders do manage to imply that, as well the people having trouble respecting some group.

This are just thoughts based on what I find works better in personal encounters with people I know or ran into, who had/have difficulty seeing the world without in-group, out-group filters of various kinds.

Keep the simple, general, most important thing clear and center.

Avoid letting the conversation be artificially narrowed by exactly the destructive framing we want to push back on. The narrower the framing the more people forget, ignore, and successfully distract from the main principle. The more people get bogged down in narrower and narrower arguments, the less people understand each other.

[dathinab]

Until this happened MS was still going around trying to convince lawyers to use their Cloud and telling them that there is no issue.

Including certain contractual "standard"(1) agreements which would make some of their higher management _personally_ liable for undue data access even under Cloud act from the US!!!

(1) As in standard agreements for providers which store lawyer data, including highly sensitive details about ongoing cases etc.

So you can't really trust MS anymore at all, even if personal liability (e.g. lying under oath) is at stack. And the max ceiling for the penalties for lying under oath seem less then what you can run into in the previous mentioned case...

You also have to look a bit closer at what it even means if "the french MS CEO swears they are complying" it means he doesn't know about non compliance and did tell his employees to comply and hired someone to verify it etc.

But the US doesn't need the French CEO to know, they just need to gain access to the French/EU server through US employees, which given that most of the infra software is written in the US and international admin teams for 24/7 support is really not that hard...

And even if you want to sue the French CEO after a breach/he (hypothetically) lied he would just say he didn't because he also was lied too leading to an endless goose chase and "upsi" by now the French CEO somehow is living in the US.

And that is if you ever learn about it happening, but thanks to the US having pretty bad gag orders/secret court stuff the chance for that is very low.

So from my POV it looks like MS has knowingly and systematically lying and deceiving customer, including such with highly sensitive data, and EU governments about how "safe" the data is even if it lead to personal legal liabilities of management.

And I mind to remember that AWS was giving similar guarantees they most most likely can't hold, but I'm not fully sure. Idk. about Google.

Oh and if you hope that the whole Sovereign Cloud things will help, it wont. It's a huge mage pretend theater moving millions over millions into the hands of US cloud providers while not providing a realistic solutions to the problem it is supposed to solve and neglecting local competition which actually could make a difference, smh.

[impossiblefork]

The max penalty for things like this is actually life inprisonment though. If you, to aid a foreign power without authorization gather certain types of information, it's espionage.

There wouldn't be any lawsuit. If you do this kind of things you get arrested, get a trial and then you are in prison forever.

[dathinab]

except we are speaking about lying under oath, not espionage, you don't get a trail for espionage because you lie under oath

and leading management also technically doesn't need to know that is happens for it to be doable. Or in other words they have a lot of reason to "accidentally" not know about it/have it overlooked

this means even if it happens they are very unlikely to be charged for anything more then negligence

but the contracts I mentioned above basically state "it doesn't matter why it happens and if you knew or if it was your fault as long as there was the smallest bit of negligence on your side you are on the hook for it personally". So in a situation where they can effectively avoid espionage trials (because they didn't commit espionage, just negligence) they still are hold responsible

if high level management would reliable go to prison for things like that you wouldn't need additional contracts to make sure they actually have insensitive to actively try to find/prevent anything like this/act very non-negligent.

[impossiblefork]

He wouldn't even be charged for lying under oath if he lied and it became apparent, because there'd be not considering the much more serious espionage charges. They'd only prosecute the espionage part.

Participating in a plot to supply french state information to the US is espionage. France also apparently has a broad definition of espionage, relative to some other EU countries.

States have a tendency of coming down rather harshly on this kind of thing, so this idea about negligence is I think unlikely. If you know about it the charges will be espionage charges. If it happened it would be the biggest thing ever. They'd arrest most Microsoft employees in relevant teams as well the leadership, probably many others too. Just interrogation would probably take half a year due to lack of interrogators.

[throwawayffffas]

> This make it less likely he's lying. It could be possible Microsoft France has a "rogue" employee system where a key person only obeys to Microsoft US orders rather than his French boss and French law. Then the boss can swear to the Senate that they're complying.

It's also possible that US employees had access to French servers without anyone in France knowing.

[jacquesm]

Less likely doesn't say much though. He may have simply weighed the chances of the French government ever finding out that he lied.

> It could be possible Microsoft France has a "rogue" employee system where a key person only obeys to Microsoft US orders rather than his French boss and French law.

I would think that is not just a possibility, but a certainty.