803
Microsoft admits it would have to let Trump spy on EU data if demanded (www.techradar.com)
submitted 1 year ago by to c/technology@lemmy.world
85 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] 70 points 1 year ago* (last edited 1 year ago) (10 children)

Anyone wonder where your country's health records about all their citizens are stored? I'm guessing it's all on either MS, AWS, or Google. That means Trump could get access to your medical history.

This is important because of his attacks on LGBTQ people, vaccines, abortion, autism, and who knows what other nonsense he wants to persecute.

And here in Canada the Liberal government is putting forth bill C-2, which opens up even more access to the US to get even records stored in Canada by Canadian companies.

https://www.eff.org/deeplinks/2025/07/canadas-bill-c-2-opens-floodgates-us-surveillance

Feel safe yet?

  • permalink
  • fedilink
  • source
  • hideshow 10 child comments
    •
  • [–] 18 points 1 year ago (2 children)

    I am from the Netherlands and work at a hospital, we exclusively use Microsoft software.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 9 points 1 year ago (1 child)

    Only if they aren't using customer provided encryption keys (is using blob/bucket storage) or an equivalent approach to encryption at rest, and make sure they're doing standard TLS for encryption in flight.

    It's absolutely possible, and standard for any decent organization, to build their cloud architectures to fully account for the cloud provider potentially accessing your data without authorization. I've personally had such design conversations multiple times.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 2 points 1 year ago*

    It is possible to do things correctly. The question is, is it done often, and is it done on hardware you can trust. I'm somewhat confident if I run my services on bare metal, the provider would have a hard time getting my encryption keys, although it's not impossible even in this situation. How many people do so with VPS and managed instances, where snooping around the runtime and exfiltrating data unbeknownst to the user is trivial?

    Also, beyond that, how many fall for the convenience of things like SSE, whether it's with customer provided keys or not? That should be a red flag, but people find it oh so convenient.

    We're bound to see stuff bubble out where "we did all the right things" boils down to clicking a checkbox in some web UI and be done with it in the future.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 7 points 1 year ago (3 children)

    In the case of Germany: confidential computing tech ensures all data is encrypted in storage and in memory, shielded even against data center employees / hosting providers. I imagine that's become the standard for most countries.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 4 points 1 year ago (2 children)

    Hmm. Policies might say so. Not every business follow policies, whether they are their own or imposed ones, though. Business going all "it's ok, our provider have the correct certifications for data handling" are definitely a thing.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •