Korva is a scroll of the internet’s best ideas.
A shell company in Germany beats the ban
The ban's loophole
Congress passed the law on a bipartisan basis a few years ago, and administrations of both parties, including the Trump and Biden administrations, have tried to limit the flow of data to adversarial countries. An adversary that sets up a shell company in Germany can buy the data anyway, and there is very little way to police it. The law adds a layer that pays for compliance law firms and checks some boxes, and it does not shut down the flow of US data to adversaries.
Why data crosses borders
Data crosses borders constantly, which is why Congress has allowed so much of it. A person can ping a server in Europe to download their own Google Drive file, because that is where Google's cloud decided to store it at that moment. Multinational corporations have made the case so far that restricting the flow would break the global economy.
What others chose
Other countries made a different choice. Europeans have passed data sovereignty laws, which require data on their citizens to sit on a server physically in their country. China does not let American companies collect huge amounts of data on its population. Congress could require that Americans' data stay on servers that American companies physically control, or stop data brokers from selling to any foreigner.
Why does Europe restrict data leaving its borders?
The General Data Protection Regulation, in force since 2018, allows personal data to leave the European Union only to countries or arrangements that offer essentially equivalent protection. In 2020 the EU's Court of Justice struck down the Privacy Shield framework in a case brought by Austrian activist Max Schrems, finding that US surveillance law did not offer that protection. The EU adopted a successor arrangement, the Data Privacy Framework, in 2023.
How does China keep its citizens' data home?
China's Data Security Law and Personal Information Protection Law, both taking effect in 2021, regulate how data leaves the country. Operators of critical information infrastructure must store personal data collected in China on servers inside it. Others that want to send large volumes abroad must pass a government security assessment. The Cybersecurity Law of 2017 had already introduced the localization requirement for critical operators.
Why might a file sit on another continent?
Cloud providers replicate files across data centers in several regions for speed and for protection against outages. A request is typically answered from whichever copy is closest or least busy. Some providers let business customers choose a region in which their data must stay. Consumer accounts usually get no such choice.
More from Shawn Ryan Show
