David<p><span class="h-card" translate="no"><a href="https://mastodon.social/@glynmoody" class="u-url mention" rel="nofollow noopener" target="_blank">@<span>glynmoody</span></a></span> <a href="https://infosec.exchange/tags/Microsoft" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Microsoft</span></a> does have one viable solution, and it would require relinquishing some control. It would work like this: </p><ol><li>Pay a European law firm to create an independent (i.e., non-subsidiary—not owned or controlled by Microsoft or any of its officers) <a href="https://infosec.exchange/tags/EU" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>EU</span></a> corporation; call it something like "Microsoft Europe." That corporation must have solely EU-resident EU citizens constituting its officers (board, directors, and voting shareholders). </li><li>Irrevocably license all Microsoft [US] IP involved in software or services used by EU principals to Microsoft Europe, as part of a contractual agreement requiring Microsoft Europe to follow Microsoft [US] direction <em>except</em> as contraindicated by EU or member-state law. Agree to allow Microsoft Europe to relicense under EU, rather than US, law, whenever providing products or services to EU customers, then have Microsoft Europe do so. </li><li>Include with the license all complete and corresponding source code (by the <a href="https://infosec.exchange/tags/GPL" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>GPL</span></a> definition), and include in the contract an NDA prohibiting any reuse or redistribution of all but the open-source parts of that source code except as strictly necessary (by the <a href="https://infosec.exchange/tags/GDPR" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>GDPR</span></a> definition) to fulfil license or contractual obligations to EU customers or to comply with EU or member state law. </li><li>Charge licensing feeds to Microsoft Europe equal to everything in excess of their operating costs (just enough personnel to fulfil licenses and contracts to EU suppliers and customers, plus EU-based insurance and legal services). Then Microsoft [US] is out no more revenue than necessary to run an office. </li><li>As the foregoing isolate Microsoft Europe legally and through disjoint org charts, isolate digital systems through cryptography. Make it mathematically impossible for Microsoft [US] to violate EU or member state law regarding EU data, as only Microsoft Europe would be able to access the cryptographic keys controlling confidentiality, availability, or integrity of EU data. </li></ol><p>The net effect: for the cost of perhaps a few to several million Euros, is that Microsoft [US] could maintain status quo the EU, except insofar as becoming unable to violate EU or member state law at the behest of the US government. The same model can be replicated in other jurisdictions, such as <a href="https://infosec.exchange/tags/Canada" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Canada</span></a>, and by other multinational digital services providers, such as <a href="https://infosec.exchange/tags/Alphabet" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Alphabet</span></a> (Google). </p><p>To make this happen, EU (and other) governments can require it as a condition of continuing to do business with Microsoft (and other multinationals). </p><p>Maintaining a monolithic multinational corporation is the legal equivalent of maintaining a flat network. Internationally federating a multinational corporation is the legal equivalent of maintaining a well segmented network. In the coming years, US-based Big Tech companies will need to firewall their non-US operations off from themselves, as outline above. And non-US governments will need to mandate that. The sanctioning of the <a href="https://infosec.exchange/tags/ICC" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>ICC</span></a> was already proof of that necessity.</p>