Bad assumptions about cloud computing and the Patriot Act
Summary: It's a common -- and dangerous -- assumption that the Patriot Act gives the U.S. government unprecedented access to your data. But where the data lives with regard to physical location of the cloud, service provider, or its facilities does not limit the government's access.
Anyone reading about the Cloud has heard the common dangerous assumption that the Patriot Act gives the government unprecedented access to your data. The misconception is that the level of access that the government has in the cloud is beyond what they would have if the data were hosted elsewhere.
Recently the European Commission Vice-President Viviane Reding, “spearheaded and vigorously advocated for the Commission's proposals to update and modernize the privacy framework in Europe through a detailed new Regulation.”
According to CSO Magazine, Commissioner Reding cried foul late last year when an EU Cloud Computing service suggested that there would be an advantage to its geographic location because it would protect customers from the reaches of the USA Patriot Act.
We live in a time, unfortunately, where many European countries have strict privacy laws which provide governments with “expedited access” to Cloud data. Reding notes that, indeed, France's anti-terrorism law has been said to make the Patriot Act look "namby-pamby" by comparison.
A recent study of the laws of Australia, Canada, Denmark, France, Germany, Ireland, Japan, Spain, United Kingdom, and the United States showed that it is incorrect to make the assumption that the US government has more or less access to data in the cloud than have other advanced economies.
The bottom line is that where the data lives with regard to physical location of the cloud, service provider, or its facilities does not limit the government's access.
Notably the author writes, “...every single country that we examined vests authority in the government to require a Cloud service provider to disclose customer data in a range of situations. Moreover, some governments permit invasive investigatory measures of Cloud providers when the investigation concerns national security.”
To underscore the reach of governments, an example was provided of the German Federal Office of Criminal Investigation (BKA); where the BKA suspects terrorism, a computer virus is employed to infiltrate and search a Cloud provider's servers. The 'Federal Trojan' is then left in the system to continue to covertly monitor traffic.
Additionally, the German intelligence services has the right, provided by the G10 act, to monitor and record telecommunications without a court order if they are investigating serious crime, terrorism or threat against their national security.
And the Patriot Act?
Well, although commonly, but erroneously, believed to have created a new mechanism for the US government to get access to Cloud provider data, really The Patriot Act extended many of the methods which were already in place while retaining Constitutional and statutory checks on abuse.
Should protecting the privacy and security of data in the cloud be a priority for cloud operators?
Should National Security trump personal security?
You tell me. At the end of the day, knowing the facts helps.
For more about cloud computing legal concerns please see Michael Overly's blog here.
See also:
Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.
Talkback
Point is...
Yes and no
Corruption Free For All
Where government officials are permitted to insider trade and take "gifts", forget about any type of trade secret or intellectual property on the cloud. If you want your data safe, keep it offline and on paper in a locked safe whenever possible. Corruption is going to kill the cloud and I don't mean hard drive failures!
TSA
Thanks for your comment!
Amen - unprecedented powers equals unprecedented abuse
Fuzzy boundries
If I put my data in 'secure' storage in the cloud it should be secured against anyone without a warrant.
That makes no sense at all...
"The bottom line is that where the data lives with regard to physical location of the cloud, service provider, or its facilities does not limit the government's access."
Um... Yes... It actually does...
The US government doesn't have the authority to go to a foreign country and copy someone’s data... The idea that you would even suggest that is ridiculously stupid. Do you even think before you write?
I think you misunderstood
not only that.
The Point
In which case...
It also extends to foreign companies.
Unless...
That is the big problem for people in Europe wanting to use cloud services. Not that a government can get access to the data, but HOW they get access to the data. Under EU law, if personal data is handed over to a third party outside the EU, the data owner needs to get written permission from each person affected, before they hand over the data.
The Patriot Act bypasses that. The US Government asks the cloud provider to hand over the data; the cloud provider has no choice AND they are not allowed to inform the data owner that their data has been breached.
The problem is, the US Government and the cloud provider are not liable for the data breach, the data owner is liable. If it comes out that their data was compromised and handed over to the US Government, without them getting the written permission of those affected, they are the ones open to prosecution.
I am sure it would work the other way round as well, if an European Government pulled the data from an American company, because their cloud provider had offices in Europe, the American company whose data was pulled would be liable to prosecution, because they "allowed" a non-domestic entity access to the data.
Sense or not
Think
Perhaps you should ask yourself that same question before jumping into the deep end....
Interesting Perspective
Meaghen
Mosaic Technology
http://www.mosaictec.com
Missing the Point
The bottom line is that where the data lives with regard to physical location of the cloud, service provider, or its facilities does not limit the government's access.
But that is not the only, or possibly even the main, issue.
For me (and I suspect many others around the world) it is one thing for *my* (duly elected) government (Australian) to snoop on my data but an entirely different thing for the US government to do so.
Agreeed
Stroll down to your local FBI office and ask about it.
The sad fact is that most governments' police forces are happy to "cooperate" with the FBI and US DoJ because they get paid to do so. They get free training at US installations, free equipment, and even funding for pet projects of their own unrelated to any US investigation. The money for this runs into the hundreds of millions of dollars every year, which is still a drop in the bucket in the overall US budget.
America operates over 600 different law enforcement offices outside of the US, from a dozen different Federal agencies and a number of state and local agencies as well. The NYPD has offices in Paris and Amsterdam, the Texas Rangers have offices in Mexico City and Bogota. Who knew?
Beware the Cloud