Slashdot Mirror
FTC Worries About Consumers, Cloud Data, and Privacy
pcause writes "Ars Techina has a nice article about the FTC's concern that consumers don't understand the implications of storing their data in the cloud. From the article: 'Data is now sitting on servers outside of your control, where it can be accessed far more easily by Google itself, hackers, and law enforcement than it ever could if kept within the device. Once data passes over the network, it gets much easier to access in realtime; once it is stored on a remote server, it gets much easier to access at any time. And those are just the phone settings. Google also has access to search history data, anything stored in Google Docs or Spreadsheets, complete schedules stored in Google Calendar, and recent Maps searches. Combine them all, and companies like Google become one-stop shops for authorities looking for personal information.' Do you think the average consumer even has a clue about this issue?"
A hard drive in your house is just as accessible as data in the cloud, they just need a warrant. However, they have a hard time hiding the fact they took your computer, it's somewhat questionable whether you can detect they got a wiretap, and outright impossible to tell what they copied out of a cloud... so the net change is that you'll have a harder time telling you've been snooped on, but that won't make it any easier to do the snooping. If you have info, they can make you turn it over whether you want to or not. What's at stake here is whether you know.
Most cloud services these days are funded by companies who have ad interests too. Google has the web's largest ad network, Amazon loves to sell things, Microsoft has an ad platform too. Will what you post on MySpace suddenly influence which ad you see when you're watching Fox? Should it?
"Do you think the average consumer even has a clue about this issue?" No. And they don't care, and can't be made to care.
My friend that works as google gave me a droid G3 phone for christmas. I guess they all got the nexus this year so he was giving me last years present. It doesn't have a SIM card in it, and I don't have it activated on a cell network. I don't really have any intentions on doing so either.
I let my 4 year old daughter play with it. There's a coloring book application called Zebra Paint. Today though I hear the phone talking.
"Hello? Heloo? Emergency 911"
I guess even without a phone plan, you can still use these things for 911?
I politely told the 911 operator what happened. He told me to be careful letting my girl play with it and that was that.
Scary thing though, this thing has GPS. If someone really wanted to track me down they could. Even without a cell phone plan or sim card in the device.
Especially when they don't have to worry about any backlash from their customers as the government will just give them immunity from any suits after the fact.
I'm just shocked the FTC is seemingly saying that easy access for law enforcement is a good thing.
Sanity in a government agency?! Cats and dogs living together? Mass hysteria?
All hard drives will fail eventually. Flash memory drives are starting to outlast them, but those will fail someday too. CD/DVDs age poorly. Nothing is safe in your house anyway.
So, a cloud with a big RAID where dead drives are replaced with no loss in a nice safe datacenter sounds like a nice option. The problem with that is that clouds are run by companies, and no company lasts forever either. Look at what happened to drive.com.... they were bought by AOL, and then thrown out. Users were given a couple of months to retrieve their data, after which everything was deleted.
Is there any way to write data and then 10 years later get that same data back?
strong encryption means they can't access it no matter where the data is. why are we even talking about this?
If you mod me down, I will become more powerful than you can imagine....
so the net change is that you'll have a harder time telling you've been snooped on
It's also easier to hide things you don't want to be seen. GMail can turn over your emails, but if they're encrypted, even with something simple, it will be harder to make it useful. How many secret messages I have hidden in the pictures I email around or post online? Who has the resources to check every one?
Searches can be masked using TOR and private browsing. Again, not bullet proof, but it doesn't have to be. Just enough to poison the data and make it unreliable. Go buy a pre-paid phone with cash and take the battery out of your regular cell phone at random intervals. You're not trying to create a smoke screen, just sow doubt.
That's if you're worried about it.
Law enforcement may think search data and social media information is some kind of lucky charm, but it's pretty easy to spoil that data, leave false trails and really easy to hide things. If they gain confidence catching stupid people, all the better for those with a little clue.
That's our life, the big wheel of shit. - The Fat Man, Blue Tango Salvage
A lot less people have (legal) access to my house than Google's servers. Maybe you live in a commune, but I don't!
Developers: We can use your help.
Side note: The article should have mentioned gmail.
Companies change. Look at Sun Microsystems. Suppose Google ends up needing money. What is going to stop them from allowing me / your mother in law / the king of Sweden from paying to dig through all of the data they have related to you? This might not be done directly through Google, but through a "nice, responsible company" which has paid for access to Google's data. If Google makes the data available to other companies, who knows what those entities might do with it?
We need legislation and a way to verify compliance!
Of course, it would be good if the legislation also protected our data from the Department of Homeland Security, but I do not expect lawmakers to be able to do the right thing there anytime soon.
-Todd
Omne ignotum pro magnifico.
With our lives stored on Facebook, MySpace, Twitter, etc. does today's younger generation even appreciate/want privacy?
Everyone knows who your friends are, what movies you like, that your cereal this morning looked like a smiley-face until your dog knocked it over.
Is our view of privacy outdated?
Google reserves their right to suspend services for any reason in most of their terms and they do exercise this right by suspending people for life from the use of their services. Becoming dependant on Google's services, or being dependant on a market they dominate, leads to a large penalty and damage when services are suspended. Google will suspend services based on their suspicion alone, and clearly use data collected to make decisions. Their investigations are held in secret, based on secret information, giving the victim no chance to defend it, and this is not fair treatment. It has become so bad that employers are asking job applicants if they have ever been suspended from Google services to avoid the risk that Google will suspend the employers services. Clearly something needs to be done, but what can they really do?
The average consumer cares about nothing more than having their immediate wants gratified. Notice I didn't say *needs*. And they are not willing to put in the effort to understand the consequences of their actions, either due to unintentional or willful ignorance.
This is not every consumer, but the average one.
There is no other possible way that I can explain American Idol. ;)
For linux tips: http://www.linuxtipsblog.com
...in an alimony suit with a woman that I'd never met. The case was quickly dismissed, but the attorney did some dirty subpoenas and essentially tore my dignity to shreds in front of several people. It's reaaaalllly funny to people who look at your search history, your emails, and your CC purchases with no context and absolutely no justification.
I USE ANONOMYZING PROXIES NOW.
Backup your important data.
Encrypt your sensitive data.
These two steps are as important and effective with the cloud as they are with any other form of storage.
Morpheus, God of Dreams.
Data on a hard drive in your house can be as accessible over the Internet as data in the cloud, assuming that the hard drive is hooked up to a computer that's connected to the Internet. The only difference is, "'Data is now sitting on servers outside of your control". That has nothing to do with "the cloud". Any hosted service has the same weakness.
Yes, sure, if you store all your data on a single company's server, then that means people only need to get access to that company's servers in order to get all of your data. Maybe people don't understand that, but it shouldn't be news to anyone here.
Finally, yes, Google is in a scary position right now. Not only might they have access to your search results, but if you use Gmail then they have your email and if you use Google Docs then they have your documents. Right now, Google has a lot of access to a lot of data, which is exactly why people think their "don't be evil" mantra is so important. If Google chooses to abuse their position, they could cause a lot of problems.
So ultimately, this isn't an issue of "the cloud". It's an issue of how companies (or particular companies) are allowed to use personal data, and whether they're providing sufficient privacy protection to their customers. Warning people is fine, but I kind of have to wonder what the law says. Is the law protecting us as well as it should? If not, if citizens aren't protected well enough, then maybe we should be looking into that instead of just warning people.
That is exactly right.
I'm astonished how many people just don't realize this.
Only a subpoena is needed to get a company to hand over data its called "subpoena duces tecum" basically it orders a person give physical evidence to the ordering court or face punishment. Subpoena's are not the same as warrants, and because they are akin to a testimony they are very easy to have issued, and you do not need to be notified because they are often related to the authorities building a case against you, as opposed to something like a warrant, where YOUR physical property is searched. Read the TOS, a company is within its rights to hand this over to the authorities.
neorush
If I have 10 kids and an SO, that's 11 people. Still fewer than the number of Google employees running around their data centers.
Actually, even if they have access to the terminal, they may not have access to the data if you have separate logins... of course, I tried something like this with my ex, once; it didn't work out real well. Separate computers turned out to be easier.
Of course, this only works if you're running a real OS. If you use Misro$oft Win/DOS, well, best of luck.
Even if your SO insists on having access to your user account and password, unless she's *NIX savvy you can always bury stuff in /usr/local/bin/whatever_arcane_sounding_subdirectory, make root the owner, and set permissions to rwx------.
If you're really worried, put the data on a separate partition, and use /etc/fstab to keep it from mounting, make an alias from the mount command to a shellscript that quietly wipes that partition, and overwrites it with garbage, unless you mount it with the correct alternate command...
Yeah, guess I'm a little paranoid.
~Hal
If you're worried about your privacy, don't forget to rm -rf /home/[username]/.macromedia everytime you logout.
Really, most people don't realize how much information is IN the cloud. For example, my mom was very surprised to discover that her email redownloaded after she deleted it from her computer.
He has reviewed cloud backup and other services, yet never mentioned the legal differences between cloud based service storage and storage on your own in-house machine. That indicates that it's not interesting to his audience, which is telling. NPR recently did an article on how the domain holder of your email service is noticed by your potential job interviewer. Their comparison was between Yahoo! and of course AOL on one side (you're a LUser), and GMail on the other. Guess whose privacy actually suffers the most. This is definitely not understood.
Storing your data in the, "Cloud", is the IT equivalent to putting your most prized valuables in the local Greyhound bus locker. I also don't see much difference in using a Cloud service and folks who create, send, and store sensitive email via hotmail or gmail and then act surprised or upset when there is breach.
IMHO
"Beer is proof that God loves us and wants us to be happy - Benjamin Franklin"
To put sensitive data in something as nebulous as a cloud, you deserve whatever you get. I wouldn't put financial or other personal data in there willingly. Once you open Pandora's box by giving away your data you can't close it. Public is public. Private is private. The chance of a hacker targeting joe cable modem vs "the cloud" is so tiny I'll take my chances protecting my data myself any day. Besides, once your data is there, you have no guarantees whatsoever. You're at their mercy because they already have your data. You think they will scrub your data securely if you ask? Heck no, and even if they did, what about the backup tapes... Yeah, sure we'll secure erase just your stuff from the 30 sets of backups we keep. No problem.
I would rather see ads for products I'm interested in than things I'm not.
I'd rather see no ads at all.
That Anonymous Coward guy is pretty annoying. Can we have the government censor him or something?
What puts this in perspective is being asked by other people why I use a commercial E-mail service when Gmail/Hotmail/Yahoo/whatever is free. My response, of course, is "TANSTAAFL". What I pay for when I use a commercial provider is not just a TOS with solid privacy features (stored data being delivered on lawful court order as opposed to request), but the fact that the data stored is my data. It isn't going to be handed over to be sifted through for marketing or advertising, nor will it be used to sling ads at me.
It's the reverse for me and I live in a safe neighbourhood with few visitors. If google have that much access to your personal data/effects in your house then you are responsible. The same as I am responsible for locking my own door, I am responsible for securing my own data. I don't subscribe to the theory that Google is watching my every move, I'm willing to bet Google doesn't even know who I am and that Eric, Larry and Sergei don't give a shit about what I search for. If you want your personal data to be secure then don't put it on line, don't sign up to Facebook with your real name and DOB, don't give your mobile phone number to a marketing site asking for it.
Your security is your responsibility. If you're that paranoid about Google, use a proxy or just don't use google and by some tin foil as Googles satellite can read your mind right through the roof (what, you didn't know the GeoEye launch was a cover up for Googles Gspy mind reading satellite).
Calling someone a "hater" only means you can not rationally rebut their argument.
Your security is your responsibility. If you're that paranoid about Google, use a proxy or just don't use google
I have a problem with this kind of approach to privacy. It creates an issue in that there is no basic set of standards. A person should at least have the knowledge that if they give X data to a company, that the company may only use it in a predetermined manner UNLESS the company specifically asks for your permission to use it in other ways.
With our current approach, you literally have each entity following their own policy which they may not even uphold (I'm not aware of any real legal ramifications for violations of your own voluntary policy) So every entity you ever deal with will have a set of rules which you are supposed to investigate, send to a lawyer and then base your decision on that? Oh and that policy may include several hundred to thousand sub policies with their 'affiliates'.
The issue is that due to the complete lack of a base standard it isn't possible to make the responsible decisions that you want people to make. The only option at that point is simply not to participate and that is obviously a non-option.
A set of VERY CLEAR standards, established by the FTC and with very clear and precise consequences for violations would serve to promote use of these services, and end this literal no-privacy policy.
A law or policy without consequences for violation of that law or policy isn't worth a damn.
Out of modpoints but really liked a post? 1BDkF6TtmmeZ3yqXbz9yhdYVqRYnwFoXDj
Erm... I think TrueCrypt would be more secure with less effort. IMHO.
Those who have telepathy have no need to RTFA.