Slashdot Mirror
The Fourth Amendment and the Cloud
CNET has up a blog post examining the question: does the Fourth Amendment apply to data stored in the Cloud? The US constitutional amendment forbidding unreasonable searches and seizures is well settled in regard to the physical world, but its application to electronic communications and computing lags behind. The post's argument outlines a law review article (PDF) from a University of Minnesota law student, David A. Couillard. "Hypothetically, if a briefcase is locked with a combination lock, the government could attempt to guess the combination until the briefcase unlocked; but because the briefcase is opaque, there is still a reasonable expectation of privacy in the unlocked container. In the context of virtual containers in the cloud...encryption is not simply a virtual lock and key; it is virtual opacity. ... [T]he service provider has a copy of the keys to a user's cloud 'storage unit,' much like a landlord or storage locker owner has keys to a tenant's space, a bank has the keys to a safe deposit box, and a postal carrier has the keys to a mailbox. Yet that does not give law enforcement the authority to use those third parties as a means to enter a private space. The same rationale should apply to the cloud." We might wish that the courts interpreted Fourth Amendment rights in this way, but so far they have not.
Shouldn't the same privacy logic apply even more to your laptops and personal electronic devices when you're entering U.S. borders? Having these people search your hard drive is an invasion of privacy.
http://www.object404.com
If you want your data to be safe,especially when you plan to store it online in this new-fangled cloud thing, then encrypt it. You can't trust a service provider to stand up to a government access order, and you can't rely on the security of a storage system that you didn't make yourself.
Be responsible for your own data privacy instead of relying on an ambiguous interpretation of an ammendment written before the days of digital data.
You can advertise in this sig from as little as £99.99 a month!
Wait a minute. I'm a manager, and I've been reading a lot of case studies and watching a lot of webcasts about The Cloud. Based on all of this glorious marketing literature, I, as a manager, have absolutely no reason to doubt the safety of any data put in The Cloud.
The case studies all use words like "secure", "MD5", "RSS feeds" and "encryption" to describe the security of The Cloud. I don't know about you, but that sounds damn secure to me! Some Clouds even use SSL and HTTP. That's rock solid in my book.
And don't forget that you have to use Web Services to access The Cloud. Nothing is more secure than SOA and Web Services, with the exception of perhaps SaaS. But I think that Cloud Services 2.0 will combine the tiers into an MVC-compliant stack that uses SaaS to increase the security and partitioning of the data.
My main concern isn't with the security of The Cloud, but rather with getting my Indian team to learn all about it so we can deploy some first-generation The Cloud applications and Web Services to provide the ultimate platform upon which we can layer our business intelligence and reporting, because there are still a few verticals that we need to leverage before we can move to The Cloud 2.0.
And if the data center is in another country, would the 4th Amendment apply there?
If so, how would you enforce it? Soldiers with machine guns show up, grab all of your data, crack the encryption, and take what they want. And you'll do exactly what?
The data is gone and seen, so you're screwed. And even if you have super duper one hundred billion bit encryption, your data center and data are gone. So, you have up to the second back-ups?
Other than cost, I see no upside to cloud computing.
at the point when urine drug testing was mandated by the government for any company receiving government contracts. You know back in the days of Ronnie Raygun and the "Just Say No" crusades?
If you aren't secure against government searches OF YOUR OWN BODILY FLUIDS, do you really think that they will respect your right of privacy regarding some random 1s and 0s stored on a private corporation's computers somewhere?
Remember "News for Nerds, Stuff that Matters"? Help make it a reality again! http://soylentnews.org
The US constitutional amendment forbidding unreasonable searches and seizures is well settled in regard to the physical world
Electrons in computers ARE part of the physical world.
Stop conceding that is it different!
IT'S NOT!
They can scoop some out of the bowl when I'm done having my Morning Glory, if they're that bothered about how much I had to drink last night.
They can also just ask me. The answer is "If you haven't brought me some black coffee and dry toast in 5 minutes, I'm barfing on your shoes."
Finally had enough. Come see us over at https://soylentnews.org/
[T]he service provider has a copy of the keys to a user's cloud 'storage unit'
Why the hell would I want to give a copy of the keys to the service provider?
Just because you use the cloud to store bits of data doesn't mean that you'd want to store unencrypted bits of data there. Those that do risk distribution of your unencrypted data via a multitude of channels, including but certainly not limited to:
Why would anyone hand the keys to all their important data to a 3rd party that they don't personally know? Just because they're under a contract with that 3rd party? A contract drawn up exclusively by that 3rd party? With clauses designed to exclusively to protect that 3rd party?
It is worth noting that under the Constitution, there is no federal power to search or seize, at all. Thus people who say that the 4th amendment doesn't list something as protected, like a computer file, miss that point. The 4th amendment is that the government is allowed to search mail, with a warrant, and nothing else.
This is my sig.
This post starts with a false statement. 4th amendment rights are not well settled. They've been challenged and altered repeatedly within the last decade.
Specifically, would it be wise to assume that all, or any, backups will only be taken in america, or that the data won't get routed to or through another country.?
It's a big world out there and the USA is only a small part of it.
politicians are like babies' nappies: they should both be changed regularly and for the same reasons
A bit offtopic but I think it is important for lawmakers : stop doing analogies. Cryptography does not work like a lock or like an opaque case, owning cryptographic keys does not make you the landlord of anything. Cryptography works by taking a clear message and a key and mix them in a way that produces a seemingly random information but that can be made sense of thanks to the decoding key and the decoding algorithm. It is not that hard to understand. It requires 30 secondes of focus to understand and twenty minutes of thinking about and around, and you have understood the basis of crypto.
Dear lawmakers, please make laws about cryptography, not about analogies of cryptography if you don't want me to just be an analogy of a law abiding citizen.
Thanks.
The Wise adapts himself to the world. The Fool adapts the world to himself. Therefore, all progress depends on the Fool.
This is exactly why I donate to the Electronic Frontier Foundation every year. Until these rights are tested for the 'new' electronic medium in a court of law, we need a lobby group dedicated to securing them.
Where would we be if Wheel had hid her round rock in a cave instead of showing everyone how it rolls?