Slashdot Mirror
Patriot Act Clouds Picture For Tech
Harperdog writes "Politico has a piece on how the Patriot Act is interfering with U.S. firms trying to do business overseas in the area of cloud computing. Here's a quote: 'The Sept. 11-era law was supposed to help the intelligence community gather data on suspected terrorists. But competitors overseas are using it as a way to discourage foreign countries from signing on with U.S. cloud computing providers like Google and Microsoft: Put your data on a U.S.-based cloud, they warn, and you may just put it in the hands of the U.S. government.'"
...you put it anywhere on the "cloud", and it's one mis-step away from being everywhere.
Doesn't matter if you comply with EU data protection rules, we still don't trust you.
American companies are scared their data might land in china and copied. This is only news in that the US is turning into the same crazy police state that we've thought was limited to china and north korea.
Four thoughts:
They may well be right in thinking their data will be more accessible to the US government.
If I were an overseas competitor, I'd certainly use this as a reason to not to use a US provider. In a heartbeat.
The law of unintended consequences bites the US yet again.
This wouldn't be an issue if the US government hadn't acted the way it has over the last 10 years. The US government has so little trust overseas that people have no trouble thinking the worst of it. Karma is a bitch.
If you put your data in the cloud, you put it in the hands of not just the US government, but every government the cloud company does business with. And also in the hands of every underpaid employee in the company; and while some companies may claim otherwise, their claims are unverifiable and unenforceable. "Cloud" services have their place - it is for data that is intrinsically public and ephemeral. Nobody should ever trust any cloud service with data that is proprietary or private or irreplaceable.
Most obviously, the "free" services are predicated on exploiting the value of their users as product to customers that are not the users. The model makes sense in some cases, for example a forum, where the shared public content is willing coproduced by users of the forum, exchanging their content creation efforts for use of the forum itself, the forum exploiting that content to attract eyeballs to advertisers that pay the bills.
While there are strong logical reasons why cloud services are intrinsically untrustable (ultimately, he who owns the hardware, owns the data), a simple thought experiment proves the folly: how hard is it to bribe an employee of a cloud service to give you inappropriate access to someone's data? Do you think you couldn't find one employee in one company somewhere? While one may be able to find companies that are currently resistant to easy attacks, cloud companies come and go like the .coms that they are are, and with inevitable waning economic optimism, so too wanes employee loyalty. In the eventual asset transactions that follow, acquiring companies of even trusted entities are unknowns and customers have no recourse and no authority.
At best, the loss of yet another fleeting cloud service means only the loss of the associated data and whatever codependent business line the cloud service customer bet on the serial risk of the success of the cloud company itself.
The premise of handing your proprietary data to another person for remote, invisible processing and care is fundamentally flawed. Your interests are not aligned and their interests will evolve and ultimately diverge or fail.
Foreign companies (and US as well) are well advised to be wary of cloud services.
Except that said US court orders can be executed by a secret court with no oversight. Pretty much like China's.
Check your premises.
We deal with this on a daily basis. Our clients (large Fortune 500 corporations) are requesting that we do not store data in the US. I personally think it has more to do with the fact that they are up to shady financial maneuvers than terrorism, but the end result is the same. It is just another nail in the economic coffin of the United States. The oft claimed, "It is too expensive/risky to do business in the States" rears its ugly head again.
The article talks about "cloud" providers, which we are not. We are more of a SaaS shop, but the regulatory challenges are the same. It all comes down to the client wanting to feel like their data is safe, and that they will have some expectation of privacy. With the United States government declaring the right to come in and seize data (the life blood of any company in this day and age) without any form of real due process, corporations are deciding that they do not want to subject themselves to that unnecessary liability.