Forrester: NSA Spying Could Cost Cloud $180B, But Probably Won't

itwbennett writes "Forrester's James Staten argues in a blog post that the U.S. cloud computing industry stands to lose as much as $180 billion, using the reasoning put forth by a well-circulated report from The Information Technology and Innovation Foundation that pegged potential losses closer to $35 billion. But Staten's real point is that when it comes down to it the cloud industry will likely not take much of a hit at all. Because as much as they voice their displeasure, turning back isn't really an option for businesses using the cloud."

Comments

"the cloud" is just mainframes again

[Dan667]

and all the problems of mainframes (like people spying on you) are being "rediscovered". The problems have not changed and no one will ever care about your data as much as you do.

Re:"the cloud" is just mainframes again

[Samantha Wright]

So is this your way of saying you wouldn't be interested in a mini-cloud in every university department and medium-sized business, or perhaps a personal cloud you could run at home? What about a mobile cloud to put in your pocket? Admittedly, they'll be rather bulky and brick-like at first, but some day they might be as compact and lightweight as, say, a deck of cards or a pocket notebook.

Re:"the cloud" is just mainframes again

[Anonymous Coward]

I'm guessing the biggest losses will be from people and corporations outside the US switching to providers outside the US. Not that the NSA won't have access to those also, but they won't know that.

Re:"the cloud" is just mainframes again

[Anonymous Coward]

There's less of a chance they'll have access, though.

Re:"the cloud" is just mainframes again

[Dan667]

or switching back to their own hardware.

Re:"the cloud" is just mainframes again

[Anonymous Coward]

What?

I think what he's saying is we've spent the past 10 years giving up whatever privacy we gained during the PC revolution and (most of us) are back to the days when BOFHs & random spooks have access to our private bits.

Personally I haven't given up on mainframes entirely but for some services at least (personal email, personal photo sharing) I've moved from Google/Yahoo/etc. to imap & webspace at my alma mater.

Re:"the cloud" is just mainframes again

[cosm]

So is this your way of saying you wouldn't be interested in a mini-cloud in every university department and medium-sized business, or perhaps a personal cloud you could run at home? What about a mobile cloud to put in your pocket? Admittedly, they'll be rather bulky and brick-like at first, but some day they might be as compact and lightweight as, say, a deck of cards or a pocket notebook.

A mobile cloud to put in your pocket? If you're being satirical...kudos. If you're sincere...just...this. The cloud is not a mystical place bits go to evolve...it is just a loose metaphor for the aggregate of the large collection of SANs, multi-hop networks, and various application layers sourced to pull a metic fuck-ton of bits from many locations scattered about in IRL back to your wetware's optical inputs when requested...

Re:"the cloud" is just mainframes again

[Anonymous Coward]

Internet is meant to become anonymous by default.

This will just speed up the time it should have taken to evolve into an un-graspable crypto clusterfuck.

Identity should just be an option, a frowned upon option.

Untempered expression of thoughts comes from anonymity.

Re:"the cloud" is just mainframes again

[subreality]

Not exactly. To the business world "The Cloud" means IaaS: outsourcing their datacenters. They're going from racked servers and storage that they own to racked servers and storage that someone else maintains.

Your point about "mainframes again" applies more to SaaS where people replace their email client and word processor with a web app.

Re:"the cloud" is just mainframes again

[DigiShaman]

FALSE! The NSA cares more about your data than you do!

Re:"the cloud" is just mainframes again

[Samantha Wright]

I'd say obviously that was satire, but terrifyingly at least one of these terms has been used (albeit wildly wrongly.)

Re: "the cloud" is just mainframes again

[crdotson]

If by "mainframe" you mean, "it's the 1980s and I use the term 'mainframe' for any vague computer concept I don't understand," then, sure. :)

Re:"the cloud" is just mainframes again

[s.petry]

This is the answer we have been telling people to keep ever since... well, always!! Businesses dropped common sense for price. Second on the list was usability, and last was security if it was thought about at all. While that would not have protected "Free" email accounts from being tapped so easily, it would have prevented the corporate espionage that the US has allegedly been involved in. Go ahead and Google search "nsa spying corporate espionage" if you want citation, you will find more links than you can read this week.

Third world countries may be able to plead ignorance, or perhaps being duped by various Governments and their agencies. The US, EU, UK, China, Russia, etc.. should all know better but chose to ignore people that work in the field.

Re:"the cloud" is just mainframes again

[s.petry]

I don't agree, mainframes were IaaS, SaaS, and PaaS all in one. You could control every aspect of the computer at a very fine grained level. I'm thinking you are looking at a very narrow view of a mainframe to think them as only SaaS platforms.

Re:"the cloud" is just mainframes again

[Khyber]

"Untempered expression of thoughts comes from anonymity."

You haven't looked at my posting history on this site, have you? If you had, you'd know that A. these words you're uttering are total bullshit, and B. you're a fucking moron for thinking otherwise.

Oh and the fun part, alcohol may or may not have had a factor in what I've posted in the past. I'll leave the answers to that as an exercise for your obviously under-developed brain.

Faggot.

Re:"the cloud" is just mainframes again

[Pi1grim]

Same way pedophiles care more about your children than you do.

Re:"the cloud" is just mainframes again

[Kjella]

Go ahead and Google search "nsa spying corporate espionage" if you want citation, you will find more links than you can read this week.

Not that it may or may not have happened, but that'll give you links of the same quality as "9/11 false flag demolition" and "moon landing faked" - an awful lot of speculation and conspiracy theories but actual proof is pretty hard to come by. Counting hits on Google isn't exactly a reliable way to measure truth,

Re:"the cloud" is just mainframes again

[Anonymous Coward]

For personal emails unless you're encrypting your emails you only gain a little in privacy Most email is transferred from server to server in plaintext.

And if both parties are actually encrypting emails (with PGP) you can actually still use cloud webmail. All they and anyone in between would see would be the encrypted emails (and of course the sender/recipients and other unencrypted metadata).

Similar thing for photo sharing - unless you're giving out accounts and using https you don't gain much in privacy.

Re:"the cloud" is just mainframes again

[SuperDre]

a mini-cloud in every university and medium-sized business is called a local server, we've already got that..
A personal cloud you could run at home, is called a harddrive in your PC, we've already got that...
A mobile cloude you could put in you pocket is called a mobilephone/tablet, we've already got that...
Just like people call every application an App these days (even though it always have been called that, as App is short for application)...
Nothing new, only a new hyped name....

Re:"the cloud" is just mainframes again

[rts008]

Counting hits on Google isn't exactly a reliable way to measure truth,

That is an excellent point, but sadly it plays right into that 'truthiness' nonsense that seems so popular lately.

Re:"the cloud" is just mainframes again

[CRCulver]

Not that it may or may not have happened, but that'll give you links of the same quality as "9/11 false flag demolition" and "moon landing faked" - an awful lot of speculation and conspiracy theories but actual proof is pretty hard to come by.

The European Parliament's 2001 report on ECHELON details some cases of corporate espionage on behalf of the US against European firms, and its reliabilty has always been assumed, plus those accusations went on to be confirmed by other serious media investigations of the NSA. Sure, a Google search is likely to turn up some speculation and conspiracy theories, but I assume that that report will be fairly high in the search results.

Re:"the cloud" is just mainframes again

[Cederic]

Fuck email and word processing.

How about the entire ERP system, end-to-end marketing, sales, billing and invoicing.

A massive humungous cost, slow and cumbersome to change, and now all possible to implement in a few days at low enough cost to put on your credit card.

You also benefit from the underlying PaaS and IaaS, so the systems scale easily and you only pay for usage so TCO is easier to predict and only rises if you grow.

I'm not arguing against replacing desktop apps with cloud based solutions, but focussing on those neglects far bigger opportunities that the market is embracing.

Re:"the cloud" is just mainframes again

[dreamchaser]

There's less of a chance they'll have access, though.

Not really. They will have just about as much access everywhere as they have in US based service providers.

Re:"the cloud" is just mainframes again

[gweihir]

Unlikely, or rather not directly. Privacy laws have a lot more teeth in Europe than they do in the US.

Re:"the cloud" is just mainframes again

[wbr1]

All of the problems? Do I need a TN3270 terminal emulator to access the cloud?

Re:"the cloud" is just mainframes again

[Anonymous Coward]

Privacy laws that apply to businesses. It's debatable whether they also apply (practically, not necessarily legally) to government.

Re:"the cloud" is just mainframes again

[gweihir]

They apply for example when a company moves personal data into a domain under control of a foreign government. That typically requires a waiver from each data owner, creating huge costs and the problem of how to deal with people that do not sign that waiver. There are some exception for places that have the same level of privacy protection, and that was used in the past to make moving personal data to the US legal. I doubt that will continue, and people can withdraw their permission for the storage and processing of their personal data at any time, requiring the company to delete that data. While that does not remove NSA access, it does create a huge headache for the company affected, and hence more and more European companies will refrain from using non-European cloud providers. And there, direct NSA taps are illegal and can get those responsible sent to prison. Of course, collaboration of the local spying agencies with the NSA is still possible, but there will be at least some care for national interests in that case. For example, German companies have been warned by the BND in the past to not send any trade-secrets in any electronic way, but to use snail-mail instead.

A second issue is that more and more businesses realize that their business secrets are not secure in clouds of any type. I know of one large organization that canceled a move to Office-365 because of the current scandal. Before, the IT security people did object but were overruled by upper management. Now upper management has stopped ignoring the problem and has discovered that moderate costs savings are not worth having this level of exposure, also because of a huge reputational risk due to possible customers outrage.

Re:"the cloud" is just mainframes again

[drinkypoo]

It really isn't, although it has many of the same problems. It also solves some problems mainframes don't solve, like availability; if your building is crushed by a meteor or some other such improbable event, even the mainframes of old which could survive crashing through to the floor below while pulling their mains cables with them will be lost. But in a cloud computing scenario, in theory your field agents can continue working without even being aware that the home office has been consumed by fire. This in turn brings up a new problem; with a mainframe at least you knew who was spying on you. With the cloud, anyone could have access to your data, anytime, anywhere.

Re:"the cloud" is just mainframes again

[Lord Lemur]

That was kind of his point Dre.

Re:"the cloud" is just mainframes again

[solidraven]

Sorry, posting because I moded incorrectly. *Curses at touch screens*

Re:"the cloud" is just mainframes again

[s.petry]

Are you really trying to claim that you must trust that the Government is "good" and "innocent" when proof is absent? Do you know how many people were called "crazy conspiracy theorists" that were warning people about the Government trying to entrap MLK? Then we read about COINTELPRO and Operation Mocking Bird later, and find out they were correct. Do you know how many people said that the Government was poisoning people in St. Louis and were called "Crazy Conspiracy Nuts" just to find out later the US Government was dumping radioactive isotopes on them? NOTE: I'm not bothering to provide links to COINTELPRO, it's too easy to find.

Those are two very easy examples out of thousands! If you read what architects and engineers ask about 9/11 you will find many very high quality questions.

I agree that counting Google hits is not a way to measure the truth, but if you actually read some of the content you should be questioning what people tell you.

Re:"the cloud" is just mainframes again

[Anonymous Coward]

You're absolutely right, there's no way Google would ever let anyone, like the nsa, have access to their cert to decrypt your email. Why that's preposterous!

Re:"the cloud" is just mainframes again

[hesaigo999ca]

Dude, I am so laughing right now, the guy said cloud "in your pocket", is that not the same as your own mobile zip drive that you can own for as little as 50$ from besdtbuy. I think if he could not grasp what he said, he might not catch what you said and you might be wasting your breath .....like trying to explain to someone why there is no refill on the halogen inside the headlights on your car. :)

Re:"the cloud" is just mainframes again

[Dan667]

I'd still take problems I can act on than being an unimportant Customer to someone like Amazon. When ec2 failed for Reddit they were down for a very long time with no way to recover and told they were queued to be helped.

Re:"the cloud" is just mainframes again

[idontgno]

+1 Icky

Re:"the cloud" is just mainframes again

[Anonymous Coward]

Dude, I am so laughing right now, the guy said cloud "in your pocket", is that not the same as your own mobile zip drive that you can own for as little as 50$ from besdtbuy. I think if he could not grasp what he said, he might not catch what you said and you might be wasting your breath .....like trying to explain to someone why there is no refill on the halogen inside the headlights on your car. :)

You guys call yourself tech geeks? Yeah, you could have a "cloud in your pocket", you already probably have a device nearly capable of doing so. In fact the Samsung S4 is entirely capable of doing this, setting up ad hoc networks as other devices come in range (WiFi or Bluetooth), it's only the network uplink that's still slow and crappy, LTE is blazingly fast but it has its limits (mostly spectrum and the fact that we support capitalism which has given us a fractured and crappy experience). Samsung even built an open bluetooth SDK for the S4 and later devices to support this kind of functionality.

Yes, you could have access to the entire cloud from your phone and the phone itself could function as an ad hoc network hotspot.

Re:"the cloud" is just mainframes again

[tnk1]

Agreed. The ability to get those sorts of systems up in the Cloud rapidly and in a scalable fashion is great. Having personal involvement with products used in a Cloud based infrastructure, there is a real ability for us to ramp up all sorts of resources for customers in a very short amount of time.

There are certainly security concerns, to be sure, but aggregating your data with some cloud providers allows smaller organizations to make use of the security capabilities of larger providers, which I can tell you is a big help.

Although, I have to admit that you're certainly more vulnerable to something like NSA spying if you assume that the IaaS provider is cooperating with them, for many things, it's really not all that big a deal. Either they could have found it out easily another way, or what you're doing with the Cloud app is just not going to produce any data that is interesting to them or harmful to you. And that's assuming that we believe that their programs are all-seeing, which I am certain they are not, despite their penetration of certain large organizations.

Re:"the cloud" is just mainframes again

[Anonymous Coward]

Go ahead and Google search "nsa spying corporate espionage" if you want citation, you will find more links than you can read this week.

Third world countries may be able to plead ignorance, or perhaps being duped by various Governments and their agencies. The US, EU, UK, China, Russia, etc.. should all know better but chose to ignore people that work in the field.

I look at the results and the best I could find was

At the moment, the European business community only has suspicions that industrial secrets were stolen by US intelligence agencies. Typically, stolen technologies and products show up in the hands of competitors or foreign countries years after they were originally taken.

I don't get it, what were you expecting us to find?
This?

In addition to spurring discussion on the tension between civil liberties and antiterrorism policies, the NSA leaks will have another, less widely recognized consequence: They will significantly increase the level of state-sponsored economic espionage directed against American companies.

Where are all the links to NSA sponsored corporate espionage?

Re:"the cloud" is just mainframes again

[Anonymous Coward]

Are you really trying to claim that you must trust that the Government is "good" and "innocent" when proof is absent? Do you know how many people were called "crazy conspiracy theorists" that were warning people about the Government trying to entrap MLK? Then we read about COINTELPRO and Operation Mocking Bird later, and find out they were correct. Do you know how many people said that the Government was poisoning people in St. Louis and were called "Crazy Conspiracy Nuts" just to find out later the US Government was dumping radioactive isotopes on them? NOTE: I'm not bothering to provide links to COINTELPRO, it's too easy to find.

Those are two very easy examples out of thousands! If you read what architects and engineers ask about 9/11 you will find many very high quality questions.

I agree that counting Google hits is not a way to measure the truth, but if you actually read some of the content you should be questioning what people tell you.

The Daily Mail is a tabloid, and the government was not researching health effects, it was testing for the dispersion of the material which was selected because it was easily detectable. Maybe radium was involved, maybe not, but bear in mind this is from the time we had factory workers putting radium on as lipstick.
Notice none of the people involved in the project are wearing masks in the pictures... The intent of the research was entirely mundane, period.

Sorry, s.petry but your "go look it up" Limbaugh/late night conspiracy show style is a little too obvious, you are a conspiracy nut.

lolwut?

[girlintraining]

the U.S. cloud computing industry stands to lose more like $180 billion,

Oh noes! That's almost as much as much money lost due to coffee machine breakdowns in the break rooms of the country! Well, at least according to the Figures Outta My Ass Department.

What I'm trying to figure out is... how does the use of more computational resources lead to a "loss"? The NSA needs a lot of "cloud" to process all that data they're collecting... Amazon and several other vendors have been jumping at the chance to create 'government cloud' services... several are in production now. Were these taken into consideration? No.

The idea that businesses are going to jump ship because of NSA spying is ridiculous. For one thing, most countries are doing the same thing the NSA is doing. Hell, the French and the Chinese are so well-known for their industrial espionage that CEOs travelling to those countries won't use the local internet, fax machines, phones, etc. This is SOP for large businesses and has been for over a decade.

Bailing out of US data centers isn't going to improve security in any real way... anyone who does the analysis quickly realizes that every major world government is spying on all the other major world governments... and their businesses.

I mean, what do you think other intelligence agencies do...? -_-

Re:lolwut?

[Anonymous Coward]

The idea that businesses are going to jump ship because of NSA spying is ridiculous.

Then you're not paying attention; some already have.

For one thing, most countries are doing the same thing the NSA is doing.

[citation needed]

Re:lolwut?

[Anonymous Coward]

[citation needed]

Actually, Most Countries Are Increasingly Spying on Their Citizens, the UN Says.

Re:lolwut?

[DeSigna]

Then you're not paying attention; some already have.

Agreed. In every discussion I've had with customers about IaaS and cloud, the security aspect has been the #1 topic of conversation brought up by the customer. Closely followed by performance.

Businesses of all sizes and industries are very interested in all this mess in the cloud space.

Re:lolwut?

[AmiMoJo]

In other words it isn't just the US cloud market that will lose money, it is the entire world. In my experience companies are quite concerned about security, even if they don't understand it.

Re:lolwut?

[CRCulver]

The NSA needs a lot of "cloud" to process all that data they're collecting... Amazon and several other vendors have been jumping at the chance to create 'government cloud' services... several are in production now.

Creation of computing infrastructure for a government three-letter agency does not compensate for loss of trade to other countries. Making something for the government does not contribute to the economy unless its innovations flow back to the market, as the government is using tax money raised from the market to pay for it.

This is not the Apollo program where all kinds of great inventions paid for by taxpayer money went on to be used in civilian manufacturing processes and ultimately boosted the economy. In this case, whatever great things are created for the NSA are not likely to be declassified for decades.

Re:lolwut?

[gweihir]

Actually, European standard is that companies must protect their customer's data against spying, which may just mean that there is no legal way form them to out-source to US data-centers. In the past, the "save haven" fiction (equivalent data protection laws at the target location than at the source location) was used, but with the current scandal, that may just have gone out the window and processing personal data in the US or in infrastructure under US control or with US data access may now be illegal and criminal (i.e. the decision maker is at risk to go to prison).

The second problem is, that in Europe, personal data belongs to the person, not the company holding it. That means any company that wants to store my personal data has to get my permission first, and I can revoke that permission. A consequence is that people can force companies to not store or process their personal data in the US or in data-centers with US access, by simply not allowing companies that do to process their personal data in the first place.

Re:lolwut?

[Anonymous Coward]

Our own governments spying on us is NOT the same as a foreign superpower doing the same - you aren't looking at this from the perspective of a non-US citizen. We can't vote in your bloody elections, we can't change a damn thing about your authoritarian government.

But we CAN stop using your software. Believe me it is already happening. 60% of EU businesses are dropping US cloud based solutions. Why on earth should we not only let the US gov spy on private commercial communications, but no doubt allow that information to be passed to our American competitors. Screw you. Not happening.

And tough shit if you lose jobs over this. You deserve to. Sort your shit government out and then we can talk.

Re:lolwut?

[girlintraining]

Making something for the government does not contribute to the economy unless its innovations flow back to the market, as the government is using tax money raised from the market to pay for it.

You mean like, The Internet ?

Re:lolwut?

[CRCulver]

The Internet didn't stay a government secret, and universities were involved pretty much from the get-go. That's a big difference from companies cashing in by providing three-letter agencies with technologies are going to stay classified for a good long time.

funny numbers pulled out of ass

[udachny]

These numbers are pulled out of asses of those, who pretend to be analysts and prognosticators in this case. 35 billion to 180 billion to infinity, beyond and back. The difference between 35 and 180 is about 500%, that's a fun estimate for anything at all.

How much should we charge for this gizmo?
1 dollar.
No, that's too little.
OK, 1 trillion dollars.
Too much.
OK, 2 dollars.

Besides, dollar amounts are a useless measure anyway, what are dollars? What are dollars when they are printed to "pay back" any debt? Nothing at all.

In any case, anything can be called a cloud. I can call my toaster a cloud if I plug CAT5 into it.

Two years to go

[Okian Warrior]

It'll take about two years for this problem to disappear.

There's an enormous monetary incentive for cloud services to implement good privacy. Anyone who doesn't implement it will get their lunch eaten by someone who does.

There's already a massive exodus away from US based servers, both at home and abroad. People are thinking through the ramifications of having their sensitive information used as "incentives" to help business. Your client lists, sales information, costs and accounting - if any part of your local network is in the cloud, the US can rifle through it and trade the information to another company in return for help fighting terrorism. Many people will choose to believe that this is not happening, but what the heck - who can tell any more?

This is a self-correcting problem.

Mega has announced an encrypted E-mail service, the client software will be open for public inspection, and none of it will be hosted on US servers.

Google has admitted in court that they don't think users have an expectation of privacy.

Which E-mail service would you rather use? The one from a sleazy convicted criminal, but with impenetrable security? Or the one from a company that always rifles through the contents, but promises to only do it for the better good?

Re:Two years to go

[rtb61]

The real question is will US three letter agencies bloated top heavy with for profit corporate contractors, simply indulge themselves in industrial espionage, there are just hundreds of billions to be made. Will they see an opportunity for inside trading on shares again billions to be made and just a key press away on the cloud.

How many countries will be stupid enough to allow this to happen, not just in global markets but locally in their markets. How destructive could the US become in economic warfare, how destructive could all the for profit corporate contractors neck deep in US intelligence agencies in their quest for profits.

Seriously will they resist the temptation to strip mine other countries economies, buy up all the assets and leave everyone beholding to the US. Stop and really think about what can be fiscally done when you have free access to the business cloud, every business email, every business phone call and can hack into every business network. Total global financial control and can't US corporations be trusted with that, ABSOLUTELY FUCKING NOT.

Re:Two years to go

[Earthquake Retrofit]

Which E-mail service would you rather use? The one from a sleazy convicted criminal, but with impenetrable security? Or the one from a company that always rifles through the contents, but promises to only do it for the better good?

Neither. I suppose I could do without.

Re:Two years to go

[Desler]

Which E-mail service would you rather use? The one from a sleazy convicted criminal, but with impenetrable security? Or the one from a company that always rifles through the contents, but promises to only do it for the better good?

Neither. That's a classic false dilemma.

Re:Two years to go

[Anonymous Coward]

but with impenetrable security

You're joking, right? You can't really be that retarded, can you?

Re:Two years to go

[s.petry]

It's a much more complex fix which will basically cause an upheaval in all major current world powers in terms of throwing out politicians. What most people are not looking at with the Snowden leak is that the NSA and Germany were very clearly working hand in hand, sharing data on people that someone didn't like. The same can be said about the US and UK, and the US and France, and the US and Spain, etc.. etc... What makes you believe that those connections are simply bi-directional? There is a lot of anecdotal evidence which should make you question how deep this rabbit hole really goes.

In many cases, the targets were people that did not agree with the politics in either country. Look at how effectively the US and Germany have shut down any and all political dissent. Media won't touch protesters except to mention the "unpatriotic criminals", police show up in mass at rallies and protests, protesters are detained harassed at the orders of higher ups. If it's illegal for the US to spy on citizens, how did they know an impromptu rally was happening in a certain location? The obvious answer is that someone else provided them data because that was a legal loophole.

It's not just the US that needs to consider removing the political class and going back to what Socrates said when he defined the Republic. That change is needed very much globally. In case you didn't read Plato's "The Republic" Socrates was very clear than in order for a Government to serve the people, the people and government should never allow a Political class. Duties of Representation need to be shared among community members, not held by people willing to leach off of society.

Re:Two years to go

[Anonymous Coward]

oh yes, yes he/she can.

welcome to the internet, you must be new here....

Re:Two years to go

[Virtucon]

Google has admitted in court that they don't think users have an expectation of privacy.

That's being blown out of proportion because Google's lawyers are echoing the Supreme Court ruling regarding your turning over information to any third party means that you have no reasonable expectation of privacy.

“a person has no legitimate expectation of privacy in information he voluntarily turns over to third parties.” Smith v. Maryland, 442 U.S. 735, 743-44 (1979). In particular, the Court noted that persons communicating through a service provided by an intermediary (in the Smith case, a telephone call routed through a telephone company) must necessarily expect that the communication will be subject to the intermediary’s systems. For example, the Court explained that in using the telephone, a person “voluntarily convey[s] numerical information to the telephone company and ‘expose[s]’ that information to its equipment in the ordinary course of business.”

Still, with Google's complicity and other US firms having to help the NSA and FBI with warrant-less searches of data, the bigger issue is that our best and brightest in terms of Technology and revenue will take a big hit as more and more people around the world push away from their services. So while complying with the law, these companies have hurt their own businesses. This includes all of the Telecom companies as well providing broadband services. This will open the door for other firms from competitors overseas to step on in at our expense. So while trying to defeat terrorism, the US has hurt the prestige of its high tech firms and further eroded our faith that our government.

I for one will encourage everybody I know to vote out every SOB in congress that has been there longer than 4 years because it was those assholes who opened the door for all of this spying on our citizens and violating our 4th amendment rights.

Re:Two years to go

[wmac1]

Neither. An email service hosted in a data center in my own country by a local company.

For my company I will use my own dedicated server in a local data center.

Re:Two years to go

[Anonymous Coward]

Piss off you pedant.

Re:Two years to go

[Anonymous Coward]

But why can't the NSA just hack into any foreign cloud server? Here they have to tip toe around it, but let me look about the US constitution's protections for other countriest (404 Page not fucking found)

Re:Two years to go

[Anonymous Coward]

Not if the spying entities and corporations get 10x from our tax money..

Re:Two years to go

[interkin3tic]

So you're saying that cyber-colonialism will be justified as "for security" or "terrorism." Genius.

I guess the silver lining is that at least it won't poison, enslave, or indebt the locals, it's not establishing banana republics, and it wouldn't be fighting proxy wars and killing them as collateral damage (though I suppose that's obsolete, now they're automatically enemy combatants if they died from our bombs). That's kind of an improvement. Still a long shot from playing nice, but baby steps towards ethical foreign policy, I guess.

I suppose it's not mutually exclusive with also raping and pillaging the old fashioned ways though.

We might just have to wait but...

[Anonymous Coward]

Couldn't it be possible (assuming our ISPs in the future provide real internet connections) to host a personal cloud that we could just point our phones/email to with one setting and everything "just works" (also assuming cloud software becomes easy to install/configure/use)? Or maybe I'm just dreaming! I basically want to WRT router version of a personal cloud for home, someone make it, quick!

--stoops

Re:We might just have to wait but...

[buswolley]

My data, I share it with agreed on tags. You see it. Shared. Done.

Political Corruption and the NSA

[Anonymous Coward]

I want to read about how NSA spying was used for political corruption.
Find that out and it will all fall down.

Re:Political Corruption and the NSA

[buswolley]

And Yes, I know I've failed to contribute.

Re:Political Corruption and the NSA

[istartedi]

I've always assumed they were using it for financial corruption. Who cares about what empty suit is sitting in office when you can score the quarterly reports a few hours early? Yeah, yeah Senator so-n-so. They pay both parties. Who cares. It's the FINANCIAL DATA. Because, you know... that's where the money is.

Re:Political Corruption and the NSA

[zippthorne]

Right, just like when we shut down the FBI over the same thing....

Open Source Failure

[buswolley]

My information is my private property.

Why isn't there a "simple" host your own "data manager" for people that will be their "email, social, storage server"?

If opensource had a cause, that should be it,

Re:Open Source Failure

[buswolley]

And yes, I know I've failed to contribute code

Re:Open Source Failure

[Anonymous Coward]

I wonder how much work that would be.

The heavy lifting has been done; linux with apache, (what are some good mail servers these days?), and diaspora would cover all the bases.

Harder parts would be
- Fitting it to hardware. It would have to involve no tinkering with drivers
- The UI
- DNS

In other words it seems like the work that's needed is the kind that that fruity firm is known for: elegant packaging of existing technology.

Re:Open Source Failure

[wierd_w]

Given it is a one trick pony (give or take), something like a broadcom SoC with 500mb of on-die RAM, 2 processor cores, an SDCard slot able to have mount points with the root filesystem (for update capabilities), and 1 to 2gb of SRAM on a busmastered connection serviced with GPIO lines for compressed swap space would do it nicely.

You could probably make a consumer product out of it for a retail target of around 100 to 130$.

Because it is a SoC, the hardware is fixed. This makes configuration a non-issue, if the core image is properly configured.

Re:Open Source Failure

[wierd_w]

(Hint: this is basically a BeagleBone, with some SRAM wired to the 40(!) GPIO pins it offers.)

Re:Open Source Failure

[Nohea]

Look at the Tent project - http://tent.io . It is just getting started, but that is the vision.

Re:Open Source Failure

[Aguazul2]

My information is my private property.
Why isn't there a "simple" host your own "data manager" for people that will be their "email, social, storage server"?
If opensource had a cause, that should be it,

If everyone uses encrypted cloud storage, with the encryption performed on the local machine, that means that the only attack vector remaining to the NSA is your local machine. This means backdoors in your OS or your application software. For Open Source that means trying to sneak backdoors into open-source projects, or closed-source software commonly used on FLOSSy OSes. We should be prepared for the attack (e.g. should we trust Chrome builds from Google, for instance, since they are already compromised by their relationship with the NSA?)

All you need to know about CLOUD and JAVA

[Anonymous Coward]

JAVA

http://www.google.ca/trends/explore?q=qsort#q=java&cmpt=q

Scroll down to the map where INDIA is highlighted and nothing else is.

CLOUD COMPUTING

http://www.google.ca/trends/explore?q=qsort#q=cloud%20computing&cmpt=q

Scroll down to the map where INDIA is highlighted and nothing else is.

H1B

http://www.google.ca/trends/explore?q=qsort#q=h1b&cmpt=q

Forrester Just Not The Same Without Enderle

[Freshly Exhumed]

Ever since the Linux community forced Rob Enderle to quit his analyst job at Forrester over all that SCO nonsense I just can't take Forrester seriously. Hee hee. Heeeeeeheeeee.... ha ha ha ha HA HA HA!!!!!!!1 I'm sedated now.

NSA != cloud computing

[Anonymous Coward]

The NSA purview > cloud computing, and everything else.

Sounds like James Staten (and Others) ...

[Anonymous Coward]

Have not heard of, say, Tahoe-LAFS or other P2P projects.

Piffle

[onyxruby]

First of all, other countries also actively spy on their citizens and almost any place you can think of is going to allow it if they think it is in that nation's interest. Moving from the US to France or any other country does nothing but change the host country.

Incidentally if your the type to stay up all night worried about the NSA boogeyman you'll want to remember that the NSA has pretty free reign /outside/ the US. It's a case where at least they have some legal restrictions within the US (you argue whether these are enough or not, but they do exist to some degree). Remember, gathering information from outside US borders is their job and moving your data outside the US simply gives them legal cart blanche they may not have previously had.

I'm also going to nitpick this 'cloud' thing. Cloud is just another way of saying servers in another location. That location might be somewhere in Iowa or India, however private clouds on your property can and do exist. Originally we called this idea the main frame, than we had thin clients / terminal services and now we call it the cloud. Same damn thing, you log in remotely to utilize services provided by a server. Cloud used to actually have a real meaning, but nowadays really just means 'server'.

Re:Piffle

[girlintraining]

I agree with that on the whole, but the NSA seems to be having a pretty free reign inside the country too lately. I could give a flying fuck through a rolling doughnut what the NSA does to people who aren't american citizens... as long as it's not a war crime or some kind of violation of universal human rights... pretty much anything we (or most other countries except us) signed a treaty saying is a bad thing we shouldn't even do to our enemies.

But I do have a problem with them slurping up and keeping records of its own citizens data without judicial process... and lately, there's been a lot of questions about the integrity of this organization. Enough to warrant a closer inspection at the least.

Re:Piffle

[Anonymous Coward]

I could give a flying fuck through a rolling doughnut what the NSA does to people who aren't american citizens

You could? So could I, because I too care about people who don't live in my home country.

Re:Piffle

[Anonymous Coward]

Really? Care to give us some empirical evidence of that, or are we just supposed to take your word for it? What material thing have you done for people in other countries that would constitute proof that you care about them?

Other costs

[gmuslera]

Wonder what would be the economical impact of most of the countries of the world rejecting all agreements of protecting intellectual property with US. After all, if US don't respect the IP of their citizens/companies/government, they are violating those agreements.

BS...

[Anonymous Coward]

Turning back is **ALWAYS*** an option for any business.

Murmurs from an internet nobody.

[EmperorOfCanada]

I recently took a course on Cryptography and the guy basically showed that with system after system that if he could pick just the tiniest thread loose he just tossed the algorithm into the junk heap. One of the other mantras was don't roll your own; you don't have enough Phds. But when it came to things like AES he seemed pretty confident. At the time of the course I nodded my head and wasn't thinking paranoid thoughts. But if we have learned anything this last month it is that you can take your typical person you once dismissed as paranoid and multiply their ravings by 3.

So my paranoid raving #1 is that they can break any of the common encryption schemes. Some mathematicians might say pshaw but hey this is now a post Snowden world. If commonly accepted encryption isn't broken then yay!

But for those with real good data such as bankers who don't want the NSA handing the data over to Goldman Sachs (why not as they make for great conspiracy fodder) then I would only use one time pad encryption. Good luck finding a mathematically loose thread there. A simple way to do one time pad encryption is just like the old spies. You send say 5 people over to your destination each with a different 1TB memory chip containing truly random data. (radioactive decay, xored with rain xored with a lava lamp) Then when you transmit data you xor it through all 5 layers of random data.

But as for the article if I were in Europe I would move my servers to Europe tomorrow. These government goons all think alike so I suspect that even the Euro police will cooperate anyway; they'll just deny it in a different accent. For instance, I sit in Canada and don't believe for one second that the local police wouldn't pee themselves with delight if the us Feds asked them to do something.

So the giant rethink in many security setups will have to be EVERYTHING that I don't control is completely compromised. Even individual employees could be compromised. Thus I would only use data schemes that would require the blackmailing/threatening/screwing of many employees.

But the simple reality is that this requires everyone to become a Rosa Parks. Every employee at these big companies needs to step out and spill the entire truth. If one person comes out they are Snowden II. If 100 come out the party is over.

Re:Murmurs from an internet nobody.

[Anonymous Coward]

Bullshit. That was an interesting post. Which part didn't you understand? Anyone can write beautifully crafted English that is utterly devoid of original thinking - if you need proof, take a class in "looking in the mirror".

Re:Murmurs from an internet nobody.

[N1AK]

But as for the article if I were in Europe I would move my servers to Europe tomorrow. These government goons all think alike so I suspect that even the Euro police will cooperate anyway; they'll just deny it in a different accent.

This is a good point and reasoning. It's easy to imagine that everyone is going to look for some super data haven, or that one doesn't exist so no one will do anything. Those are the two extreme views and sadly due to the wonders of internet arguing get most of the focus. Another option is that you at least limit your data to fewer organisations and ones that in general are more likely to be on your side.

One thing the Snowden affair has shown is that citizens are far more bothered about their rights being abused than foreigners. He lost a lot of sympathy later on when he outed secrets, that as a European I appreciate, but American's didn't because it wasn't them being spied on.

Re:Murmurs from an internet nobody.

[lexman098]

You send say 5 people over to your destination each with a different 1TB memory chip containing truly random data. (radioactive decay, xored with rain xored with a lava lamp) Then when you transmit data you xor it through all 5 layers of random data.

Sorry to derail the conversation a bit, but if just one of your sources was truly random wouldn't that be enough? As far as I know you can't be more random than random.

Re:Murmurs from an internet nobody.

[Anonymous Coward]

You are correct, a single truly random source is sufficient. The advantage of combining several is if it turns out one or more of those isn't truly random, the output will still be random as long as one of those inputs is truly random. The danger is if none of those inputs is truly random.

Re:Murmurs from an internet nobody.

[EmperorOfCanada]

You should take a class in professional communication. You have some serious problems writing coherently.

I apologize. My excuse is that I often read/write slashdot after working a 16 hour day. My other failing is that I will hit submit and then read what I wrote as opposed to checking during the preview. This results in my realizing that I just said something like that I work a 160 hour day or a 1 hour day. My best posts are when I write 300 words and then cut it down to 80. My worst are when I leave it at 300.

And I am not being sarcastic when I ask if you could suggest the fastest quality online course in communications (I don't have a whole lot of time to spare).

Re:Murmurs from an internet nobody.

[EmperorOfCanada]

This is an excellent point. If you had truly random data and then xored it with 123412341234 the crappy 1234 would add very little to the cryptographic strength but it wouldn't take away from the uber random layer. Ideally you would use layer upon layer of randomness. Seeing that you don't need to generate it in realtime you would have the luxury of just piling on many very different types of randomness. This way even if it turns out that say the lava lamp has a mathematical weakness along with the rain having one you just keep adding new layers. Ideally you are using things that are so random (radioactive decay) that if anyone figures out a way to predict it they win a Nobel prize. I think predicting radioactive decay is the Nobel equivalent of a Scratch and win.

I really like

[no-body]

the "loosing money" term.
You can loose something which you own and not something which you "may" get, or not...
Sounds similar to the same train of thought happening in brains of RIAA, MPAA folks and friends when they claim those fantastic numbers of "lost" revenue due to actions of others.

Just a balloon of ideas in people's head goes poof...

Re:I really like

[oodaloop]

If your money is loose, try tightening it back down.

Wait till governments get involved

[Camael]

Because as much as they voice their displeasure, turning back isn't really an option for businesses using the cloud.

Maybe in the US, but worldwide is a different matter. Governments could easily force the issue by forbidding the use of US cloud companies, especially for their companies that deal with issues of defence and national security.

Lest you think its farfetched, China already bans the use of Google, Facebook, Twitter, YouTube, and FourSquare in China. Local alternatives such as Sina, Tencent, qq etc. took their places fairly quickly. After PRISM, more governments may follow suit.

Re:Wait till governments get involved

[EmperorArthur]

The EU is already considering requiring all companies to only use servers that comply with EU privacy regs. The US doesn't. That alone accounts for quite a bit of lost business. I'm pretty sure that in the face of, "Don't use US servers or we'll seize all your assets," that companies will reconsider the, "not an option."

Re:Wait till governments get involved

[Anonymous Coward]

Lest you think its farfetched, China already bans the use of Google, Facebook, Twitter, YouTube, and FourSquare in China. Local alternatives such as Sina, Tencent, qq etc. took their places fairly quickly. After PRISM, more governments may follow suit.

Not to nitpick, but China bans some Google sites and services, but not all. Just which ones depends on what part of the country you're in, and how/where you access the Web. GMail and Google Translate generally aren't blocked. FB and YT are definitely completely blocked anywhere on the mainland, though. And the article you link to is talking specifically about Google+, BTW.

I know about this because I just spent 3 weeks in China.

Oh, and be careful with Google Translate--some very unhelpful people apparently have been "correcting" some of the Simplified Chinese results with Traditional/Cantonese characters and pronunciations, even though Simplified is used only with Mandarin.

Captcha: ellipsis (heh)

Re:Wait till governments get involved

[am 2k]

Not quite, the EU already requires adherence to the privacy regulations. The only thing that is discussed right now is the problem that it's officially ok to use the US, even though its companies actually aren't adhering to them.

"Loosing money"

[Arker]

"You can loose something which you own and not something which you "may" get"

Actually, you can only loose something which you have leashed.

You might have been thinking of "lose" instead.

Big Brother & Cloud Computing

[lionchild]

If big business, or any sort of business, that employs cloud computing models becomes truly concerned about the security of their data, that Big Brother is getting a copy of everything, then they'll either move their data outside the reach of Big Brother, they'll encrypt everything and leave a speed bump to be overcome, or they'll embed their own personnel in the data center so they'll know when a mysterious new server shows up that's mirroring their data traffic. Or, they'll not use cloud computing on someone else's cloud, they'll have their own, run by their own data center.

Now, as for SMB, that's where you'll find a market for non-US based cloud systems, IMHO. And, being non-US, outside the reach of Big Brother, they may be willing to pay a little more, not a lot, than going rate for cloud systems that are US-based.

NSA Killed The U.S.A. Cloud Industry

[Anonymous Coward]

'Privacy' is an illusion.

The U.S.A. Constitution is ignored by 99% of the Federal Government, i.e. the Un-elected Federal Government.

But even with those facts, the NSA blew their game and deserve to die, a bloody and ignominious death, one-by-one.

Alexander (Viagra Junky), Clapper (DNI, Alexander's Boss, Mr. Gen. Least Untruth, Meth Junky) and Obama (Pot Head 'Constitutional' Professor, Professor of What?); what a worthless panoply of sperm that should never have lived.

Kill'm All in a CIA holding cell warehouse in Mogadishu.

Better yet, air-drop them in Cairo! Let them fend for themselves, naked and not even a jar of Vaseline for their rectum.

Tor bridges in the Amazon cloud

[Anonymous Coward]

https://cloud.torproject.org/

"This project runs on the Amazon EC2 cloud computing platform, which powers Amazon.com and other major websites. Amazon EC2 allows users to launch their own virtual machines and computing resources with flexible and cost-effective terms"

There are a lot of Amazon cloud exit nodes, too.

IQ is not relevant

[Okian Warrior]

You're joking, right? You can't really be that retarded, can you?

As an outside observer, what do you think about the human race?

I have a measured IQ of 87 so yeah, I can be that retarded - but no more. What's IQ got to do with it anyway?

Here's an IQ test for you, fill in the blank:

rue is to pain as street is to ___________

Re: IQ is not relevant

[Anonymous Coward]

Tu parles francais?

Re: IQ is not relevant

[Anonymous Coward]

Ha, I was going to guess "bread." Somehow I doubt it was supposed to be a French test. For people who don't know French: rue = street, pain = bread.

Re:IQ is not relevant

[Khyber]

You do understand you're being called retarded due to your absolutely stupid and ludicrous statement of 'impenetrable security' yea? Are you really that retarded to not see this?

Man can make it, man can break it. Impenetrable security is BULLSHIT, son.

I've Said It Again, & I'll Say It Before...

[Anonymous Coward]

Save your business; Move offshore. Save your personal data; Use services outside the NSA.

Oops, freudian slip there. I meant to say the USA.

GAH! that word "cloud"

[shuz]

I believe it is realistic to say that turning back really isn't an option for businesses using the "internet". However those businesses don't have to go with an internet application or hosting vendor based out of the USA. I think it is realistic that some companies could look elsewhere. However most large and medium companies already doing business in or with the USA are unlikely to change many habits as they must already comply with a lot of regulation. It is also worth noting that no leaks have come out suggesting that the US government is using surveillance programs to commit corporate espionage. It has been suggested that other countries have been complicit with corporate espionage. Funny thing is a lot of companies are chomping at the bit to gain access to some of those countries which I won't name but if I was Canadian I might say something like "a country that has Ch eh iN eh in the name"

It's OK, They're Locked In

[Bob9113]

But Staten's real point is that when it comes down to it the cloud industry will likely not take much of a hit at all. Because as much as they voice their displeasure, turning back isn't really an option for businesses using the cloud.

So let me see if I'm reading that correctly: The free market would not choose to use these services under these conditions, but it's OK because they're locked in, so fuck 'em. That's a helluva way to run an economy -- how could that attitude possibly bite us in the ass in the long run?

Retarded maybe, but it met my objective

[Okian Warrior]

You do understand you're being called retarded due to your absolutely stupid and ludicrous statement of 'impenetrable security' yea? Are you really that retarded to not see this?

Man can make it, man can break it. Impenetrable security is BULLSHIT, son.

One of my favorite overheard comments: "It's not enough to be right, you also have to be effective."

You understand why I chose that particular phrase, right?

Re:Retarded maybe, but it met my objective

[Anonymous Coward]

Parent is not human.
Parent is bad AI.

Turning sideways

[Anonymous Coward]

Turning back may not be an option for businesses that throw away all their own IT resources, but turning sideways is definitely an option. Switching from one cloud resource to another is probably easier than switching from in-house to cloud.

It all depends on Snowden's laptops...

[Error27]

The cost really depends on who Snowden leaks the SSL keys to doesn't it?

Facinating...

[mitcheli]

If you read the regulations on what various classifications mean (top secret meaning, exceptional harm to the US) you can get a grasp of why some content is classified the way it is. Given the Snowden leaks, the administration is quick to point out how those disclosures cause exceptional harm because our adversaries will change their communication techniques to mask our ability to find them. .... True enough this indicates exceptional harm to our Government... But harm to our businesses and our citizens is also harm. Seems reasonable to assume that $180 Billion dollars would be a pretty significant amount of harm ... Hero or not, and wrong or not, there was a reason those programs were classified, and it wasn't just to protect the Government. Food for thought.

Re:Facinating...

[profplump]

The harm caused by exposing these programs isn't a result of their exposure -- the programs are harmful in their own right, whether or not they are exposed.

Essentially you're arguing that if Warren Buffet murdered someone the government would be justified in keeping it a secret because exposing his crime would disrupt his economic contributions.

Re:Facinating...

[Anonymous Coward]

Normally, I don't downvote stupid posts, because... hey... stupid people are still people.
But this is so exaggeratedly stupid, it's fringing on trolling (in the absence of any sign of sarcasm, Poe's law allows me to pick whatever meaning I like).
If you did really mean what you wrote, food for your thought: if someone snitches on a criminal, however painful it may be, the crime is stil the criminal's fault not snitch's.

Re:Facinating...

[DarkOx]

Let me guess you work for a three letter agency, that reasoning is utter tucking bullshit. The real reason these programs are classified is the military industrial complex has to much influence. American business would never have been harmed by these programs if they'd been implemented after an open public debate, the protest against then would have made SOPA and PIPA resestance look like nothing.

Joe Six Pack might get DRM and the finer points of copyright law, but he understands we are going to read you email and tap your phone just fine. There are two things that are going on here now, one it's already there so people don't feel like they can do anything about it, and two you can see people don't feel they have a voice just reading comments here on slashdot.

They feel that way because they don't. It's time we wake up to the fact you can't have a representative democracy if you let your representatives have secret meetings all day.

Re:Facinating...

[mitcheli]

The harm caused by exposing these programs isn't a result of their exposure -- the programs are harmful in their own right, whether or not they are exposed.

Ok, that logic is ridiculous. If that was applied then every classified military technology would be unjustified.

Re:Facinating...

[mitcheli]

I'm not questioning the rightness or wrongness of the program. That's still very much up for debate, both through official channels and the general public, and no doubt and in no small part on Slashdot. That was the whole intent of why Snowden did what he did. But what I am mentioning is that the reason the program was classified as Top Secret is because releasing the information (which Snowden did) would cause exceptional harm to the US. ... $160B in damage in my book is definitely exceptional.

Re:Facinating...

[Anonymous Coward]

"Ok, that logic is ridiculous. If that was applied then every classified military technology would be unjustified."

        And your point is?

Re:Facinating...

[zlives]

the business harm can easily be mitigated by NSA not breaking the law. its not the secret military tech thats the issue here, its the secret breaking of the law by the entity that enforces the said law.

Re:Facinating...

[Anonymous Coward]

the programs are harmful in their own right, whether or not they are exposed.

No, they are not?

Prove how undetected surveillance _on its own_ is harmful.

Actions speak louder than words, and in the absence of either your argument is shit.

Who cares? $180b is NOTHING.

[Seumas]

In a country where we give trillions for bailouts and economic recovery employment projects and have a national debt of more than $70-trillion (as per the recent UofC study of actual real national debt), it's hard to take sums like $180b seriously, anymore. Especially when they're amortized.

Re:Who cares? $180b is NOTHING.

[zlives]

180 instagrams worth of damage...

I cancelled

[Anonymous Coward]

Us web hosting
Skype
Gmail
Yahoo mail
strong vpn
3x Norton 360
Google chrome x 3 ...
lots more to come, in particular Google android tablets will be replaced by generic android minus the google spyware

NSA mass surveillance might be a lifeline for some, but you can't cover existing tax spending, so good luck with that.

Actually, Bailing out of "cloud" entirely...

[Anonymous Coward]

Actually, Bailing out of "cloud" entirely would improve security.

Move all your data in house, with your own security, and protect it as you see fit.

Much better than giving to a "cloud" to maintain, and share with every tom, dick, harry, and NSA that wants it.

Mod parent up

[davide marney]

Very interesting post!

I got your "cloud" right here

[Anonymous Coward]

Hey guys, good news! I got your "cloud" ready for use! Sureeeee just dump your data onto your personal cloud I'm harvesting errr hosting. No worries, it's completely confidential! No other company will be able to login with your userid...

Cost trumps EVERYTHING

[Anonymous Coward]

The flaw in this reasoning is that cost trumps everything in today's business world. I don't think managers care if the NSA puts an agent in their offices as long as it's not their headcount. The rush to the cloud is for one reason only - to reduce headcount and equipment.

IMHO, Forrester is usually pretty astroturfish

[idontgno]

But I think they have a point about how businessess make decisions and manage risks.

If you're a business leader working on a cloud migration of your data and processes, the cost of mitigating confidentiality risks can be as as low as the price of a big bucket of sand to bury your head in.