Slashdot Mirror
Forrester: NSA Spying Could Cost Cloud $180B, But Probably Won't
itwbennett writes "Forrester's James Staten argues in a blog post that the U.S. cloud computing industry stands to lose as much as $180 billion, using the reasoning put forth by a well-circulated report from The Information Technology and Innovation Foundation that pegged potential losses closer to $35 billion. But Staten's real point is that when it comes down to it the cloud industry will likely not take much of a hit at all. Because as much as they voice their displeasure, turning back isn't really an option for businesses using the cloud."
and all the problems of mainframes (like people spying on you) are being "rediscovered". The problems have not changed and no one will ever care about your data as much as you do.
It'll take about two years for this problem to disappear.
There's an enormous monetary incentive for cloud services to implement good privacy. Anyone who doesn't implement it will get their lunch eaten by someone who does.
There's already a massive exodus away from US based servers, both at home and abroad. People are thinking through the ramifications of having their sensitive information used as "incentives" to help business. Your client lists, sales information, costs and accounting - if any part of your local network is in the cloud, the US can rifle through it and trade the information to another company in return for help fighting terrorism. Many people will choose to believe that this is not happening, but what the heck - who can tell any more?
This is a self-correcting problem.
Mega has announced an encrypted E-mail service, the client software will be open for public inspection, and none of it will be hosted on US servers.
Google has admitted in court that they don't think users have an expectation of privacy.
Which E-mail service would you rather use? The one from a sleazy convicted criminal, but with impenetrable security? Or the one from a company that always rifles through the contents, but promises to only do it for the better good?
Why isn't there a "simple" host your own "data manager" for people that will be their "email, social, storage server"?
If opensource had a cause, that should be it,
A Good Troll is better than a Bad Human.
I recently took a course on Cryptography and the guy basically showed that with system after system that if he could pick just the tiniest thread loose he just tossed the algorithm into the junk heap. One of the other mantras was don't roll your own; you don't have enough Phds. But when it came to things like AES he seemed pretty confident. At the time of the course I nodded my head and wasn't thinking paranoid thoughts. But if we have learned anything this last month it is that you can take your typical person you once dismissed as paranoid and multiply their ravings by 3.
So my paranoid raving #1 is that they can break any of the common encryption schemes. Some mathematicians might say pshaw but hey this is now a post Snowden world. If commonly accepted encryption isn't broken then yay!
But for those with real good data such as bankers who don't want the NSA handing the data over to Goldman Sachs (why not as they make for great conspiracy fodder) then I would only use one time pad encryption. Good luck finding a mathematically loose thread there. A simple way to do one time pad encryption is just like the old spies. You send say 5 people over to your destination each with a different 1TB memory chip containing truly random data. (radioactive decay, xored with rain xored with a lava lamp) Then when you transmit data you xor it through all 5 layers of random data.
But as for the article if I were in Europe I would move my servers to Europe tomorrow. These government goons all think alike so I suspect that even the Euro police will cooperate anyway; they'll just deny it in a different accent. For instance, I sit in Canada and don't believe for one second that the local police wouldn't pee themselves with delight if the us Feds asked them to do something.
So the giant rethink in many security setups will have to be EVERYTHING that I don't control is completely compromised. Even individual employees could be compromised. Thus I would only use data schemes that would require the blackmailing/threatening/screwing of many employees.
But the simple reality is that this requires everyone to become a Rosa Parks. Every employee at these big companies needs to step out and spill the entire truth. If one person comes out they are Snowden II. If 100 come out the party is over.
Because as much as they voice their displeasure, turning back isn't really an option for businesses using the cloud.
Maybe in the US, but worldwide is a different matter. Governments could easily force the issue by forbidding the use of US cloud companies, especially for their companies that deal with issues of defence and national security.
Lest you think its farfetched, China already bans the use of Google, Facebook, Twitter, YouTube, and FourSquare in China. Local alternatives such as Sina, Tencent, qq etc. took their places fairly quickly. After PRISM, more governments may follow suit.
The harm caused by exposing these programs isn't a result of their exposure -- the programs are harmful in their own right, whether or not they are exposed.
Essentially you're arguing that if Warren Buffet murdered someone the government would be justified in keeping it a secret because exposing his crime would disrupt his economic contributions.