Slashdot Mirror
Should Cloud Vendors Decrypt Data For The Government? (helpnetsecurity.com)
An anonymous Slashdot reader quotes an article by Help Net Security's editor-in-chief:
More than one in three IT pros believe cloud providers should turn over encrypted data to the government when asked, according to Bitglass and the Cloud Security Alliance (CSA). 35 percent believe cloud app vendors should be forced to provide government access to encrypted data while 55 percent are opposed. 64 percent of US-based infosec professionals are opposed to government cooperation, compared to only 42 percent of EMEA respondents.
Raj Samani, CTO EMEA at Intel Security, told Help Net Security the answers ranged from "no way, to help yourself, and even to I don't care..." But since vendors can't satisfy both camps, he believes the situation "demands some form of open debate on the best approach to take..."
Raj Samani, CTO EMEA at Intel Security, told Help Net Security the answers ranged from "no way, to help yourself, and even to I don't care..." But since vendors can't satisfy both camps, he believes the situation "demands some form of open debate on the best approach to take..."
If they receive a legal and correct warrant, meaning one that has issued by a proper court, not a secret, shady, pseudo-military one, where the accused can challenge it, then yes, the cloud provider should turn over the data.
A smart provider however will have implemented its data management software in such a way that only his client has the key to decrypt the data it just turned over to the government. That way it cannot even be forced to decrypt it without violating the rules of mathematics and complexity theory.
If that is not the case, meaning that the cloud provider is able to decrypt the data themselves, then a warrant might be only the least problem a client will have with such a company. Most likely their biggest problem will be that the cloud provider uses that data to directly or indirectly harm them, either by selling it to advertisers or by being unable to protect it during hacking attacks.
A warrant is supposed to provide independent (non-executive) oversight. No warrant - no data. That was the theory. Warrants exist to prevent abuse by the executive government, which would eventually tend to use unchecked surveillance powers to protect itself and to stay in power.
1) Is it legal in the US to ask the question of job candidates, "Do you believe that the government should be required to hand over cloud data to the government without a warrant targetted to a particular individual?" I would ask this and reject anyone who said 'yes'.
2) Which immediately shows that the question is annoyingly ambiguous because it doesn't specify whether this is fishing expedition type access or targetted warranted access, so the survey results are meaningless.
In particular, it might be that e.g. German respondents with their strong privacy laws assumed it was only referring to access with a warrant.
No. Governments get hacked on such a regular basis that they can't be trusted with keeping the information secure, as proliferation of locations holding information increases chances of it being accessed.
Also the governments themselves can't be trusted not to misuse information.
Also, information should never be decrypted under circumstances that the specific information is being asked for, directly or indirectly, by a foreign government. Globalism can go take a break in the bottom of the toilet.
if it is necessary to provide data to the government
Do you think that cloud services should be setup in such a way that the provider is even capable of decrypting user data? IMO, the answer should be no.
Of course, for some kinds of publicly available data like websites this does not hold. If anyone on the world can see them and is supposed to be able to see them, the government can too, even without a warrant.
If the information is available to the cloud provider to do so, then they should.... however... the cloud customer should be encrypting the data in a fashion where the cloud provider has no access, so the cloud provider then just hands over a big lump of encrypted data... then they are not in violation of anything, and are not "interfering with an investigation" etc.., but they also haven't compromised their customer's security... because they aren't capable.
Are we talking just friendly requests or court orders that went through the full legal process? If it's just a request the response should be "Screw off, go get a warrant." I'm of the opinion that anyone that stores data for you in a professional capacity is acting as an agent on your behalf and should enjoy the same legal protections that you yourself would have if you had the data yourself.
In the end, they will be forced to. The move towards the Age of Total Surveillance is irreversible. The populace will have to adapt to being watched 24/7, everywhere. There's no turning back.
Then the government can come to me – with a warrant – if they want me to decrypt my data for them.
I don't store my encryption key on the server with the data.
Why are they even in the business of encrypting their customer's data. Let the customer encrypt their own shit then the problem is shifted from the provider to them.
If they will do it for the Govt, then they should legally be forced to send me a unencrypted tarball DB dump of my own data.
Give me my data you scumbags.
So which government are we talking about? Because each company has multiple jurisdictions, and can be forced in ANY of those jurisdictions to hand over data for ALL those jurisdictions.
In the UK, Theresa May made it legal for UK to demand any data from any company 'cos Terrorist-might-eat-your-babies. She didn't restrict it to the UK. She even added a clause requiring they decrypt any data they encrypted. As soon as she did that, she opened the doors to Putin who promptly demanded keys from every business in Russia 'cos Terrorists-might-eat-your-babies.
By requiring they have a way to remove any encryption they add, it means they also can remove it for Putin too.
Putin's law, likewise doesn't restrict itself to the keys only for Russia, once he's got them trained into handing the FSA live feeds for their data, he'll demand more and more access abroad. So will Theresa's lot. So will the Chinese soon. Thus they've created a race to zero-privacy for countries that require decryption.
EMEA is basically middle east. Are Israelis cool with Saudi Arabia getting their data? Are Saudi's cool with Israeli's getting their data? I'm pretty sure they're not, yet Microsoft, Drop Box, Google, etc. is in both places and subject to both sets of demands.
Boy that is sure a fun game. I started with the demo and moved on to the full version.
The government is incompetent. They go in and get your data and guess what? There is nothing that will prevent them from accidentally or intentionally releasing it. Our government is hardly trustworthy. And they are constantly being hacked. And you people think they can be trusted with your data?!
And just think, someone with enough political connections could get a look at that data and maybe get some business ideas or a look into a company's strategic plan or technology.
Working on a manuscript for a Tom Clancy type of book that has terrorists and a fictional plan about blowing something up? And some grunt with a badge and gun sees it? Guess what?! Off to jail without trial.
I'm of the opinion that anyone that stores data for you in a professional capacity is acting as an agent on your behalf and should enjoy the same legal protections that you yourself would have if you had the data yourself.
That's not what I want since it leaves the provider the option to voluntarily share my data. What we have in Canada is far better: the holder of the data has a legal duty to protect your privacy and cannot share you data with anyone unless required to do so by law.
With a warrant and the ability (the keys), cloud vendors would probably have to decrypt it.
The rubber hits the road when it comes to "without a warrant" -- that tests how flexible their morality is. Are they willing to turn down only the requests where a legitimate court order wasn't present?
It seems obvious to me that if you want encrypted data, you probably want to encrypt it yourself. The cloud is just storage, you can create your own trust model for encrypted data that doesn't include them.
That being said, there may be practical advantages to cloud-provider managed encryption where the risk:reward makes provider encryption worthwhile. What would be nice would be an encryption system with an access log of some kind to verify key usage. This would allow for a canary in the coal mine warning that your data had been decrypted by someone else. It's imperfect, but it's better than just silent loss of access control.
()*&C*Y_@()#+_(D_(++_*()&(*&#_&*DFEWJI@+*+)(*#$_()&FE{FOPI#@$+()*
There, take that you chowderheads.
If they were running things properly, they wouldn't be able to decrypt the data. If they can, it means anyone can and they cant be trusted.
A legal company will eventually do everything a(*) government requires, or stop doing business in that country. The latter only if the country is insignificant or the expected negative PR effect is huge (eg doxing queers for the Iranian government).
The question should be, should they be able to? Should they ever hold the key? Of course not. If you trust some random "cloud vendor" (**), why encrypt at all?
(*) funny how these questions always assume there is only one government
(**) mental image: balloon guy at fun fair
Why should I store my data with you if you will hand it over to someone with as much as a "gimme" as an order? Moreover, why YOUR government. I fully cooperate with mine. No questions about this. Yours? Piss off!
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
No.
More than one in three IT pros believe cloud providers should turn over encrypted data to the government when asked, ...
Have all the encrypted data you want. The keys and/or forced decryption are another matter.
It must have been something you assimilated. . . .
There was a terrorist thwarted earlier this week near where I live. The police tracked him on the internet, knew of his sympathy for ISIS, and were able to act just before he was going to set off his bombs. That ability saved lives. There are big concerns about the abuse of this ability, and there should be an absolute requirement of a warrant that is publicly available after the danger has passed or after a limited period of time, possibly with some names and details censored to protect ongoing investigations.
Freedom comes with responsibility.
TL;DR Yes, with a non secret warrant.
Explore their business model, origins, and executives. It has nothing to do with security.
More than 1 in 3? Pretty sure we can understand percentages or god forbid decimal places. More importantly wouldn't that look better as 65% SAY NO to decryption for the government. What kind of spin are you trying to put on that data. 1/3 say yes... get the hell out of here with that nonsense.
No. Absolutely not. Why is this even a question? Next!
If you're in a situation where the government has proper legal authority to demand decryption, and you believe in the rule of law, then you must decrypt.
That much is simple. But there are two complicated angles to this: (1) What to do when the government doesn't have the legal power to compel you to decrypt and (2) when the government should have the power to compel you to decryupt.
As a private citizen one often does things one is not required to out of public-spiritedness. But as a provider of IT services you're not being public spirited with your own resources, you're volunteering stuff that belongs to other people -- in fact stuff those people have entrusted to you. So I'd say the decision boils down to this: as a provider of IT services you should decrypt your customers' data if -- and only if -- the law compels you to.
There are exceptions, e.g. if the Gestapo are looking for Anne Frank's family you'd be justified in not decrypting a document that will lead them to the attic where they're hiding. In other words situations where civil disobedience is justified. But then you'd better be prepared for the consequences.
As for how much legal power the government should have to compel, I've watched these things for many years and thought about that, and the conclusion I've come to is there is no one single, simple answer. There are good arguments on both sides, but the danger is in the assumptions behind the arguments. My belief is that the amount of power the government should have to compel should depend upon the degree to which that power is constrained by oversight and transparency. The harder it is for a government to abuse a power the more it safe to give it power; or equivalently: the easier it is for a government to abuse power the less it should have.
Post may contain irony: discontinue use if experiencing mood swings, nausea or elevated blood pressure.
Should the postal service decrypt any mail before delivering it to the government, even if they don't even have the means to do so?
Why is anyone putting anything on the cloud that they haven't encrypted themselves?
Of there there are some things that you can't encrypt beforehand like the pictures and contacts that go into iCloud. But if you are just throwing files up onto storage on some file server then you should never be depending on the providers encryption. Encrypt all files yourself and then let the provider encrypt it again. That way even if they do happen to hand it over to some government with the ability to decrypt it all that government will get is some encrypted files.
On my Mac I created an encrypted disk image and I use BitTorrent Sync as cloud software. I put all of my important stuff that I want to work on there when I'm away. The transmission is encrypted and the data is encrypted too. Underneath the disk image is stored as a series of blocks so only those blocks that are changed are transferred instead of the whole disk image. It works very well.
Should the government...?
No, it should not.
What financial incentive do I have to do anything for your government? Are you my customer? Did you sign a contract? Oh, you didn't do any of those things? Then fuck the hell off. I have no reason to waste time or money on you.
Do not assume incompetence. That's just right wing fox news propaganda that too many people buy into.
Even things that look like failures are engineered by people who know exactly what they're doing. I'll say especially things that look like failures.
Should Cloud Vendors Decrypt Data For The Government?
The question is irrelevant. If the vendor can decrypt the data, then it wasn't properly encrypted to begin with.
Encrypting data on the server is essentially a "Alice-gives-the-message-to-Bob-who-then-encrypts-it-for-Charlie" situation. The vulnerability is built right into the design -- therefore, it's not a proper application of encryption. It's security theater that uses encryption incorrectly to deliberately fool the user into a false sense of security -- all for financial gain, of course.
The only acceptable place to do encryption/decryption is on the client side, using end-to-end encryption. Period. End of discussion.
I am aware that E2E encryption reduces the types of services that can be provided by cloud vendors. But that reduction in service is a necessary price we must pay in order to actually implement encryption correctly.
The public pay the salaries of the FBI and CIA. Of course nobody is going to pay taxes so you can be a fucking gestapo state.
Fucking nitwits. Fuck your kids too.
If you're in a situation where the government has proper legal authority to demand decryption, and you believe in the rule of law, then you must decrypt.
Yes, and it's unfair and unrealistic to expect companies to violate the law to protect your data (even if the law is abusive). This is why the services themselves should not have the decryption keys. That allows them to comply with all laws without endangering their clients.
Only under a court order, should they do this. And by court order, I mean an open court of law, not these so called hush hush courts that no one knows about. But, what will happen, is these businesses will be forced to decrypt the data "or else" their access to the internet will be disrupted, the IRS will magically investigate them, justice department will investigate them, labor law will investigate them and on and on. The government, has unlimited resources to get anything they want.
but then being introduced to Monty Python at the age of 12 is liable to do interesting things to one's sense of humour
To release data without a legal justification would constitute an offence. The fact that it happens routinely and is seldom prosecuted is disappointing, but the potential is there.
Form the key by XORing the ciphertext with something you like...perhaps text of the Bible or some favorite book...
Then turn over the ciphertext and this key.
Don't do, or offer to do, anything else. And only turn in anything if your system has been logging it, which is not
really a good idea.
When they are asked? Hell no! You do that even once, you will be on my list of vendors I will never, ever work with, and recommend every client I consult to not touch with a ten foot pole, either.
When served with a proper court order? That's a different story.
Assorted stuff I do sometimes: Lemuria.org
One important aspect of all the primarily American underwear sniffing is that the US services also do business espionage as part of their mission, as they see an strategic asset in this. And they supply American companies with results from these actions, like Boeing, who got information on Airbus contracts to undermine bids.
So with some cloud providers willingly spreading their legs to be raped by the TLAs, for a non-US company to put business to put data in a cloud system could be considered gross neglect or even willful damaging.
They don't need a proper court order to force the cloud providers turning over the data. All they need is a "National Security Letter", then the cloud provider has to drop its pants and bend over. No nasty court order necessary. Forget "Due Cause" and "Fourth Amendment", that's a thing of a past long gone.
Sure! If the government pays the vendor for support.
Tracy Johnson
Old fashioned text games hosted below:
http://empire.openmpe.com/
BT