Slashdot Mirror
Should Cloud Vendors Decrypt Data For The Government? (helpnetsecurity.com)
An anonymous Slashdot reader quotes an article by Help Net Security's editor-in-chief:
More than one in three IT pros believe cloud providers should turn over encrypted data to the government when asked, according to Bitglass and the Cloud Security Alliance (CSA). 35 percent believe cloud app vendors should be forced to provide government access to encrypted data while 55 percent are opposed. 64 percent of US-based infosec professionals are opposed to government cooperation, compared to only 42 percent of EMEA respondents.
Raj Samani, CTO EMEA at Intel Security, told Help Net Security the answers ranged from "no way, to help yourself, and even to I don't care..." But since vendors can't satisfy both camps, he believes the situation "demands some form of open debate on the best approach to take..."
Raj Samani, CTO EMEA at Intel Security, told Help Net Security the answers ranged from "no way, to help yourself, and even to I don't care..." But since vendors can't satisfy both camps, he believes the situation "demands some form of open debate on the best approach to take..."
If they receive a legal and correct warrant, meaning one that has issued by a proper court, not a secret, shady, pseudo-military one, where the accused can challenge it, then yes, the cloud provider should turn over the data.
A smart provider however will have implemented its data management software in such a way that only his client has the key to decrypt the data it just turned over to the government. That way it cannot even be forced to decrypt it without violating the rules of mathematics and complexity theory.
If that is not the case, meaning that the cloud provider is able to decrypt the data themselves, then a warrant might be only the least problem a client will have with such a company. Most likely their biggest problem will be that the cloud provider uses that data to directly or indirectly harm them, either by selling it to advertisers or by being unable to protect it during hacking attacks.
A warrant is supposed to provide independent (non-executive) oversight. No warrant - no data. That was the theory. Warrants exist to prevent abuse by the executive government, which would eventually tend to use unchecked surveillance powers to protect itself and to stay in power.
1) Is it legal in the US to ask the question of job candidates, "Do you believe that the government should be required to hand over cloud data to the government without a warrant targetted to a particular individual?" I would ask this and reject anyone who said 'yes'.
2) Which immediately shows that the question is annoyingly ambiguous because it doesn't specify whether this is fishing expedition type access or targetted warranted access, so the survey results are meaningless.
In particular, it might be that e.g. German respondents with their strong privacy laws assumed it was only referring to access with a warrant.
No. Governments get hacked on such a regular basis that they can't be trusted with keeping the information secure, as proliferation of locations holding information increases chances of it being accessed.
Also the governments themselves can't be trusted not to misuse information.
Also, information should never be decrypted under circumstances that the specific information is being asked for, directly or indirectly, by a foreign government. Globalism can go take a break in the bottom of the toilet.
Do you think that cloud services should be setup in such a way that the provider is even capable of decrypting user data? IMO, the answer should be no.
Of course, for some kinds of publicly available data like websites this does not hold. If anyone on the world can see them and is supposed to be able to see them, the government can too, even without a warrant.
If the information is available to the cloud provider to do so, then they should.... however... the cloud customer should be encrypting the data in a fashion where the cloud provider has no access, so the cloud provider then just hands over a big lump of encrypted data... then they are not in violation of anything, and are not "interfering with an investigation" etc.., but they also haven't compromised their customer's security... because they aren't capable.
Are we talking just friendly requests or court orders that went through the full legal process? If it's just a request the response should be "Screw off, go get a warrant." I'm of the opinion that anyone that stores data for you in a professional capacity is acting as an agent on your behalf and should enjoy the same legal protections that you yourself would have if you had the data yourself.
Then the government can come to me – with a warrant – if they want me to decrypt my data for them.
I don't store my encryption key on the server with the data.
So which government are we talking about? Because each company has multiple jurisdictions, and can be forced in ANY of those jurisdictions to hand over data for ALL those jurisdictions.
In the UK, Theresa May made it legal for UK to demand any data from any company 'cos Terrorist-might-eat-your-babies. She didn't restrict it to the UK. She even added a clause requiring they decrypt any data they encrypted. As soon as she did that, she opened the doors to Putin who promptly demanded keys from every business in Russia 'cos Terrorists-might-eat-your-babies.
By requiring they have a way to remove any encryption they add, it means they also can remove it for Putin too.
Putin's law, likewise doesn't restrict itself to the keys only for Russia, once he's got them trained into handing the FSA live feeds for their data, he'll demand more and more access abroad. So will Theresa's lot. So will the Chinese soon. Thus they've created a race to zero-privacy for countries that require decryption.
EMEA is basically middle east. Are Israelis cool with Saudi Arabia getting their data? Are Saudi's cool with Israeli's getting their data? I'm pretty sure they're not, yet Microsoft, Drop Box, Google, etc. is in both places and subject to both sets of demands.
Which is why Windows 10 was pushed so hard.
If builders built buildings the way programmers wrote programs, then the first woodpecker would destroy civilization.
I'm of the opinion that anyone that stores data for you in a professional capacity is acting as an agent on your behalf and should enjoy the same legal protections that you yourself would have if you had the data yourself.
That's not what I want since it leaves the provider the option to voluntarily share my data. What we have in Canada is far better: the holder of the data has a legal duty to protect your privacy and cannot share you data with anyone unless required to do so by law.
With a warrant and the ability (the keys), cloud vendors would probably have to decrypt it.
The rubber hits the road when it comes to "without a warrant" -- that tests how flexible their morality is. Are they willing to turn down only the requests where a legitimate court order wasn't present?
It seems obvious to me that if you want encrypted data, you probably want to encrypt it yourself. The cloud is just storage, you can create your own trust model for encrypted data that doesn't include them.
That being said, there may be practical advantages to cloud-provider managed encryption where the risk:reward makes provider encryption worthwhile. What would be nice would be an encryption system with an access log of some kind to verify key usage. This would allow for a canary in the coal mine warning that your data had been decrypted by someone else. It's imperfect, but it's better than just silent loss of access control.
Which is why Windows 10 was pushed so hard.
The harder the push, the more inevitable the fall.
People can take a lot of abuse, as long as the abuse is added gradually. But when it becomes clear that they've been backed into a corner, they will react - violently.
Why should I store my data with you if you will hand it over to someone with as much as a "gimme" as an order? Moreover, why YOUR government. I fully cooperate with mine. No questions about this. Yours? Piss off!
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
What? My mother was a saint!
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
More than one in three IT pros believe cloud providers should turn over encrypted data to the government when asked, ...
Have all the encrypted data you want. The keys and/or forced decryption are another matter.
It must have been something you assimilated. . . .
If you're in a situation where the government has proper legal authority to demand decryption, and you believe in the rule of law, then you must decrypt.
That much is simple. But there are two complicated angles to this: (1) What to do when the government doesn't have the legal power to compel you to decrypt and (2) when the government should have the power to compel you to decryupt.
As a private citizen one often does things one is not required to out of public-spiritedness. But as a provider of IT services you're not being public spirited with your own resources, you're volunteering stuff that belongs to other people -- in fact stuff those people have entrusted to you. So I'd say the decision boils down to this: as a provider of IT services you should decrypt your customers' data if -- and only if -- the law compels you to.
There are exceptions, e.g. if the Gestapo are looking for Anne Frank's family you'd be justified in not decrypting a document that will lead them to the attic where they're hiding. In other words situations where civil disobedience is justified. But then you'd better be prepared for the consequences.
As for how much legal power the government should have to compel, I've watched these things for many years and thought about that, and the conclusion I've come to is there is no one single, simple answer. There are good arguments on both sides, but the danger is in the assumptions behind the arguments. My belief is that the amount of power the government should have to compel should depend upon the degree to which that power is constrained by oversight and transparency. The harder it is for a government to abuse a power the more it safe to give it power; or equivalently: the easier it is for a government to abuse power the less it should have.
Post may contain irony: discontinue use if experiencing mood swings, nausea or elevated blood pressure.
Should the postal service decrypt any mail before delivering it to the government, even if they don't even have the means to do so?
Why is anyone putting anything on the cloud that they haven't encrypted themselves?
Of there there are some things that you can't encrypt beforehand like the pictures and contacts that go into iCloud. But if you are just throwing files up onto storage on some file server then you should never be depending on the providers encryption. Encrypt all files yourself and then let the provider encrypt it again. That way even if they do happen to hand it over to some government with the ability to decrypt it all that government will get is some encrypted files.
On my Mac I created an encrypted disk image and I use BitTorrent Sync as cloud software. I put all of my important stuff that I want to work on there when I'm away. The transmission is encrypted and the data is encrypted too. Underneath the disk image is stored as a series of blocks so only those blocks that are changed are transferred instead of the whole disk image. It works very well.
Should the government...?
No, it should not.
What financial incentive do I have to do anything for your government? Are you my customer? Did you sign a contract? Oh, you didn't do any of those things? Then fuck the hell off. I have no reason to waste time or money on you.
Most of the time you don't just store data.. Often you need to process it too, and doing so in the cloud is easy and cheap, thus you need the decrypted data in the cloud.
There was a terrorist thwarted earlier this week near where I live. The police tracked him on the internet, knew of his sympathy for ISIS, and were able to act just before he was going to set off his bombs. That ability saved lives.
Can you tell us if the police just saw his incoherent allahu ackbar noise on Facetwat, or did the police actually got a warrant, and broke into his.. what.. email? SMS?
You see, AC, I doubt most crims have their plans squirreled away on a secur-ish machine encrypted on hardware and locked in a safe. I think most crims brag their intentions openly, be it Facetwat, or the local pub or burger joint.
The "Civilized World" jumped the shark ca. 1973.
If you're in a situation where the government has proper legal authority to demand decryption, and you believe in the rule of law, then you must decrypt.
Yes, and it's unfair and unrealistic to expect companies to violate the law to protect your data (even if the law is abusive). This is why the services themselves should not have the decryption keys. That allows them to comply with all laws without endangering their clients.
That's actually OK as long as everyone who has an interest in the data is aware that their security is being sacrificed to save a few bucks.
Only under a court order, should they do this. And by court order, I mean an open court of law, not these so called hush hush courts that no one knows about. But, what will happen, is these businesses will be forced to decrypt the data "or else" their access to the internet will be disrupted, the IRS will magically investigate them, justice department will investigate them, labor law will investigate them and on and on. The government, has unlimited resources to get anything they want.
but then being introduced to Monty Python at the age of 12 is liable to do interesting things to one's sense of humour
To release data without a legal justification would constitute an offence. The fact that it happens routinely and is seldom prosecuted is disappointing, but the potential is there.
When they are asked? Hell no! You do that even once, you will be on my list of vendors I will never, ever work with, and recommend every client I consult to not touch with a ten foot pole, either.
When served with a proper court order? That's a different story.
Assorted stuff I do sometimes: Lemuria.org
One important aspect of all the primarily American underwear sniffing is that the US services also do business espionage as part of their mission, as they see an strategic asset in this. And they supply American companies with results from these actions, like Boeing, who got information on Airbus contracts to undermine bids.
So with some cloud providers willingly spreading their legs to be raped by the TLAs, for a non-US company to put business to put data in a cloud system could be considered gross neglect or even willful damaging.
They don't need a proper court order to force the cloud providers turning over the data. All they need is a "National Security Letter", then the cloud provider has to drop its pants and bend over. No nasty court order necessary. Forget "Due Cause" and "Fourth Amendment", that's a thing of a past long gone.
Sure! If the government pays the vendor for support.
Tracy Johnson
Old fashioned text games hosted below:
http://empire.openmpe.com/
BT