Should Cloud Vendors Decrypt Data For The Government? (helpnetsecurity.com)

An anonymous Slashdot reader quotes an article by Help Net Security's editor-in-chief: More than one in three IT pros believe cloud providers should turn over encrypted data to the government when asked, according to Bitglass and the Cloud Security Alliance (CSA). 35 percent believe cloud app vendors should be forced to provide government access to encrypted data while 55 percent are opposed. 64 percent of US-based infosec professionals are opposed to government cooperation, compared to only 42 percent of EMEA respondents.
Raj Samani, CTO EMEA at Intel Security, told Help Net Security the answers ranged from "no way, to help yourself, and even to I don't care..." But since vendors can't satisfy both camps, he believes the situation "demands some form of open debate on the best approach to take..."

Comments

Turn over: yes. Decrypt: no

[sciengin]

If they receive a legal and correct warrant, meaning one that has issued by a proper court, not a secret, shady, pseudo-military one, where the accused can challenge it, then yes, the cloud provider should turn over the data.

A smart provider however will have implemented its data management software in such a way that only his client has the key to decrypt the data it just turned over to the government. That way it cannot even be forced to decrypt it without violating the rules of mathematics and complexity theory.

If that is not the case, meaning that the cloud provider is able to decrypt the data themselves, then a warrant might be only the least problem a client will have with such a company. Most likely their biggest problem will be that the cloud provider uses that data to directly or indirectly harm them, either by selling it to advertisers or by being unable to protect it during hacking attacks.

Re:If they have a warrant

[Beezlebub33]

FWIW, the argument that 'metadata is not data', and so who you called does not require a warrant, based on Smith v Maryland. The Supreme Court ruled that gathering metadata does not constitute a search.

However, that was 1979, pre-internet. In light of the ability to collect massive amounts of metadata, from almost all aspects of a persons life, combined with the ability to computer analyze that information, I would argue that Smith v Maryland should be re-considered. In that case, it was decided on the idea that the gathering of metadata provided limited insight to a persons life, and that is no longer the case.