Patriot Act Clouds Picture For Tech

Harperdog writes "Politico has a piece on how the Patriot Act is interfering with U.S. firms trying to do business overseas in the area of cloud computing. Here's a quote: 'The Sept. 11-era law was supposed to help the intelligence community gather data on suspected terrorists. But competitors overseas are using it as a way to discourage foreign countries from signing on with U.S. cloud computing providers like Google and Microsoft: Put your data on a U.S.-based cloud, they warn, and you may just put it in the hands of the U.S. government.'"

It is common sense, not the patriot act.

[gessel]

If you put your data in the cloud, you put it in the hands of not just the US government, but every government the cloud company does business with. And also in the hands of every underpaid employee in the company; and while some companies may claim otherwise, their claims are unverifiable and unenforceable. "Cloud" services have their place - it is for data that is intrinsically public and ephemeral. Nobody should ever trust any cloud service with data that is proprietary or private or irreplaceable.

Most obviously, the "free" services are predicated on exploiting the value of their users as product to customers that are not the users. The model makes sense in some cases, for example a forum, where the shared public content is willing coproduced by users of the forum, exchanging their content creation efforts for use of the forum itself, the forum exploiting that content to attract eyeballs to advertisers that pay the bills.

While there are strong logical reasons why cloud services are intrinsically untrustable (ultimately, he who owns the hardware, owns the data), a simple thought experiment proves the folly: how hard is it to bribe an employee of a cloud service to give you inappropriate access to someone's data? Do you think you couldn't find one employee in one company somewhere? While one may be able to find companies that are currently resistant to easy attacks, cloud companies come and go like the .coms that they are are, and with inevitable waning economic optimism, so too wanes employee loyalty. In the eventual asset transactions that follow, acquiring companies of even trusted entities are unknowns and customers have no recourse and no authority.

At best, the loss of yet another fleeting cloud service means only the loss of the associated data and whatever codependent business line the cloud service customer bet on the serial risk of the success of the cloud company itself.

The premise of handing your proprietary data to another person for remote, invisible processing and care is fundamentally flawed. Your interests are not aligned and their interests will evolve and ultimately diverge or fail.

Foreign companies (and US as well) are well advised to be wary of cloud services.

Re:Yep

[Anonymous Coward]

More importantly, since there are US laws which contradict the very protections that EU safe harbor rules require, we CAN'T trust US companies to abide by our data protection requirements. We are bound by law to ensure these protections, so sending the data to the US is arguably illegal. The only reason why anyone still does it is that enforcement is so lax.

Re:We're MUCH safer then the other guy... TRUST us

[forkfail]

Except that said US court orders can be executed by a secret court with no oversight. Pretty much like China's.

Very real issue

[dave562]

We deal with this on a daily basis. Our clients (large Fortune 500 corporations) are requesting that we do not store data in the US. I personally think it has more to do with the fact that they are up to shady financial maneuvers than terrorism, but the end result is the same. It is just another nail in the economic coffin of the United States. The oft claimed, "It is too expensive/risky to do business in the States" rears its ugly head again.

The article talks about "cloud" providers, which we are not. We are more of a SaaS shop, but the regulatory challenges are the same. It all comes down to the client wanting to feel like their data is safe, and that they will have some expectation of privacy. With the United States government declaring the right to come in and seize data (the life blood of any company in this day and age) without any form of real due process, corporations are deciding that they do not want to subject themselves to that unnecessary liability.

It's true

[Baldrake]

I work at a 2,000 person organization outside the US. The institution has formally adopted a policy that no sensitive data can be hosted in the US, precisely due to the Patriot Act.

Don't look for logic in this. They would rather we use a server sitting under some IT guy's desk than use, say, DropBox, which is based on encrypted S3 storage. But perceptions are everything.

Re:what's the problem?

[Aryden]

I've noticed that you have cleaning products under your sinks. Didn't you know that in this state, it is a felony to have cleaning supplies in reach of children under the age of X? Oh, is that your 2 year old son. I'm sorry, I'll have to take you to jail now.

This is a hypothetical, but it is representative of how the government works. More often than not, they are coming in to look for things that will aid them in building a case against you even though they may seem completely benign. While searching your "nothing to hide stash" they come across a picture of you from 10 years ago with a college buddy who is now on a "watch" list, or a family member who speaks out just a little too much about the government.

Just because you think you have nothing to hide, does not actually mean that you have nothing to hide and shouldn't hide anything.

Re:Yep

[crankyspice]

Maybe if Amazon, Google and a few other major cloud storage providers take a huge hit, they'll tell the government to fix the situation.

No, shops large enough to have influence are likewise large enough to simply setup European subsidiaries, with hardware in Europe and a cadre of European compliance officers, and it's business as usual. "You can choose a Region to optimize for latency, minimize costs, or address regulatory requirements ... Objects stored in a Region never leave the Region unless you transfer them out. For example, objects stored in the EU (Ireland) Region never leave the EU." http://aws.amazon.com/s3/ [amazon.com] (emphasis added)

Canada Too..

[codegen]

You miss the point. The point is the jurisdiction of the court. Both Europe(and Canada) have data protection laws that say that you cannot divulge certain classes of data without a court order. And it has to be a European (resp. Canadian) court that allows you to give up the information. If you store the data in another jurisdiction where another court can order the data to be divulged, then you have a problem. Because the moment that the cloud service obeys a court order from the other jurisdiction and discloses some of your data, you are in breach of the law in your jurisdiction. The sticking point in the case of the U.S. Patriot Act is that the US government can demand the data without any court oversight and in addition prevent the cloud service from notifying you that the data was disclosed. There have been several controversies here in Canada, specifically in the area of health and student information. One of the provincial governments wanted to outsource some of the government health plan data management to a U.S. company (the lowest bidder). It was effectively stopped because they could not guarantee that someone would not use a U.S. court to order the data management company to disclose the health information of a Canadian citizen in the US. As a result, the data had to remain in Canada, and the US company did not get the contract. Similarly, student information at Canadian Universities has been an issue. I am a professor, and I cannot legally put a spreadsheet with student marks or any other student information in dropbox or on any cloud service that stores the data in the U.S. Just this month, I was approached by a web based application provider that wanted me to use their web app in our classes. But the web app stored all of the data in Amazon EC2. I had to tell them that the best I could do is inform the students that the app existed and disclose the fact that their data would exist outside of Canadian jurisdiction, but under such circumstances, we could not formally adopt the software for the course. We can't require the student to student to store data outside of Canadian jurisdiction as a condition of getting the degree (i.e. completing assignments, and passing the course). Any European company is going to be in a similar bind. While the Data Safe Harbour is supposed to provide an out. But it depends on the extent to which the European governments want to make a stink if the US government goes after the European data held by US companies. Even if the government doesn't make a stink, the nightmare of a European company would be the PR disaster of client data being revealed because of court action in the US.

Re:what's the problem?

[NotSanguine]

I don't see the issue. Unless your using the cloud to store kiddy porn, your terrorism plots, or other illegal shit why do you care? The lady doth protest too much, methinks.

Because my payroll records, confidential company databases/documents, strategic plans, company emails and other stuff isn't anyone else's business even if there's nothing illegal immoral or fattening about them.

Are you really a moron, or do you just play one on /.?

Dropbox encrypted?

[codegen]

This has come up in the past. While dropbox uses S3 for the base encryption layer, the staff at dropbox have access to the encryption keys. In fact because of a FTC complaint [wired.com] dropbox had to change the terms of use as explained on their blog [dropbox.com] To clearly indicate that while the contents are encrypted, that dropbox staff still have access to be able to comply with the US justice system. And the US can order the dropbox to disclose the data without telling you that the data was disclosed. At least if the courts come after the data in the server sitting under some IT guy's desk, you will know about it.

Re:Yep

[canadian_right]

It is illegal in BC, Canada to store any personal information on any server physically residing in the USA. This law is an acknowledgement that the USA Patriot act can lead to Canadian information, protected by Canadian laws, being revealed without judicial oversight.

We don't care if it is a cloud or not, it can't be stored in the USA.

Re:Yep

[chrb]

Wholly-owned international subsidiaries are separate legal entities under the control of the parent company. They are obliged to follow the laws of the country that they are based in, but under no obligation to obey the law of a foreign land (such as the U.S.), as they are outside of that legal jurisdiction. However, the parent company is under such an obligation, and since it controls the subsidiary, under the Patriot Act it has a legal obligation to compel the subsidiary to comply. But if, in complying, the subsidiary may break local laws, then there are problems. Basically, the company has to decide whether to violate U.S. law or local law.

To whom do these laws apply? All U.S. citizens and permanent resident aliens, entities and organizations located in or out of the United States (including any subsidiary or foreign offices overseas) must comply with the USA PATRIOT Act, Executive Order 13224, and Office of Foreign Assets Control regulations. Further, U.N. Security Council Resolution 1373 and other resolutions have the force of international law binding on all member states.

http://www.mott.org/resources/patriotact/faqs.aspx#q6 [mott.org]

Whether the Patriot Act could be used to compel a U.S. parent to disclose records held by a Canadian subsidiary remains a matter of debate. The B.C. Commissioner Report found that it is a “reasonable possibility” that the FISA Court would order production of documents that are within the custody or control of a U.S. company, such as a U.S. parent with access to records held by a Canadian subsidiary.[14] If a U.S.-linked company makes a disclosure to U.S. authorities without the consent of the Canadian individuals named, this could result in the Canadian organization that transferred the information breaching Canadian privacy legislation unless the disclosure meets an exception in the applicable Canadian privacy legislation. http://library.findlaw.com/2005/May/10/245866.html [findlaw.com]

Any company that is wholly-owned by a U.S.-based corporation cannot guarantee that the data will not leave its customer-designated datacenters or servers. Google would not budge from its first and final response, and Microsoft could not offer guarantees to not move data outside the EU under any circumstances. These subsidiary companies and their U.S.-parent corporations cannot provide the assurances that data is safe in the UK or the EEA, because the USA PATRIOT Act not only affects the U.S.-based corporations but also their worldwide wholly-owned subsidiary companies based within and outside the European Union.

http://www.zdnet.com/blog/igeneration/case-study-how-the-usa-patriot-act-can-be-used-to-access-eu-data/8805?pg=4&tag=content;siu-container [zdnet.com]