Beware the Cloud

Cloud computing has been all the rage for a bit now and this article poses some interesting scenarios. For those unfamiliar with the term cloud computing I refer you to Wikipedia:

Cloud Computing is Internet-based computing, whereby shared resources, software and information are provided to computers and other devices on-demand, like a public utility.

It is a paradigm shift following the shift from mainframe to client-server that preceded it in the early '80s. Details are abstracted from the users who no longer have need of, expertise in, or control over the technology infrastructure "in the cloud" that supports them. Cloud computing describes a new supplement, consumption and delivery model for IT services based on the Internet, and it typically involves the provision of dynamically scalable and often virtualized resources as a service over the Internet.It is a byproduct and consequence of the ease-of-access to remote computing sites provided by the Internet.

src

The story goes as follows:

FBI agents targeting alleged criminal spammers last year obtained a trove of incriminating documents from a suspect’s Google Docs account, in what appears to be the first publicly acknowledged search warrant benefiting from a suspect’s reliance on cloud computing.

The warrant, issued August 21 in the Western District of New York, targeted Levi Beers and Chris de Diego, the alleged operators of a firm called Pulse Marketing, which was suspected of launching a deceptive e-mail campaign touting a diet supplement called Acai Pure. The warrant demanded the e-mail and “all Google Apps content” belonging to the men, according to a summary in court records.

some notable points of this story included:

Privacy advocates have long warned that law enforcement agencies can access sensitive files stored on services like Google Docs with greater ease than files stored on a target’s hard drive. In particular, the 1986 Stored Communications Act allows the government to access a customer’s data whenever there are “reasonable grounds” to believe the information would be relevant in a criminal investigation — a much lower legal standard than the “probable cause” required for a search warrant.

The Google Docs search warrant, in contrast, was issued under seal and presented politely to Google, without an FBI agent having to draw his gun or sternly bang on a door. More significantly, and unlike most physical search warrants, the government has no obligation to disclose the cloud search to Beers and de Diego, unless criminal charges are filed. Beers said he’s received no notice that his documents were searched, even though nearly eight months have passed since Google handed them over. “I have not received notification from Google or the government about this search warrant,” he writes.

The issue here is not that a spammer was caught, I doubt anyone would view that as a problem. The issue is that through the convenience of cloud computing, if you decide to post personal or confidential material, it could be used in an investigation without your knowledge. I use Google Docs, working off the cloud has huge advantages, however I do not post anything personal. Do other ATS members utilize cloud services and if so how leery are you?

src

brill

[edit on 17-4-2010 by brill]

so you ONLY find out you had a warrant served on you. is when they find out you did some thing illegal. so all the people who had this search on them. and nothing came of it. they Never get to find out about it!!!
ignorance is bliss?

Interesting. Not sure how hot you guys are over there on Data Protection, but I guess in this case "user beware".

The only problem is could they obtain a warrant to look based on a "we think", as opposed to "probable cause"? How easy is it for them to get a warrant of this type? Could be another step on the road to The Ultimate Surveillance State.

I wonder where lines of jurisdiction are drawn? Is it the law of the country the IP is in? Is it the law of the country the servers are in? For example, if a guy runs a successful brothel and weed cafe in Amsterdam, will his business documents in the google cloud be deemed illegal by US agencies? Same for the people with the Japanese comics the US defines as child porn. What happens there? Industrial espionage would be another issue...would any business in competition with a US business feel secure?

There are a few problems with "the Cloud".

First, The Cloud is simply the internet. It is actually nothing new, except that non-techhies have suddenly decided how great it would be to replace desktop apps with apps run over the internet in a web browser.

The next problem is said non-techhies have no idea whatsoever about either SECURITY or THE LAW.

I've noticed in the last couple of years that the world of IT has been inflitrated by idiots posing as managers, directors etc.. that seem to think they know what they're on about because they use Twitter or Facebook, but actually have no idea at all.

Because of this, companies are just blindly saying "hey! this is the latest thing - we've got to be in on it!" instead of sitting back and asking: WTF?

It won't be until someone buys into a cloud service that happens to reside in China, comes up with a great idea then finds the Chinese have stolen it that everyone will wake up and realize that "The Cloud" (the Internet) is not the friendly, safe and secure place they first thought, and that whilst they think they had all the security in the world, they failed to notice the geographic location of the physical servers, and note that the encryption they used was compromised because the "secure server" they used cached all the keys for them to used at any time by the host.

It won't be until the blows up in their faces that they'll realize they actually know nothing, and people like myself who are currently side-lined for being "out of touch with current trends" actually knew what they were on about the whole time.

I just hope when it happens, none of my data is involved.

If you want The Cloud, at least have the brains to host it on your own servers that you physically control, and use local software devs to write the software, not some unknown in India simply because it appears cheaper. Imagine the loss when your reputation tanks.

[edit on 18-4-2010 by mirageofdeceit]