Battle of the Clouds: Azure goes lower

Re: USA and clouds

Matt, it's not about the search warrant - it's about needing a search warrant in the first place, and if so, how that is issued.

Most EU countries have fallen for the same ruse and introduced backdoors into their legislation, ostensibly for fighting "terrorists" or whatever other evil du jour (you may have noticed that people have stopped being scared of terrorists, so expect another atrocity soon - conspiracy theorists are welcome to assume sponsoring, given the parties that always do well out of such an event).

The critical point of that backdoor is that it neatly avoids due process - even in the UK you can under circumstances gain access on the nod, nod, wink, wink principle because nobody wants to be blamed for helping terrorists/child pornographers/communists (just to give you a list) and so BREAKS the law - but with no consequences, all were starting to consider that the norm, regardless of who got hurt in the process. Well, until the Leveson enquiry in the UK.

We have rights, and obligations to go with them. Your right, enshrined in the Human Rights declaration and adopted by all the nations under question isn't just that of privacy, but also of correct application of the law - innocent until proven guilty. Law enforcement has controlled privileges to break that right on suspicion of crime, but they are privileges, not rights, and the control was exactly what was discarded with anti-terror legislation - notice that key to all this legislation is the ability to hide what they do with it. THIS is where you should ask the question: "what are you hiding?" (the answer is massive abuse, but "national security" covers many sins).

Nobody should have a problem with law enforcement doing what we pay them to do, everybody should have a problem with law enforcement abusing those privileges because that opens the door wide for insider threat. So it should not be a matter of "slapping" a search warrant on someone, this should be the result of a correct process which involves a judge, full examination of initial evidence and which protects the results so they cannot be abused for other purposes either. If time pressure prevents such full process, it must be re-examined afterwards, something that simply doesn't happen.

So, the question is, how can you protect yourself against that abuse, yet not get in the way of correct law enforcement process (because that's not just wrong, it's also stupid)? I'm using the answer to that for business - we sell really *secure* services because we didn't just get the tech right (that's was the relatively "easy" part), we also got the legal coverage done to a point where we tell even lawyers what to do (one of the largest UK law firms shipped all their IT out of the UK less than a month after talking to us).

Here are a few hints:

- as an ordinary citizen or SME you cannot force process on law enforcement - unless they have to cross the border

- examine the laws in all parts of the world where a supplier is present, the US Patriot Act is not the only example and any subsidiary can be used to create a backdoor

- examine how much you pay. Doing this right isn't just expensive technically, lawyers cost money too. If it's cheap (compare people vs costs, for instance) you better start asking questions because something isn't right.

- get someone competent involved in such examination. It takes insight in technology, security, process and law to examine this, and there are very few who offer that combination - it takes us months to train new people because doing it right is simply complex.

So there..

Re: USA and clouds

It's about protecting the client as well as the data.

If the US gets the Australian government to allow them to rifle through your bank accounts, that's one thing. To make an Australian's bank account data available in the US or China without telling anyone - that's a whole different story. It's a liability thing.

And don't laugh, this is history, not speculation.