Your data in the Cloud is not secure from the US Government

Data stor­age in the cloud is clearly the where things are mov­ing just now. Given the pleth­ora of devices people have — com­puters at home, laptops and tab­lets on the move, smart­phones in the pock­et, it makes per­fect sense for all of a person’s devices to use a single, com­mon repos­it­ory for shared inform­a­tion. Ser­vices such as Apple’s forth­com­ing iCloud at the domest­ic level, and commonly–used ser­vices such as Google’s Google Apps, Salesforce.com and Microsoft’s Office 365 all store your data in their own clouds.

You’d think that this would be done with respect to Data Pro­tec­tion laws. Wrong. If the USA wants your data, the USA gets it. My friends Simon Bis­son and Mary Branscombe have the details: regard­less of European pri­vacy dir­ect­ives and the UK Data pro­tec­tion act, the US see the PATRIOT act over­rid­ing these for US com­pan­ies and EU sub­si­di­ar­ies of US com­pan­ies:

That means that US gov­ern­ment can (under the aus­pices of the act) request the data of any indi­vidu­al or com­pany that’s using US-owned or hos­ted ser­vices, no mat­ter where that data is actu­ally being held. It doesn’t mat­ter if you’ve geo-locked your data, and it only resides in European data centres, it can still be requisi­tioned and taken to the US. Yes, it’s an issue of nation­al secur­ity, but when res­ults can be found by machine learn­ing and trawl­ing massive data sets (the lar­ger the bet­ter), there’s a tempta­tion for gov­ern­ments to take all they can and more.

Undoubtedly this will lead to much hand–wringing in the EU Par­lia­ment. How­ever, what can be done? It is unlikely that the USA will give up their powers.

There­fore, the only solu­tion is in the hands of indi­vidu­als and com­pan­ies wish­ing to use cloud ser­vices — only use cloud ser­vices from wholly–EU–owned com­pan­ies host­ing your data inside the EU. While the leg­al pro­tec­tions you will have in those cir­cum­stances are not huge, they are bet­ter than none at all.

Oh — an after­thought. How happy do you now feel, if per­haps you have just given a whole heap of your per­son­al inform­a­tion to Google, dur­ing the Google Plus sign–up pro­cess?