Your data in the Cloud is not secure from the US Government

Data stor­age in the cloud is clearly the where things are mov­ing just now. Given the pleth­ora of devices people have — com­puters at home, laptops and tab­lets on the move, smart­phones in the pock­et, it makes per­fect sense for all of a person’s devices to use a single, com­mon repos­it­ory for shared inform­a­tion. Ser­vices such as Apple’s forth­com­ing iCloud at the domest­ic level, and commonly–used ser­vices such as Google’s Google Apps, and Microsoft’s Office 365 all store your data in their own clouds.

You’d think that this would be done with respect to Data Pro­tec­tion laws. Wrong. If the USA wants your data, the USA gets it. My friends Simon Bis­son and Mary Branscombe have the details: regard­less of European pri­vacy dir­ect­ives and the UK Data pro­tec­tion act, the US see the PATRIOT act over­rid­ing these for US com­pan­ies and EU sub­si­di­ar­ies of US com­pan­ies:

That means that US gov­ern­ment can (under the aus­pices of the act) request the data of any indi­vidu­al or com­pany that’s using US-owned or hos­ted ser­vices, no mat­ter where that data is actu­ally being held. It doesn’t mat­ter if you’ve geo-locked your data, and it only resides in European data centres, it can still be requisi­tioned and taken to the US. Yes, it’s an issue of nation­al secur­ity, but when res­ults can be found by machine learn­ing and trawl­ing massive data sets (the lar­ger the bet­ter), there’s a tempta­tion for gov­ern­ments to take all they can and more.

Undoubtedly this will lead to much hand–wringing in the EU Par­lia­ment. How­ever, what can be done? It is unlikely that the USA will give up their powers.

There­fore, the only solu­tion is in the hands of indi­vidu­als and com­pan­ies wish­ing to use cloud ser­vices — only use cloud ser­vices from wholly–EU–owned com­pan­ies host­ing your data inside the EU. While the leg­al pro­tec­tions you will have in those cir­cum­stances are not huge, they are bet­ter than none at all.

Oh — an after­thought. How happy do you now feel, if per­haps you have just given a whole heap of your per­son­al inform­a­tion to Google, dur­ing the Google Plus sign–up pro­cess?