Securing Data in the Cloud

2010 June 20 by Frank Monaldo.

The laws and traditions surrounding the rights of people to “…be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures…” takes on new and interesting twists in a world where communications are conducted via e-mail rather than traditional mail and where papers and effects are stored not only in the home or office but virtually in the “cloud.” It is not clear that statutory law and case law has recognized these distinctions. Where do we have or not have reasonable expectations of privacy? Is it reasonable to have any expectation of privacy for anything that is online?

A couple of interesting cases have brought this issue to our current attention. Hushmail is a service where people are promised that they can send encrypted e-mail secure from outside scrutiny, even by Hushmail. A Javascript program is installed on a person’s local browser which encrypts the e-mail before it is sent from the computer.

It turns out that Hushmail may not be quite a secure as some users believed. Hushmail turned over 12 CD’s worth of clear text mail to prosecutors pursuing the distribution of illegal steroids.

The case of Thomas Drake is more sensational. Drake was a former NSA employee accused of sharing classified information with a reporter for a “national newspaper.” Some of the alleged communications transpired over Hushmail.

We have every reason to assume in these cases that all the proper warrants were obtained and the appropriate court supervision was provided. From a technical standpooint, how then was the Hushmail data in these case obtained. Much depends on the users. Using Hushmail with a local Javascript is the most secure way of using the service. However, for the sake of convenience, Hushmail also allows uses to use SSL encryption on the way up to Hushmail servers where it is then encrypted for e-mail transmission. Hence, between the point that the uploaded e-mail in unencrypted from the SSL session and the point it is re-encrypted for e-mail transmission, the mail is in clear text. It is at this point, the Hushmail could have saved e-mails to turn over to authorities. In principle, it would always be possible for Hushmail to push down new Javascript code that would make it appear that local encryption was taking place when it actually was not.

This same issue is relevant with cloud storage. As a matter of good practice, one should backup one’s data continuously offsite. One convenient way to do this is to use services like Carbonite, Mozy, or Backblaze. It is easy to imagine a situtation where the private papers of many people are stored in the cloud. Perhaps, even lawyers, doctors, and accountants who have a fiduciary responsibility to maintain confidentiality would find it prudent to use cloud storage.

Besides the standard SSL encryption on transmission, all these services offer additional encryption such that even the provider, ostensibly, cannot decrypt the data. However, just as the case with Hushmail, it would be possible for the provider, upon instruction from the authorities, to push new software that would bypass the user’s encryption key. It would be possible for a user to double encrypt, i.e., encrypt data using some other protocol before uploading and adding the encryption on the outside server.

There is not a lot of evidence that the government or others are abusing these offsite storage capabilities. Encryption is important from the standpoint of protecting data from private snooping. We should always presume that under the appropriate circumstances governments can and many times should have the ability to search private data. However, from a civil liberties standpont, it is important for the government to provide statutory protection for data stored in the cloud and not wait for the courts to do so. Personal data stored in the cloud should enjoy the same protection that paper documents stored in one’s house. The legal hurtles to obtain a search warrant should be the same for private data in the cloud as it is for one’s home or private office. Professions that have statutory protections of their relationships with clients, should have these offsite storage options treated with the same respect that the paper files stored in offices are normally accorded.

Posted in Law, Social Commentary | Print | No Comments »