9 ms·
It was never safe for any government to move any secrets to any cloud. The fact that the US government is okay with doing this with its own secrets surprises me
by pclmulqdq 2y ago
It was never safe for any government to move any secrets to any cloud. The fact that the US government is okay with doing this with its own secrets surprises me to this day. You have no secrets from the person who owns your hardware.
- sieabahlpark 2y ago[dead]
- rcpt 2y agoSecurity isn't a "safe" vs. "not safe" bool
- dmantis 2y agoThe world literally has hard proofs of mass espionage by the NSA and CIA after Snowden and Wikileaks Vault 7. Moving your government secrets to the US cloud has been madness for at least 12 years.
- raverbashing 2y agoCool, encrypt everything before uploading. Keep the key client-side See, parent is right? Safe/not safe dichotomy helps nobody
- ta988 2y agoI didn't know that computation on encrypted data without decryption was solved overnight.
- erikerikson 2y agoIt seems like you might be aware of limitations but for those who aren't aware of the technique: https://en.m.wikipedia.org/wiki/Homomorphic_encryption https://en.m.wikipedia.org/wiki/Homomorphic_encryption
- eesmith 2y agoWhen I last looked into it, the compute overhead was very high, such that (for the tasks I was looking at) it seemed significantly cheaper to handle everything on-premises with trusted hardware than remotely on untrusted hardware. To be clear, this was 10 years ago so things may have changed. Also, my task was memory bandwidth limited, where even changing the memory access patterns slowed things down by 10% or more.
- rcpt 2y agohttps://www.usenix.org/system/files/1401_08-12_mickens.pdf https://www.usenix.org/system/files/1401_08-12_mickens.pdf Alright so get a magical amulet.
- dmantis 2y agoIt's not a boolean value, I don't get the irony. If China and Russia can somehow solve the issue and manage their infra, I don't see why EU, for example, can't. It's better to have at least partially protected your whole government and citizens data than having it handed directly to the foreign intelligence in bulk. That's the question about political will, we don't talk about average Joe here.
- dijit 2y agoCorrect, it's more like a bitmask. Except if any of the bits are flipped you're f-d; especially so if your adversary is a nation.
- im_down_w_otp 2y agoI guess so, but based on current events, it doesn't seem like the US Govt. has any secrets that it places any value on. Between a bunch of glorified interns being given access to anything & everything and a bunch of known compromised department heads being appointed... it doesn't strike me that the US Govt. takes its national security very seriously at all. The US Govt. seems empirically much more vested in what goes on in public restrooms than it does in what goes on in global affairs and military conflicts.
- niceice 2y ago[flagged]
- ugexe 2y agoWhat audits?
- Onawa 2y agoPentagon audits, they've failed for 7 years in a row and they don't expect to be able to pass an audit until 2028 https://breakingdefense.com/2024/11/pentagon-fails-7th-audit-in-a-row-eyes-passing-grade-by-2028/ https://breakingdefense.com/2024/11/pentagon-fails-7th-audit...
- NekkoDroid 2y agoHas Elon (I guess rather his "DOGE" department) so far even remotely touched anything military related?
- deleted 2y ago[deleted]
- torstenvl 2y agoYes.
- 2y ago
- closeparen 2y agoThe US government’s secrets are routinely held and processed by contractors. The prototypical government secret is something like the plans of an airplane designed and manufactured by Lockheed Martin.
- zombiwoof 2y agoElon Musk will have access to all data. That should scare everyone given his propaganda machinery aimed at elections he does or doesn’t like
- DamnYuppie 2y agoWere you this afraid of the propaganda machinery when it was aimed at conservatives? It seems far less radicalized now then it was. Just now other voices are actually allowed.
- red-iron-pine 2y agohis propaganda machinery hasn't been aimed at conservatives for a decade or more now. "other voices" is a joke given how much censorship there is on twitter
- jandrewrogers 2y agoIt isn't uniform by any means but the US runs on a physically independent cloud, often in their own facilities, designed by the big cloud companies. When using the public cloud for unclassified work (e.g. working with outside vendors), the data is only allowed to reside in specific data centers that have been vetted by the government, not all US regions have the same authorization. For example, government data in an S3 bucket in the public cloud may only be accessed and processed within the same region, which can be annoying if your infrastructure is elsewhere. The US is far ahead of most countries when it comes to government use of the cloud. Other developed countries often learn how to do it from the US but are less comfortable with the technical requirements, which slows down adoption.
- dataflow 2y agoPhysical isolation is kind of irrelevant for the concerns being voiced here no? It's not like Europe's main worry is random people walking in and yanking hard disks out of servers in datacenters.
- KennyBlanken 2y agoOther developed countries are less comfortable because all the major cloud providers are US-owned companies and the NSA has a very, very long history of using US companies as information security weapons. Not that they're the only ones. Israel has been busy stuffing investment cash into the pockets of Unit 8200 members so they can found security software and service startups coughSnykcough
- red-iron-pine 2y agofor Israel I would have said Check Point firewalls, or the company that owns Express VPN and Private Internet Access
- vimbtw 2y agoThis is a great point. For example, near where I live there’s a massive Google cloud warehouse out in the middle of a field next to the highway. Inside of that warehouse there’s a separate section for servers belonging to the US government that can benefit from all the electricity contracts Google has negotiated, the physical security and fences that Google has set up, and the fiber optic cables they’ve laid. It’s the best of both worlds, they get the decades of research Google has put into systems engineering and fault tolerance while retaining the security of having their own servers.
- dangus 2y agoIsn't this just kind of willfully ignorant to the way the government cloud works? GovCloud claims that it's used to "manage sensitive data and controlled unclassified information (CUI)." I don't think the US government is dumping classified info onto corporate cloud environments judging by this description from GovCloud. But there's plenty of info that's sensitive but unclassified and the government does need to function in a lot of ways that doesn't involve state secrets. https://aws.amazon.com/govcloud-us/ https://aws.amazon.com/govcloud-us/ for more of a description of what GovCloud actually is.
- thesuperbigfrog 2y ago>> I don't think the US government is dumping classified info onto corporate cloud environments judging by this description from GovCloud. There are cloud environments specifically for classified info: https://aws.amazon.com/federal/secret-cloud/ https://aws.amazon.com/federal/secret-cloud/ https://techcommunity.microsoft.com/blog/coreinfrastructureandsecurityblog/introduction-to-microsoft-azure-government-secret/2043581 https://techcommunity.microsoft.com/blog/coreinfrastructurea...
- dgacmu 2y agoand google also, including top secret: https://www.nextgov.com/acquisition/2024/04/google-now-authorized-host-classified-data-cloud/395557/ https://www.nextgov.com/acquisition/2024/04/google-now-autho...
- dcrazy 2y ago“Secrets” is a broad term that covers everything from payroll information to the history of CIA clandestine operations. Only some kinds of these are stored in the cloud.
- rapatel0 2y agoThe US Gov't has their own GOV Cloud Datacenter Regions. It's run by azure and AWS but there are restrictions on who is allowed to use it. It's not really public https://aws.amazon.com/govcloud-us/?whats-new.sort-by=item.additionalFields.postDateTime&whats-new.sort-order=desc https://aws.amazon.com/govcloud-us/?whats-new.sort-by=item.a... https://learn.microsoft.com/en-us/azure/azure-government/documentation-government-overview-dod https://learn.microsoft.com/en-us/azure/azure-government/doc...
- ocdtrekkie 2y agoThe point is Amazon and Microsoft surely have vested interests in government data they are not supposed to be privy to.
- aprilthird2021 2y agoAnd the government has lots of leverage it can use against Amazon and MS if they use it in a way the government doesn't want. EU govts don't have that
- _DeadFred_ 2y agoUS Government leverage: $200,000 fine, appealable.
- tyre 2y agoUS Government leverage: FISA secret court, prison time
- overstay8930 2y agotouch the right HSM in one of these facilities and you get to know what it's like to disappear
- userbinator 2y agoNot with this current government.
- whimsicalism 2y agoyou can obviously have secrets from someone who holds your ssd, that is the whole point of encryption.
- TechDebtDevin 2y agoThats not fool proof what so ever.
- sidibe 2y agoIt's as fool proof as you can get though. If your data is well encrypted they practically don't have any access to any of the information except how much of it there is
- ncallaway 2y agoI feel like you've narrowed the original statement ("You have no secrets from the person who owns your hardware") when you scope it to just data storage at rest. I take hardware to mean significantly more than just at rest data storage in the context that it was used. If your unencrypted data flows through any AWS memory or compute, or if your encryption key flows through any AWS memory or compute, then AWS *can* access that data.
- whimsicalism 2y ago> It was never safe for any government to move any secrets to any cloud. does this not refer to moving data?
- ncallaway 2y agoI don’t think it refers solely to data at rest, no.
- jiveturkey 2y agoThere are secrets and then there are secrets. For the former, confidential compute is far enough along that this data can in fact be secret from the hardware owner. This is vital even for on-prem hardware -- IT folks and techs with physical access shouldn't have access simply due to proximity. For the latter, sure, but this is very expensive. It goes well beyond owning the hardware.
- breadwinner 2y ago> You have no secrets from the person who owns your hardware. What if the hardware is physically located in your own country, and employees of cloud vendor are virtually "accompanied", and watched, any time they login to the hardware? That's called sovereign cloud and all cloud vendors have it.
- deleted 2y ago[deleted]
- ivanmontillam 2y agoYes, I agree. I make the parallel with "gold." Whoever has your gold, got you by the hanging spheres. Given the importance of data today, I am baffled common citizens are not familiar with the "Data at rest" principle.
- zhengiszen 2y agoNice comparison
- cscurmudgeon 2y agoSo the US is within its rights to ban TikTok?
- ivanmontillam 2y agoNo, that's overreaching. If a country's citizens want to give away their data, it's well within their right to do so. At most, the U.S. Government should educate about it, much like tobacco dangers. Having that said, U.S. citizens with clearance and/or government employees should be subject to data loss prevention measures, like they already do[0]. I'd be forward for a ban if it was an issue of public mental health, but the U.S. Government cannot take that angle because they'd have to kill Meta Platforms as well. They know they can't, Meta lobbyists will not allow that. But restricting TikTok based on data control and free speech liberties, that's overreaching. I've already seen TikTok videos of people saying they'd stamp their U.S. passport on the forehead and give it to Chinese ByteDance rather than use Instagram. It is well within their rights to do so if they so desire. -- [0]: https://www.pbs.org/newshour/politics/why-tiktok-is-being-banned-for-some-federal-employees https://www.pbs.org/newshour/politics/why-tiktok-is-being-ba...
- ivanmontillam 2y agoQuick note I wanted to add: My take on this matter comes from a "regardless of what you do, the why is more important than the what." Ban TikTok? Do whatever, I don't use my account. I deleted the app long ago. Why do you do it? Fight that tooth and nail. Do it for the right reason and be consistent.
- jviotti 2y agoI think this is the key. It is cheaper and more convenient than ever to deploy and manage data critical services yourself, in a self hosted manner that is protected by whatever jurisdiction you are in. What matters is not who builds it, but who has access to the data, and ideally, that's only you!
- cogman10 2y agoThis does raise a valid question of what secrets can or should the government have. I think it's obvious that some secrets should be kept. It makes little sense to expose our nuclear secrets, counter espionage, or ongoing investigation efforts. But how far does or should that extend? Should everything the NSA/CIA/FBI/IRS does be secret? Should they stay secret for years or decades or forever? IMO, the US goes too far in it's secrets. Stuff gets classified that just makes the government look bad and that's dangerous. And that's where I'm somewhat less concerned about putting US secrets into the cloud. Sure there's highly sensitive stuff that shouldn't go there, but there's also a lot of stuff that shouldn't have been a secret in the first place.
- Andrex 2y agoFOIA makes the US gov't one of the more transparent democracies, as a counterpoint. So much so it started getting copied by them. https://reason.com/2024/12/26/foia-for-all/ https://reason.com/2024/12/26/foia-for-all/
- Nullabillity 2y agoAccording to the very link you posted, the US was two whole centuries late to the party. Better late than never of course, but the spin of trying to then frame it as an American Victory(tm) is pretty ridiculous.
- thelamest 2y ago“Transparency” as leaks from abuse is very, very different from transparency as a policy of easy access – and neither makes you necessarily better informed. In short, a biased selection of information can leave you worse off than having no information.
- GeoAtreides 2y agopretty sure my remote encrypted backups[1] can keep a secret or two from the cloud storage provider [1]https://rclone.org/crypt/ https://rclone.org/crypt/
- riffic 2y agoThat's not necessarily true if you use the appropriate tools and controls to safeguard data. Further, "any cloud" is a sweeping generalization and not all clouds are created equal. You raise valid concerns about trusting third-party hardware BUT.. come on, ease up on the alarmism. To elaborate: robust encryption, dedicated hardware security modules (HSMs), and sophisticated key management safeguards data even if it resides on someone elses hardware. If you design your system properly, even if the cloud provider manages the underlying hardware, your secrets remain secure because the keys and sensitive data are protected in a controlled, isolated environment.
- aiono 2y agoThe US government is okay basically because people who own cloud platforms are part of the government.
- rsync 2y agoI disagree. Why would encrypted data, which the provider holds no keys to, be a dangerous way For a government to hold a secret?
- jjav 2y ago> The fact that the US government is okay with doing this with its own secrets surprises me to this day. This fact conveys information. Namely, how tightly bound these supposedly independent services like AW GovCloud are with the government itself. Which also tells us how much direct access the government has to all the AWS (and all other providers) infrastructure.