10 ms·

An Apology to my European IT Team

528 points by flybrand 13y ago

rdl 13y ago
Seems odd that someone wouldn't have understood that even 10-15 years ago. Outsourced means being exposed to risk from your supplier -- by the company itself, by its employees, or by governments. Gmail has somewhat better technical security to protect from outside non-state hackers than your average self-hosted exchange server, and from insiders (the IT guy, like Snowden, may not have the same goals as the organization...), but that may or may not make up for the ease of serving a third-party communications service provider. I still prefer well-run self-hosted mail unless: * You have a <6 month retention policy (i.e. so ECPA's weaker protections are a non issue) (which can be specified in Google Apps for Your Domain) * You don't have the technical competence to run your own mail server (which gets complicated in a larger organization due to HR risk), or don't have the business competence to hire a contractor to run it in-house in such a way that their staff don't become a huge risk. There's a third way which would be a lot better for everyone, but it's not technically feasible yet -- a way to outsource some aspects of the server without giving up control.
- ricardobeat 13y ago
  It would be great to have a service that could manage your mailserver configuration, tracking reputation & avoiding spam, while not having any access at all to the data itself.
  - yen223 13y ago
    Is there any way to tell if a particular email is spam, without knowing the content or the sender of said email?
    - olalonde 13y ago
      Maybe homomorphic encryption[0] could help here? Here's what comes up after a quick Google: http://www.eweek.com/c/a/Security/IBM-Uncovers-Encryption-Scheme-That-Could-Improve-Cloud-Security-Spam-Filtering-135413/ http://www.eweek.com/c/a/Security/IBM-Uncovers-Encryption-Sc... [0] http://en.wikipedia.org/wiki/Homomorphic_encryption http://en.wikipedia.org/wiki/Homomorphic_encryption
    - ChuckMcM 13y ago
      If all your actual email is encrypted then by definition spam is the unencrypted stuff. A long time ago in a different galaxy I built a PGP MTA (based on sendmail at the time) which only forwarded mail that was encrypted, and as expected it was spam free, all though these days spammers just might go to the trouble of sending it encrypted if they thought it would get through.
      - csense 13y ago
        I'm guessing that people who only accept encrypted mail are such a small minority, you're probably safe from most spammers if you do this. People who target your company and employees specifically, maybe not. But even this could be made more difficult for spammers by only allowing access to your public key directory from trusted IP ranges. It's also a great idea from the standpoint of giving an encryption policy teeth. I'm thinking of a company where the official line is "We encrypt all our email," but then some IT screwup results in having half the company sending each other cleartext email for several quarters before anybody notices. If your mailservers reject unencrypted mail, the above scenario can't happen, because presumably people will notice when everyone's mail starts getting discarded, and it'll be fixed very quickly.
      - rdl 13y ago
        Even just setting START TLS REQUIRED might solve your spam problem, as long as only a tiny minority of people did it. That would have the added benefit of protecting you from Yahoo Mail users, the FBI, and such. At this point, I'd consider NOT using START TLS for your MTA to be nearly as irresponsible as not using ssh instead of telnet/rsh, or not using secure passwords. It correctly pushes all the pain onto the sysadmin (and a very tiny amount of pain), rather than end users.
        bigiain 13y ago
        Do you know if a successful response to a START TLS command endured end-to-end TLS secured mail transport? I kinda doubt it - if for some reason your outgoing mail server connects to one of my secondary/relaying MX servers, I don't think there's any way for you to ensure that server bothers trying to set up a TLS session when it relays my mail(which I guess is mostly my problem/fault) - and similarly, if your ISP requires you to send mail via their SMTP servers (blocking port 25 isn't uncommon here) - I don't think you've got any say in whether or not that server requires TLS? (I know - I really should go and look this up myself…)
    - clicks 13y ago
      It could be a crowd-sourced effort -- e-mails that are spam you mark as spam and upload to some repo that is maintained by someone (a la Adblock). You keep your filters updated, and run your e-mail against the filters file.
      - ricardobeat 13y ago
        That's how current spam filters work, every mail server reports back to some central directories which keep tab on IPs, common subjects, keywords and other characteristics used to calculate spam scores. The trick is doing that without giving out access to message content to third-parties. http://en.wikipedia.org/wiki/The_Spamhaus_Project http://en.wikipedia.org/wiki/The_Spamhaus_Project
        rdl 13y ago
        You can free ride -- receive the spam directory but not contribute. As long as your mail is representative of the overall mail corpus, that works out fine.
      - eru 13y ago
        That would be trivially defeated by sending everyone a slightly different spam email. (And if your encryption doesn't produce totally different files for slight changes in plaintext, it doesn't deserve that name.)
        ricardobeat 13y ago
        I think you're replying to the wrong comment tree. Spammers already do this today, by including your name and other data in the message, and varying the wording, but that is not enough to fool the spam blockers, and there are diminishing rewards as your addresses/IPs begin to get marked as source of spam regardless of the content.
        eru 13y ago
        No, it was the right one. I was thinking about the grand-grand-fathers suggestion in relation to encryption.
    - rdl 13y ago
      No need to go that far. The provider just pushes code to a server the user controls. The code is trusted to just do mail server with no backdoor for the service provider to get data. That code executes in an environment trusted by the data owner, so the code is allowed to see the data and process based on it. I'm kind of tempted to do this, since we largely do this kind of thing for VPN already. Doing it with trusted execution lets the code execute on hardware owned by the service provider, but that is technically difficult and hard to prove. Just letting you run code on your own virtual machine host is a lot easier (could be a third party virtualization provider if that is what you want, but I'd at least go for colo of my own server, if not on premise.)
      - clicks 13y ago
        > I'm kind of tempted to do this, since we largely do this kind off thing for VPN already. Take advantage of the zeitgeist rdl. You can look forward to at least one customer if you decide to go ahead with this. (me). :)
    - betterunix 13y ago
      Yes, but it is still very much in the research stages, not quite ready for real-world deployment: https://en.wikipedia.org/wiki/Fully_homomorphic_encryption https://en.wikipedia.org/wiki/Fully_homomorphic_encryption https://en.wikipedia.org/wiki/Secure_multi-party_computation https://en.wikipedia.org/wiki/Secure_multi-party_computation There is a huge amount of interest among cryptography researchers and from DARPA and the NSF.
  - rdl 13y ago
    Yeah, that wouldn't be too hard to set up. You could run arbitrary services that way -- the key would be keeping configurations totally locked down, so all config edits happen through some kind of defined interface, to let the service provider do full testing. But I don't think individual mailboxes would be very likely to cause changed in testing before deploying upgrades. You could just use the "virtual appliance" model and do virtual machine level upgrades, with data on a separate partition -- less of a hassle than testing a bunch of upgrades from smaller patches (the paranoia about breaking it is that the service provider doesn't have root, so a failed upgrade could be bad). I'd probably want encrypted backups held with the provider too, for most non sophisticated users.
- damian2000 13y ago
  I think he understood the risks, but basically took it as fact that the US was beholden to decent privacy laws restricting access to private (and encrypted) communications like email. One of the main arguments for using Google apps in the past is the technical level of Google's security, and protection from being hacked. But the NSA/prism leaks have raised a new question in peoples minds, in favour of keeping things in-house or at least in your own country.
  - mpyne 13y ago
    That's just it though, we've heard of stuff like ECHELON (which involved no warrants whatsoever) since years before this discussion would have taken place. ECPA dates to 1986! FISA dates to 1978! The insidiously loose interpretation on 4th Amendment controls for third-party communications dates back for centuries. A lot of this was just a quick Google search away, and would have been just as relevant the very year GMail was introduced. Likewise there's no theoretical reason to trust internal Google policy controls over U.S. government legal and policy controls. Even if what the author thought had been true about U.S. law actually was true, he'd still have been setting his customer up for the possibility of having their confidential data leaked (maliciously or not) or hacked into (e.g. by the always-vulnerable password reset function). That's not just a nitpick either. There have been a couple of services at work I would have liked to setup on something like Digital Ocean, Basecamp Breeze, etc. that I can't because of PII concerns. So while I'm sorry that the author made wrong assumptions I don't know what to tell him other than IANAL isn't just a five-letter acronym, and "due diligence" doesn't simply mean "hire a contractor to think about this for me".
    - rdl 13y ago
      FISA and ECPA made things more secure than they were previously, which is the crazy part.
- dfc 13y ago
  For those interested in google apps retention: http://support.google.com/a/bin/answer.py?hl=en&answer=151128 http://support.google.com/a/bin/answer.py?hl=en&answer=15112... Spoiler Alert: Apps for Business/Education only
comrade1 13y ago
3 years ago my clients (top 100 European banks, car companies, luxury goods) would reluctantly let us host data at aws European servers. They would never allow hosting at u.s. servers. Now they won't allow aws at all and everything is in chaos.
frozenport 13y ago
I wonder if this problem is particularly acute for Eastern European companies who often sell their products to despicable despotic regimes.
- betterunix 13y ago
  How would that differentiate them from Western companies? https://en.wikipedia.org/wiki/FinFisher https://en.wikipedia.org/wiki/FinFisher
- readme 13y ago
  Yeah, because there haven't been any despotic regimes in the US lately.
btipling 13y ago
Hrm I wonder what are the chances that someone at the NSA or doing contract work for the NSA has a buddy at a company and that person decides to use their NSA powers to get their buddy's competitor's emails from Google Apps and send those emails to their friend. If there are safeguards in place from keeping this from happening how was Snowden able to take so many documents with him when he went to Hong Kong. Ok so maybe he didn't take any of that kind of data, maybe I'm reaching. If this kind of thing did happen would they let the affected company know? Would anyone know?
- alrs 13y ago
  This kind of work isn't informal. Economic espionage is a big part of what intelligence agencies are doing all day. http://www.commondreams.org/headlines/070200-02.htm http://www.commondreams.org/headlines/070200-02.htm
  - leoc 13y ago
    One unintended consequence of the Snowden leak is to advertise this service to US businesses. My guess is that the discreet inquiries are already winging their way towards Congressmen.
    - pc86 13y ago
      No. With the exception of the handful of Members on relevant intelligence committees, most Members of Congress were not aware of the massive scope of this program, or even that it existed in its current form. Access to this type of information by a private citizen would require a hell of a lot more access than writing a big check to a Representative can get you.
      - Jgrubb 13y ago
        Color me skeptical, but it doesn't appear that there's anything that's outside the scope of what a big check to a congressperson can get you these days. I do hope you're right, though.
      - 13y ago
drawkbox 13y ago
Sadly the NSA programs are strongly anti-business as it is based on 'trust in me'. American businesses could and should lobby Congress to fight this and to find ways to protect US stored data, I know I wouldn't trust a Chinese cloud company not to snoop or steal business/corporate ideas and trade secrets. But if there were assurances for US cloud businesses that this doesn't affect their business ideas accidentally or deliberately then we could set a global example on how to run cloud data storage that is safe and business friendly. There is an opportunity here for Google, Amazon, Apple etc for cloud data. Lots of damage control to be done here for international clients. As an American I would always trust our systems more but international companies may have a very hard time trusting without the US being a shining example of how to correctly protect business data in clouds here, especially encrypted data that is automatically subject to storage/filtering if international.
- deleted 13y ago
  [deleted]
- greyman 13y ago
  But what protection of stored data do you mean should Congress find, by introducing some Laws? Because, well, if the data are not encrypted on the server, then someone could still take them... that's how Internet works. For now, the only solution I can think of is that you encrypt the data locally, and upload only the encrypted data - but this way, the cloud provider will not able to provide any additional value. Or are there some other possibilities?
  - drawkbox 13y ago
    Not necessarily talking about encryption or security of data, that should already be an inherent part of cloud systems. I am talking about protections on unauthorized access by agencies (even for national security) meaning no more blanket access to all email/files/etc rather explicit machine read systems that only access data that has a warranted access and useful to the investigations. Human access should not be allowed unless the data has already been warranted, filtered by the system and useful in the investigation that the NSA/DOJ/ etc might be using. A big problem right now with it is blanket access and collecting content in bulk to sift through. There should be no way a human can go into an email box or cloud files and read everything for instance unless the person themselves is under investigation, email communication with that person can only be pulled from other innocent people's boxes that are part of the investigation, not everything. As is it right now they just collect everything and store it. It should also have heavy encryption and 3-5 approvals/logs/access audits per individual human access so there is a minimized threat of people searching business ideas for personal gain. This would prevent the one time email or document share with someone that they allows access to all their data. Explicit access and heavily verified across judicial, audits and multiple users 3-5 at least approving or seeing the access within the security organization. NSA and CIA etc are patriots and like their freedoms as well, I am sure they don't want colleagues stealing ideas, business plans and random people's personal info when they go civilian. It is currently too sweeping and broad due to terrorism threats that have yet to take away as many freedoms as our own internal legal overreaches. For example, right now let's say I am some crooked agent or politician, I could have one email or call to a person and justify looking at all their data. This might be someone who is in a competitive company or business information they want to find out. Steps like the above would minimize those abuses which are bound to happen. Take for instance oil mining or product plans, these types of competitive environments are very susceptible to snooping and corporate espionage without heavy controls on access to data. Protection for international users in the same as US persons. Noone will trust storing data on our servers and cloud systems if they know all their data is being filtered and easily accessible by a single agent. Also, extremely fast audits, judicial warranting. There is no reason it should take a long time with today's tools. I imagine the NSA and others are collecting all this data because the bureaucracy makes it difficult to get approvals in time, so they go in bulk as a fail safe. I dont' envy them the work is very hard and it is justified when true threats exist, these people typically aren't evil and most have the best intentions. But with great access to information comes a power that is hard to contain if not verified. Timed release/removal of information that is not needed now, not indefinite storage. Will this make us less safe? Maybe but freedoms are not easy, it takes work to be free. Authoritarian is easy. Maybe something like a Bill of Data Rights that also applies to international people in addition to the US. We would really revolutionize rights and data rights in the world, it would attract alot of business to data storage in the US. However currently data is free-er in other places sadly.
Camillo 13y ago
While OP's apology is appreciable, there was more than enough information available in 2008 to understand that his Czech colleagues were right. The Prism scandal may have come as a surprise to US citizens, but the US has been spying foreign nationals and companies for years, and we've long known about it - haven't you heard of Echelon? It was also well known that these systems were used for industrial espionage.
- skrebbel 13y ago
  Huh. How is "You should've known!" a useful response to an apology? Of course he should've known, that's why he's apologizing.
  - prof_hobart 13y ago
    There is a big difference between "Subsequent facts have shown them to be right" and "Evidence existing at the time already strongly indicated they were right".
  - seclorum 13y ago
    It is a useful response because it allows for the solution to these sorts of things to occur: continued discussion of the need to enlighten oneself, and be aware of the lies of the world as they are told. An apology is not the last step, merely the first, in amending the situation .. and thus a continued dialog is of use.
  - rsynnott 13y ago
    It's written as if dubious access to data by US (and other; see ECHELON) security services is a startling new revelation, whereas in fact it has been a known risk for a couple of decades, and certainly a consideration when using hosted services. Here is a European commissioner raising it as a concern with respect to the Data Protection Directive, over a decade ago, for instance: http://europa.eu/rapid/press-release_SPEECH-01-368_en.pdf http://europa.eu/rapid/press-release_SPEECH-01-368_en.pdf
- icebraining 13y ago
  Agreed. From September 7, 2001, on CNN: European Parliament adopts 'Echelon' report (...) the document lists several examples in which intelligence officers are believed to have interfered in a commercial contract. The report claims that European aircraft maker Airbus Industrie had its lines tapped in 1994 while negotiating a $6 billion contract with the Saudi Arabian government and national airline. http://archives.cnn.com/2001/TECH/internet/09/07/echelon.report.idg/ http://archives.cnn.com/2001/TECH/internet/09/07/echelon.rep...
Sami_Lehtinen 13y ago
I just wonder why telcos I've been dealing with have always required to encrypt all information which is not classified as public information. All customer, project, system, configuration, documentation, contracts etc. must be encrypted before transit. - Surely they must have known about this. So if telcos won't trust privacy of telecommunication, why should anyone else think that telcos are trustworthy?
- deleted 13y ago
  [deleted]
- rsynnott 13y ago
  (A) Yes, they probably knew about this, at least as a potential risk; while the media has gotten very excited about PRISM, it isn't really that different to ECHELON, which has been effectively public knowledge since the late 90s. (B) Governments aren't the only ones potentially spying on peoples' unencrypted comms.
mironathetin 13y ago
How nice that finally there is understanding, that web-based services are good for providers and third parties not users. It's so obvious.
driverdan 13y ago
The author is overlooking one major flaw in his discussion: security (and possibly also reliability). His implication is that they can run internal servers more securely than Google and Salesforce. While government collection of encrypted emails is problematic, securing your own server and making it reliable is an entirely different issue. Unless they have an absolutely top notch security team they'd be better off on someone else's servers.
- honzzz 13y ago
  When your provider is forced by their government to just hand over your data, security is pretty much irrelevant. Anything is more secure than that.
  - redwood 13y ago
    The problem this, and many articles are missing: it isn't that the gov is taking the data from the cloud providers' servers. It's that the gov is mirroring all internet traffic and backing it all up.Thus they don't have to gain access to a cloud provider... let alone to a closet server, to get your traffic/emails.
  - plywoodtrees 13y ago
    No, not true. There are government and non-government attacks. Even if we assume cloud services are more vulnerable to government snooping, we need to also consider that many more companies and individuals suffer more damage from regular criminal hackers than from the NSA. Avoiding a small risk by increasing your exposure to a large risk is not rational.
    - honzzz 13y ago
      Generally this is a good point but I think it's not relevant in this case. The author of discussed article claims that they do business with governments and the knowledge that US government can access their data just by asking their provider to give it to them is not some 'small risk' that you might want to accept to avoid something worse - it's a deal breaker. Expose yourself like that and you have no business.
pconf 13y ago
It doesn't take much reading of the literature to understand industrial espionage or any of the other substantive risks of outsourcing. Prism or not, when you put your intellectual property on someone else's networks you are taking a risk. Yet most of the managers I see who make this decision just don't care. They ignore the advice of their systems admins and follow the old adage "you can't get fired for buying IBM" like sheep to a slaughter. It's typical of the short-term mindset that drives so many business decisions. I chalk this up to a lack of education, both in business and IT. While CS professors obsess over data structures and algorithms, and non-IT departments preach about the relevance of the next quarter's results, "Rome is burning".
- flybrand 13y ago
  We'd brought up a wafer fab in the Hsinchu Scientific Park in Taiwan before - so we weren't strangers to the concerns about industrial espionage. Several of us have done a lot of work with the government and we'd manufactured some very sensitive products (as does the current business). My apology is really around the fact that at the time we were trusting that such programs would not exist here (this was before explained Echelon to us), and that the US didn't work that way. I was naive and I was wrong.
  - pconf 13y ago
    we were trusting that such programs would not exist here It's still not clear what programs you are talking about. Because google provides no access logs "someone could go into our account and take confidential information, and we would never know". What does that have to do with Echelon or Prism?
jojobe 13y ago
Hosting the email on a server in your office is no protection if the data is being captured at your ISP unless all email is transmitted using SSL, and even then govt probably has that cracked long ago.

528 points by flybrand 13y ago

rdl 13y ago

Seems odd that someone wouldn't have understood that even 10-15 years ago. Outsourced means being exposed to risk from your supplier -- by the company itself, by its employees, or by governments. Gmail has somewhat better technical security to protect from outside non-state hackers than your average self-hosted exchange server, and from insiders (the IT guy, like Snowden, may not have the same goals as the organization...), but that may or may not make up for the ease of serving a third-party communications service provider. I still prefer well-run self-hosted mail unless: * You have a <6 month retention policy (i.e. so ECPA's weaker protections are a non issue) (which can be specified in Google Apps for Your Domain) * You don't have the technical competence to run your own mail server (which gets complicated in a larger organization due to HR risk), or don't have the business competence to hire a contractor to run it in-house in such a way that their staff don't become a huge risk. There's a third way which would be a lot better for everyone, but it's not technically feasible yet -- a way to outsource some aspects of the server without giving up control.

ricardobeat 13y ago
It would be great to have a service that could manage your mailserver configuration, tracking reputation & avoiding spam, while not having any access at all to the data itself.
- yen223 13y ago
  Is there any way to tell if a particular email is spam, without knowing the content or the sender of said email?
  - olalonde 13y ago
    Maybe homomorphic encryption[0] could help here? Here's what comes up after a quick Google: http://www.eweek.com/c/a/Security/IBM-Uncovers-Encryption-Scheme-That-Could-Improve-Cloud-Security-Spam-Filtering-135413/ http://www.eweek.com/c/a/Security/IBM-Uncovers-Encryption-Sc... [0] http://en.wikipedia.org/wiki/Homomorphic_encryption http://en.wikipedia.org/wiki/Homomorphic_encryption
  - ChuckMcM 13y ago
    If all your actual email is encrypted then by definition spam is the unencrypted stuff. A long time ago in a different galaxy I built a PGP MTA (based on sendmail at the time) which only forwarded mail that was encrypted, and as expected it was spam free, all though these days spammers just might go to the trouble of sending it encrypted if they thought it would get through.
    - csense 13y ago
      I'm guessing that people who only accept encrypted mail are such a small minority, you're probably safe from most spammers if you do this. People who target your company and employees specifically, maybe not. But even this could be made more difficult for spammers by only allowing access to your public key directory from trusted IP ranges. It's also a great idea from the standpoint of giving an encryption policy teeth. I'm thinking of a company where the official line is "We encrypt all our email," but then some IT screwup results in having half the company sending each other cleartext email for several quarters before anybody notices. If your mailservers reject unencrypted mail, the above scenario can't happen, because presumably people will notice when everyone's mail starts getting discarded, and it'll be fixed very quickly.
    - rdl 13y ago
      Even just setting START TLS REQUIRED might solve your spam problem, as long as only a tiny minority of people did it. That would have the added benefit of protecting you from Yahoo Mail users, the FBI, and such. At this point, I'd consider NOT using START TLS for your MTA to be nearly as irresponsible as not using ssh instead of telnet/rsh, or not using secure passwords. It correctly pushes all the pain onto the sysadmin (and a very tiny amount of pain), rather than end users.
      - bigiain 13y ago
        Do you know if a successful response to a START TLS command endured end-to-end TLS secured mail transport? I kinda doubt it - if for some reason your outgoing mail server connects to one of my secondary/relaying MX servers, I don't think there's any way for you to ensure that server bothers trying to set up a TLS session when it relays my mail(which I guess is mostly my problem/fault) - and similarly, if your ISP requires you to send mail via their SMTP servers (blocking port 25 isn't uncommon here) - I don't think you've got any say in whether or not that server requires TLS? (I know - I really should go and look this up myself…)
  - clicks 13y ago
    It could be a crowd-sourced effort -- e-mails that are spam you mark as spam and upload to some repo that is maintained by someone (a la Adblock). You keep your filters updated, and run your e-mail against the filters file.
    - ricardobeat 13y ago
      That's how current spam filters work, every mail server reports back to some central directories which keep tab on IPs, common subjects, keywords and other characteristics used to calculate spam scores. The trick is doing that without giving out access to message content to third-parties. http://en.wikipedia.org/wiki/The_Spamhaus_Project http://en.wikipedia.org/wiki/The_Spamhaus_Project
      - rdl 13y ago
        You can free ride -- receive the spam directory but not contribute. As long as your mail is representative of the overall mail corpus, that works out fine.
    - eru 13y ago
      That would be trivially defeated by sending everyone a slightly different spam email. (And if your encryption doesn't produce totally different files for slight changes in plaintext, it doesn't deserve that name.)
      - ricardobeat 13y ago
        I think you're replying to the wrong comment tree. Spammers already do this today, by including your name and other data in the message, and varying the wording, but that is not enough to fool the spam blockers, and there are diminishing rewards as your addresses/IPs begin to get marked as source of spam regardless of the content.
        eru 13y ago
        No, it was the right one. I was thinking about the grand-grand-fathers suggestion in relation to encryption.
  - rdl 13y ago
    No need to go that far. The provider just pushes code to a server the user controls. The code is trusted to just do mail server with no backdoor for the service provider to get data. That code executes in an environment trusted by the data owner, so the code is allowed to see the data and process based on it. I'm kind of tempted to do this, since we largely do this kind of thing for VPN already. Doing it with trusted execution lets the code execute on hardware owned by the service provider, but that is technically difficult and hard to prove. Just letting you run code on your own virtual machine host is a lot easier (could be a third party virtualization provider if that is what you want, but I'd at least go for colo of my own server, if not on premise.)
    - clicks 13y ago
      > I'm kind of tempted to do this, since we largely do this kind off thing for VPN already. Take advantage of the zeitgeist rdl. You can look forward to at least one customer if you decide to go ahead with this. (me). :)
  - betterunix 13y ago
    Yes, but it is still very much in the research stages, not quite ready for real-world deployment: https://en.wikipedia.org/wiki/Fully_homomorphic_encryption https://en.wikipedia.org/wiki/Fully_homomorphic_encryption https://en.wikipedia.org/wiki/Secure_multi-party_computation https://en.wikipedia.org/wiki/Secure_multi-party_computation There is a huge amount of interest among cryptography researchers and from DARPA and the NSF.
- rdl 13y ago
  Yeah, that wouldn't be too hard to set up. You could run arbitrary services that way -- the key would be keeping configurations totally locked down, so all config edits happen through some kind of defined interface, to let the service provider do full testing. But I don't think individual mailboxes would be very likely to cause changed in testing before deploying upgrades. You could just use the "virtual appliance" model and do virtual machine level upgrades, with data on a separate partition -- less of a hassle than testing a bunch of upgrades from smaller patches (the paranoia about breaking it is that the service provider doesn't have root, so a failed upgrade could be bad). I'd probably want encrypted backups held with the provider too, for most non sophisticated users.
damian2000 13y ago
I think he understood the risks, but basically took it as fact that the US was beholden to decent privacy laws restricting access to private (and encrypted) communications like email. One of the main arguments for using Google apps in the past is the technical level of Google's security, and protection from being hacked. But the NSA/prism leaks have raised a new question in peoples minds, in favour of keeping things in-house or at least in your own country.
- mpyne 13y ago
  That's just it though, we've heard of stuff like ECHELON (which involved no warrants whatsoever) since years before this discussion would have taken place. ECPA dates to 1986! FISA dates to 1978! The insidiously loose interpretation on 4th Amendment controls for third-party communications dates back for centuries. A lot of this was just a quick Google search away, and would have been just as relevant the very year GMail was introduced. Likewise there's no theoretical reason to trust internal Google policy controls over U.S. government legal and policy controls. Even if what the author thought had been true about U.S. law actually was true, he'd still have been setting his customer up for the possibility of having their confidential data leaked (maliciously or not) or hacked into (e.g. by the always-vulnerable password reset function). That's not just a nitpick either. There have been a couple of services at work I would have liked to setup on something like Digital Ocean, Basecamp Breeze, etc. that I can't because of PII concerns. So while I'm sorry that the author made wrong assumptions I don't know what to tell him other than IANAL isn't just a five-letter acronym, and "due diligence" doesn't simply mean "hire a contractor to think about this for me".
  - rdl 13y ago
    FISA and ECPA made things more secure than they were previously, which is the crazy part.
dfc 13y ago
For those interested in google apps retention: http://support.google.com/a/bin/answer.py?hl=en&answer=151128 http://support.google.com/a/bin/answer.py?hl=en&answer=15112... Spoiler Alert: Apps for Business/Education only

comrade1 13y ago

3 years ago my clients (top 100 European banks, car companies, luxury goods) would reluctantly let us host data at aws European servers. They would never allow hosting at u.s. servers. Now they won't allow aws at all and everything is in chaos.

frozenport 13y ago

I wonder if this problem is particularly acute for Eastern European companies who often sell their products to despicable despotic regimes.

betterunix 13y ago
How would that differentiate them from Western companies? https://en.wikipedia.org/wiki/FinFisher https://en.wikipedia.org/wiki/FinFisher
readme 13y ago
Yeah, because there haven't been any despotic regimes in the US lately.

btipling 13y ago

Hrm I wonder what are the chances that someone at the NSA or doing contract work for the NSA has a buddy at a company and that person decides to use their NSA powers to get their buddy's competitor's emails from Google Apps and send those emails to their friend. If there are safeguards in place from keeping this from happening how was Snowden able to take so many documents with him when he went to Hong Kong. Ok so maybe he didn't take any of that kind of data, maybe I'm reaching. If this kind of thing did happen would they let the affected company know? Would anyone know?

alrs 13y ago
This kind of work isn't informal. Economic espionage is a big part of what intelligence agencies are doing all day. http://www.commondreams.org/headlines/070200-02.htm http://www.commondreams.org/headlines/070200-02.htm
- leoc 13y ago
  One unintended consequence of the Snowden leak is to advertise this service to US businesses. My guess is that the discreet inquiries are already winging their way towards Congressmen.
  - pc86 13y ago
    No. With the exception of the handful of Members on relevant intelligence committees, most Members of Congress were not aware of the massive scope of this program, or even that it existed in its current form. Access to this type of information by a private citizen would require a hell of a lot more access than writing a big check to a Representative can get you.
    - Jgrubb 13y ago
      Color me skeptical, but it doesn't appear that there's anything that's outside the scope of what a big check to a congressperson can get you these days. I do hope you're right, though.
    - 13y ago

drawkbox 13y ago

Sadly the NSA programs are strongly anti-business as it is based on 'trust in me'. American businesses could and should lobby Congress to fight this and to find ways to protect US stored data, I know I wouldn't trust a Chinese cloud company not to snoop or steal business/corporate ideas and trade secrets. But if there were assurances for US cloud businesses that this doesn't affect their business ideas accidentally or deliberately then we could set a global example on how to run cloud data storage that is safe and business friendly. There is an opportunity here for Google, Amazon, Apple etc for cloud data. Lots of damage control to be done here for international clients. As an American I would always trust our systems more but international companies may have a very hard time trusting without the US being a shining example of how to correctly protect business data in clouds here, especially encrypted data that is automatically subject to storage/filtering if international.

deleted 13y ago
[deleted]
greyman 13y ago
But what protection of stored data do you mean should Congress find, by introducing some Laws? Because, well, if the data are not encrypted on the server, then someone could still take them... that's how Internet works. For now, the only solution I can think of is that you encrypt the data locally, and upload only the encrypted data - but this way, the cloud provider will not able to provide any additional value. Or are there some other possibilities?
- drawkbox 13y ago
  Not necessarily talking about encryption or security of data, that should already be an inherent part of cloud systems. I am talking about protections on unauthorized access by agencies (even for national security) meaning no more blanket access to all email/files/etc rather explicit machine read systems that only access data that has a warranted access and useful to the investigations. Human access should not be allowed unless the data has already been warranted, filtered by the system and useful in the investigation that the NSA/DOJ/ etc might be using. A big problem right now with it is blanket access and collecting content in bulk to sift through. There should be no way a human can go into an email box or cloud files and read everything for instance unless the person themselves is under investigation, email communication with that person can only be pulled from other innocent people's boxes that are part of the investigation, not everything. As is it right now they just collect everything and store it. It should also have heavy encryption and 3-5 approvals/logs/access audits per individual human access so there is a minimized threat of people searching business ideas for personal gain. This would prevent the one time email or document share with someone that they allows access to all their data. Explicit access and heavily verified across judicial, audits and multiple users 3-5 at least approving or seeing the access within the security organization. NSA and CIA etc are patriots and like their freedoms as well, I am sure they don't want colleagues stealing ideas, business plans and random people's personal info when they go civilian. It is currently too sweeping and broad due to terrorism threats that have yet to take away as many freedoms as our own internal legal overreaches. For example, right now let's say I am some crooked agent or politician, I could have one email or call to a person and justify looking at all their data. This might be someone who is in a competitive company or business information they want to find out. Steps like the above would minimize those abuses which are bound to happen. Take for instance oil mining or product plans, these types of competitive environments are very susceptible to snooping and corporate espionage without heavy controls on access to data. Protection for international users in the same as US persons. Noone will trust storing data on our servers and cloud systems if they know all their data is being filtered and easily accessible by a single agent. Also, extremely fast audits, judicial warranting. There is no reason it should take a long time with today's tools. I imagine the NSA and others are collecting all this data because the bureaucracy makes it difficult to get approvals in time, so they go in bulk as a fail safe. I dont' envy them the work is very hard and it is justified when true threats exist, these people typically aren't evil and most have the best intentions. But with great access to information comes a power that is hard to contain if not verified. Timed release/removal of information that is not needed now, not indefinite storage. Will this make us less safe? Maybe but freedoms are not easy, it takes work to be free. Authoritarian is easy. Maybe something like a Bill of Data Rights that also applies to international people in addition to the US. We would really revolutionize rights and data rights in the world, it would attract alot of business to data storage in the US. However currently data is free-er in other places sadly.

Camillo 13y ago

While OP's apology is appreciable, there was more than enough information available in 2008 to understand that his Czech colleagues were right. The Prism scandal may have come as a surprise to US citizens, but the US has been spying foreign nationals and companies for years, and we've long known about it - haven't you heard of Echelon? It was also well known that these systems were used for industrial espionage.

skrebbel 13y ago
Huh. How is "You should've known!" a useful response to an apology? Of course he should've known, that's why he's apologizing.
- prof_hobart 13y ago
  There is a big difference between "Subsequent facts have shown them to be right" and "Evidence existing at the time already strongly indicated they were right".
- seclorum 13y ago
  It is a useful response because it allows for the solution to these sorts of things to occur: continued discussion of the need to enlighten oneself, and be aware of the lies of the world as they are told. An apology is not the last step, merely the first, in amending the situation .. and thus a continued dialog is of use.
- rsynnott 13y ago
  It's written as if dubious access to data by US (and other; see ECHELON) security services is a startling new revelation, whereas in fact it has been a known risk for a couple of decades, and certainly a consideration when using hosted services. Here is a European commissioner raising it as a concern with respect to the Data Protection Directive, over a decade ago, for instance: http://europa.eu/rapid/press-release_SPEECH-01-368_en.pdf http://europa.eu/rapid/press-release_SPEECH-01-368_en.pdf
icebraining 13y ago
Agreed. From September 7, 2001, on CNN: European Parliament adopts 'Echelon' report (...) the document lists several examples in which intelligence officers are believed to have interfered in a commercial contract. The report claims that European aircraft maker Airbus Industrie had its lines tapped in 1994 while negotiating a $6 billion contract with the Saudi Arabian government and national airline. http://archives.cnn.com/2001/TECH/internet/09/07/echelon.report.idg/ http://archives.cnn.com/2001/TECH/internet/09/07/echelon.rep...

Sami_Lehtinen 13y ago

I just wonder why telcos I've been dealing with have always required to encrypt all information which is not classified as public information. All customer, project, system, configuration, documentation, contracts etc. must be encrypted before transit. - Surely they must have known about this. So if telcos won't trust privacy of telecommunication, why should anyone else think that telcos are trustworthy?

deleted 13y ago
[deleted]
rsynnott 13y ago
(A) Yes, they probably knew about this, at least as a potential risk; while the media has gotten very excited about PRISM, it isn't really that different to ECHELON, which has been effectively public knowledge since the late 90s. (B) Governments aren't the only ones potentially spying on peoples' unencrypted comms.

mironathetin 13y ago

How nice that finally there is understanding, that web-based services are good for providers and third parties not users. It's so obvious.

driverdan 13y ago

The author is overlooking one major flaw in his discussion: security (and possibly also reliability). His implication is that they can run internal servers more securely than Google and Salesforce. While government collection of encrypted emails is problematic, securing your own server and making it reliable is an entirely different issue. Unless they have an absolutely top notch security team they'd be better off on someone else's servers.

honzzz 13y ago
When your provider is forced by their government to just hand over your data, security is pretty much irrelevant. Anything is more secure than that.
- redwood 13y ago
  The problem this, and many articles are missing: it isn't that the gov is taking the data from the cloud providers' servers. It's that the gov is mirroring all internet traffic and backing it all up.Thus they don't have to gain access to a cloud provider... let alone to a closet server, to get your traffic/emails.
- plywoodtrees 13y ago
  No, not true. There are government and non-government attacks. Even if we assume cloud services are more vulnerable to government snooping, we need to also consider that many more companies and individuals suffer more damage from regular criminal hackers than from the NSA. Avoiding a small risk by increasing your exposure to a large risk is not rational.
  - honzzz 13y ago
    Generally this is a good point but I think it's not relevant in this case. The author of discussed article claims that they do business with governments and the knowledge that US government can access their data just by asking their provider to give it to them is not some 'small risk' that you might want to accept to avoid something worse - it's a deal breaker. Expose yourself like that and you have no business.

pconf 13y ago

It doesn't take much reading of the literature to understand industrial espionage or any of the other substantive risks of outsourcing. Prism or not, when you put your intellectual property on someone else's networks you are taking a risk. Yet most of the managers I see who make this decision just don't care. They ignore the advice of their systems admins and follow the old adage "you can't get fired for buying IBM" like sheep to a slaughter. It's typical of the short-term mindset that drives so many business decisions. I chalk this up to a lack of education, both in business and IT. While CS professors obsess over data structures and algorithms, and non-IT departments preach about the relevance of the next quarter's results, "Rome is burning".

flybrand 13y ago
We'd brought up a wafer fab in the Hsinchu Scientific Park in Taiwan before - so we weren't strangers to the concerns about industrial espionage. Several of us have done a lot of work with the government and we'd manufactured some very sensitive products (as does the current business). My apology is really around the fact that at the time we were trusting that such programs would not exist here (this was before explained Echelon to us), and that the US didn't work that way. I was naive and I was wrong.
- pconf 13y ago
  we were trusting that such programs would not exist here It's still not clear what programs you are talking about. Because google provides no access logs "someone could go into our account and take confidential information, and we would never know". What does that have to do with Echelon or Prism?

jojobe 13y ago

Hosting the email on a server in your office is no protection if the data is being captured at your ISP unless all email is transmitted using SSL, and even then govt probably has that cracked long ago.