4 ms·

Sadly the NSA programs are strongly anti-business as it is based on 'trust in me'. American businesses could and should lobby Congress to fight this and to fin

Sadly the NSA programs are strongly anti-business as it is based on 'trust in me'. American businesses could and should lobby Congress to fight this and to find ways to protect US stored data, I know I wouldn't trust a Chinese cloud company not to snoop or steal business/corporate ideas and trade secrets. But if there were assurances for US cloud businesses that this doesn't affect their business ideas accidentally or deliberately then we could set a global example on how to run cloud data storage that is safe and business friendly. There is an opportunity here for Google, Amazon, Apple etc for cloud data. Lots of damage control to be done here for international clients. As an American I would always trust our systems more but international companies may have a very hard time trusting without the US being a shining example of how to correctly protect business data in clouds here, especially encrypted data that is automatically subject to storage/filtering if international.

deleted 13y ago
[deleted]
greyman 13y ago
But what protection of stored data do you mean should Congress find, by introducing some Laws? Because, well, if the data are not encrypted on the server, then someone could still take them... that's how Internet works. For now, the only solution I can think of is that you encrypt the data locally, and upload only the encrypted data - but this way, the cloud provider will not able to provide any additional value. Or are there some other possibilities?
- drawkbox 13y ago
  Not necessarily talking about encryption or security of data, that should already be an inherent part of cloud systems. I am talking about protections on unauthorized access by agencies (even for national security) meaning no more blanket access to all email/files/etc rather explicit machine read systems that only access data that has a warranted access and useful to the investigations. Human access should not be allowed unless the data has already been warranted, filtered by the system and useful in the investigation that the NSA/DOJ/ etc might be using. A big problem right now with it is blanket access and collecting content in bulk to sift through. There should be no way a human can go into an email box or cloud files and read everything for instance unless the person themselves is under investigation, email communication with that person can only be pulled from other innocent people's boxes that are part of the investigation, not everything. As is it right now they just collect everything and store it. It should also have heavy encryption and 3-5 approvals/logs/access audits per individual human access so there is a minimized threat of people searching business ideas for personal gain. This would prevent the one time email or document share with someone that they allows access to all their data. Explicit access and heavily verified across judicial, audits and multiple users 3-5 at least approving or seeing the access within the security organization. NSA and CIA etc are patriots and like their freedoms as well, I am sure they don't want colleagues stealing ideas, business plans and random people's personal info when they go civilian. It is currently too sweeping and broad due to terrorism threats that have yet to take away as many freedoms as our own internal legal overreaches. For example, right now let's say I am some crooked agent or politician, I could have one email or call to a person and justify looking at all their data. This might be someone who is in a competitive company or business information they want to find out. Steps like the above would minimize those abuses which are bound to happen. Take for instance oil mining or product plans, these types of competitive environments are very susceptible to snooping and corporate espionage without heavy controls on access to data. Protection for international users in the same as US persons. Noone will trust storing data on our servers and cloud systems if they know all their data is being filtered and easily accessible by a single agent. Also, extremely fast audits, judicial warranting. There is no reason it should take a long time with today's tools. I imagine the NSA and others are collecting all this data because the bureaucracy makes it difficult to get approvals in time, so they go in bulk as a fail safe. I dont' envy them the work is very hard and it is justified when true threats exist, these people typically aren't evil and most have the best intentions. But with great access to information comes a power that is hard to contain if not verified. Timed release/removal of information that is not needed now, not indefinite storage. Will this make us less safe? Maybe but freedoms are not easy, it takes work to be free. Authoritarian is easy. Maybe something like a Bill of Data Rights that also applies to international people in addition to the US. We would really revolutionize rights and data rights in the world, it would attract alot of business to data storage in the US. However currently data is free-er in other places sadly.
  - greyman 13y ago
    > Human access should not be allowed Yes, of course, but this is not enforceable. You have to trust the company that they will not allow it. You can't ensure it.
  - alextingle 13y ago
    > Human access should not be allowed unless the data has already been warranted Access should not be allowed unless the data has already been warranted. I don't care a fig whether my privacy is being violated by amoral machines or amoral humans.
pekk 13y ago
I love how business-friendliness is your top concern here. How about this: only businesses (like Facebook, Google et al.) should be able to say 'trust in me' - to their customers. Privacy regulation is only for the government, this will ensure that the surveillance state is built by corporations, as God intended. It's obviously a huge risk and embarrassment if the US government looks at data from Europeans. But if American companies sell each other that data, that should be of no concern to Europeans, because private companies are all inherently trustworthy without external oversight.
- drawkbox 13y ago
  Well I mentioned business aspects since that was the topic/article focus, lack of trust in US business/cloud data due to unsure protections and secrets of business. Also I mention that frequently because the people that say 'I have nothing to hide' and don't mind, might think differently if they are business focused and do worry about people stealing ideas, plans, or reacting based on those business secrets. It is bad all around when individual privacy is at risk unknowingly, but it also affects business privacy and that impacts everyone and harms perception of US cloud services for one which the article mentions. If you make something public on a website like Facebook you should expect that will be used. But noone expected private emails, phone calls, logs of files in the cloud to be so easily accessible. It creates huge problems in business trustworthiness and protections. That aside from the more important lack of individual privacy that is expected in the same and the root of the problem.
- wolfgke 13y ago
  > How about this: only businesses (like Facebook, Google et al.) should be able to say 'trust in me' - to their customers. As a user of Facebook, you aren't a customer, but the product that is sold to the advertising customers.
rsynnott 13y ago
Historically, similar systems have been quite pro-business (or pro-American-business); ECHELON sigint data was used in the 90s to help Boeing win a large contract over Airbus, for instance.

deleted 13y ago

[deleted]

greyman 13y ago

But what protection of stored data do you mean should Congress find, by introducing some Laws? Because, well, if the data are not encrypted on the server, then someone could still take them... that's how Internet works. For now, the only solution I can think of is that you encrypt the data locally, and upload only the encrypted data - but this way, the cloud provider will not able to provide any additional value. Or are there some other possibilities?

drawkbox 13y ago
Not necessarily talking about encryption or security of data, that should already be an inherent part of cloud systems. I am talking about protections on unauthorized access by agencies (even for national security) meaning no more blanket access to all email/files/etc rather explicit machine read systems that only access data that has a warranted access and useful to the investigations. Human access should not be allowed unless the data has already been warranted, filtered by the system and useful in the investigation that the NSA/DOJ/ etc might be using. A big problem right now with it is blanket access and collecting content in bulk to sift through. There should be no way a human can go into an email box or cloud files and read everything for instance unless the person themselves is under investigation, email communication with that person can only be pulled from other innocent people's boxes that are part of the investigation, not everything. As is it right now they just collect everything and store it. It should also have heavy encryption and 3-5 approvals/logs/access audits per individual human access so there is a minimized threat of people searching business ideas for personal gain. This would prevent the one time email or document share with someone that they allows access to all their data. Explicit access and heavily verified across judicial, audits and multiple users 3-5 at least approving or seeing the access within the security organization. NSA and CIA etc are patriots and like their freedoms as well, I am sure they don't want colleagues stealing ideas, business plans and random people's personal info when they go civilian. It is currently too sweeping and broad due to terrorism threats that have yet to take away as many freedoms as our own internal legal overreaches. For example, right now let's say I am some crooked agent or politician, I could have one email or call to a person and justify looking at all their data. This might be someone who is in a competitive company or business information they want to find out. Steps like the above would minimize those abuses which are bound to happen. Take for instance oil mining or product plans, these types of competitive environments are very susceptible to snooping and corporate espionage without heavy controls on access to data. Protection for international users in the same as US persons. Noone will trust storing data on our servers and cloud systems if they know all their data is being filtered and easily accessible by a single agent. Also, extremely fast audits, judicial warranting. There is no reason it should take a long time with today's tools. I imagine the NSA and others are collecting all this data because the bureaucracy makes it difficult to get approvals in time, so they go in bulk as a fail safe. I dont' envy them the work is very hard and it is justified when true threats exist, these people typically aren't evil and most have the best intentions. But with great access to information comes a power that is hard to contain if not verified. Timed release/removal of information that is not needed now, not indefinite storage. Will this make us less safe? Maybe but freedoms are not easy, it takes work to be free. Authoritarian is easy. Maybe something like a Bill of Data Rights that also applies to international people in addition to the US. We would really revolutionize rights and data rights in the world, it would attract alot of business to data storage in the US. However currently data is free-er in other places sadly.
- greyman 13y ago
  > Human access should not be allowed Yes, of course, but this is not enforceable. You have to trust the company that they will not allow it. You can't ensure it.
- alextingle 13y ago
  > Human access should not be allowed unless the data has already been warranted Access should not be allowed unless the data has already been warranted. I don't care a fig whether my privacy is being violated by amoral machines or amoral humans.

pekk 13y ago

I love how business-friendliness is your top concern here. How about this: only businesses (like Facebook, Google et al.) should be able to say 'trust in me' - to their customers. Privacy regulation is only for the government, this will ensure that the surveillance state is built by corporations, as God intended. It's obviously a huge risk and embarrassment if the US government looks at data from Europeans. But if American companies sell each other that data, that should be of no concern to Europeans, because private companies are all inherently trustworthy without external oversight.

drawkbox 13y ago
Well I mentioned business aspects since that was the topic/article focus, lack of trust in US business/cloud data due to unsure protections and secrets of business. Also I mention that frequently because the people that say 'I have nothing to hide' and don't mind, might think differently if they are business focused and do worry about people stealing ideas, plans, or reacting based on those business secrets. It is bad all around when individual privacy is at risk unknowingly, but it also affects business privacy and that impacts everyone and harms perception of US cloud services for one which the article mentions. If you make something public on a website like Facebook you should expect that will be used. But noone expected private emails, phone calls, logs of files in the cloud to be so easily accessible. It creates huge problems in business trustworthiness and protections. That aside from the more important lack of individual privacy that is expected in the same and the root of the problem.
wolfgke 13y ago
> How about this: only businesses (like Facebook, Google et al.) should be able to say 'trust in me' - to their customers. As a user of Facebook, you aren't a customer, but the product that is sold to the advertising customers.

rsynnott 13y ago

Historically, similar systems have been quite pro-business (or pro-American-business); ECHELON sigint data was used in the 90s to help Boeing win a large contract over Airbus, for instance.