In the clouds...

[Scoobos]

phew, I'm pleased with the concensus here, I thought i was getting a bit tinfoil hat about it.

It's a genuine concern for a lot of my customers , namely those in Pharma / Medical and also child data that is held.

[darmstadt]

Yup, they'd hand you or me over without stopping for lunch. But the politicians wouldn't dream of handing over their banking bosses' data to the 'Merkins. Who'd fund the Labtorycrats then?

Not me, I don't reside in the UK...

February 2010:

The European Parliament has vetoed an agreement that gives the US authorities access to banking details of Europeans. IT and EU law expert Lassi Jyrkkiö, who currently works in the European Parliament for Finnish Green MEP Heidi Hautala explains the context behind and impact of the decision.

You just might have missed it but 11 February was a game-changing date for citizens' data protection in Europe. Civil liberty activists opened champaigne bottles after the European Parliament (yes, that over-subsidised talking shop) sensationally voted 396 to 187 to veto the SWIFT bank data agreement between the EU and United States.

The European section of the US government's Terrorist Finance Tracking Program, which allowed US Treasury and CIA access to SWIFT's (Society for Worldwide Interbank Financial Telecommunication) transaction database, had been executed post-9/11 - not only in secret but also in breach of EU data protection laws. The scheme was finally exposed in 2006. Ever since, the USA has made agreements with the EU Council (Governments of EU member states), enabling American surveillance authorities to access the data.

The eventually snubbed agreement was secretly negotiated and signed by the Council at the end of last year. However, the dodgy-sounding Lisbon Treaty came into force on 1 December, enabling the Parliament to veto international agreements such as SWIFT. US government understood the risk of rejection. Officials such as Hillary Clinton appealed intensely to MEPs to give their consent. But the agreement's shortcomings were too plain to see.

The biggest fault was that US authorities would have been allowed access to European citizens' bank transfers data in bulk. As anyone with some internet savviness has learned, it's easy to assemble extremely specific information on almost anything by connecting facts from several sources.

Similarly, if you grant a foreign government with practically unrestricted access to citizens' private information such as bank, passenger and phone call data, you effectively create an enormous potential of wrongdoing-enabling combinations. Whilst access should sometimes be given to a specific detail, it is an altogether different matter to let US authorities "google" European SWIFT data.

There was also the lack of reciprocity; the data highway over the Atlantic was set to be used as a one-way street. Furthermore, the agreement allowed USA to pass information onwards to other countries and the redress mechanisms were inadequate. The data retention period would have been too long; in the words of one MEP "one day [the data] may be available not to an Obama administration, but to a Sarah Palin one."

While in some EU countries the whole chain of events was a non-issue, the agreement made front-page news in German-speaking Europe for months. Not only the blogosphere but the general public got worried. This shifted even many conservatives to oppose the agreement (not just the leftist, liberal and Green usual suspects). This scenario was encouraging for UK and the rest of Europe.

The SWIFT agreement would have been an interim one, running out at the end of October. Now the USA will seek information in accordance with the respective laws of each member state. Negotiations for a new long-term SWIFT deal will begin soon. Security and civil liberties will again have to be the reconciled in the agreement on aeroplane Passenger Name Records. After 11 February, you just might expect somewhat sensible future deals from certain useless talking shops.

June 2010:

MEPs in Strasbourg voted unanimously to endorse an agreement that gives the US access to bulk data from Swift, the Brussels-based cooperative that handles inter-bank financial payments.

The parliament rejected a similar agreement in February, citing concerns that personal information could be misused by US authorities.

But parliamentarians approved the new deal, with 484 in favour and 109 against.

The US insists the Swift deal is critical to fighting terrorism, as part of the US Terrorist Financing Tracking Programme (TFTP), set up in the wake of the September 2001 attacks. Senior figures, including Secretary of State Hilary Clinton, lobbied the Parliament.

In an attempt to placate concerns voiced by MEPs and lobby groups, the EU has now agreed to appoint officials to monitor US investigators' actions.

[Scoobos]

Of course, then you get into the realms of plausible deniability. If you really want to, you can have a hash that decrypts to more than one plaintext you know.

Not that HMG is ever likely to entertain a request for a British bank or business to hand over its encryption keys to a foreign power without a very good reason to do so.

This has already happened I think and its also moving to try and get Revenue and Customs, DVLA and ISP information too . (parts of the DVLA have already been farmed out to non Data Protection Act countries too -

The finance has already been covered, I think the idea is, once they have buy in to the TFTP they will then be able to mop up the soft targets of DVLA, ISP etc.


Terrorist Finance Tracking Program - Wikipedia, the free encyclopedia

Whilst I'm pedalling cloud conspiracy theories , there's a big, perhaps not completely unfounded fear that the US is trying to get access to pretty much all internet traffic in one way or another. Given the massive increase in cyber warfare I'd also add that we want to worry about breaches in the cloud by thieves or enemies on cloud infrastructures.

If you penetrate one cloud host, you've perhaps got 10 -15 businesses in 1 attack - it makes attacking the cloud platforms a lot more viable than a privately run internal infrastructure.

Finally, before I become scared of my own shadow - you also have to trust the staff that work these cheap cloud platforms (not Azure etc, but the smaller offerings)

Not 100% related, but a show of how we need to take much better care of our data.

http://www.infosecurity-magazine.com...ndian-workers/