Reply to: In the clouds...

[Scoobos]

Of course, then you get into the realms of plausible deniability. If you really want to, you can have a hash that decrypts to more than one plaintext you know.

Not that HMG is ever likely to entertain a request for a British bank or business to hand over its encryption keys to a foreign power without a very good reason to do so.

This has already happened I think and its also moving to try and get Revenue and Customs, DVLA and ISP information too . (parts of the DVLA have already been farmed out to non Data Protection Act countries too -

The finance has already been covered, I think the idea is, once they have buy in to the TFTP they will then be able to mop up the soft targets of DVLA, ISP etc.


Terrorist Finance Tracking Program - Wikipedia, the free encyclopedia

Whilst I'm pedalling cloud conspiracy theories , there's a big, perhaps not completely unfounded fear that the US is trying to get access to pretty much all internet traffic in one way or another. Given the massive increase in cyber warfare I'd also add that we want to worry about breaches in the cloud by thieves or enemies on cloud infrastructures.

If you penetrate one cloud host, you've perhaps got 10 -15 businesses in 1 attack - it makes attacking the cloud platforms a lot more viable than a privately run internal infrastructure.

Finally, before I become scared of my own shadow - you also have to trust the staff that work these cheap cloud platforms (not Azure etc, but the smaller offerings)

Not 100% related, but a show of how we need to take much better care of our data.

http://www.infosecurity-magazine.com...ndian-workers/

[darmstadt]

Yup, they'd hand you or me over without stopping for lunch. But the politicians wouldn't dream of handing over their banking bosses' data to the 'Merkins. Who'd fund the Labtorycrats then?

Not me, I don't reside in the UK...

February 2010:

The European Parliament has vetoed an agreement that gives the US authorities access to banking details of Europeans. IT and EU law expert Lassi Jyrkkiö, who currently works in the European Parliament for Finnish Green MEP Heidi Hautala explains the context behind and impact of the decision.

You just might have missed it but 11 February was a game-changing date for citizens' data protection in Europe. Civil liberty activists opened champaigne bottles after the European Parliament (yes, that over-subsidised talking shop) sensationally voted 396 to 187 to veto the SWIFT bank data agreement between the EU and United States.

The European section of the US government's Terrorist Finance Tracking Program, which allowed US Treasury and CIA access to SWIFT's (Society for Worldwide Interbank Financial Telecommunication) transaction database, had been executed post-9/11 - not only in secret but also in breach of EU data protection laws. The scheme was finally exposed in 2006. Ever since, the USA has made agreements with the EU Council (Governments of EU member states), enabling American surveillance authorities to access the data.

The eventually snubbed agreement was secretly negotiated and signed by the Council at the end of last year. However, the dodgy-sounding Lisbon Treaty came into force on 1 December, enabling the Parliament to veto international agreements such as SWIFT. US government understood the risk of rejection. Officials such as Hillary Clinton appealed intensely to MEPs to give their consent. But the agreement's shortcomings were too plain to see.

The biggest fault was that US authorities would have been allowed access to European citizens' bank transfers data in bulk. As anyone with some internet savviness has learned, it's easy to assemble extremely specific information on almost anything by connecting facts from several sources.

Similarly, if you grant a foreign government with practically unrestricted access to citizens' private information such as bank, passenger and phone call data, you effectively create an enormous potential of wrongdoing-enabling combinations. Whilst access should sometimes be given to a specific detail, it is an altogether different matter to let US authorities "google" European SWIFT data.

There was also the lack of reciprocity; the data highway over the Atlantic was set to be used as a one-way street. Furthermore, the agreement allowed USA to pass information onwards to other countries and the redress mechanisms were inadequate. The data retention period would have been too long; in the words of one MEP "one day [the data] may be available not to an Obama administration, but to a Sarah Palin one."

While in some EU countries the whole chain of events was a non-issue, the agreement made front-page news in German-speaking Europe for months. Not only the blogosphere but the general public got worried. This shifted even many conservatives to oppose the agreement (not just the leftist, liberal and Green usual suspects). This scenario was encouraging for UK and the rest of Europe.

The SWIFT agreement would have been an interim one, running out at the end of October. Now the USA will seek information in accordance with the respective laws of each member state. Negotiations for a new long-term SWIFT deal will begin soon. Security and civil liberties will again have to be the reconciled in the agreement on aeroplane Passenger Name Records. After 11 February, you just might expect somewhat sensible future deals from certain useless talking shops.

June 2010:

MEPs in Strasbourg voted unanimously to endorse an agreement that gives the US access to bulk data from Swift, the Brussels-based cooperative that handles inter-bank financial payments.

The parliament rejected a similar agreement in February, citing concerns that personal information could be misused by US authorities.

But parliamentarians approved the new deal, with 484 in favour and 109 against.

The US insists the Swift deal is critical to fighting terrorism, as part of the US Terrorist Financing Tracking Programme (TFTP), set up in the wake of the September 2001 attacks. Senior figures, including Secretary of State Hilary Clinton, lobbied the Parliament.

In an attempt to placate concerns voiced by MEPs and lobby groups, the EU has now agreed to appoint officials to monitor US investigators' actions.

[Scoobos]

phew, I'm pleased with the concensus here, I thought i was getting a bit tinfoil hat about it.

It's a genuine concern for a lot of my customers , namely those in Pharma / Medical and also child data that is held.

[Gentile]

Of course it would, it quite happily hands over its citizens...

Yup, they'd hand you or me over without stopping for lunch. But the politicians wouldn't dream of handing over their banking bosses' data to the 'Merkins. Who'd fund the Labtorycrats then?

[darmstadt]

Of course, then you get into the realms of plausible deniability. If you really want to, you can have a hash that decrypts to more than one plaintext you know.

Not that HMG is ever likely to entertain a request for a British bank or business to hand over its encryption keys to a foreign power without a very good reason to do so.

Of course it would, it quite happily hands over its citizens...

[Churchill]

Of course, then you get into the realms of plausible deniability. If you really want to, you can have a hash that decrypts to more than one plaintext you know.

Not that HMG is ever likely to entertain a request for a British bank or business to hand over its encryption keys to a foreign power without a very good reason to do so.

By the time you're asked for the key the evidence has already been obtained.

There's a reason why so much money gets thrown into places like Menwith Hill, Pine Gap etc.

[EternalOptimist]

They don't have to break it. They ask you for the key, you refuse, you end up in prison.

I put my data in a cloud
That floats on high in the USA,
When all at once I saw a crowd,
A host, of Yankee security men;
Beside the house, beneath the trees,
Demanding my security keys.

..



For oft, when in my cell I lie
In vacant or in pensive mood,
I think about that SLA
I think of that 0.5 percentile;
And as the waterboarding begins,
Thanks a fckng bunch. gentile



EO Worsdsworth

[Gentile]

They don't have to break it. They ask you for the key, you refuse, you end up in prison.

Of course, then you get into the realms of plausible deniability. If you really want to, you can have a hash that decrypts to more than one plaintext you know.

Not that HMG is ever likely to entertain a request for a British bank or business to hand over its encryption keys to a foreign power without a very good reason to do so.

[darmstadt]

It wasn't called cloud when I knew it...

[Churchill]

They can request it all they like. All they're going to get is a hash of the data. As long as you take certain precautions, such as encrypting the data locally before storing a hash of same (as opposed to allowing SQL Server to do the hashing itself, which would involve you sending plaintext and would leave you open to a side-channel attack), even the NSA couldn't break data encrypted with 256-bit AES at the present time.

They don't have to break it. They ask you for the key, you refuse, you end up in prison.

[Gentile]

I've heard some real crap too, like "you can work without a net connection" "yes you can work on the train without wireless" etc etc.

Of course you can't do that just by using the Cloud to store your data. But you certainly can do that, whether or not you're using Cloud data storage, if you design a Smart Client that keeps a local data store and is designed to facilitate synchronisation when you do have an internet connection.

You have to be careful how you design it, though: basically, no two people must be able to edit the same record offline, or you need to include some way to resolve conflicts after the fact (usually the former works better). It's been a while since I was asked to design something like that, though. In the present age of near-ubiquitous HSDPA and GPRS people just don't need it.

[Gentile]

I wish I could agree; I've found in practice, over time that these SLA's are never met and just a marketing gimmick. 99.95% sla is less than 8 hours a year. The only major player I've worked with thats met SLA without cheeky exceptions is rackspace (if I am allowed to mention them).

A SLA of 99.95% with a small financial penalty is often a sales gimmick, I've not seen many providers meet SLA unless they cost an absolute bomb.

Regarding encryption, its a grey area - technically the DOJ can request anything thats hosted by a US company under the patriot act.

I hope that isn't FUD, but its certainly my impression over the past 4 years.

I've heard some real crap too, like "you can work without a net connection" "yes you can work on the train without wireless" etc etc.

Terminal services over 3g isn't a great idea.

They can request it all they like. All they're going to get is a hash of the data. As long as you take certain precautions, such as encrypting the data locally before storing a hash of same (as opposed to allowing SQL Server to do the hashing itself, which would involve you sending plaintext and would leave you open to a side-channel attack), even the NSA couldn't break data encrypted with 256-bit AES at the present time.

[Scoobos]

Frankly, I'd rather let a company that has dedicated their business model to providing a guaranteed uptime of 99.95% under their SLA look after the infrastructure that my solution runs on, than entrust the same responsibility to some underappreciated in-house techy.

As for handing the keys to your system over, provided you've encrypted everything competently there shouldn't be any risk of handing your data or your code over to anyone.

I wish I could agree; I've found in practice, over time that these SLA's are never met and just a marketing gimmick. 99.95% sla is less than 8 hours a year. The only major player I've worked with thats met SLA without cheeky exceptions is rackspace (if I am allowed to mention them).

A SLA of 99.95% with a small financial penalty is often a sales gimmick, I've not seen many providers meet SLA unless they cost an absolute bomb.

Regarding encryption, its a grey area - technically the DOJ can request anything thats hosted by a US company under the patriot act.

I hope that isn't FUD, but its certainly my impression over the past 4 years.

I've heard some real crap too, like "you can work without a net connection" "yes you can work on the train without wireless" etc etc.

Terminal services over 3g isn't a great idea.

[MarillionFan]

All this talk of clouds is very interesting. But who truly knows what it's all about??

Anyway, can't hang around here I've got to be at a Cloud Conference in Palo Alto in an hour. I'll see if they know anymore.

[Gentile]

Azure == handing the DOJ in the US the keys to your system.

Less tin foil hat wise, it's actually a pretty nice system - but if you have the in house resource to manage a local ESX farm then you're not going to save money going to Azure.

My serious bug bear with all this cloud *cough, INTERNET* hosted stuff is that you're usually handing support over to a bunch of people with absolutely no vested interest in your company, just their own.

I'm trying my hardest to pull a charity out of all this stuff right now, it just isn't cost effective in real terms; for them.

Frankly, I'd rather let a company that has dedicated their business model to providing a guaranteed uptime of 99.95% under their SLA look after the infrastructure that my solution runs on, than entrust the same responsibility to some underappreciated in-house techy.

As for handing the keys to your system over, provided you've encrypted everything competently there shouldn't be any risk of handing your data or your code over to anyone.