US surveillance raises concerns over cloud data security

Remember how US cloud computing vendors dismissed objections from New Zealand companies that their data is insecure?

Last week the US government confirmed it secretly collects information from companies like Google, Facebook and Apple in search of national security threats. The admission makes a mockery of those earlier assurances.

Foreign owned data has less protection

Australia’s shadow communications minister Malcolm Turnbull hits the nail on the head. He says concerns will increase after allegations that “foreign-owned data hosted by US internet companies has lesser protection than data belonging to US citizens”.

When New Zealand or Australian companies raise the Patriot Act as an objection to buying US cloud services, their suspicions are rejected – sometimes rudely – I’ve even heard them described as paranoid. Even US government officials repeatedly reject fears that authorities could easily intercept cloud information.

New Zealand and Australian companies who believed those assurances are now combing the fine print of their contracts to decide their next move.

Return of data sovereignty

Data sovereignty is the idea that information is subject to the laws of the country where it is stored. It’s a big deal in Australia which recently passed laws insisting private data is not shipped overseas.

Now data sovereignty is on the radar in New Zealand. Local cloud vendors, understandably, use it in their marketing.

Overseas cloud vendors dismiss the idea of data sovereignty as a form of protectionism. In a sense it is.

Cloud costs

And it comes at a cost. Local cloud vendors often don’t have the economies of scale found in the US, so their costs can be higher. In some cases this means local customers pay twice as much as they would pay an overseas cloud provider.

US cloud vendors have put infrastructure in Australia to address that country’s privacy legislation. Although treaties between the US and Australia mean American authorities can get access to data with a court order, this guards against systematic snooping.

Either way, it’s likely spies in the US or any other advanced nation can find ways to get access to any data they want. It just isn’t easy, immediate or automatic.