PRIVACY AND CLOUD STORAGE

-- By TuviaPeretz - 30 Oct 2011

Introduction

NOTE: The focus here is on issues related to cloud storage in the United States and not jurisdictional complications. There are a whole set of other legal issues related to cloud computing which have to do with information moving across jurisdictions and being exposed to differing, and potentially conflicting, privacy regimes.

Legal Inconsistencies

When using cloud storage, an individual or a company uses storage capacity provided to it by a third party instead of maintaining its own files. Although one may not intuitively view this distinction as significant, there is case law (US v. Miller (1976)) which allows such information to be treated differently for privacy purposes. The government argues that because a file has been turned over to a third party, the file does not have the same privacy protections it would if it were held by the creator. The significance of the government’s approach becomes increasingly important as more and more files are being turned over for third party storage.

The question we need to ask is whether there is any valid justification for treating a file turned over to a third party for storage differently than the a file retained by an individual or corporation. Those in favor of the government’s right to access such information would argue that an individual or corporation does not have a reasonable expectation of privacy once they turn over the information to a third party. However, is this how individuals and corporations think of the issue when storing information on the cloud? While most people would likely acknowledge that there is a set of privacy concerns associated with the cloud, I believe these concerns stem from the fact that the information is being stored on the internet as well as whether they trust the third party to which the information is turned over—not the legal distinctions associated with the fact that it has been turned over to a third party. The decision to have data and information stored on a particular cloud is closer to a decision to hire a file management consultant, about whom you hopefully make a educated decision whether or not to trust, to manage and protect your data and less like putting that information in a lockbox to which the government has the key but can only open it when they think it’s important. The view that you do have a reasonable expectation of privacy in E-mails was endorsed in a recent Sixth Circuit decision, US v. Warshak (2010) (Wikipedia), but it remains to be seen how this will impact the law in the area.

The main statutory provision which protects wire, oral, and electronic communications is the Electronic Communications Privacy Act (ECPA). Title II of the ECPA, the Stored Communications Act (SCA), protects communications held in electronic storage. The ECPA has not undergone a major revision since being enacted in 1986 and its privacy standards are wildly out of sync with much of the computer activity which occurs today. Take, for example, the fact that E-mail can be accessed by the government without a warrant if it has been left on a server for more than 180 days. When the law was passed, E-mail was generally downloaded. Therefore, the law considered E-mail which remained on a server for more than 6 months to be abandoned. Today, however, E-mail is regularly kept and stored on servers, yet the law still considers E-mail left on a server abandoned and allows law enforcement to access it without a warrant. This means that POP and IMAP E-mail services are treated asymmetrically for privacy purposes.

Proposals For Change

An organization called Digital Due Process (a coalition of various companies) has laid out its major principles for bringing the ECPA up to date with today’s computing needs, and Senator Patrick Leahy has introduced a bill in the Senate.

Roadblocks

The major roadblocks to enacting this change come from the government and the cloud computing industry itself. Obviously the government is interested in continuing the practices it currently takes part in. The government wants its investigative procedures to remain as simple and as quiet as possible. The government does not want individuals to know they are being investigated and has no interest in increasing the evidentiary standard required to obtain data and information on a person or corporation.

The industry is caught in a tough position. On the one hand they want to back data and privacy protections insofar as they encourage individuals and corporations to embrace the cloud and utilize their services. However, the cloud providers want to continue to access individuals data for their own informational purposes (look at Amazon terms of service regarding your files particularly 5.2) and do not want to back any laws which might increase privacy protections and inhibit their use of consumer data.

# * Set ALLOWTOPICVIEW = TWikiAdminGroup, TuviaPeretz

Note: TWiki has strict formatting rules. Make sure you preserve the three spaces, asterisk, and extra space at the beginning of that line. If you wish to give access to any other users simply add them to the comma separated list