Feeds

Privacy winds blow through Clouds towards Switzerland

Safe haven guaranteed?

Secure remote control for conventional and virtual desktops

Opinion Cloud services are one of the major changes to the way companies use computing services, but the weather may be changing as a consequence of increasing activity of European Data Protection watchdogs.

Whereas US citizens and companies have to contend with ever decreasing rights to privacy, EU companies will come under pressure from Data Protection regulators keen to show their independence (as Google has discovered). This will create a demand for assurances.

Companies that do not want to fall foul of privacy regulations have a problem: the legislative anti-terror backdoors installed post 9/11 offer authorities easy access, but provide for little transparency in how those rights are used or what happens to the data afterwards, and they exist in European law too.

In the UK alone, fairly public events have shown that not only such legislation will be abused, even more so when those who are supposed to guard against abuse are in collusion with those who break the law.

The result will be a continued search for a safe haven for any company that requires confidentiality. There are plenty companies that need it: organisations with interesting IP and any entity that handles truly private data such as law firms, medical practices, private banks and finance advisers.

Unsafe harbour

Companies with links to the US will have to prove they are not simply shipping all data to the US, and this may prove impossible. The lack of oversight and control over use of the US PATRIOT Act renders the whole Safe Harbor agreement effectively meaningless, yet companies without such links will only have local legal leverage available as an offset to the risks posed by laws that effectively seek to bypass due process. Europe may be safer, but not safe.

Companies with intelligent lawyers will eventually discover that cross-jurisdictional IT deployment offers the only route to secure storage. For example, they can avoid the EC legal risks by hosting in Switzerland. This creates a two-pronged safety net for abuse of intercept facilities: not only will an international request for assistance create a visible audit trail, Swiss laws are also stricter when it comes to standards of evidence and containment of any information gleaned during an investigation, thus frustrating abuse and returning due process to investigations.

Continuing the Swiss theme, last year has also seen a hardening of the Swiss stance against data theft. They will no longer collaborate with investigations where evidence has been sourced by means considered illegal under Swiss law, which makes the nation all the more attractive as a new data haven for European organisations.

US as well as European law makers will have to find ways to demonstrate that they use their powers responsibly, with more transparency of their use of special powers as a good first step. Otherwise, pressure groups such as Anonymous and Wikileaks will see a continued justification of their existence. A jurisdiction that seeks to avoid due process should not be surprised when its citizens start to ask:

What do they have to hide?

Peter Houppermans is a privacy and IT security expert based in Switzerland.

Internet Security Threat Report 2014

Whitepapers

Driving business with continuous operational intelligence
Introducing an innovative approach offered by ExtraHop for producing continuous operational intelligence.
Why CIOs should rethink endpoint data protection in the age of mobility
Assessing trends in data protection, specifically with respect to mobile devices, BYOD, and remote employees.
Getting started with customer-focused identity management
Learn why identity is a fundamental requirement to digital growth, and how without it there is no way to identify and engage customers in a meaningful way.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Simplify SSL certificate management across the enterprise
Simple steps to take control of SSL across the enterprise, and recommendations for a management platform for full visibility and single-point of control for these Certificates.