(updated 12/12) There has been a bit of a buzz regarding access to citizen and company data by the U.S government and the associated risks of Cloud computing in that regard. I’m talking about the recent searches of gMail and Facebook of WikiLeaks supporters. Paul Carr’s Tech Crunch article and David Linthicum’s InfoWorld story refer to these events. In addition, the New York Times ran a story on secret F.B.I. subpoenas. When you move your data to the cloud, you lose some control over government access to your data during what may (or may not) be a legal search. I touched briefly on this last year (here), in my article on the Challenges and Risks to Cloud Computing. For the purposes of this article, I’ll assume your data is still in the US, not a foreign country data center, which poses an entirely different set of risks.At issue: an individual or business person’s ability to stop an illegal search of their data when law enforcement shows up at your data’s door (that “door” being the door to your cloud provider’s data center). There is also worry that Fourth Amendment rights will be trampled on because application data has moved to the cloud. Because your data now lives in a data center, presumably operated outside your company or home, you lose the ability to know when you are being searched, to stop warrantless searches, and to analyze the warrant and validate that the search is, in fact, legal. Unless you (or preferably your lawyers) are at the data center during the search, you can’t ensure that it adheres to the boundaries set by the warrant to prevent fishing expeditions. At the same time, you may lose control of privacy or company secrets as part of that search. How do you protect your Fourth Amendment rights if you don’t even know you are being searched? If your data is co-located with other individuals or businesses that are being searched, how are you protected from information leakage when they are searched?
Something new to think about when moving into the cloud... location. You should probably know the physical location of your data when moving your compnay into the cloud. Physical location might impact the legal & regulatory aspects of moving to the cloud. More specifically, what country does the server reside in? Although I don't have all the answers regarding the specific legal and regulatory aspects that having your data in various countries may have, it's reasonable to postulate that there is most certainly risk here. For example, the US has very specific laws regarding search and seizure of computers and the information they hold, but these laws no longer apply when your data resides outside the US. I won't name countries here but many governments wouldn't hesitate to march into a data center, confiscate equipment and ask questions later. The point should be clear, understand where your data is kept and, if not in the US, understand the legal as well as 