Why hackers and spooks want our heads in the cloud

Posted on Apr 26, 2011 in Records Management News

by John Har­ris, Guardian, guardian.co.uk, Mon­day 25 April 2011 20.00 BST

Our unthink­ing embrace of these giant data cen­tres is throt­tling the giddy anti-authoritarian com­put­ing dream

Imag­ine this. A noto­ri­ous multi­na­tional is on the look­out for new busi­ness. For the sake of argu­ment, let’s imag­ine it’s Lock­heed Mar­tin, the defence, secu­rity, and “advanced tech­nol­ogy” cor­po­ra­tion that has lately been see­ing to the cen­sus. From some­where in their R&D divi­sion comes an idea: “per­sonal lifestyle secu­rity ser­vices” for mil­lions across the planet. The wheeze is sim­ple enough: sign up and hand them your per­sonal cor­re­spon­dence, finan­cial records, bank details, ID doc­u­ments, and more. They’ll have all your stuff, and you’ll have a unique pass­word when­ever you want a look. And just think: more clut­ter shunted out of your life, leav­ing you to glide through the min­i­mal­ist bliss of 21st cen­tury living.

You would have to be out of your mind. But this is the world we are hurtling towards, although it’s not defence con­glom­er­ates who are in charge – yet – but pri­vate tech­nol­ogy giants. The key is cloud com­put­ing, whereby just about any­thing that can be digi­tised is stored in remote servers, leav­ing us to access it from wher­ever we fancy. If you have a Gmail or Hot­mail account, you’ll already be a prac­tised cloud user. Two years ago, David Cameron sug­gested that Google and Microsoft might be involved in the cloud-based stor­age of people’s NHS records; now the Depart­ment of Health appears to have plans for exactly that. In 2009 the worth of cloud com­put­ing was put at $58.6bn; by 2013 it’s fore­cast to reach $150.1bn.

The new world is, of course, less a mat­ter of clouds than data cen­tres: huge imper­sonal sheds in which servers whirr away, while mil­lions log in and out – a turn­about with an intrigu­ing cir­cu­lar­ity. Up until the late 20th cen­tury the his­tory of the indus­try was partly the mass trans­fer of data from hulk­ing main­frames to ever smaller per­sonal com­put­ers. Now the momen­tum is in the other direc­tion, and what you might think of as dig­i­tal cen­tral­ism is back, in a world awash with pry­ing gov­ern­ments, hack­ers, cor­po­ra­tions that seem as prone to skul­dug­gery as they ever were – and ter­ror­ists who may well eye data cen­tres as mouth­wa­ter­ing targets.

So why aren’t we wor­ried? Inspired brand­ing undoubt­edly does its work. First, there is the term “cloud com­put­ing” itself, whose uncer­tain ety­mol­ogy is less impor­tant than its implicit sug­ges­tion of an inno­va­tion with all the unre­mark­able ordi­nar­i­ness of the weather. Con­sider also the cud­dly, kids’-TV-esque Google logo, or the way that so much of the Microsoft brand is syn­ony­mous with the human­i­tar­ian work of Bill Gates. All this chimes with a cul­ture in which, as sup­pos­edly mav­er­ick organ­i­sa­tions get ever closer to gov­ern­ment, mass trust in their oper­a­tions still seems to know no bounds – even when such rev­e­la­tions as the iPhone’s sur­rep­ti­tious track­ing of its users’ move­ments point to slightly more on their minds than the breezy con­ve­nience of their customers.

While we’re here, take note: all mes­sages on Gmail are auto­mat­i­cally scanned so Google knows where to place any rel­e­vant ads – and deleted mes­sages and accounts “may take up to 60 days to be deleted from our active servers and may remain in our offline backup systems”.

Inevitably, hack­ing into stuff stored in the cloud is a global pas­time, with its own grim star sys­tem. Ear­lier this month, for instance, a very unpleas­ant Cal­i­forn­ian named George Bronk was jailed for six years for rifling through Gmail and Yahoo mail accounts belong­ing to women and girls (some of them British), and send­ing any reveal­ing pic­tures he found to all their Face­book con­tacts. Mean­while the world’s more author­i­tar­ian states know exactly what the cloud allows them to do: in late 2009, for instance, Google’s servers were breached by Chi­nese hack­ers, pre­sumed to be under gov­ern­ment orders, who tried to break into the email accounts of human rights activists.

We all know how even demo­c­ra­tic states tend to view the kind of infor­ma­tional riches that the cloud con­tains. Our own Reg­u­la­tion of Inves­ti­ga­tory Pow­ers Act is in the process of being partly reformed, but even more inva­sive data-gathering pow­ers seem in the pipeline. In the US, whether to drop or renew pro­vi­sions in the infa­mous Patriot Act is cur­rently the sub­ject of a noisy debate – but exten­sive pow­ers to pry into data and com­mu­ni­ca­tions will remain. (In Canada this has fed into a fas­ci­nat­ing debate about pub­lic and pri­vate sec­tors using US-based cloud ser­vices, and thereby leav­ing peo­ple open to Amer­i­can surveillance.)

There is, per­haps, a wor­ry­ing time lag at work here. The com­puter indus­try came of age in the 1990s, that giddy phase of Amer­i­can and Euro­pean his­tory when author­i­tar­i­an­ism was assumed to be on the wane. For sure, it’s still nice to live in a lib­eral democ­racy, but given that the world has since moved in no end of sin­is­ter direc­tions, isn’t our unthink­ing embrace of the cloud (and just to recap: our med­ical records could soon be up there) an ill-advised throw­back? And what of the long view: look­ing ahead 50 years, how cer­tain are we that the sur­veil­lance state will not have extended its ten­ta­cles; that nasty, illib­eral pol­i­tics will not be all the rage; or that Google, Microsoft et al will not have learned dan­ger­ous new tricks?

Right now, I think of the hyper-connected activists behind UK Uncut, or the ongo­ing anti-fees protests, or the other cam­paigns over which our spooks pre­sum­ably keep watch, and feel a pang of unease. This cloud, I fear, may yet turn very dark indeed.

Read more at: http://www.guardian.co.uk/commentisfree/2011/apr/25/hackers-spooks-cloud-antiauthoritarian-dream
Com­pli­ments of File­Man Research