-------------------------------------------------
The Government and “The Cloud”

DéAna Colón
Project-Based Information Systems, 90.480.032, TP5

Table of Contents

Table of Contents 2 Introduction 3 US Privacy Rights 3 Loss of Companies’ Products/Services 4 Government’s Cloud-Data Security 6 Negative Impact on International Relations 7 Loopholes 8 Conclusion 9 Sources 10

Figure 1: Cisco's Projected Revenue Chart 5 Figure 2: Key Stakeholders and Responsibilities for FedRAMP 7

Introduction
With the technological advances made, cloud-based data storage has become a staple in businesses worldwide. Storing data using a web-based content management system offers a limitless amount of off-site storage, allowing companies to save larger amounts of data longer. The United States government currently has the unwarranted authority to read emails or access cloud-based data that has been stored for six months or more. Both positive and negative aspects are realized with this controversy.
On a positive perspective, many feel the government accessing the data could be beneficial. Probing may help the government prevent terrorism in the United States. It may also provide the information needed to better forecast the country’s economic future. A disparaging concern is that companies feel the government is violating privacy rights. In addition, possible data leaks may result in a company’s loss of product or services. Ultimately, it must be decided whether the government should be allowed to access this information. With the evidence presented, I recommend the government should not have access to this data.
US Privacy Rights
Since the beginning, the United States government has established laws to protect its citizens, including rights to privacy. The Fourth Amendment was created to give citizens the right to privacy and unwarranted searches, including personal effects. Over the years, with society and technology rapidly advancing, additional privacy laws have been crafted to continue to protect rights. The Federal Wiretap Act of 1968 was established to protect citizens against unlawful interceptions of conversations using ‘hard’ wiretaps on telephones. In 1986, Ronald Regan signed into effect the Electronic Communications Privacy Act (ECPA), an update to the Federal Wiretap Act of 1968. The ECPA prevents unwarrantedly accessing all computer, digital, and electronic communication. To continue to keep up with technology, Title II was added to the ECPA. It states:
“Stored Communications Act (SCA), protects the privacy of the contents of files stored by service providers and of records held about the subscriber by service providers, such as subscriber name, billing records, or IP addresses. 18 U.S.C. §§ 2701-12.”

With the surfacing of the government’s unwarranted cloud-stored data probing, many companies feel it is in direct violation of the ECPA. According to US District Court Judge Richard J. Leon, the data collection is an “arbitrary invasion”. His ruling is in connection with two people suing the NSA for their telephone data collection. Judge Leon’s was the first ruling against the NSA’s program. He felt the manner in which the data is collected invades on US citizens’ privacy.
Loss of Companies’ Products/Services
In 2013, a former US government employee leaked information proving the government was secretly probing electronic data. This NSA leak drastically effected companies on an international level. One company in particular, Cisco, immediately felt the effects. Cisco reported major profit loss because companies no longer trusted the security of their data in its cloud-based products. Fearing millions more in profit losses, the tech company urged President Obama to correct or diffuse the NSA leak scandal. In addition to Cisco’s drop in product sale and recorded profit loss, Verizon was impacted as well. Germany decided it will not be renewing their contract with Verizon due to the discovery of the NSA leak. Germany fears US intelligent agencies will have access to sensitive communications.
Figure 1: Cisco's Projected Revenue Chart
To further impede on privacy rights, the government continuously submits requests to probe online data and the companies have provided ‘transparency reports’. This data collection is not made known to the subscribers. For years, both Twitter and Google have handed over countless reports of its users’ online data. In one year alone, the government issued 679 data requests from Twitter, and the company satisfied 63% of them. The government’s requests from Google were in the tens of thousands. In 2013, Twitter gave French authorities data to help probe in connection with an investigation into anti-Semitic tweets. This stemmed from a court ruling due to France’s Union of Jewish Students (UEJF) pressed charges against Twitter. Twitter was mandated to release the data to authorities, however, it was not mandated for the users to be notified.
Aside from Twitter and Google, other companies track data and transmit it to/through third parties with the users’ consent. Smart phones collect data and forward it to third parties and government. For example, Motorola’s privacy policy indicates information will be collected and shared with others.
“Motorola may also passively collect information (i.e. without you knowing) from you… The information collected by Motorola is used to a) operate the MOTOBLUR Software and Services, including interaction with third party social networking sites and other third party websites and services…”

Government’s Cloud-Data Security
Fully aware of how susceptible cloud-based data is to probing, the government has supplementary acts and policies in place to ensure its own data is properly stored and safe from any data mining. Each government agency is responsible for following its agency documentation and security steps. The Privacy Act of 1974 is the first step in ensuring information privatization and security is established. Each agency must: * Determine whether or not the data is covered by the Privacy Act of 1974 * Publish a list of the records which will be cloud-stored * Determine how the Federal agency will grant access to data * Meet all requirements in the Privacy Act when storing, making all stipulations, responsibilities, and expectations contractually clear

Aside from the Privacy Act of 1974, the federal government also established a process specifically for establishing cloud-based data security. The Federal Risk and Authorization Management Program (FedRAMP) encompasses their security controls and data privatization process.
FedRAMP is a security control baseline for approving third party cloud service providers. This rigorous analysis takes a minimum of four months to approve a provider; however, it ensures the government’s information will not be jeopardized in the hands of a third party. Third party approval times depend on the quality of the documentation provided for the approval process. If these security measures were taken for US citizens, there wouldn’t be an ongoing battle with the government’s unwarranted access to information.

Figure 2: Key Stakeholders and Responsibilities for FedRAMP
Negative Impact on International Relations
US citizens were not the only ones affected by the government’s data probing. It was discovered that international data was probed and collected as well. This was considered an invasion of privacy and Europe began to take immediate measures to ensure the security of its data communications. The birth of the European Communication Network emerged. The ECN creation is to avoid data transmissions through the US, thereby eliminating the possibility of unwarranted data probing.
Although Europe insists these measures are taken to ensure data security, the United States believes Europe’s intent to build a European Communication Network gives European companies an advantage over American companies. The US feels the ECN is a breach in international trade laws.
“The main mission of the ECN is to exchange best practices on preparation and implementation of communication plans and other communication practices. It also aims at facilitating DG COMM's assistance to other DGs on technical issues and strives towards a more effective and cost-efficient use of tools (audiovisual, Internet, citizens' help-lines, etc.) and evaluation methods.”

In the wake of the NSA leak, China seizes this as an opportunity to shut down business between the US and Beijing. Instead, China pushes forward its own cloud security software and policies. Beijing gladly accepts China’s software and hardware. To add to the United States’ new technological breakdown overseas, India and China put restrictions and increased rates for US telecommunications operations. Neither country believes in the Unites States’ ability to perform cloud-based data storage without infringing upon their nation’s security.
Loopholes
For years organizations have tried to get the government to update the ECPA. In 2010, a coalition of companies and unions, the “Digital Due Process” Coalition, urged the government to update the ECPA. In 2011, a press conference was held by two senators, Ron Wyden (D-OR) and Mark Kirk (R-IL), on the 25th anniversary of the ECPA, urging privacy law updates. In 2011, Senator Patrick Leahy proposed US SB1011“Electronic Communications Privacy Act Amendments Act of 2011”. This bill would eliminate the 6-month rule, and require search warrants for cloud data. It would also require that customers be notified if their information will be shared due to a search warrant.
Not only does the Obama administration disapprove of US SB1011, it has yet to update privacy laws and continues to use the existing loopholes to their advantage.
Conclusion
With cloud-based data storage now being a staple in businesses worldwide, the United States government should not have access to cloud-based data that has been stored for 6 months or more. It is a blatant invasion of privacy. Furthermore, with its inability to keep up with technology’s rapid evolution, the government capitalizes on loopholes within outdated Acts such as the ECPA and SCA. Besides businesses worldwide no longer believing in the security of their cloud-based data, technical companies are also suffering major financial losses due to data leaks. With this evidence, eliminating the government’s access to cloud-based data would be beneficial to businesses and should be implemented immediately.

Sources
Associated Press Wire Report. “Twitter shares info on government demands for user data”. First Amendment Center. 6-Jul-2012. Web. 17-Jul-2014. <http://www.firstamendmentcenter.org/twitter-shares-info-on-government-demands-for-user-data>
Dinan, Stephen. “Federal judge says NSA phone program violates Fourth Amendment”. The Washington Times. 16-Dec-2013. Web. 5-Jul-2014. <http://www.washingtontimes.com/news/2013/dec/16/federal-judge-says-nsa-phone-program-violates-four/?page=all>
Durden, Tyler. “Cisco CEO Warns Obama To Rein In NSA Or Face Collapse Of Trust In US Technology (And Cisco Sales)”. Zero Hedge. 18-May-2014. Web. 8-Jul-2014. <http://www.zerohedge.com/news/2014-05-18/cisco-ceo-warns-obama-rein-nsa-or-face-collapse-trust-us-technology-and-cisco-sales>
Hughes, Krista. “U.S. knocks plans for European communication network”. Reuters. 4-Apr-2014. Web. 6-Jul-2014. <http://www.reuters.com/article/2014/04/04/us-usa-trade-telecomunications-idUSBREA331W820140404>
Jeschke, Rebecca. “ECPA Anniversary Week Brings Calls for Change”. Electronic Frontier Foundation. 17-Oct-2011. Web. 20-Jul-2014. <https://www.eff.org/deeplinks/2011/10/ecpa-anniversary-week-brings-calls-change>
Kravets, David. “Aging ‘Privacy’ Law Leaves Cloud E-Mail Open to Cops”. Wired. 21-Oct-2011. Web. 7-Jul-2014. <http://www.wired.com/2011/10/ecpa-turns-twenty-five/>
Kravets, David. “Senate Bill Requires Warrant for E-Mail, Cloud Content”. Wired. 17-May-2011. Web 20-Jul-2014. <http://www.wired.com/2011/05/cloud-content-warrants/>
Munchbach, Andrew. “Your smartphone is tracking you, and you said it was okay”. BGR.com. 20-Apr-2011. Web. 17-Jul-2014. <http://bgr.com/2011/04/20/your-smartphone-is-tracking-you-and-you-said-it-was-okay/>
News Wires. “France Twitter releases data to French anti-Semitism probe”. France24.com. 12-Jul-2013. Web. 16-Jul-2014. <http://www.france24.com/en/20130712-twitter-releases-data-french-anti-semitism-probe/#./?&_suid=140553768750508434747235546947>
Ogg, John C. “Verizon Losing German Government Contracts”. 24/7 Wall St. 26-Jun-2014. Web. 2-Jul-2014. <http://247wallst.com/telecom-wireless/2014/06/26/verizon-losing-german-government-contracts/>
Smith, Gerry. “’Snowden Effect’ Threatens U.S. Tech Industry’s Global Ambitions”. The Huffington Post. 24-Jan-2014. Web. 2-Jul-2014. <http://www.huffingtonpost.com/2014/01/24/edward-snowden-tech-industry_n_4596162.html> “EFF Joins With Internet Companies and Advocacy Groups to Reform Privacy Law”. Electronic frontier Foundation. 30-Mar-2010. Web. 20-Jul-2014. <https://www.eff.org/press/archives/2010/03/30>
“Electronic Communications Privacy Act of 1986 (ECPA), 18 U.S.C. § 2510-22. Justice Information Sharing, Office of Justice Programs. 30-Jul-2013. Web. 7-Jul-2014. <https://it.ojp.gov/default.aspx?area=privacy&page=1285>
“External Communication Network”. European Commission. 16-May-2014. Web. 17-Jul-2014. http://ec.europa.eu/ipg/basics/management/committees/ecn/index_en.htm “Fourth Amendment”. United States Courts. n.d. Web. 16-Jul-2014. http://www.uscourts.gov/educational-resources/get-involved/constitution-activities/fourth-amendment.aspx “Fourth Amendment: An Overview”. Cornell University Law School. N.d. Web. 6-Jul-2014. <http://www.law.cornell.edu/wex/fourth_amendment> “June 2014 FedRAMP Update”. Cloud.cio.gov. June 2014. Web. 28-Jun-2014. <http://cloud.cio.gov/document/june-2014-fedramp-update>
“Privacy”. Cloud.cio.gov. n.d. Web. 28-Jun-2014. <http://cloud.cio.gov/topics/privacy> “Privacy Act of 1974”. The United States Department of Justice. n.d. Web. 18-Jul-2014. http://www.justice.gov/opcl/privacy-act-1974
”Privacy and Civil Liberties”. Justice Information Sharing, Office of Justice Programs. 30-Jul-2013. Web. 2-Jul-2014. <https://it.ojp.gov/default.aspx?area=privacy&page=1285> “US Congress Senate Bill 1011”. LegiScan. n.d. Web 20-Jul-2014. <http://legiscan.com/US/text/SB1011/id/297636>

--------------------------------------------
[ 1 ]. “Fourth Amendment”. United States Courts. n.d. Web. 16-Jul-2014.
[ 2 ]. ”Privacy and Civil Liberties”. Justice Information Sharing, Office of Justice Programs. 30-Jul-2013. Web. 2-Jul-2014.
[ 3 ]. Dinan, Stephen. “Federal judge says NSA phone program violates Fourth Amendment”. The Washington Times. 16-Dec-2013. Web. 5-Jul-2014.
[ 4 ]. Ogg, John C. “Verizon Losing German Government Contracts”. 24/7 Wall St. 26-Jun-2014. Web. 2-Jul-2014.
[ 5 ]. Durden, Tyler. “Cisco CEO Warns Obama To Rein In NSA Or Face Collapse Of Trust In US Technology (And Cisco Sales)”. Zero Hedge. 18-May-2014. Web. 8-Jul-2014.
[ 6 ]. 14Associated Press Wire Report. “Twitter shares info on government demands for user data”. First Amendment Center. 6-Jul-2012. Web. 17-Jul-2014.
[ 7 ]. News Wires. “France Twitter releases data to French anti-Semitism probe”. France24.com.12-Jul-2013. Web. 16-Jul-2014.
[ 8 ]. 15Munchbach, Andrew. “Your smartphone is tracking you, and you said it was okay”. BGR.com. 20-Apr-2011. Web. 17-Jul-2014.
[ 9 ]. “Privacy”. Cloud.cio.gov. n.d. Web. 28-Jun-2014.
[ 10 ]. “June 2014 FedRAMP Update”. Cloud.cio.gov. June 2014. Web. 28-Jun-2014.
[ 11 ]. Hughes, Krista. “U.S. knocks plans for European communication network”. Reuters. 4-Apr-2014. Web. 6-Jul-2014.
[ 12 ]. “External Communication Network”. European Commission. 16-May-2014. Web. 17-Jul-2014.
[ 13 ]. Hughes, Krista. “U.S. knocks plans for European communication network”. Reuters. 4-Apr-2014. Web. 6-Jul-2014.
[ 14 ]. “EFF Joins With Internet Companies and Advocacy Groups to Reform Privacy Law”. Electronic Frontier Foundation. 30-Mar-2010. Web. 20-Jul-2014.
[ 15 ]. Jeschke, Rebecca. “ECPA Anniversary Week Brings Calls for Change”. Electronic Frontier Foundation. 17-Oct-2011. Web. 20-Jul-2014.
[ 16 ]. “US Congress Senate Bill 1011”. LegiScan. n.d. Web 20-Jul-2014.
[ 17 ]. Kravets, David. “Aging ‘Privacy’ Law Leaves Cloud E-Mail Open to Cops”. Wired. 21-Oct-2011. Web. 7-Jul-2014.