Why I'm boycotting US cloud tech
theregister.co.uk
theregister.co.uk
Perhaps some European startup has a solution to our US based privacy problem that we could all migrate to for our cloud services.
Let's take a very obvious and blatant example. The government of Saudi Arabia signed the declaration of human rights, the FIRST article of which guarantees individual freedom of religion. Yet we all know they don't allow that, and they regularly execute ex-muslims for converting to Christianity, for being gay, and for a dozen other things. There's thousands of documented cases.
As if this is not bad enough, the government officials of Saudi Arabia regularly get caught torturing people they plucked off the street, apparently for fun. One of their allies, a UAE official, got caught on tape (or should we say, made a tape of him having his fun, then someone "leaked" it) [1]. This is legal (in sharia the government has the right to kill, torture and ... anyone they want).
I would say this is a far more blatant and dishonest practice than the ones you're alleging to. Yes the US spies, big whoop. They don't publicly behead people for things they signed a treaty they would not consider a crime ... And yet nobody seems to care. Yet one thing seems blatantly obvious : when it comes to human rights, the US ... is not the problem.
The truth is that outside of some of Western Europe and the US, most governments consider international treaties little more than a weapon to be used against their enemies because of the public attention they can garner using them. The most blatant violators, from Saudi Arabia to China, accuse everyone, from the US to Luxembourg, of violating international agreements of torture. Nobody should take this serious, but of course a lot of people do.
So let me know how these international treaties are supposed to work. I would love to hear how you'll get freedom of conviction, religion, politics and sexual orientation respected in the ~2/3rds of our planet that has signed an international treaty not to consider it a crime, yet kill people for it. China, just about every muslim country, Russia, ... (2/3rds, because China, India and Indonesia together form a comfortable 60% of the world, and none of them respects even basic freedom of religion. Only India can be said to give it a half-hearted attempt)
How does the quote go? "Don't spy. Government hates competition"
EDIT: I should also point out that if yes, google data goes to the US gov't (which I believe in a qualified manner) one could chalk up the european shutdowns of google to basically just be jealous of the US's access to that data.
[1] http://blogs.wsj.com/washwire/2013/06/07/transcript-what-oba...
But even then this will only solve the chatting and storage problem (somewhat), but not the Gmail problem. Even with local encryption available as one-click, it seems very unlikely more than 1% of the users would use it, because they'd need to send the key to their friends, and that's just too cumbersome. And if only so few use it, then it's as good as useless, and Google still can't be fully trusted for e-mails (thanks to the US government).
What I'd like to see Google do now, is become very pro-active about this, and to implement measures like this to "give the privacy control back to the people". Then maybe, just maybe, I'll begin to trust Google again.
But I'm not holding my breath. I doubt it's illegal for them to do all of this, but especially if there's a legal grey area here to make it easy for their customers to encrypt stuff locally, I don't see them bothering to fight for this. The only way they might do it if there's a significant threat to their business, much like SOPA was.
That's why I'm hoping the theory put forward by the author will become reality, and this NSA story will hurt US companies' bottomlines badly, and their international relationships, because only then we'll have true competition in privacy.
It's also probably the only way to convince the government to stop doing it to this extent, because from what I've noticed they listen a lot more to money and lobbying than to citizen outrage.
Most foreign governments are just as bad, just with fewer resources and often with less explicit protections for privacy.
The ultimate solution would be to only use cloud servers which make verifiable technical claims about security and privacy to the level you require; otherwise, boycott the cloud.
I'm personally fine with Twitter as a publishing platform (and essentially treat my dm as "stuff which is too spammy for even an at reply".)
Facebook kind of skirts the line. It is really useful as both a way to get newsfeed updates and a messaging system. In the long run, I'd really need something like OTR to continue using messages.
My email is too private for me to want it on a cloud service without serious technical controls. No one offers this yet, so I self-host.
IM with OTR is ok for privacy, but sucks for traffic analysis still, and there are serious problems with OTR and mobile/multi client, still.
My password manager is too sensitive to live on public servers even with crypto, since I can't audit every single update to the package thoroughly enough. Same goes with "secure notes" (safe combos, etc). A belt and suspenders approach of both using crypto and maintaining access control on the file is about the best I can do so far; something like an HSM in the future.
Cellphones and voice (and presence/location) are the sacrifice I hate the most (along with finance, I guess). If I had a way to get analog one-way pager notifications of incoming messages and a wifi-tunneling tablet, I'd consider ditching cellphone entirely. This would be a moderately big deal to develop, though.
Ultimately anonymous ecash (chaumian blinded tokens or Zerocoin or something else) is the solution to financial privacy (probably not straight Bitcoin, since there will be a jihad against mixes, and without mixes, Bitcoin privacy is horrible.)
Judging by what I've seen of USG security, their COMSEC side (defense) is actually comparatively weaker than best practices in most of the high-end civilian world. Their only saving grace is a focus on physical separation and hardware implementations; otherwise they'd be totally pwned, and they seem to be moving "into the cloud" which will lose their their existing advantages.
And, if they had a magic way to factor or whatever, it would be so highly classified (like Enigma break in WW2)that they could never use it on anything which wasn't totally justifiable through other plausible means, and of such incredible value (like "killing OBL" or higher), that I can act as if they can't factor.
Agree that the US's COMSEC is degrading, rapidly. As is the USN's nuke reactor program. Sigh.
It's also a lot harder, IMO, to convince a top theoretical mathematician to go to NSA vs. remain in public, since there aren't exactly amazing resources NSA can offer (better chalk?), compared to someone who needs access to multi-million or billion dollar resources. In exchange for better chalk (and access to other classified work, sure), you can't publish, so you'll never win a Fields, be respected by your mom, etc. (A guy who really is into nuclear physics could be tempted by DOE, by comparison.)
I think NSA would have a much easier time recruiting "true believers" in US national defense than anything else. i.e. "yes, you're an expert in theoretical math, but rather than doing purely abstract stuff, you can help protect your country from the evil terrorists!". An easier case when the threat was existential nuclear annihilation from a USSR your relatives may have fled in the past, than now where we're going up against mud hut dwellers who can't afford shoes and take over planes with boxcutters.
NSA also does the bullshit "EOE" recruiting, particularly in the high school and undergrad level. Sorry, but most high level math people are not particularly "diverse".
Plus, go to the math department at top universities. Find the US citizen. Find the US citizen who isn't particularly counterculture or does recreational drugs or whatever. Convince him to work for GS/GG wages (maybe $100k, tops?) vs. a tech startup or a hedge fund. With paralyzing bureaucracy, uncertain funding in the next 10-20 years, and stifling work rules.
I would not want to be the NSA's recruiting department.
For encryption, that's not really true. If armor were like encryption then one inch of armor would be a billion times more resistant than half an inch.
The strength of encryption can be calculated to be on a cosmic scale infeasible to crack.
The point is, a technical solution is a band aid solution for a technical elite happy to live half outside of "normal" society. The only way to convey similar protections on the rest of the population is through strong legislation.
The everyday use of strong encryption would be a lot more than a "band aid." It would mean securing our right to be secure in our documents against any attack, legal or technical. It would become a right any individual could enforce against all comers.
Arms race. You cannot win with purely technical means when you fundamentally lack control over the technology.
You assert that the people "fundamentally lack control over the technology" and that just isn't true. Start with the fact that strong encryption was born in an environment where the adversary is assumed to be a state actor with unlimited resources. There is enough open security technology that surmising that our government or any other has an undiscovered technology with fundamentally different properties is like any super-weapon fantasy: There are no flying saucers at Area 51 and there is no hyperdimensional machine in the basement of Ft. Mead. They put their pants on one leg at a time like everyone else.
What are those 'modern beliefs' then? Modern democracy, philosophy and human rights are not American products, but European, starting with ancient Greece, further expanded during the Renaissance and the reformations after the 2 world wars.
The fact that America is so young allowed them to choose from many of the time's political ideas. Saying what you said is like saying 'all smartphone users owe Samsung for the user experience, because they created the Galaxy S4'.
How Eurocentric of you.
As http://www.america.gov/st/washfile-english/2004/September/20... points out, the US Constitution took some of its inspiration from the Iroquois. They provided inspiration for freedom of religion, freedom of speech, a 2 state legislature, a federal system, the requirement for an annual state of the union address, and so on.
Of course the influences you cite were also hugely important. However the USA introduced important ideas from the native Americans that had not previously been part of the European tradition.
I don’t think ideas from native Americans were of particular importance, or, even if they were, substantially newer than those from Europe.
Franklin in particular became inspired by the idea of combining the colonies into a federation after reading about the Iroquois. And did much to raise awareness of their culture, and get involved with them. (Including becoming an envoy to them, and being involved in treaty negotiations.)
The fact that these ideas had plenty of European precedents does not diminish the fact that, historically, it appears that key figures in the US revolution and the later writing of the Constitution actually took inspiration from the Iroquois.
The last part is the bit that annoyed me. Of course I don’t know how or where the founding fathers got their ideas, but saying that these important cornerstones were non-existent in Europe before is simply wrong.
Perhaps we can say that the prominence of the Iroquois confederacy (where, although the tribes themselves had hereditary leadership, the way the tribes were confederated was vaguely democratic[2]), was used as a persuasive anchor in favor of the colonists' confederation - Ben Franklin urging: "It would be a very strange thing, if six Nations of ignorant savages should be capable of forming a Scheme for such a Union … and yet that a like union should be impracticable for ten or a Dozen English Colonies."
Some excerpts:
Rakove writes, "The voluminous records we have for the constitutional debates of the late 1780s contain no significant references to the Iroquois" and notes that there are ample European precedents to the democratic institutions of the United States.[57]
Tooker concluded that the documents cited indicate that groups of Iroquois and white settlers realized the advantages of a confederation, but she thinks there is little evidence to support the idea that 18th century colonists were knowledgeable regarding the Iroquois system of governance.
Tooker concludes, "...there is virtually no evidence that the framers borrowed from the Iroquois." She thinks the myth resulted from exaggerations and misunderstandings of a claim made by the Iroquois linguist and ethnographer J.N.B. Hewitt after his death in 1937.[60]
[2] (from wikipedia) No Iroquois treaty was binding unless it was ratified by 75% of the male voters and 75% of the mothers of the nation.[46] In revising Council laws and customs, a consent of two-thirds of the mothers was required.[46] The need for a double supermajority to make major changes made the Confederacy a de facto consensus government.[47]
[57] http://hnn.us/articles/12974.html
[60] Tooker E (1990). "The United States Constitution and the Iroquois League"
Doubly so given that the Corsican constitution predates the US and has many of the same ideas, but clearly with no native influence.
Still, there are parallels, and the case is strong that Benjamin Franklin was personally moved by the Iroquois example.
That is besides the point really. What I said was in reaction the the quote that America 'created' all those things. While I argue that they were able to pick and choose from existing political systems. So they didn't create, they chose. You can compare this to either building your own framework or picking one that will work for what you are trying to do.
We should all be boycotting centralization of private communications and unencrypted file storage in the cloud as a precautionary measure. In light of NSA/Prism, especially when communicated across national borders, we should insist on end-to-end encryption: GPG/PGP, S/MIME, HTTPS, RSA/DES/etc, i.e. nothing sent in the clear.
For public services like Google+ or Twitter, the information is public anyway. Unless Google, Apple, Microsoft, et al, start implementing back doors on my devices for the NSA I don't think boycotting is the answer. The pressure has to be primarily on the politicians, hold their feet to the fire until FISA/PATRIOT acts are repealed.
US citizens for example get taxed worldwide and banks worldwide have to comply with American law if they want to remain part of the global banking system (and don't want to go out of business). That's possible because the heart of the global banking system is located in the US or at least under American control.
Today's Internet is very similar and American companies are the dominating forces on the Internet anyway. And with regard to surveillance and interception, the US even has many supporting allies worldwide, just think of Echolon …
To put it another way, given a choice Gmail-private will come to be preferred to Gmail-PRISM should the user facing feature sets be comparable. And it is likely to be easier to implement Gmail-private if the company providing it is located outside the US - i.e. is not Google. The same applies to search, maps, and eventually mobile communication.
An unpleasant fact is that the Internet outside the US is under heavy surveillance too, think of China and the Arabic world but also Europe. From a user perspective, you cannot opt against surveillance, you can mainly choose who can directly intercept your communications. And in this regard and although I don't like to be under any surveillance, the US is usually the lesser evil.
This is where a tragic lack of foresight comes in. In 40 years China will be the world's dominant nation. Do we want to be in that transition setting a good example or a bad example? Do we want to be setting high standards for restraint, privacy, and individual freedom, or do we want to be seen grabbing every privilege and advantage right to the bitter end?
The way you posit the question... Are you sure they care about any such example?
I wouldn't call it "only".
That's a very important distinction.
It means that on the internet, they can be a (more) sovereign state -- not depended on third countries for their internet services and life.
Here's the real situation: Lawyers and big government, especially the second, have unlimited time, money, effort, and powers and nothing much else to do but cause trouble, and I just do not have the resources to defend myself against them. To them a false alarm is just another project at the office; to me their false alarm is likely the death of my business and a big torpedo below the water line of my little boat in life.
So, my 'tactic' is just to do nothing wrong, certainly have nothing wrong in my data, try to remain mostly anonymous, stay the heck below their radar, and keep my data inside my own four walls.
I can still be vulnerable to various false alarms. And if my business is at all successful, I may have to become something of a 'public person', that is, not so anonymous, and, then, be on the radar of various people who would like to cause me trouble. There could be news reporters looking to 'manufacture' a scandal for a 'scoop'. There could be politically motivated attackers. And there could be just common shakedown artists who want me to give them something and else trigger some false alarm to have big government cause me trouble. One false alarm could cost me my business, years of time, millions of dollars in legal fees, all for nothing substantive at all.
Just as for anyone, any of my data outside my four walls is just raw meat for lots of people who could do me harm. So, no 'cloud' servers; no 'cloud' file backup; little or nothing on Facebook, LinkedIn, Twitter, Google+; all blog posts anonymous; mostly don't let browsers accept cookies,; etc.
Let lawyers and big government go after easier targets. I remember the old joke that don't have to outrun the angry bear; instead, just have to outrun the poor other guy trying to outrun the angry bear.
At times I have heard suggestions that I should start a blog, but then I'd be closer to being a public figure and more at risk.
Again, if my business is successful, then I will be less anonymous and sometimes have to hold my tongue!
Been with them for a decade, always been extra happy with it.
National borders have always been special demarcations and so any crossing, physical or digital, is subject to special examination.
The nature of modern digital communication has blurred the borders somewhat and perhaps more significantly has made it easy to forget when your digital actions are transgressing those borders.
In the physical world we've accepted that there are border control stations on roads, at airports, and ports. Some of the surveillance mechanisms that have been in the press lately are the digital equivalent. Some seem to be much more than that.
It is going to take some serious public debate and some enlightened leadership to reign in our surveillance state and to come to a better public consensus regarding what privacy standards we want to embed in domestic and international law.
Otherwise, I keep it as close to home as possible. It's a pain to use a VPS in America for example. Even with Mosh.
Gmail was disqualified from the bidding to provide a hosted email solution for the university I work at, for that reason, but Google services are nonetheless pretty widely used by individuals, even for official purposes. The contract eventually went to Microsoft's Office 365, which claims to comply with EU data-protection best practices (I believe the servers are also physically hosted in Europe): http://office.microsoft.com/en-us/business/office-365-trust-...
I would guess that the promise is not particularly solid if the U.S. government wants to siphon off data from Microsoft, though. In practice I think it does provide some protection, but mostly against commercial use of the data: Microsoft has contractually agreed to certain rules about data-mining and data-sharing that Google hasn't.
Lots of companies use Google Apps in Denmark.
I think the US Cloud is used by lots of europeans.
Of course discussion of specialized topics were spread out over a million places, but that was a million places - many of which were spread over different countries - someone would need to look (and get a warrant) to access data.
The down side to homogeneity is that it takes just one infection to bring down the lot.
Anyway, boycotting US cloud tech is not that hard, albeit a bit inconvenient in some cases. In many cases putting data within legal reach of the US government is simply illegal, so an entire market has sprung up to offer services that guarantee non US ownership and no data and services within US jurisdiction.
And this is just for the sake of regulatory compliance. In fact, it's probably the #1 selling point for non-US cloud services already. The NSA shitstorm is not exactly going to have a negative impact on that market...
Incidentally, the scale for disrupting the US's state sponsored dominance of the internet could readily be implemented at the state sponsored level in another country, and claims and disputes over access to markets made at the WTO level.
Among the BRIC's, Brazil and India are particularly well placed - neither has a massive security apparatus. Mexico by proximity is also positioned to serve the US from "offshore."
We have seen in the past how the US Government overreaches to take down any website no matter where it's hosted. If you want to be "not subject to American law" you need to build an .onion torsite.
This isn't just the US folks.
darkness.io is a incredible startup that is a complete game changer. I founded darkness.io after realizing that there is an untapped 383221 billion dollar opportunity in removal of prism stories from the web.
I can't tell you the details about our platform because we are currently in stealth mode, but we are the only player in removal of prism stories which we will completely disrupt in 3 months. At darkness.io we believe that everyone deserves less prism stories. Our product will bring together prism annoyance, anti-prism and boredom to introduce synergies that will democratize, and revolutionize removal of prism stories.
This idea is so potent yet so deceptively simple that it has the capacity to produce an unlimited amount of profit.
We haven't created our product yet, so we are looking a real javascript samurai to join our team so they can build it for us. This is a once in a lifetime opportunity for you to be a part of the next big thing. We have free food, unlimited vacation, generous equity compensation. Also each week we give you a new iSpy just for being amazing.
If know javascript and 'want in', just tweet me and you'll be on our uber game-changing, revolutionary, disruptive team in no time, helping us change the world!
If it introduces latency and "credit card call center" style interface barriers, that doesn't mean it cannot be profitable.
There is a large market which sees itself as receiving no benefit from the American military-industrial complex as it is manifesting itself on the web. The laws which enable PRISM may place US companies at a disadvantage. PRISM affordance is not a feature in most people's minds. Indeed, it is a bug in many.
I'd go French. Because as Eddie Izzard put it (roughly), "the French are so.... French "
(1)Yes, I am aware of the one single exception. Who I'm not so sure the US Government wanted to really that bothered with. Bad PR and all that.
And which government?