The Dangers of European Clouds
A recent study by ITIL just predicted that the US cloud industry stands to lose $21.5 – $35 billion over the next few years related to loss of market share due to PRISM. Is the marketing arm of US cloud providers on vacation?
Europeans (including residents of the UK and other parts of the world) have been justifiably outraged by the revelations of Edward Snowden about the US’ data mining of non-citizen information. Maybe. The truth is that most European governments can access their citizens’ data when held in country with far less due process than the US requires. Further, the US press hasn’t bothered to report much about the fact that the GCHQ (Britain’s version of the NSA; its motto: “Keeping our society safe and successful in the Internet age”) has their own version of PRISM: Tempora. With the secret cooperation of BT, Vodafone, Verizon, Global Crossing, Level 3, Viatel and Interoute, GCHQ gets details of telephone calls, emails, FaceBook posts and other online traffic by monitoring undersea fiber-optic cables – the ones that make up an enormous share of the backbone of the Internet.
So, excuse me for laughing at the hyperbole around the dangers of US cloud providers because of PRISM. The proposed solutions from abroad are even worse. Fears of US government surveillance have sprouted such nonsense as a UK-only cloud or legislation restricting EU members from using foreign clouds.
Me thinks there is more behind the proposed isolationism than data privacy. The US absolutely dominates cloud computing. I don’t know why really, but I can make some guesses. One would be the relative strength of the US economy versus Europe in the last ten years when cloud computing has mushroomed. I have another theory that is related to privacy. The reality is that the US has lax privacy laws and the EU has restrictive privacy laws that don’t play well in a cloud environment. It’s normal for the law to lag behind technology, but in this case, the US’ dearth of regulation has allowed the cloud industry to develop relatively unhindered. Europe’s privacy laws from the nineties don’t help.
While both US and European cloud providers serving EU residents need to comply with EU law, in my experience many US providers don’t bother. I blame that on ignorance and arrogance. As many lawyers as we have in the US, cloud providers just don’t think they have to worry too much about legal requirements. And if they stay within our borders and don’t handle financial or health related data, they don’t have much to think about. So, why not allow users from other countries? The US doesn't regulate transborder data flows.
I'm not advocating for PRISM or Tempora (or the next secret government program that will be revealed). Nor do I believe all privacy laws are useless. But so far, there has been a major disconnect between what cloud users expect, believe and actually get related to privacy – whether their data is in the cavalier US or the tight-lipped EU.
By Cindy Wolf