The move to cloud computing is unstoppable – but WikiLeaks gives us pause

[Jake Kouns <jkouns () opensecurityfoundation org>]

http://www.guardian.co.uk/technology/blog/2010/dec/07/wikileaks-cloud-computing

Until last week, any computing futurologist would tell you that cloud
computing is where it's at. You don't need to know where your data is
being stored; it's just on a computer, or more likely computers, Out
There On The Internet. Thus Amazon, with its EC2 ("Elastic Cloud
Compute") service, or Microsoft with its Azure service, or the most
familiar example, Google, with its GoogleMail and Google Docs
services, which are used by thousand of companies around the world.
(Disclosure: the Guardian uses Google Docs and Mail, and Amazon's EC2
system for its API.)

Indeed, the prestigious Pew Research Center said in June that "solid
majority of technology experts and stakeholders participating in the
fourth future of the internet survey expect that by 2020 most people
will access software applications online and share and access
information through the use of remote server networks, rather than
depending primarily on tools and information housed on their
individual, personal computers" and that "most users will perform most
computing and communicating activities through connections to servers
operated by outside firms".

We already do, to a large extent: Google's search index lives in the
cloud; lastminute.com, TripAdvisor, toptable.com, they're all a
"cloud" service. What has been changing in the past few years is that
individuals and companies have been able to upload their own content
onto those computers – hence the explosion in size of Facebook,
Flickr, YouTube and Twitter, none of which generate their own content.
It all lives in the cloud, where one organisation offers the servers
and another offers the software that interfaces to the content.

Last week though the premise behind cloud computing began looking a
bit creaky. On Wednesday, Amazon dropped the contents of WikiLeaks
that had been hosted on its EC2 service. In a very po-faced message,
Amazon said that it wasn't the hackers' DDOS attacks that had prompted
the move ("those were successfully defended against") but that
WikiLeaks was "not following" its terms of service.

Terms of service? Since when did Amazon have the time to decide
whether every one of the companies it offers is following its terms of
service? And why were the WikiLeaks warlogs all right to be hosted on
Amazon EC2, yet cables aren't?

Since then every DNS, which offered a free service so that if you
typed "wikileaks.org" into a browser it would direct your computer to
the site, has dropped WikiLeaks too, citing the DDOS attack – though
strangely it didn't find that a problem while the service was hosted
on Amazon. Other American companies, and one Swiss bank, have rattled
after them.

Is that it, then, for cloud computing? Has WikiLeaks shown that cloud
computing will eventually rain on any sufficiently
authority-challenging parade?

The reality is that anyone who manages to get under the skin of
governments as effectively as Julian Assange and the WikiLeaks team
have done will test the limits of government, and hence commercial
tolerance. To see how, do some thought experiments around WikiLeaks.
First, imagine that it was leaking /Chinese/ diplomatic cables,
telling us what the Chinese thought of the world around them – the
wars, the mineral buyups in foreign countries, the hacking attacks
against American search engines.

Would you be happy with that? You probably would. Now imagine that the
leaks were being hosted on servers controlled by Baidu.com, which in
China has a larger share of the search market than Google. Still OK?

It might be uncomfortable for Baidu, because the Chinese government
licenses every web company. But we'd be enjoying the discomfiture of
the Chinese, wouldn't we?

Next imagine that Baidu takes them down, saying that they break its
terms of service, which are that you can't have content that the
government deems harmful to the state. Spineless Baidu! Wicked
Chinese!

That might come to pass. But in the meantime, precisely that – though
involving American, rather than Chinese, content – has come to pass.
The list of American-owned companies that have shunned WikiLeaks this
week is astonishing, added to today by Visa and Mastercard.

It doesn't mean that cloud computing is a bust; more and more
companies will continue to move their data to the cloud, urged on by
Google and Microsoft (the latter is preparing a strong push to move
clients cloudwards next year). But it does mean that it has not broken
free of politics; and possibly the net never will. The interesting
next move would be whether the Chinese government will offer to host
the WikiLeaks cables – a move that Assange and his team may think goes
slightly too far.

In the meantime, though, the cables will continue to circulate on
file-sharing systems, especially Bittorrent – which are the ultimate
in cloud computing, consisting of an ad-hoc network of users' PCs
which have a copy of the main file and pass anyone who wants it a
little piece, so that they can't be shut down. Commercial cloud
computing is what it says it is – commercial, and so vulnerable to
political and commercial pressures. But file-sharing is turning out to
be the really resistant form where, as John Naughton points out, the
only way to stop it is to turn off the internet. And not even the
American, or even Chinese governments, seems ready to countenance that
just yet.
_______________________________________________
Dataloss Mailing List (dataloss () datalossdb org)
Archived at http://seclists.org/dataloss/
Unsubscribe at http://datalossdb.org/mailing_list

Learn encryption strategies that manage risk and shore up compliance.
Download Article 1 of CREDANT Technologies' The Essentials Series:
Endpoint Data Encryption That Actually Works
http://credant.com/campaigns/realtime2/gap-LP1/