The Lifer: How Secure Is the Cloud?
Posted 07/16/2012 at 11:00am
| by Rik Myslewski
Tech watchdog Rik Myslewski dons his tinfoil hat to examine the ever-increasing privacy risks of the digital age

Back in the late 1960s, a popular public service announcement intoned: “It’s 10pm. Do you know where your children are?” Let’s rephrase that for today: “It’s 2012. Do you know where your data is?” My guess is that you don’t.
Thirty years ago, we geeks knew exactly where our data was: on floppies in Tyvek sleeves. Then we got multiuser systems at work, and shared hard drives with our coworkers. Next, networks put our files on central servers, a step further away from our direct control. In the 1990s came the Internet, which gave us access to a world of content, but which also gave the world a doorway--preferably a locked one--into our Macs.
The Internet begat remote storage, remote storage begat the cloud, and the cloud begat iCloud, Apple’s free email, contacts, calendar, photo, and iWork sync ‘n’ storage system for OS X and iOS. iCloud knows where you are and what you’re doing, but do you know the same about it? And do you care?
Probably not. But I’ll argue that you should. And no, I don’t mean caring about which storage arrays your individual bits and bytes occupy in Apple data centers in Newark, CA and Maiden, NC, or upcoming ones in Santa Clara, CA and Prineville, OR. I’m talking about needing to know who has access to that data, and how they might use it.
First, let me slip on my well-worn tinfoil hat--I wear a size 7 7/8, so mine’s made of 18-inch Reynolds Wrap Heavy Duty--and remind you that you simply don’t know who is accessing your information. Sure, Apple has more-than-reasonable privacy controls, but even Cook & Co. must answer to higher powers--two, to be exact: the government and the market.

Should we be concerned about trusting all our important data to ouside sources?
From July to December of 2011, for example, Google received 6,321 requests for information on about 12,243 user accounts from US government agencies and courts, and complied with 93 percent of them. Apple doesn’t release such statistics, but you can make your own projections based on Google’s data.
“But why would they be interested in me?” you ask. Well, if your name is Ahmed and you lived in New York during the last decade, the NYC police likely kept you under surveillance, probable cause or no probable cause. If the 9/11 hijack jerks had been named Glowacki, Grobowski, and Zukowski, I don’t doubt that law enforcement would ask Apple to run keyword filters on my iOS notes or scan my contacts for others with similiar surnames.
“But I’m just a law-abiding ‘Merkin,” you say. You may be now, but times change. Fred Korematsu, for example, was a law-abiding citizen before FDR signed Executive Order 9066. Bottom line: the more information the powers-that-be possess about you--or can demand from corporations such as Apple and Google--the more vulnerable you are should you choose to dissent from the norm.
Also--and less tinfoiley--you have become a product. Information about you on iCloud, in your Google breadcrumbs, filling your Facebook page and profile, or wherever, is what gives you value. Advertising is becoming more and more targeted, and the more that advertisers know about you the better they can entice you to buy their wares and the more the entities that possess your information can charge them for it.
Exactly how the ongoing consumer-privacy-versus-consumer-benefit, opt-in-versus-opt-out feud will be resolved is not yet known. Some insist that government regulation is anathema to free-market principles, while others decry unbridled collection, retention, and rental of users’ personal information.
Which brings me to my final question: if you’re ultimately the product, shouldn’t you be able to name your own price? Or, for that matter, take yourself off the market?
>> Rik Myslewski was editor-in-chief of MacAddict from 2001 until transformed into Mac|Life in 2007, and how writes for The Register, which is "biting the hand that feeds IT" daily at www.theregister.co.uk