Spying is bad for business: NSA spying caused 9 percent of foreign firms to dump U.S. clouds - by Mike Wheatley

In the weeks following Edward Snowden’s revelations of the NSA’s massive web surveillance program PRISM, speculation was raised about the negative implications it could have on U.S. cloud companies.

Now, Forrester Research has taken the time to see just what kind of impact it has had, asking a host of foreign firms whether or not PRISM has caused them to scale back their spending on U.S. cloud services, and the answer makes for some uneasy reading.

A total of 1,668 non-U.S. business technology decision makers were quizzed in Forrester’s survey. The exact question asked was “In the past year, has your company explicitly halted or reduced your spending with US-based companies for Internet-based services (e.g., cloud, online service/outsourcing) due to these security concerns?”, with 26 percent of respondents answering in the affirmative.

Forrester followed up by asking the 427 who said yes what their reasons for doing so were, and found that 34 percent cited “fear of the intelligence community spying”. A quick sum of the math shows that 9 percent of foreign firms have therefore ditched U.S. cloud companies due to the NSA, not an insignificant number by any means, despite The Register’s insistence that “Snowden didn’t scare off many”.

It’s worth nothing that the respondents held, on average, only about a third of their company data in U.S. clouds anyway, so their decision to pull out may not be as significant as it first seems. But even so, U.S. cloud firms will still want to take notice of the survey, which indicates that most foreign companies simply don’t trust them all that much anyway, irrespective of the NSA. In total, 53 percent of respondents said they would not trust any of their critical data with a U.S. cloud company, end of story.

Read more: NSA spying caused 9 percent of foreign firms to dump U.S. clouds | SiliconANGLE

Internet: The Cloud -No, your data isn't secure in the cloud - by Lucas Mearian

While online data storage services claim your data is encrypted, there are no guarantees. With recent revelations that the federal government taps into the files of Internet search engines, email and cloud service providers, any myth about data "privacy" on the Internet has been busted.

Experts say there's simply no way to ever be completely sure your data will remain secure once you've moved it to the cloud.

"You have no way of knowing. You can't trust anybody. Everybody is lying to you," said security expert Bruce Schneier. "How do you know which platform to trust? They could even be lying because the U.S. government has forced them to."

While providers of email, chat, social network and cloud services often claim -- even in their service agreements -- that the data they store is encrypted and private, most often they -- not you -- are the ones who hold the keys. That means a rogue employee or any government "legally" requesting encryption keys can decrypt and see your data.

Even when service providers say only customers can generate and maintain their own encryption keys, Schneier said there's no way to be sure others won't be able to gain access.

For example, Apple's SMS/MMS-like communications platform, iMessage, claims both voice and text are encrypted and can't be heard or seen by third parties. But because the product isn't open source, "there's no way for us to know how it works," said Dan Auerbach, a staff technologist with the Electronic Frontier Foundation (EFF). "It seems because of the way it works on functionality, they do have a way to access it. The same goes for iCloud."

Note EU-Digest: The Cloud services are also offered to European Internet users. Given that  the storage data banks of  Google, and Apple for Cloud and other similar systems are kept in the US by American companies, and consequently  fall under US jurisdiction, it probably would not be a good idea for EU citizens and businesses to store sensitive material on these data bank services.

Read more: No, your data isn't secure in the cloud | Computerworld