Forgot your password?
typodupeerror
Cloud Data Storage Encryption Google Privacy Security IT Technology

Google Asks 'Who Cares Where Your Data Is?' 241

Posted by timothy
from the dumbwaiter-for-bits dept.
mask.of.sanity writes "The chief security officer for Google Apps, Eran Feigenbaum, said popular concerns over data sovereignty in outsourced environments are unwarranted. He said businesses should worry about security and privacy of data, rather than where it is stored. The comments clash with those made by IT pros including Gartner, who said cloud providers like Google can't be trusted with sensitive data."
This discussion has been archived. No new comments can be posted.

Google Asks 'Who Cares Where Your Data Is?'

Comments Filter:
  • Encrypt it then (Score:5, Insightful)

    by Anonymous Coward on Thursday June 09, 2011 @06:42PM (#36395232)

    If the data is sensitive, you should be encrypting it anyway before passing it along to a third party thatr has no business looking at it. If the data isn't sensitive enough to encrypt, why do you care where Google keeps it?

    • Re:Encrypt it then (Score:5, Insightful)

      by shadowfaxcrx (1736978) on Thursday June 09, 2011 @06:45PM (#36395260)

      Your post fails to consider the completely reasonable choice of not handing your data off to a third party in the first place. . .

      • Re:Encrypt it then (Score:5, Insightful)

        by hawguy (1600213) on Thursday June 09, 2011 @06:51PM (#36395300)

        But if it's sensitive, it should still be encrypted, even if it's in your datacenter.

        • by c0lo (1497653)
          I can't control the sender (can't ask all of them to send the emails exclusively in encrypted form) and there's no warranty that the message is not intercepted while in transit (actually, with this crazy ISP data retention laws popping up everywhere, high chances that the messages are actually intercepted).
      • Re:Encrypt it then (Score:5, Insightful)

        by 0123456 (636235) on Thursday June 09, 2011 @06:52PM (#36395310)

        Your post fails to consider the completely reasonable choice of not handing your data off to a third party in the first place. . .

        That is not a reasonable choice if you're a manager who's going to get a big bonus for shipping your data off to 'The Cloud' so you can close down your own data center.

        • Re:Encrypt it then (Score:4, Insightful)

          by shadowfaxcrx (1736978) on Thursday June 09, 2011 @07:55PM (#36395742)

          Just because the people in charge of your bonus are unreasonable does not suddenly mean that shipping the data off is suddenly reasonable. You might choose to make an unreasonable choice for personal financial gain, but from a data security standpoint, it's still unreasonable.

          • by Luckyo (1726890)

            The OP addresses the reality. You're addressing a fantasy where managers are knowledgeable about IT security.

          • Re:Encrypt it then (Score:4, Insightful)

            by Savantissimo (893682) on Friday June 10, 2011 @02:47AM (#36397630) Journal

            Even Google doesn't believe that it doesn't matter where the data is. When Kazakhstan said all .kz domains had to be hosted in that country, Google just walked away from providing Kazakh-tailored search. "If we were to operate google.kz only via servers located inside Kazakhstan, we would be helping to create a fractured Internet," said Google senior vice president for engineering Bill Coughran.

            I hesitate to agree with Gartner about anything, but you can't trust that Google won't not only turn over your data to any jurisdiction that asks, but will likely cooperate with and not try to contest virtually any sort of court order or even law enforcement request. With a government-agency level of threat model, though, you shouldn't be storing information on computers that are ever hooked to the internet.

      • by node 3 (115640)

        Your post fails to consider the completely reasonable choice of not handing your data off to a third party in the first place. . .

        Your post fails to consider the value in having the "best of both worlds".

        The cloud provides a real value. Staying away from it unnecessarily doesn't seem very rational. Encryption addresses the specific issue being brought up here.

      • To the average person, sending it off to a third party is as secure, if not more, than on their own personal computer. It is more likely to have backups, and the if it's a reputable third party, they will only use your data for advertising, not for emptying your bank account, which is what might happen if you get a keylogger on your computer.

        Really. There is a surprising number of people who don't have backups.
    • Re:Encrypt it then (Score:5, Interesting)

      by martin-boundary (547041) on Thursday June 09, 2011 @07:04PM (#36395404)

      If the data isn't sensitive enough to encrypt, why do you care where Google keeps it?

      Sensitive or no, Google has no right to snoop on your data.

      Besides, what may not be sensitive when you've got it, can become sensitive when someone else has got it.

      For example: you and a friend both own half of a secret password. One piece alone is worthless, so you don't mind if Google knows your half. Similarly, your friend doesn't care if Google knows his half. Result: Google knows both halves.

      What's true for passwords is also true for people's information profiles in general. Company A might know where you buy diapers, company B knows what movies you watch, company C knows your address, etc.

      • You must be watching some unbelievably entertaining movies, to be so engrossed that you would spend money to save the precious few second delay required for a lavatory break...

      • Re:Encrypt it then (Score:4, Insightful)

        by geekmux (1040042) on Thursday June 09, 2011 @09:16PM (#36396190)

        Sensitive or no, Google has no right to snoop on your data.

        Yes, you're right, Google has no right, and Google doesn't snoop on your data...

        Google will just hand it over to any Federal agency, pretty much on a whim, because said agency heard a rumor that your farts smell like a terrorists, and they will snoop on your data. Spank you very much Patriot act.

        And all this talk of encryption is laughable for the same reason(like THEY don't have the keys to the commercial encryption "castle"?), unless you are willing to go well above and beyond any semi-standard keylength (like 4096+) to at least offer some level of difficulty.

    • by bruceg (14365)

      If the data is sensitive, you should be encrypting it anyway before passing it along to a third party that has no business looking at it. If the data isn't sensitive enough to encrypt, why do you care where Google keeps it?

      Ayup. Fire up truecrypt, and be done with it.

    • by rasmusbr (2186518)

      Realistically speaking, how are you going to get your employees to never use the built-in save function in their apps?

      My understanding, correct me if I'm wrong, is that the "save" button will essentially work as a button that uploads a document to the cloud. Each separate app would need its own built-in encryption and decryption if it's going to be practical from a user perspective.

    • Okay. I'll bite.

      Yes encrypting the data is good enough http://everything2.com/title/Thermodynamics+limits+on+cryptanalysis [everything2.com] and http://en.wikipedia.org/wiki/Grover's_algorithm [wikipedia.org] (if quantum computers come up then grover's algorithm still isn't much use. See the max speedup of the algorithm)

      However...
      effing HOW? I can't even get people to use PARAMETERIZED QUERIES. How in the HELLS am I going to get them to use a crypto system?

      Sure, I can make it easy to some degree, but then how do we do queries on anything bu

    • by Darinbob (1142669)

      Whether or not it's sensitive why would I want to give it to Google?

  • Obligatory XKCD (Score:2, Insightful)

    by RDW (41497)
  • Gartner says this? (Score:3, Insightful)

    by waddgodd (34934) on Thursday June 09, 2011 @06:43PM (#36395246) Homepage Journal

    I'm sorry, but on the trust scale, Google, who has yet to lie to me, wins big over Gartner, who lies through their teeth every time they review a product. I still recall Gartner recommending WinME. 'Nuff said there....

    • by Bloodwine77 (913355) on Thursday June 09, 2011 @06:48PM (#36395280)

      I don't trust Google with my sensitive data because I assume it will be analyzed, packaged, and sold to marketers and advertisers. I have some faith that it is anonymized first, but even still I don't like it and you have to wonder how anonymous the data actually is.

      I would rather retain 100% control of access to my data.

      • by SuperQ (431) *

        Not how it works, sorry. Have you ever heard of any "marketers and advertisers" getting data from google? It doesn't happen. People buy ads for keywords and Google does the matching bits.

        If it were true that "marketers and advertisers" could get your data, even anonymized, I could go and buy it through the sale service right now.

      • by Ash Vince (602485) *

        I don't trust Google with my sensitive data because I assume it will be analyzed, packaged, and sold to marketers and advertisers. I have some faith that it is anonymized first, but even still I don't like it and you have to wonder how anonymous the data actually is.

        I would rather retain 100% control of access to my data.

        If you think any company will NOT sell any data they can regarding you on the free market you are living on cloud cuckoo land. Companies all exist to turn a profit, and if data regarding you is profitable then you can be sure they will sell it.

        • All my data is stored at a data center, but we manage our own servers. The data center staff has login credentials for emergencies, but they have never abused this privilege.

    • by fuzzyfuzzyfungus (1223518) on Thursday June 09, 2011 @06:55PM (#36395338) Journal
      The problem here is that, while Gartner is indeed utterly useless, their opinion is also unnecessary to determine that Google is oozing nonsense.

      Different jurisdictions have different laws on the books about what data are considered specially protected, what data are an open book for the local feds, and what data require some sort of judicial approval(and to what degree that approval is a serious consideration or a simple rubber-stamp). Therefore, the jurisdiction in which your data are located(or where your outsourcing partner has offices large enough that the local feds can motivate them to comply) is part of rather than opposed to worrying about the privacy and security of your data.

      Google certainly doesn't seem to be the worst when it comes to rolling over and wagging their tail for any jackboots who come calling; but anybody who thinks that they put up extra-legal resistance to any of the major powers in which they operate is, shall we say, under the influence of excessive optimism...
    • by mellon (7048) on Thursday June 09, 2011 @06:55PM (#36395344) Homepage

      Um, but Google *is* definitely lying to you. You don't need to compare reputations. What Google is saying is simply, obviously wrong: that you can trust them with read/write access to your data. Sure, if your data is something that would be of minimal value, there's no harm in it leaking. But if your data is sensitive, then unless Google is willing to indemnify you for whatever damages you'll be liable for if the data leaks, you have a fiduciary responsibility not to store your data on a Google server. And as far as I understand it, Google is not willing to indemnify you for that (realistically, how could they?).

      So independent of anything Gartner says, what Google is saying is at the very least misleading for the application they are talking about. The sense in which Google is right is that if you aren't taking any precautions to protect the security of your data, either because you can't afford to or because you don't know how to, then it may well be no *worse* for you to store your data on a Google server. But if that's the case, you don't care about security anyway, so Google's entire claim is moot.

    • Re: (Score:2, Interesting)

      by owlstead (636356)

      By now when I see that Gartner is at one point of an argument, the other party immediately gains points for acting against Gartner. It's starting to be like Godwin's law; once Gartner chooses your side, you loose :)

  • What! (Score:4, Insightful)

    by traindirector (1001483) on Thursday June 09, 2011 @06:46PM (#36395268)
    1. 1. Article is worthless.
    2. 2. Security and privacy of data are affected by where the data is stored.
    3. 3. Article is worthless.
    • by owlstead (636356)

      First rule of having a meaningful discussion: argument your case.

      • by jedidiah (1196)

        OK, then I will throw something else out....

        How do you take action against people who do you arm in foreign jurisdictions?

        Where is the control and accountability in such situations?

        When it came to proprietary software, the oft brought up issue was "who do you sue" or
        "who can you blame when something goes wrong"? Well, that question applies to all forms
        of outsourcing too, including all of this "Cloud" stuff.

      • by traindirector (1001483) on Thursday June 09, 2011 @07:49PM (#36395700)

        *sigh*. Okay. I thought it was obvious why this "story" is not quality discussion material, but I'll explain.

        The article is presented as if its subject is Eran Feigenbaum's claim that "Professionals should worry about security and privacy of data, rather than where it is stored." But instead the article is a potpourri of quotations and facts unrelated to the main problem with the claim, which the article totally ignores. Any article on the subject of this claim needs to in some way establish that security and privacy can make location irrelevant, and I would expect the supporting statements of the article to do this, but nothing in the story even approaches this basic aspect of the claim. Instead, it is filled with a number of superficially-seemingly-related-but-ultimately-off-topic anecdotes.

        After presenting Feigenbaum's main claim, the article presents a "supporting argument" by Feigenbaum: "He cited a meeting in Europe where he had tracked an email sent within an office as it bounced through five countries. In this circumstance, Feigenbaum said, security trumps data sovereignty." So email currently goes through a lot of countries when it is sent from one person in an office to another, where it is likely in plain text and can be read by any number of corporate and government entities. The only way this could possibly be construed as supportive of Feigenbaum's point is if read as "Email currently goes through many nations and it is secure enough". If read with any understanding of how the email system works, it undermines Feigenbaum's point.

        Then the article has Michael Cloppert "support" the argument with the same type of claim: "I'm not convinced that the data location issue is a problem - after all, packets are routinely routed around the world irrespective of the export status of their content". Again, the argument is "this is what we're doing now, therefore it is secure enough". Actual security of information going through various nations is not addressed.

        Then it presents the "other side" of the argument: There is no way you can know how Google is handling your data even though they assure you they are doing it well. And their contracts have lots of language that could excuse them from legal liability if that is not the case.

        Then we go back the argument supporting Feigenbaum's main point. "He said customer data can only be accessed on a need-to-know basis". This does not support 5he argument that privacy and security make location irrelevant. "[L]ess than two per cent of Google staff had entered its top secret data centres". This does not support the argument that privacy and security make location irrelevant. "Google also stamped each hard drive with unique barcodes that allowed the company to track the lifecycle of data stored on each disk." This does not support the argument that privacy and security make location irrelevant.

        Then we are presented with this: "But it did not encrypt data at rest, and had no immediate plans to introduce the protection." This makes it sound like location is very important to security and privacy--that someone could entire a facility by force and read the data.

        The article acheives nothing other than quoting a single-sentence, questionable claim. It presents the claim, then a number of partially related statements that are presented as "discussion" of the claim but that actually have very little to do with it. I wouldn't be surprised if the article twists what Feigenbaum actually said for sensationalistic purposes.

        This article represents the worst type of "journalism".

    • by siglercm (6059)

      Good heavens, someone PLEASE mod parent up, +1, Insightful.

      Security and privacy of data are affected by where the data is stored.

      I may disagree about privacy, assuming encryption is secure within reason. But security of data is meaningless without access to data. "Yes, my data is super secure. It's locked inside a nuclear strike-proof vault inside Mt. Storm. Of course, it is a pain in the ass to retrieve the tapes and disks every time I need to update the database or apply a patch to the git repository or send someone a copy of the documentation." How does that help anyo

  • Ummm... What? (Score:4, Insightful)

    by fuzzyfuzzyfungus (1223518) on Thursday June 09, 2011 @06:48PM (#36395284) Journal
    Obviously, it is Feigenbaum's job to exude nonsense where required; but the notion that worrying about where something is stored isn't part of(much less opposed to) "worry[ing] about security and privacy of data" is transparent absurdity.

    Where data are, in part, determines what laws(and de-facto uses and abuses of power) they are subject to or subject to the protection of. In a number of cases(including the not-exactly-economically-insignificant case of EU businesses working with American cloud entities...) it might even turn out that storing certain sorts of data in some jurisdictions means that a given entity is in violation of data protection laws at home because the data protection laws are insufficiently strong where they are storing data.

    Things like whether or not you are getting hacked by lulzsec are, of course, also important; but(until Google transforms itself into a cypherpunk utopia or sprouts a formidable nuclear deterrent), location is right up there with hackers in determining how likely your data are to be absconded with against your wishes. And(unlike hackers) you can't really code your way past the feds...
  • I don't think the Google exec is listening to himself. If I am concerned with the security and privacy of my data then where it is stored and who has access to it are going to be pretty close to the top of the list of thing to be concerned about. Google still might be an ok place for it, but exec's saying things like this make me more than a little uneasy.

  • Oh Please! (Score:2, Insightful)

    by Anonymous Coward

    I didn't hear anything about Sony having their data outsourced. It didn't seem to do any good to keep sensitive data on their own servers. I think the lesson here is that all data on any networked device is at risk.

    • by Mashiki (184564)

      Oh those are just terrible lies. I mean we have the nuclear football plugged right into the internet. Right over there!

  • ...does impact on security (real and perceived, which impacts on trust).

    One can say that it is more important to trust the provider of the data storage than to trust the location. What makes any particular location untrustworthy if not the security that one can bring to bear? One provider may simply not be able to be as disciplined with their security protocols than another, while being in an area that is deemed to be more secure...like comparing Palo Alto and Namibia.

  • Either or? (Score:5, Insightful)

    by eepok (545733) on Thursday June 09, 2011 @06:57PM (#36395356) Homepage

    Why should we be concerned only with security/privacy of data OR the actual location of the storage? Can't we care about both?

  • Given the number of breaches (most unreported ones by employees and former employees), it seems that hosting it elsewhere is the least of our problems. In fact, if done right, it's likely that it's more secure elsewhere because that makes it harder for the number 1 breacher (employees) to get to it.

    Yeah, yeah, I know, we are supposed to ignore what actually happens and instead focus on targeted corporate breaches like anyone really cares what we do for a living.
    • That will only open the gate for the employees of the cloud service to get your data. And those are even less loyal to your company, and you have even less control over them than your ones.

  • by Infernal Device (865066) on Thursday June 09, 2011 @07:00PM (#36395386)

    I'm not comfortable keeping data entrusted to me on a provider who can walk away from a data loss with no penalties due to the Terms of Service.

    At least when it's on my systems, someone is going to take a fall for data loss, even if it's me. And I'm OK with that.

  • by mrjatsun (543322) on Thursday June 09, 2011 @07:05PM (#36395408)

    How much are they willing to compensate me if they lose my data? What, they won't? Don't trust themselves?

  • for la-de-da things yea who cares, when your trying to get stuff done and you cant cause your document is on the cloud, which is experiencing outages, or your internet just shat on itself then yea I care where my durn spreadsheet is when someone is breathing down my neck asking for a shipping update from Indonesia

  • "He said businesses should worry about security and privacy of data, rather than where it is stored." -- but those aren't separate concepts. Should I worry about security if my data is located at Sony corp? Or privacy if my data is on Facebook? security and privacy is very much a function of "where", and of: "who buys out the company next". The only where where one might have some sense of security or privacy is on a drive that you control.
  • The US has already proved it will do whatever it wants, unwarranted, in the name of Intellectual Property Protection. What's to stop another country from doing the same thing for any number of warrant-less reasons and never giving the data back?
  • If that's the case why doesn't Google store its data with Amazon or Microsoft? I'm sure both Amazon and Microsoft will give Google a deal on data storage.

    • by hawguy (1600213)

      If that's the case why doesn't Google store its data with Amazon or Microsoft? I'm sure both Amazon and Microsoft will give Google a deal on data storage.

      I think because it's more expensive and has higher latency. For a small business, Amazon S3 is much cheaper than an enterprise storage system and if you use availability zones and regions wisely, you can end up with an extremely robust storage system for not a whole lot of money.

      But when you already have datacenters across the country and require petabytes of storage, it's generally cheaper to buy your own storage directly rather than buy from a intermediary... or even create your own cheap storage systems

  • by gweihir (88907) on Thursday June 09, 2011 @07:19PM (#36395510)

    First, it may actually be a legal requirement keeping the date in a certain jurisdiction. And second, any law enforcement or TLA access to the data will be governed by the laws of the place the date is physically stored. If the Google people do not understand that, one more reason to not hand your data to them.

    • by celesteh (1864708)
      Indeed, under UK data protection laws, you need the permission of users to host their data outside of the EU. If Google doesn't understand that, then they're writing off EU customers.
  • PATRIOT ACT (Score:5, Insightful)

    by Anonymous Coward on Thursday June 09, 2011 @07:34PM (#36395600)

    I care because I'm Canadian. If I keep my data up here it's not subjected to the almighty Patriot Act. Case Closed.

    • Seconded. In healthcare and in Ontario, we need to make sure we have at least a copy of our data in our province.

  • by Wolfling1 (1808594) on Thursday June 09, 2011 @07:38PM (#36395628) Journal
    Its not about securing data. Its not even about Google mis-using demographics.

    Its about privacy and business value.

    Most businesses are valued based on their assets, stock on hand and good will. Good will is a measure of the number of customers who continue to use the business regularly.

    Good will is typically measured by looking at the CRMs and counting the number of client files that are active. Take that away, and you can no longer measure good will.

    So, why does Cloud computing threaten good will? I'm glad you asked. Many consumers continue to conduct business with a particular company because 'they have my records'. Its not some kind of corporate blackmail. Its easy for the customer to continue to do business with the people that know them. This customer knowledge is held in corporate CRMs.

    As soon as it becomes widely known that all CRM data is in the Cloud, there will be a gradual transition (thanks to FOI laws) of the ownership of the data moving back to the individuals instead of residing with the companies. Microsoft's HealthVault is case in point. When my medical records are owned by ME instead of owned by my doctor, I can choose to get healthcare anywhere.

    There are great arguments in favour of the concept. Client service will improve out of sight when it is the yardstick for comparing companies (instead of possession of CRM data). However, show me one businessman who is prepared to give his goodwill into Google's custody, and I'll show you a big risk-taker.
  • Host it yourself.

    Depending on what your line of business is, this may not be feasible. If you're a startup that's begging for capital, well, beggars can't be choosers.

    OTOH, if you're just having a site hosted that has no real sensitivity to it, what does it matter? Put it in a cheap cloud hosting service and be done with it.

  • by codegen (103601) on Thursday June 09, 2011 @07:45PM (#36395670) Journal

    Googles example of an intraoffice message being routed around the world is a classic strawman argument. It's not the individual intraoffice messages that might bounce outside the data centre (possible due to a .forward on an individual account) that worries me. That's a needle in a haystack (although the searching algs are getting much better). It is the fact that the entire storage of read and unread (i.e. webmail,imap) ends up on a server that may be in a different legal jurisdiction (and for my University, it is a different legal jurisdiction). Or, if you adopt google docs, all of your documents are stored in google's servers (and without encryption to boot!!). One US court subpoena, warrant or NSL, and all your data is vacuumed. Even though some recent cases have strengthened the notification requirement, you have to fight the subpoena or warrant in a US court under US law.

    If you are just using google as a disk drive, then you can encrypt your data, but if you are actually using the google services, forget it.

    • by PPH (736903)

      One US court subpoena, warrant or NSL, and all your data is vacuumed.

      "Your data"? Everyone from Facebook to the telecoms thinks of it as their data. And when the gov't comes knocking, they are unmotivated to defend it on your behalf. If they stood up for your rights, they'd expose themselves to punitive measures.

      Even though some recent cases have strengthened the notification requirement, you have to fight the subpoena or warrant in a US court under US law.

      Or move it offshore. Where the data center owner is less beholding to gov't thugs. And knows how to tell them to "blow it out their ass" in seven languages when they come asking.

      • by geekmux (1040042)

        One US court subpoena, warrant or NSL, and all your data is vacuumed.

        "Your data"? Everyone from Facebook to the telecoms thinks of it as their data. And when the gov't comes knocking, they are unmotivated to defend it on your behalf. If they stood up for your rights, they'd expose themselves to punitive measures.

        Uh, so it's "their" data, right up until the point they are questioned about "their" data, and then suddenly, it's not "theirs" anymore?

        Don't get me wrong, you bring a valid point in that they will NOT allow themselves to get tangled up in legal issues that doesn't really involve them, but if that's the case, then the line needs to be drawn more clearly. Either you deal with the fact that it is MY data and NOT yours, or you take 100% responsibility of "your" data. I grow tired of legal loopholes and conve

        • by PPH (736903)

          Uh, so it's "their" data, right up until the point they are questioned about "their" data, and then suddenly, it's not "theirs" anymore?

          Oh, its still "theirs". But they don't have any regard for it's security. So when the FBI comes asking, its "Sure. You can have it. Glad to be a patriot and help out. And thanks for not having the IRS audit our entire board of directors."

          What Google, Facebook, Comcast, et al. are trying to avoid is creating a fiduciary [wikipedia.org] relationship with you over your data. They don't want an obligation to protect it on your behalf at their expense. So its "their" data to hand over. Until the kiddie porn is found. Then its

  • I want my data stored in Google's new datacenter in Kazakhstan.
  • The EU can't allow their stuff to be hosted in the US where unwarranted and secretive searches are the norm. The US won't allow their stuff to be hosted in the EU because they can't trust the individual states to do the same to them.

    The only solution is client-side encryption where Google etc. hosts only encrypted data and can't have access to the keys. There are projects that are working on this but this means the 'cloud' won't be hosting everything but a more hybrid approach is necessary.

  • Form 637 [irs.gov]:

    5. List the address where your books and records are kept (if different from the address in Part I)

    Just the first hit I got off Google.

    • by PPH (736903)

      Form 637:

      5. List the address where your books and records are kept (if different from the address in Part I)

      "The Cloud".

      Better yet. Move everything offshore and become an employee of a foreign corporation. If the IRS wants any info. they can write to the address in Grand Caymen. I don't know sh*t. I just work for them.

      Sometimes, not knowing something works to your advantage (it worked for Reagan).

  • by FatSean (18753) on Thursday June 09, 2011 @08:04PM (#36395804) Homepage Journal

    Until we have one world government, differing laws on data privacy mean you have added considerable complexity for the savings of using their cloud. Maybe it is a worthwhile trade-off, maybe not. But he is silly making such a blanket statement. If you work for a company that contracts with the US Government you may be aware of ITAR and the various rules about where data can be stored.

    In general, to me, the cost savings is far over shadowed by the increased risk. Even if you mitigate the risk by doing your homework and picking a state with laws that you agree with...you've just spent quite some time and money on that research.

  • 1. If it's sensitive then it shouldn't be on the internet in any manner including hosting. 2. Knowing your legal rights is relevant, and that requires knowing where your data is hosted. If beach pictures of your wife violate Iranian law then they shouldn't be hosted in Iran. 3. Known risks. If you work for a European aircraft builder and you're trying to beat out a major American aircraft builder for a large contract then you best not host your trade secrets in the USA.
  • Maybe he should ask Citigroup credit card holders?

  • The comments clash with those made by IT pros including Gartner, who said "cloud providers like Google can't be trusted with sensitive data."

    I wouldn't say they 'clash.' I'd say they show an attitude that serves as evidence of such assertions.

  • ,,,how banks work. Where the data is stored has a lot to do with how much (or little) legal maneuvering is required to gain access to customer financial data.

  • The main concerns about data location and sovereignty ARE privacy and security. These two viewpoints aren't opposed. Sure, worrying about the location of your data //for its own sake// is silly. The big reason people worry about where their data is is WITH WHOM it is: whether they can be trusted not to snoop it, sell it, carelessly lose it, or cave to a subpoena or DMCA takedown. That's the whole point.

  • I think I'll trust the Google's opinion about the safety/security/availability of "The Cloud!" when one of two things happens:

    1) Google turns out the lights in all their data centers and moves their entire operation into someone else's cloud service.

    Or

    2) Google is willing to trust their entire existence to the integrity of their cloud service. This means that Sergey, Eric, Larry, and all their employees turn over stock ownership. They hand over the keys to the buildings, the data centers, the networks, the

  • /me raises hand

    But it is nice that Who cares, even if I thought David Tennant was a better Doctor.

  • by drb226 (1938360) on Friday June 10, 2011 @01:10AM (#36397296)
    RMS cares.

"The whole problem with the world is that fools and fanatics are always so certain of themselves, but wiser people so full of doubts." -- Bertrand Russell

Working...