Is Cloud Storage Safe?

Short Answer? No.

There are only three things you have to worry about when you store something on the web. Your host, the federal government, and hackers.

1. Your host. If you think Microsoft’s OneDrive or Google’s Cloud Storage is private, dig up their “Terms of Use”. When you use their servers, you accept the terms of service which is part of the deal. That gives them both the right to inspect – and delete – materials that they find offensive, illegal or objectionable in any other way. Recently, we’ve seen various types of political censorship as part of our bitter election fight this year. Using Microsoft as an obvious, but certainly not the only, example, you agree to the following condition:

Microsoft reserves the right to review materials posted to the Communication Services and to remove any materials in its sole discretion

Other cloud storage services have the same conditions. In other words, anything you store in the cloud is subject to inspection by the service provider, despite vague promises to the contrary. In addition, those are only the legitimate, permitted access.

2. The federal government. More recently, various agencies of the federal government have come to believe they have the right to snoop through your personal emails and anything else they think they need to protect you from yourself. With or with out search warrants from the secret FISA Court, You should just simply assume that anything you have ever stored, emailed or posted on the web is subject to inspection at any time.

That’s not paranoid raving.  In the news this week, Yahoo Inc last year secretly built a custom software program to search all of its customers’ incoming emails for specific information provided by U.S. intelligence officials. The company complied with a classified U.S. government demand, scanning hundreds of millions of Yahoo Mail accounts at the behest of the National Security Agency or FBI. Microsoft and Google swear they haven’t received similar demands and of course, they would rigorously object…long enough to create plausible deniability for their public relations folks.

But that’s just our government. Now consider the Russians, the North Koreans, Iranians, terrorist groups. All of them are hungry to purloin your extensive collection of cat pictures.

3. Now add in non-legitimate intruders – hackers and criminals. Yahoo recently admitted that 500 million user accounts had been hacked, including passwords, user profiles and anything else stored in your user account. Note that the population of the US is only 340 million people. We hear of banks losing control of their credit card accounts almost on a monthly basis. You have to worry about everything from pimple-faced teenagers in mom’s basement, but everything up to contract programming for money by expert professionals.

The internet is a tough neighborhood. Ask Jennifer Lawrence and perhaps 600 other iCloud users, apparently after a successful hack by a Chicago cretin. Over Labor Day last year, dozens of nude celebrity photos were released all over the internet. This case doesn’t really mean that iCloud is any less secure than any other online cloud storage, any more than a padlocked bicycle on a public street. It wasn’t system-wide, but individual accounts were hacked one at a time by password cracking. The point to be noted here, of course, is that most any cloud storage account can – and predictably, will be hacked.

Does all this mean you should go into panic mode? Like most things, no. Nobody cares about 200 cat photos, or your kids’ homework. Most people have nothing to worry about, but you might give some careful thought about storing your password list (“So I can find my passwords no matter where I am…”), your Quicken backup files, your bank statements, employee salaries, your social security number, or anything else that might be sensitive.

Bottom line, the rule is simple:

If you wouldn’t put it up on the bulletin board at the grocery store, don’t poke it up to the cloud.

A little reasonable caution goes a long way. For me, the best solution is simply not to use cloud storage at all. My personal opinion is this: The only way to win is not to play the game in the first place.

Posted in Security.