The cloud providers told their customers that this information was secure from government interference, and that the government had to obtain search warrants in order to even inspect the data. This turned out not to be true, as Snowden demonstrated. This changes the level of risk, and apparently at least some companies are rethinking their cloud commitments. Also, as Target's 40 million customer credit card breaches demonstrate, there is a real cost of not providing your own (good) security and keeping data safe. And that cost may get higher. See http://finance.yahoo.com/news/senator-calls-accountability-t...
The government does need to subpoena AWS etc if they want access to my s3 bucket, or ec2 instances. The NSA siphoning off unencrypted data in transit via backbone providers en masse is entirely different.
You wrote: "The government does need to subpoena AWS etc if they want access to my s3 bucket, or ec2 instances"
Do they? Evidently, the NSA, a US government agency, feels that portions of the Patriot Act and related laws (including secret interpretations of such laws) do grant it legal right to collect information that is on any server of any company in the world (including servers physically located in the United States), in order to fight terrorism and other threats to national security, without the need for a subpoena or a warrant. Furthermore, if the NSA if legally allowed to do so, are not the CIA, the Department of Defense, other Homeland Security Agencies and any other information-collecting agencies, whether or not such collection is overt or covert, and whether or not the subject of such collection is aware of such collection or not, also able to make the same argument that such activities would be legal under the same legal justification used by the NSA?
If if this is so, then the statement you made: "The government does need to subpoena AWS etc if they want access to my s3 bucket, or ec2 instances" must be incorrect, or untruthful.
If it is untruthful, then the negation must be truthful, which means the government does not need to subpoena AWS etc if they want access to your s3 bucket or ec2 instance.
The judge in this case essentially confirmed the case of Smith V. Maryland (1979) < http://caselaw.lp.findlaw.com/scripts/getcase.pl?court=US&in... > (see page 2 of the article we are commenting on) that one does not have expectation of privacy for information provided to a third party. You logged in to amazon systems, and you conveyed information (data) from your system to their system. I see this as no different than providing a phone number to a telephone carrier in order for them to connect the call. You are putting software, data, instructing them to serve it to other parties, as in the case of s3 buckets, or instructing them to run virtual machines to perform computational operations on their computers, as in the case of ec2 instances.
While, as the article mentioned, there are now people in the justice system who may think the 1979 case no longer reflects the realities of electronic communications, it is still the law and will remain so until the lawyers decide it isn't.
To quote from the article:
[begin quote]
In one of the concurrences, Justice Sonia Sotomayor wrote that "it may be necessary to reconsider the premise that an individual has no reasonable expectation of privacy in information voluntarily disclosed to third parties."
[end quote]
So, while the Fourth Amendment is clear about "papers and effects", it is not so clear on data provided to third parties (no matter the purpose, no matter the level of protection of the data the company promised--company promises cannot supercede state or federal law) isn't wide open for government access, in light of what the article states, and in light of the judge's decision in this case.
It seems to me that while sentiments and opinions may lean toward granting more privacy protections to data stored online, the law today isn't there yet.
They do need a subpoena to access your data on AWS, they do not when they are just sniffing it off the wire en masse as it passes thru a third party system. Kind of like you not having privacy when you mail a postcard and expecting that no one should read it.
Also the NSA wouldn't be subpoenaing data from amazon anyway it would be someone like the FBI in this case.
