CSA Concepts of Sovereignty & Cloud User Rights

www.cloudsecurityalliance.org Copyright © 2012 New Zealand Cloud Security Alliance

Rizwan Ahmad

Chair Data Governance, CSA, CEO NZCSA, Senior Lecturer MIT

http://www.cloudsecurityalliance.org/

www.cloudsecurityalliance.org Copyright © 2012 New Zealand Cloud Security Alliance Copyright © 2014 Cloud Security Alliance New Zealand Chapter

Global, not-for-profit organization

Members

Over 49,000 individual members

200 corporate members

70 chapters worldwide

Established with the aim of bringing trust to

the cloud

30 research groups with 25 research

projects



Over 300 hundred members

Main focus is research in

Data governance

Privacy

Cloud Assurance

Cloud Auditing



Sir Winston Churchill



Preservation of sovereignty is a Noble

cause

Enshrined in constitutions, Legislation and

Patriotism

To preserve peace

To protect territory against the hostile elements

To protect its citizens

To guarantee freedom



Countries take various steps to preserve

sovereignty of the state without infringing

the rights of his/her own citizens through

Proactive actions

Reactive actions



Legal or not Legal?

Sovereignty of State

Reactive

Police Military

Proactive

Intelligence Agencies

Counter Operational



Government develops legislative measures

to enhance these agencies by National

security laws meant to protect citizen’s

Fundamental rights

Freedom

Democracy

Country





Various covert and overt operations are

under fire

These operations reflect national security

but overrides fundamental rights

(Globalization)

Operations take strength from legislation



These programs and legislations are not

new



Country National Security Laws Tolerance

USA Foreign Intelligence Security Act (FISA) PATRIOT ACT

Justifies PRISM Zero tolerance for Foreigners US Citizens safe

UK Regulation of Investigatory Powers Act

2000 section 22(2) Telecommunications Act 1984 section 94

Tempora Program targets Citizens and Non Citizens

Sweden Act 2008:717 on signals intelligence

within defence intelligence operations

Act 2009:966 on the Intelligence Court Decree 2009:968

Gathering information Has some weakness

France Code de la Sécurité Intérieure Book 2,

Title IV of this Code.

Anti-Terror Act 2006 CNCIS

Targeted surveillance Extends powers to gather telecom data directly from providers



Country National Security Laws Tolerance

Germany G-10 Law Warrantless automated wiretaps of

domestic and international

Communications

Netherlands Dutch Intelligence and Security Act 2002 Does not permit wiretap

European

Union

Directive 95/46/EC, Article 13

Exemption to data protection

European

Union

Convention for the Protection of

Individuals with regard to Automatic

Processing of Personal Data

Exemption in Article 9 and Article

16

International Convention on Cybercrime

Article 27 and 30



Country User Data

Requests

Percentage of

requests where

some data

produced

Users/Accounts

Specified

Total > 27477 64% > 42648

United States 10,574 83% 18,254

France 2,750 51% 3,378

Germany 2,660 40% 3,255

India 2,513 66% 4,401

United Kingdom 1,397 69% 3,142

Brazil 1,085 49% 1,471

Italy 896 42% 1,084

Australia 780 70% 944

Singapore 755 68% 847

Spain 545 53% 761

Poland 502 23% 740


https://www.google.com/transparencyreport/userdatarequests/US/

https://www.google.com/transparencyreport/userdatarequests/FR/

https://www.google.com/transparencyreport/userdatarequests/DE/

https://www.google.com/transparencyreport/userdatarequests/IN/

https://www.google.com/transparencyreport/userdatarequests/GB/

https://www.google.com/transparencyreport/userdatarequests/BR/

https://www.google.com/transparencyreport/userdatarequests/IT/

https://www.google.com/transparencyreport/userdatarequests/AU/

https://www.google.com/transparencyreport/userdatarequests/SG/

https://www.google.com/transparencyreport/userdatarequests/ES/

https://www.google.com/transparencyreport/userdatarequests/PL/


Survey on PRISM



56% 31%

10%

3%

Survey 207 responses

Less

No impact

Cancelled

More



47%

32%

11%

10%

Survey Results of 440 responses

Poor

Fair

No Idea

Excellent



36%

64%

Survey Results 220 responses

Yes

No



41%

46%

13%

Survey Results 423 responses

Patriot Act Repealed

Patriot Act Modified

Patriot Act is Fine



91%

9%

Survey Results 438

Yes

No



User rights are aggravated by

Lack of transparency manifested by the cloud

service providers and governments

Inadequate cloud security standards

Evolving nature of cloud computing

Risks

Jurisdictional laws and conflicts



Universal principles



Article II 3(b), (c), (d) and (e) United Nations

Guidelines for Consumer Protection

(b) The promotion and protection of the economic

interests of consumers;

(c) Access of consumers to adequate information to

enable them to make informed choices according to

individual wishes and needs;

(d) Consumer education, including education on the

environmental, social and economic impacts of

consumer choice

(e) Availability of effective consumer redress.



Transparency

•What information is disclosed by CSP

Legal Protection

•What legal protection is offered?

Compliance

•What standards and laws?

Accountability

•How grievance is addressed?

Cloud Governance



Right to know reforms…..

Disclosure of information to inform cloud

user that impact his data rights related to

Jurisdiction

Legal issues

Data protection laws

Compliance to relevant policies, law enforcement

Redress, complains



Assess legal and jurisdictional risks

Contracts must be enforceable

Flexible contracts to allow cloud user

requirements

Choice of court

Arbitration

Ensure data protection under cloud user

laws



Cloud Service provider displays compliance

to

Relevant provisions of laws

Security standards, best practices

Legal protection not to show data to third party

Transparency, legal protection and compliance to

standards show accountability



Cloud service provider displays information

to show

Accountability processes

Breach of security

Electronic dispute resolution

Liability

Choice of court



Four Elements

Transparency

ISO 27001 CCM

SSAE 16 SOC2 Type 2/ ISAE 3402

STAR Registry (CAIQ, CCM)

Disclosure of laws

Breach notification

Legal Protection

Choice of court

Flexible contracts

Enforceable contracts

Compliance

Standards

Contracts

User laws

Accountability Liability

Dispute resolution



Foundation for data governance

Need your cooperation to build strong

research

Presenting a proposal for new standards

on data sovereignity



[email protected]

Join Hands for Cloud and

Cyber Security to Secure

Community



Thankyou


Technology

CSA Concepts of Sovereignty & Cloud User Rights