What is the cloud, and who can access your data?

Module 1: Why a European cloud? · Reading time: 10 minutes

Learning objective: After this lesson, you can explain what "the cloud" is, which parties can access your data, and why the location of the datacentre isn't the whole story.

Key concepts: cloud, SaaS, PaaS, IaaS, provider, datacentre, jurisdiction, administrator access, encryption in transit, encryption at rest, end-to-end encryption, key management

The cloud is someone else's computer

"The cloud" sounds like something vague floating above us. In reality it's very concrete: your files, mail and calendar sit on computers (servers) belonging to another company, in a building full of servers: a datacentre. You rent a small part of those computers and use it over the internet.

Take Bakkerij De Korrel, a bakery with twelve staff and the domain name example.com. The owner, Sanne, has used a well-known package from a large American tech company for years: mail at info@example.com, a shared calendar for the delivery routes, recipes and quotes in online folders, and a chat with the staff. That works fine. But Sanne doesn't actually know where that data is stored, or who can access it.

Three types of cloud

You'll come across three abbreviations. The difference lies in how much the provider arranges for you:

This course is mainly about SaaS: the services a small organisation uses every day. With SaaS, the provider arranges almost everything. That's convenient, but it also means the provider holds almost everything in its hands.

Who can access your data?

When your data sits with a cloud service, more parties can, in principle, access it than just you:

1. You and your colleagues, with your accounts. And anyone you share something with.
2. The provider: administrators who maintain the systems, support staff who help you, and automated systems (for example spam filters or virus scanners) that read your data to do their job.
3. Parties the provider brings in: the datacentre, a company that handles support in another country, a backup supplier. These are called sub-processors (lesson 1.2 and 9.2).
4. Governments: police, judicial authorities and intelligence services of the country the provider falls under, where the law allows it. You can read which laws are involved in lesson 1.3.
5. Attackers, if security falls short or someone gets hold of your password.

You largely arrange points 1 and 5 yourself, with good passwords and two-factor authentication (2FA) (lesson 7.3). Points 2, 3 and 4 depend on the provider you choose. That's what this course is about.

Why the datacentre isn't the whole story

Many providers now say: "Your data is located in Europe." That's good, but it's only part of the answer. There are three layers:

• Where is the server? The country of the datacentre. This determines, for example, which police force can physically access the machine.
• Who is the provider, and who owns it? A company falls under the law of the country where it's established. If the European provider is a subsidiary of an American company, an American court can order the American parent company to hand over data that it has "in its possession", even if that data is stored in Europe.
• Who holds the key? If the data is encrypted, the question is who can decrypt it.

The word for "which law something falls under" is jurisdiction. A server in Frankfurt belonging to a company with a parent company in the United States therefore falls under two jurisdictions at once. In lesson 2.1 you'll learn five questions that help you work this out for any provider.

Encryption: three types, one key question

Encryption means making data unreadable to anyone without the right key. You'll hear of three types:

The key question is always: who manages the key? With encryption in transit and at rest, that's the provider. This is necessary, because otherwise the provider couldn't display your files in the browser, search them, or let you edit them in an online office. It also means: if the provider is legally required to hand over data, it is technically able to do so.

End-to-end encryption solves this, but costs convenience. Working on a document together in the browser, searching content and resetting a password often no longer work. And if you lose the key, no one is able to open your files any more. For most of a bakery's data, e2e isn't necessary; for a folder containing, say, personnel files, it can be worth considering.

What this means for Bakkerij De Korrel

Sanne lays it all out. Her mail, calendar and files sit with an American company. According to that company's website, the data is stored "in Europe". But the company itself falls under American law, and the company holds the keys. That's no reason to panic: nothing has gone wrong. But Sanne has no insight into who might be able to access it in future, and she has no influence over the rules. That's exactly the question this course addresses: do you want to keep it that way, and if not, how do you switch without losing anything?

It's important to say straight away: a European provider isn't automatically safer. A poorly secured European service is worse than a well-secured American one. It's about two things at once: good security and a jurisdiction whose rules you know and that can be reviewed by a European court.

This is explanation, not legal advice.

In practice: what this looks like at a provider

A provider should simply be able to answer these questions. At WebOké, for example, it's set out in the Nextcloud manual: the data is stored in two Dutch datacentres, traffic runs over https, the disks are encrypted, and anyone who wants to can turn on end-to-end encryption for a folder, along with the limitations that come with it. Other European providers have similar pages, often under names like "Security", "Trust centre" or "Privacy". If it's nowhere to be found, ask. A provider that can't tell you where your data is stored and who can access it is not a good choice.

Summary

• The cloud is someone else's computer: servers in a company's datacentre.
• With SaaS, the provider arranges almost everything, and therefore also holds almost everything in its hands.
• Besides you, the provider, its sub-processors, governments and attackers can, in principle, access your data.
• The location of the datacentre is one layer; the provider's place of establishment and ownership also determine which law your data falls under.
• With encryption in transit and at rest, the provider holds the key; only with end-to-end do you hold it, at the cost of some convenience.

Quiz

Exercise

Exercise A1.1: Where is your data now? Enter your own domain name (or one belonging to your organisation). The program looks up where your mail arrives (MX) and where your website is hosted (A/AAAA), and which network owner those IP addresses belong to. You fill in beforehand which company and which country you expect. Afterwards you compare.

Exercise E1.1: Who can get in? Choose one service you use daily (mail, storage or chat). Look up on the provider's website where the data is stored, which company the provider is and where it's established, and what type of encryption is used. Fill in the five parties from this lesson for that service.

Further reading

The steps in these articles apply to WebOké's services; with other providers it works in a similar way.

• Nextcloud manual 1.1: What is Nextcloud and what is a WebOké Nextcloud?
• Nextcloud manual 3.1: How does WebOké secure your Nextcloud?
• Nextcloud manual 3.9: End-to-end encryption: when to use it, and when not to
• WebOké manual 14.3: WHOIS, IP lookup and SSL checker
• NIST SP 800-145, The NIST Definition of Cloud Computing (definition of SaaS, PaaS and IaaS)