Cloud computing services are convenient but pose risks for consumers
Current trends will make it easier to bypass providers, and own your own data again
Digital Consumers by Dr Jeremy Malcolm
UNLESS they work in the tech industry, most consumers have at best a vague idea of what cloud computing actually is, and may be surprised to learn that they probably make use of it every day.
Most non-commercial end-users run their email software from a web browser, and many also manage their photo collection with Facebook or Flickr, or may use Google Docs when they need to edit documents when away from home.
So just because cloud computing may not be a household word doesn't mean that consumers' rights aren't deeply impacted by the shift of IT services to the cloud.
ACCAN, the Australian Communication Consumers Action Network, developed a position statement last year which provides a good overview of the potential risks that the cloud introduces for digital consumers.
Amongst eight points mentioned are:
Interoperability – It should be easy to transfer data from one service to another. Consumers must be able to alter, transfer or completely delete their data on request.
Ownership – Data uploaded to cloud services must remain the property of the user. Services should not use or allow secondary parties to use data without specific opt-in consent from the user.
Privacy – Services should respect a user’s right to privacy and follow international best practices in data protection.
Security – Services must maintain sufficient security measures to protect information stored within and transferred between the user and the cloud.
Transparency – As a matter of best practice, cloud services provided to Australian consumers should be subject to Australian laws including laws relating to data protection, consumer protection, contracts and law enforcement.
The Australian Government last year proposed a voluntary cloud computing protocol that would require disclosure of information relevant to these risks by cloud providers, such as those highlighted above – though as ACCAN points out, it would do nothing to specify what minimum standards those providers should be adhering to in the first place.
Also, since this work on consumers and cloud computing began, the environment in which cloud services operate has changed dramatically with the revelations by Edward Snowden that consumers' communications over cloud services have been systematically and indiscriminately mined by national surveillance agencies such as the US National Security Agency (NSA).
In this new context, will consumers who are concerned about the privacy and security of their data be consoled by the existence of a voluntary protocol – especially one developed under the auspices of the Australian Government, which is itself a partner of the NSA in the Five Eyes partnership of national surveillance agencies?
Escaping the cloud
Many of the digital consumer activists with whom I work are taking matters into their own hands, and making the move away from centralised cloud-based applications and platforms.
For some of them, this means moving to smaller hosted services like those provided at riseup.net, which provides webmail, mailing lists, virtual private networking (VPN), chat, and etherpad (online note-taking software).
This platform and others like it run on free and open source software, that is written and supported by a community of developers, rather than by a company like Google or Microsoft.
Besides the services mentioned above, open source software also powers a variety of other alternative Web platforms, including photo and video hosting services such as Trovebox and EngageMedia (pic), social networking websites such as Diaspora and GNU Social, and blogging platforms such as Wordpress and Ghost, amongst a wide range of others.
Admittedly, shifting from (say) Gmail to Riseup isn't really escaping the cloud – it's just moving from a large cloud service provided by Google, to a smaller one maintained by a group of volunteers.
If you trust Riseup more than you trust Google – or perhaps more pertinently, if you assume that Google is more vulnerable to surveillance or attack (which is not necessarily a safe assumption) – then this may make sense for you.
But if you really want to break free of the cloud, you need to go further and actually run your own version of the software that powers the above websites.
In that way, you can maintain control of your own email, blog and photos, because you control the software that makes them available on the Net.
How to do it
So how can you actually run your own cloud software? Unlike most software that consumers are familiar with, you generally can't run cloud software on your own desktop or notebook PC; it has to be installed on a server, which is simply an always-on computer with an IP (Internet Protocol) address that is accessible from the Internet.
The easiest way to get your own server is to hire a virtual private server or VPS, which starts from about the price of a weekly Starbucks coffee. Many virtual servers come with a web-based control panel that allows you to install common email, blogging and hosting software with a single click, without the need to learn how to use the underlying operating system.
The service provider can also help you to attach a domain name to your server, which will give your email and website a custom home on the Net.
Even the virtual server option may be seen as a bit of a compromise, because virtual servers are themselves a cloud service (infrastructure as a service). So for the ultimate in cloud-independence, you'll want to set up your own server on a spare home or office PC, and to install the software there.
This can be an inexpensive option – the software itself is free, and if you have a spare PC and an always-on Internet connection, the hardware and network access might come free too.
However the expense comes in the time that you'll need to spend in learning how to set the software up by yourself. If you wish to pursue this option and are not a hardcore geek, you might be better off paying an expert a couple of hundred dollars to set up your home server for you.
But this is slowly changing, with a new generation of web-based software that will be as easy to install as desktop software.
An example is the crowdsourced open source webmail software Mailpile, which entered alpha testing earlier this year. It offers a similar experience to Gmail, but is designed to keep your email on your own PC rather than on a third-party server.
Mailpile also makes end-to-end encryption easy, with fully-integrated support for the PGP encryption standard. Though it's not ready yet, Mailpile aims to eventually be a one-click install on any PC or Mac.
Next page: What the future holds, and raising awareness