1. Vaciago, CybercrimePage: 1 CLOUD COMPUTING WORKSHOP LEGAL ASPECTS OF THE CLOUD Brussels, March 1, 2012 Prof. Dr. Giuseppe Vaciago

2. US PATRIOT ACT The Patriot Act is extraterritorial in application (Section 215 and Section 505). Under this Act, U.S. authorities are entitled to subpoena business records from any company that has: i.“minimum contacts” with the U.S. ii “possession, custody or control” of the targeted data Page: 2 Vaciago, Cybercrime The Director of the Federal Bureau of Investigation or a designee of the Director (whose rank shall be no lower than Assistant Special Agent in Charge) may make an application for an order requiring the production of any tangible property (including books, records, papers, documents, and other items) for an investigation for protecting against international terrorism or clandestine intelligence activities, provided that such investigation of a United States person is not conducted solely upon the basis of activities protected by the first amendment of the Constitution [...] Patriot Act, Sec. 215. Access To Records And Other Items Under The FISA

3. IS IT A DATA PROTECTION ISSUE ? “The Data Protection directive shall not apply to the processing of personal data or in any case to processing operations concerning public security, defence, State security and the activities of the State in areas of criminal law” (Art. 3 Directive 95/46/EC) Recent proposal for a Directive on the protection of individuals with regard to personal data by competent authorities for the purpose of detecting criminal offences shall not apply in the course of an activity which falls outside the scope of Union law, in particular concerning national security (Art. 1, 2b) Page: 3Vaciago, Cybercrime

4. EU POSITION – AUGUST 2011 August, 23, 2011, Vivian Reding (E- 006901/2011 – Answer to parliamentary question): “In accordance with international public law, and in the absence of a recognised jurisdictional link, a foreign law or statute cannot directly impose legal obligations on organisations or undertakings established in a third country regarding the activities performed within the territory of that third country” Page: 4Vaciago, Cybercrime Viviane Reding - Vice-President of the European Commission

5. IT IS A JURISDICTION ISSUE Territorial principle: the Court in the place where the data is located has jurisdiction. Nationality principle: the nationality of the perpetrator is the factor used to determine criminal jurisdiction. “Flag” principle: crimes committed on ships, aircraft and spacecraft are subject to the jurisdiction of the flag state. “Power of Disposal Approach”: Law enforcement would only have to legally obtain username and password of the suspect’s computer. Page: 5Vaciago, Cybercrime Jan Spoenle (Germany) for the Economic Crime Division of the Council of Europe

6. EU COMPANIES “CloudSigma is operated and controlled by a Swiss AG, which is not subject to direct or indirect U.S. control” “City Cloud and Several Nines offer a partnership safe-haven from the Patriot Act in Sweden” Amazon Web Services (AWS) is subject to the US Patriot Act but the chief technology officer, Werner Vogels, encrypts private data for transit to the Cloud — and for employing best practice when it comes to classifying data Page: 6Vaciago, Cybercrime

7. NON-US NATIONAL SECURITY LAWS French Act No. 2011/267 of 14 March 2011 on the prevention of International terrorism Spain Act No. 12/2003 of 21 March 2003 on the prevention of terrorism financing Italy Act No. 144/2005 of 27 July 2005 on the prevention of International terrorism Canadian Anti-Terrorism-Act No. C-36 18 December 2001 seems to grant powers similar to those of the Patriot Act Page: 7Vaciago, Cybercrime

8. JURISDICTION – YAHOO! CASE In 2009, the US- based company, Yahoo, was imposed a fine by a Belgian Criminal Court for failing to identify the users of a number of webmail accounts This judgment was overturned by the Court of Appeal of Ghent in 2010 In January 2011, however, the Belgian Supreme Court reversed the Court of Appeal’s decision In October 2011, the decision was referred back to the Court of Appeal which decided that Yahoo! was not subject to Belgian jurisdiction Page: 8Vaciago, Cybercrime

9. EU POSITION – DECEMBER 2011 December 6, 2011 Vivian Reding - 2nd Annual European Data Protection and Privacy Conference - Brussels: “I am reading in the press about a Swedish company whose selling point is that they shelter users from the US Patriot Act and other attempts by third countries to access personal data” “Well, I do encourage cloud computing centres in Europe, but this cannot be the only solution. We need free flow of data between our continents. And it doesn't make much sense for us to retreat from each other” Page: 9Vaciago, Cybercrime

10. CONCLUSIONS The real issue with Cloud computing is a loss of data location due to: (i)“Data at rest” does not reside on the device. “Data in transit” cannot be easily analyzed because of encrypting all traffic. “Data in execution” will be present only in the cloud instance (ii)Virtualization and cloud communication protocols. The investigator who wants to capture the bit-stream data of a given suspect image will be in the same situation as someone who has to complete a jigsaw puzzle, whose pieces are scattered randomly across the globe Page: 10Vaciago, Cybercrime

11. CONCLUSIONS Terrorism and Cyber-terrorism represent a very serious global threat and operate on a transnational basis out of necessity Over 11,500 terrorist attacks occurred in 72 countries in 2010, resulting in approximately 50,000 victims, including almost 13,200 deaths The number of attacks rose by almost 5 per cent over previous year Page: 11Vaciago, Cybercrime NATIONAL COUNTERTERRORISM CENTER 2010 REPORT ON TERRORISM 11064 ATTACKS IN 2010

12. CONCLUSIONS The Patriot Act has been copied in many countries, including Canada, with rules that are not that dissimilar to the American ones The Canadian Anti-Terrorism-Act (ATA), shortly after September 11, 2001, was combined with the National Defense Act (NDA) giving a Minister (Defense) the power to authorize investigation of data storage at home and abroad Page: 12Vaciago, Cybercrime The Minister of Defense’s authorization is required for the Communications Security Establishment to intercept foreign communications targeted against a non- Canadian abroad that may have a Canadian connection, or to undertake security checks of government computer networks to protect them from terrorist activity [...] Anti-Terrorism-Act (Review of 2004) Canadian Department of Justice

13. CONCLUSIONS Without referring to Cloud computing, everyday, the transactions of millions of users using credit cards with U.S.- based providers are monitored. Section 326 of the US Patriot Act requires all financial institutions (this includes Credit Card processing companies) to obtain, verify and record information that identifies each person who ‘opens, changes or charges’ an existing account. Page: 13Vaciago, Cybercrime The regulations shall, at a minimum, require financial institutions to implement, and customers (after being given adequate notice) to comply with, reasonable procedures for: (a) verifying the identity of any person seeking to open an account to the extent reasonable and practicable; (b) maintaining records of the information used to verify a person’s identity, including name, address, and other identifying information; and (c) consulting lists of known or suspected terrorists or terrorist organizations provided to the financial institution by any government agency […] Patriot Act, Sec. 326. Verification of Identification

14. CONCLUSIONS Without referring to Cloud computing, projects relating to face recognition are increasingly making it possible, and with ever greater reliability, to track a person's movements, even globally. 3 factors are important: (a)Increasing public self ‐ disclosures through online social networks (2.5 billion photos uploaded by Facebook users alone per month in 2010) (b)Identified profiles in online social networks (c)Improvements in face recognition accuracy * * A. Acquisti, Faces Of Facebook - Or, How The Largest Real ID Database In The World Came To Be Page: 14Vaciago, Cybercrime

15. CONCLUSIONS Even if the goal of the Digital Due Process is review of the ECPA, it may represent an excellent solution to the tension between due process and civil liberties around the world 3 important guidelines: (i) Technology and Platform Neutrality (ii) Assurance of Law Enforcement Access and (ii) Equality Between Transit and Storage However, I believe it should have a strong EU identity, as this is of crucial importance for ensuring greater EU-US co-operation in this scheme, too Page: 15Vaciago, Cybercrime

16. Page: 16 Cybercrime Research Institute Giuseppe Vaciago Niehler Str. 35 D-50733 Cologne, Germany vaciago@cybercrime.de www.cybercrime-institute.com Vaciago, Cybercrime