In fact, government access to data in clouds could be blown wide open if the FBI gets its way in passing certain legislation. But that could be in the future. For now, actually, the workloads running on Platform-as-a-Service (PaaS) and Infrastructure-as-a-Service (IaaS) clouds could be harder to get at than data inside higher-level consumer-cloud services and Software-as-a-Service (SaaS) applications.

SaaS customers concerned

Elad Yoran, CEO of cloud-security startup Vaultive, said he has fielded “dozens and dozens and dozens” of inquiries since the PRISM news hit about how companies using SaaS programs can protect their data.

“I don’t think there’s a company out there that will consider Google or Office 365 without asking themselves the question about unauthorized — from their perspective — disclosure to the government and whether they’re willing to take the risk that their data is sitting unencrypted in a database, out of their control,” Yoran said.

Yoran isn’t sure just how much the use of such services — or any public cloud, for that matter — will fall off and go back on premise, but it’s clear to him that companies are thinking about these issues now. He recommends the companies using SaaS applications keep their data encrypted when it’s in transit, at rest and in use.

The thing about SaaS is that companies sign up to run on them, and the SaaS providers — take Google with its email, for example — can just provide access in response to government requests without needing to consult with the customer. In fact, the PATRIOT Act specifically prohibits speaking up about these requests.

Why IaaS is different

Compare this with PaaS or IaaS, and the situation is different. Narrowing down to the virtual machine the data about an individual end-user federal agents want to learn about could be quite a task, if it is even possible. “In the Infrastructure-as-a-Service space it’s not possible,” said Jason Hoffman, chief technology officer at IaaS provider Joyent. “It couldn’t even provide a data feed on the backend that exposes people’s data. It just doesn’t work that way.” To put it another way, AWS doesn’t know what’s happening on its servers and doesn’t have access to those virtual machines any more than Hewlett-Packard knows how a customer is using its Moonshot servers.

There’s also a legal element to this. The third-party doctrine lets the government ask a SaaS company such as, say, Pinterest for information on end users, but when the SaaS app is running on hardware owned by an unrelated cloud provider, such as Amazon Web Services (AWS), the government can’t get that same data directly through AWS.

Regardless of whether these data grabs can and do happen, the idea of it happening might be enough to scare off cloud customers and strengthen the story for on-premise infrastructure. As my colleague Derrick Harris noted earlier this week, in an increasingly cloudy business world that might not be the best thing for the economy.

While companies have been experimenting with development and testing work and some larger workloads on IaaS from AWS and other providers, complete dependence on public-cloud infrastructure is still way off, and the PRISM news puts more of a damper on the use of it, said Luke Kanies, founder and CEO of Puppet Labs.

“When I talk to customers about why they don’t use public cloud, … a lot of it is fear,” Kanies said. That fear often stems from uncertainty on legal and other implications of processing and storing data on shared infrastructure. And uncertainty on public cloud translates to staying on premise.

This argument applies not only to companies based in the United States; those based elsewhere surely will want to dodge the sort of data mining that U.S. intelligence agencies apparently conduct.

“Nearly every other country in the world is working hard to prevent its citizens’ data from being given to the NSA,” Kanies said. The European Union’s data-protection rules are a case in point, and the PRISM revelations will only fuel the fire on this front.

Altogether, Kanies said, “I would go so far as to say I would expect to see much lower adoption of public infrastructure owned by American companies. My guess is Europe is not going to trust American companies at all, regardless of whether it’s going to be hosted here or not.”

Kanies isn’t alone in expressing these sorts of sentiments. GigaOM Research Analyst David Linthicum in recent days predicted blowback on the international front, too:

The rise of cloud computing in the European Union will see the greatest impact on this scandal. The group is already suspicious of the U.S. government’s power to either monitor or outright seize their data. While there may not be any direct logical connection behind the perceived risk, the truth is people often make decisions, such as moving to the public cloud, based on feelings as much as facts.

Just another talking point

Then again, the news on PRISM might turn out to be nothing more than another proving point for public-cloud naysayers to exploit, bringing minimal actual impact.

Mark Thiele, executive vice president of data center technologies at colocation and cloud provider Switch, doubts the PRISM news will affect the total market opportunity of public-cloud use by any more than 3-5 percent. And that estimate might be generous.

“Those people that are convinced that the public cloud is the right place to do certain things in are going to continue to do it, and it’s (the PRISM program’s existence) not going to scare anyone away,” Thiele said. The difference in expenditures speaks for itself, and concerns about keeping data out of the government view won’t necessarily outweigh the financial and operational benefits of running in public or even hybrid clouds.

Private-cloud snooping

The gee-whiz factor that could throw off this whole equation is what the U.S. government might do to guarantee access to company data, including that which is kept on premise, in the future.

The FBI has thought about mandating forced access to encrypted data as part of an enhancement of the Communications Assistance for Law Enforcement Act, the New York Times reported last month.

Should that come to pass, there’s a chance data kept behind a firewall in an on-premise data center would become much easier for the U.S. intelligence community to access, said Eva Galperin, a global policy analyst at the Electronic Frontier Foundation.

“Depending on how the legislation is phrased, yes, it would be (possible),” Galperin said. “It would be tremendously dangerous. It would be the end of private internet communications.”

For now, it looks like the legislation might not go that far. Rather, an expansion of the act would ask companies for assistance in relinquishing data to the federal government or impose fines.

That climate could have long-term effects, not only on the growing shared-infrastructure camp but on others, too. Entrepreneurs could move abroad, so they don’t have to comply with such stringent regulations in the name of national security. They would rather build great products quickly than devote lots of staff time to compliance.

The political question in the end is whether national security outweigh economic and technological advancements.

Feature image courtesy of Shutterstock user Bruce Rolff.

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

• A near-term outlook for big data
• Cloud computing 2013: how to navigate without a map
• PaaS market accelerators, 2012–2013

Can your dog help advance the Internet of Things? Ben Jacobs of Whistle thinks so and explains to Stacey Higginbotham how vets, researchers and pet owners can take advantage of data from devices worn by pets.

Lastly, our GigaOM Weekly Wrapup podcast recaps seven years of blogging as GigaOM celebrates another birthday. There’s more information on the PRISM saga and even a little gaming news: Did Sony turn the tables on Microsoft at this year’s E3 gaming convention?

(Download the GigaOM Chrome Show)

(Download the GigaOM Internet of Things podcast)

(Download the GigaOM Weekly Wrapup podcast)

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

• CES 2012: a recap and analysis
• The future of mobile: a segment analysis by GigaOM Pro
• Connected consumer first-quarter 2013: Analysis and outlook

Bearing the rather clunky name of “Office Mobile for Office 365 subscribers”, the app does require a subscription to Microsoft’s cloud service, but the fundamentals are present: you can use it to access, view and edit Word, Excel and PowerPoint documents on an iPad or iPhone — although the app is optimized for the iPhone 5, so don’t expect a tablet-friendly experience.

According to the product blurb:

“Documents look like the originals, thanks to support for charts, animations, SmartArt graphics and shapes. When you make quick edits or add comments to a document, the formatting and content remain intact.”

The app can be used on Office documents received as email attachments, or those stored on SkyDrive, SkyDrive Pro or SharePoint. If your desktop Office 2013 is connected to Microsoft’s cloud, you can also pull up documents that were recently viewed there, from your mobile device.

It is possible to edit documents while offline. The app is compatible with iPhone 4 and up, and with the 3rd generation iPad and up (and yes, with the iPad mini too). Devices have to run iOS 6.1 or later.

It doesn’t seem the rollout is global just yet, though. My iPad mini, which is set to the U.K. App Store, isn’t seeing it at the time of writing. No sign of an Android version, either.

UPDATE (5am PT): Microsoft has now published a blog post explaining the functionality in greater detail.

NOTE: This article originally bore the headline “Microsoft quietly pushes out Office for iPhone and iPad”. A few minutes after posting the “… and iPad” was excised because, while the app will work on iPads, it’s not optimized for them.

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

• Analyzing the wearable computing market
• The connected planet: Smartphones aren’t the only player
• A Media Tablet Forecast, 2011 – 2015

So, in theory, apart from having advance notice to patch their own systems, those agencies could exploit that zero-day vulnerability to hack into your data, before Microsoft gives you a chance to patch the flaw. And it’s not just Microsoft. According to the report, “thousands of [U.S.] technology, finance and manufacturing firms” are closely aligned with American national security agencies, passing them information such as vulnerability details and hardware and software specifications, and giving them access to overseas facilities and data.

In return, Bloomberg claims, the agencies give the companies information about foreign attacks on their systems. Google is cited as an example of this, with Sergey Brin allegedly having been invited to sit in on a secret intelligence briefing after an attack by Chinese hackers in 2010. Of course, the companies aren’t the only sources of useful flaws — security expert and activist Christopher Soghoian detailed late last year how some security researchers sell vulnerability information to governments for large sums of cash too. “This is the [U.S.] government buying a flaw without the intention of fixing it,” Soghoian explained in his Harvard University presentation. (Thanks to Jeff Ausloos for alerting me to that one.)

Backbone hacking

The Bloomberg report also notes claims recently made by NSA leaker Edward Snowden that the U.S. hacks network backbones in China and Hong King. Although the evidence for this “Blarney” program appears scantier than that for PRISM, the gist is that the scheme captures metadata from internet-connected devices such as computers and smartphones around the world, including OS version, Java software version and browser. Again, this would make it easier for the agencies to target and hack such devices.

On the domestic front, the piece also claims a security system called Einstein 3, which is meant to protect U.S. government systems, can “expose the private content of the emails under certain circumstances.”

Who’s the customer?

But it’s the claims about U.S. tech vendors and their apparently voluntary information exchange with the country’s spy agencies that will most bother governments and their public sector organizations around the world.

Microsoft spokesman Frank Shaw seemingly confirmed this cooperation in the Bloomberg article, saying the early release of vulnerability information helps to give the U.S. government an “early start” in protecting its systems. Other “trusted partners” reportedly include Intel’s security business McAfee, which apparently acts as a consultant of sorts to spy agencies wanting to know more about network architectures around the world.

There’s no suggestion that any of this data-sharing is illegal – but for many governmental customers around the world it will suggest that their vendors have undisclosed interests that don’t align with their own. For some in the U.S. tech industry, these revelations may turn out to be as damaging as PRISM, if not more so.

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

• In Q3, Big Data Meant Big Dollars
• Connected consumer first-quarter 2013: Analysis and outlook
• Cloud and data first-quarter 2013: analysis and outlook

For now, the companies are prohibited from releasing such information.

It’s clearly a PR offensive on behalf of the web and software giants, hoping to distance themselves from revelations that the three companies and others have participated in the FBI and National Security Agency’s PRISM program first reported last week.

It’s still unclear just how the program gained access to external data and what participating companies have done to enable this sort of access. But regardless of that, the perception of complicity is something Google and the rest must fight. Whether or not the federal government complies with requests for more transparency almost doesn’t matter. The companies need to at least look like they want to shed light on their involvement and the extent of the data mining. And the letters achieve that goal.

Feature image courtesy of Shutterstock user ARTSILENSE.

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

• Content monetization: News licensing and syndication still need marketplaces and infrastructure
• Where the next-generation console fits in today’s video game market
• How consumer media will change in 2013

There has been a free tier of the AWS service for Amazon Machine Images (AMIs) running Amazon Linux or other “unpaid” versions of Linux for some time, but SUSE and Red Hat did not fall into that category. Now Red Hat Linux, which has become the Linux standard for most corporations, is part of the free tier. Users can get 750 hours of free Red Hat usage, but here’s some fine print: 

These free tiers are only available to new AWS customers, and are available for 12 months following your AWS sign-up date. You will not be eligible for the Offer if you or your organization create(s) more than one account to receive additional benefits under the Offer or if the new account is included in Consolidated Billing. You will be charged standard rates for use of AWS services if we determine that you are not eligible for the Offer.

It will be interesting to see if this move shifts the composition of operating system share on EC2. According to the Cloud Market, Ubuntu makes up over half of all AMIs running in AWS. “Other” Linux,which is presumably Amazon or other unpaid Linux, is at 23.2 percent; Windows at 8.4 percent and then there’s Red Hat at 5 percent (see chart).

This just the latest example of cloud coopetition. Red Hat is working on its own flavor of an OpenStack cloud, still in preview but likely to become generally available this week at the Red Hat Summit. It is tailored for enterprise users and would challenge AWS for those the enterprise workloads that Amazon so clearly wants.

There may be a micro battle raging between the various flavors of Linux but the war lies ahead  as companies from Amazon, IBM, Microsoft, HP and Red Hat fight to make their respective clouds the destination for corporate workloads.

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

• Cloud computing infrastructure: 2012 and beyond
• Infrastructure Q1: Cloud and big data woo enterprises
• Amazon’s DynamoDB: rattling the cloud market

This tidbit comes courtesy of app developers, who of course are now able to play with the preview of iOS 7 ahead of its consumer launch later this year. A Yandex spokesman subsequently confirmed the inclusion to me.

Here are tweets from devs in Russia:

Яндекс в iOS7 http://t.co/wnJMn2bqWr—
ʎɐsʇɐd ʎdɯnɹƃ (@alexmak) June 11, 2013

… And Turkey:

iOS 7 supports yandex search on Safari

@YandexComTr @yandex @YandexDestek http://t.co/0zCwTU5Oj2—
Bahaeddin Nakiboglu (@bahaeddin) June 10, 2013

Turkey is a particularly big win for Yandex, which is pushing hard into that country. As for the company’s more traditional markets, the inclusion of Yandex search as an option in Safari could even be seen as belated – the company has a majority share of the Russian search market, and a few months ago it even ranked higher than Microsoft’s Bing for numbers of searches on a global basis.

Yandex has already been supplying data for local users of Apple Maps since September last year.

Around the world, Google is the default search option for Apple’s customers. Bing and Yahoo are also global options. Not many local players get to join that list – although China’s Baidu is a notable exception in that country.

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

• The future of mobile: a segment analysis by GigaOM Pro
• Siri: Say hello to the coming “invisible interface”
• Takeaways from mobile’s second quarter

Companies such as Google, Facebook and Apple all claimed this week that they had never heard of a National Security Agency program called PRISM that reportedly gave intelligence analysts access to all kinds of personal data stored on the servers of the largest internet companies on the planet. But while the NSA may not have shared the code name for the project, first disclosed in reports from The Washington Post and the Guardian Thursday, “the companies were essentially asked to erect a locked mailbox and give the government the key,” the Times reported, citing “people briefed on the negotiations” between tech companies and the government. And while companies “bristled” at the request, they acquiesced.

Facebook — whose founder, Mark Zuckerberg, slammed what he called “outrageous press reports” in a statement Friday — actually built a system for the NSA that allowed it to securely transmit data to the government if requested under the FISA law, according to the report. It’s not clear what any of the other companies named as having negotiated with the government — Apple, AOL, Google, Microsoft, Paltalk and Yahoo — may have done to facilitate access to user data.

The companies’ carefully worded denials were likely constructed because the employees tasked with carrying out these systems “are not allowed to discuss the details even with others at the company, and in some cases have national security clearance,” the report said.

Twitter, which many noted was conspicuous in its absence from the list of companies named in the original reports, reportedly declined to provide the federal government with any assistance in getting access to user data in response to legal requests. “While handing over data in response to a legitimate FISA request is a legal requirement, making it easier for the government to get the information is not, which is why Twitter could decline to do so,” the report said.

Our tracking page on the unfolding PRISM story has a thorough explanation of the background to this report.

This post was updated at 11:43pm with the correct name of the NSA, the National Security Agency.

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

• The state of cross-platform media measurement
• Q4 Wrap-up: SOPA and the future of digital content
• Connected world: the consumer technology revolution

That’s the million dollar question that a group of about 100 people, including Vice President Al Gore and Google Chairman Eric Schmidt, tackled at a Google event this week. It’s also the question that I’ve spent about six years thinking about as I’ve written about the evolution of cleantech innovation and how digital technologies can drive efficiency.

The rub of the internet is that it is a collection of data centers filled with computing gear, networks that weave across continents, and a growing amount of battery-powered devices; all of these things need energy to operate. The disturbing part is that the energy consumption of the internet will only grow as the population hits 9 billion in 2050, and all of these people get connected to the internet.

But on the flip side of that energy suck is the idea that the internet can make processes and systems significantly more energy efficient, from transportation to shopping to the electricity network itself. Sustainability wonks call that dematerialization, or replacing atoms with bits. A study called Climate 2020 found that information and communications technology could reduce greenhouse gas emissions from other sectors of the economy, below business-as-usual growth, by 15 percent.

Other than that seminal report, there’s been a trickle of research that has reached conclusions along the lines of the notion that buying digital music online is a lot more energy efficient than driving to the store and buying a CD. Data center energy guru Jonathan Koomey, who’s a research fellow at the Steyer-Taylor Center for Energy Policy and Finance and Stanford University, has led a bunch of this research, particularly around how the trend toward cloud computing has increased the energy efficiency of the internet. The web sharing economy is another much talked about trend that is indirectly making the use of goods (like cars and apartments) more efficient.

But all of this research is so new, and these issues are so complex, that answering that question — is the internet green or not? — is a very difficult one. After the day long Google event called How green is the internet? I have a lot more questions than answers.

More good than bad

Throughout the day of Google’s event it became clear that there are significant gaps in knowledge and in research. One of the problems for researchers has been getting access to really detailed industry data. The leaders of the internet industry have only just started to think about these issues, and are slowly warming up to the idea of giving their energy data to third party researchers. Google only revealed its total electricity use publicly a year and a half ago.

But if you ask that direct question — does the internet have a more positive or negative effect on the environment — there’s some researchers who are already leaning toward the positive camp. Koomey said at the Google event that he thought the preoccupation with the electricity use of the internet was misplaced. The overall system effects are more important than the direct electricity use, said Koomey, noting “Moving bits not atoms can have a major effect on efficiency.”

A research fellow from the Center for Industrial Ecology at the University of Coimbra in Portugal, Vlad Coroama, echoed those thoughts at the Google event: “Sending bits is usually much more efficient than sending atoms.” Carnegie Mellon Professor Scott Matthews, who’s done research showing how e-commerce is more energy efficient than shopping at physical retail outlets, wondered if the introduction of digital goods and e-commerce could have such a large impact that it could reduce carbon emissions and energy use compared to the current physical processes by a factor of ten.

But the complexity of the internet as a system, and how it effects people’s behavior, makes calculating numbers around this very difficult. For example, the process of driving to the store to buy a physical book is clearly more energy intensive than hitting a button to buy a Kindle single on your Kindle. But then you also have to take into account more complex questions like the embodied energy of making the Kindle, and the idea that when consumption is so easy and efficient, you might buy and download exponentially more e-books.

Throughout the day at Google, many noted, like Google’s Urs Hoelzle, senior vice president of technical infrastructure, that problems and opportunities need to be looked at from an entire systems perspective. Looking at just one aspect of the equation doesn’t give the entire picture. A couple people at the event also noted to me that one of the universities or research centers should be acting as more of a research hub for this type of data.

Even some of the data that is out there is difficult to prove. Professor Coroama’s number — that it takes an average of 0.2 kWh/GB to send data across the internet — was head-scratching to some, and several people noted to me that the number seemed high.

Then there’s the soft effects of the internet on the planet that don’t have to do with energy consumption at all. The high level visionary speakers — both Gore and Schmidt — focused more on the internet’s ability to open up access to information and organize people, which could be used for environmental, and climate-fighting, causes. Gore said that the digital revolution and the explosion of data are some of the most powerful tools that can be used to help solve the climate crisis. It’s hard to quantify such soft effects, but they could still be very powerful.

Keep it that way

The main issue now will be as internet access grows, mobile phones connected to the web proliferate and internet companies build ever more data centers, how does the industry maintain sustainable growth so that the equation doesn’t flip, and so that the internet doesn’t start to have a negative effect on the environment? There’s going to be 9 billion people on the planet by 2050 that could have a handful of connected devices each, and some of them will  be spending their lives immersed in digital data 24/7.

That’s exactly why I thought Google’s Summit was so important: As a way to shine a spotlight on the issue, address its complexity, and see how the problem can be solved as the internet grows. Essentially designing the growth of the internet with sustainability in mind. Google can be one of the leaders of this discussion, as can other internet companies like Apple, Microsoft, and Facebook in addition to hardware companies like Cisco, IBM, and Intel.

Going forward, I’d like to see a hub grow at a university or research center that can act as a collection point to draw together this type of research, and also to help validate it. I’d also like to see more mainstream attention on this topic of the intersection of the Internet and the environment. At the Google event, it was invite-only and had about 100 people that had been thinking about these topics for years. This topic is important enough that is needs more mainstream attention and discussion.

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

• Locating data centers in an energy-constrained world
• Ups and downs for cleantech in Q1
• How the mega data center is changing the hardware and data center markets

Facebook’s data center in Prineville, Ore

They all denied — in carefully worded ways — that they provided direct access to customer information. The source of the original story — ostensibly leaked NSA slides obtained by the Washington Post and The Guardian — indicated that the National Security Agency tapped directly into these company servers to get at customer meta data.

In a radio interview Friday on WBUR, Post reporter Barton Gellman said it’s more likely that the slide was poorly worded and that the NSA placed its own “black boxes” on vendor property next to the servers in question. Those black boxes could mirror the server and be queried as a proxy while giving those vendors plausible deniability if asked whether their own servers had been accessed.

Obviously, if that is the case it’s hard for vendors to plead ignorance to what was going on. But there are ways the government could harvest people’s Google and Facebook and other data without those vendors knowing.

First, they could eavesdrop on the HTTP traffic flowing over the internet — which is not usually encrypted. Or there could be a covert back door into these services themselves, something that Jon Oltsik, senior principal analyst at Enterprise Strategy Group finds hard to believe.

And, there have been reports that government agencies are indeed collecting data provided from internet service providers and telcos.  On Friday, The Wall Street Journal said that the NSA’s gathering data on Verizon customers, is just the tip of the iceberg. According to the Journal:

“… people familiar with the NSA’s operations said the initiative also encompasses phone-call data from AT&T Inc. and Sprint Nextel records from Internet-service providers and purchase information from credit-card providers.

Update: One security expert who did not want to be named becuase he does work for government agencies said if the NSA is doing what it does best — which is traffic analysis. This is stuff like who is talking to whom and for how long and when. “It is a kind of social network mapping … questions arise if there is a radio in an uninhabited jungle [or] when I call Djokar Tsarnaev at 1 a.m. or when one call comes in and one call goes out continguously,” he said via email.

If this is the sort of traffic analysis the NSA is doing — the default assumption — then there is “no requirement for the cooperation of the endpoints, only the carriers,” he said. In all internet-based TCP/IP situations, the communications are all multi-hop, and thus there is no need to surveil all possible paths, just the “must go through” paths,” he continued. “If I can listen one hop outside your firewall, then there is nothing you can do about it, you won’t know I am doing it, and to the extent that traffic analysis is sufficient for the surveillance team, the job is done.”

This is really key stuff. When you post updates to your Facebook page or Google Drive, that data typically flows unencrypted over the web. That data-in-transit could, in theory, also be intercepted at the routers directing traffic or at Content Delivery Network (CDN) points that optimize traffic flow. We just don’t know, because security agencies won’t say. But the upshot is, if the government is collecting that traffic, it truly does have a ton of information about everything you do, or at least everything you say. That is truly a sobering use of big data.

As we learned last year, it may well be compiling a full dossier on you (and everyone) which it’s storing in the no-longer-quite-so-top-secret giant NSA data center in Bluffdale Bluffton, Utah,

Beyond that, we probably won’t know the truth of what Google, Microsoft, et al. knew and if or how much they participated in snooping for years to come.

This story was updated at 4 p.m. PDT to correct the name of the town where the NSA data center is located and again at 9:14 a.m. PDT on June 8 to add additional comment and context from a security expert.

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

• How the mega data center is changing the hardware and data center markets
• A near-term outlook for big data
• Connected world: the consumer technology revolution