In December 2014, at the 31st Chaos Communication Congress in Hamburg, Caspar Bowden, Microsoft’s former chief privacy adviser, described how he had warned the company in 2011 about cloud computing. He said that selling cloud services to foreign governments would let the US National Security Agency run mass surveillance on those customers. He was dismissed from Microsoft in 2011, after nine years at the company.
His talk, titled “The Cloud Conspiracy”, came after the Snowden disclosures. Bowden said he had not known about PRISM while at Microsoft. He had reached his conclusions by reading American law and public sources.
The legal argument
Bowden told the audience that he had briefed about 40 of Microsoft’s National Technical Officers, who in effect acted as the company’s ambassadors in individual countries. His subject was the US Foreign Intelligence Surveillance Act Amendment Act of 2008, known as FISAAA. In his account, the law covers the collection of foreign intelligence by targeting non-US persons outside the United States. He put that group at about 95 per cent of the world’s population. Providers, he said, must give the government the facilities to do this in secret.
He drew a blunt conclusion for anyone outside the US. A non-American could not trust cryptographic or other software services from US companies. Even sound software, he argued, could be changed through an update aimed at one user. He also noted that, as Yahoo’s Marissa Mayer later pointed out, a company that refused to comply could be held in contempt of court. In his telling, it could also face espionage-law penalties of up to 20 years in prison.
Bowden stressed that the purpose need not be crime or national security. It could be political or economic surveillance in the interests of the United States. He said foreigners abroad had no constitutional protection, a point he said US lawmakers treated lightly.
Why encryption was not the answer
Bowden said he met indifference when he took the warning to journalists at the Guardian, the New York Times and the Washington Post. He also met it from mainstream European politicians. The usual reply was that the data would be encrypted anyway.
He rejected that. Most privacy law, he said, was written for communications rather than computing. Data can be encrypted and stored securely in the cloud, but not if the user wants to compute on it. “You cannot protect data in cloud computing,” he said.
His proposed remedies
Bowden said he had worked with people trying to build workable cloud contracts, but he considered that route a dead end. In his view, even an act of Congress could not bind a president on spying on foreigners abroad, because he saw it as a presidential prerogative.
He offered two answers. The first was political: the European Union should withhold data flows to US-based cloud providers, in effect a trade confrontation, until the rules changed. The second was technical: free and open source software running in locally hosted data centres.
He also argued that surveillance harms democracy. Voters rely on politicians and officials to decide fairly. Those officials, he said, might be swayed by fear that their own private lives are being watched, since one tabloid story can end a career. He said the public could not now unthink what Edward Snowden had put in its mind.
What happened next
Bowden died of cancer on 9 July 2015, aged 53. The Register reported that he had held privacy roles at Microsoft between 2002 and 2011, and that he had testified at the European Parliament after publishing a report on US surveillance programmes and their effect on European citizens’ privacy. Privacy International’s Gus Hosein said Bowden had foreseen Tempora and PRISM, and had been labelled paranoid until events proved him right.
Bowden had also been on the board of the Tor Project. He co-founded the UK’s Foundation for Information Policy Research.