Comments on: Survv with Google App Engine http://blog.survv.org/2008/06/01/survv-with-google-app-engine/ Law's Place on the New Web Wed, 07 Jan 2009 11:00:04 +0000 http://wordpress.org/?v=2.6 By: Ian Bicking http://blog.survv.org/2008/06/01/survv-with-google-app-engine/#comment-3 Ian Bicking Mon, 02 Jun 2008 02:42:57 +0000 http://blog.survv.org/?p=11#comment-3 They've stated very clearly that they take no ownership over your data, so presumably they treat it accordingly. Which still implies that given a subpoena they would give access to the data, just like a bank would to something in a safe deposit box. I don't know if they'd keep you in the loop enough to fight the subpoena on your own, as it would seem reasonable that you should have that opportunity, but in practice it's only effective if Google makes sure you have that opportunity. Presumably they have some policy about this sort of thing, and could tell you that policy if asked and given specific scenarios that you are concerned with. For something explicitly legal like a pro bono site, the result might be workable as you have access to the lawyers to setup whatever protocols you require. Of course, this only relates to civilized legal attacks. Things like national security letters are another approach, and one which Google would be obligated to obey without any opportunity for you to do anything. Archive.org has fought these, but they seem quite alone (though none of us have any way to know). Notably no (US-based) managed service is likely to be any better than Google, which is the norm for most hosting situations anyway. If you own the computer and can regulate physical access to the server, that helps. If you host the server and data outside of the country it also helps a great deal, as it's just really *hard* to manage the process of dealing with laws in other countries. Though it should be noted that Rackspace has turned over computers it hosts in the UK based on orders received in the US. So... there's several things to think of, and though it could be more explicit Google doesn't seem any worse than any other managed service. And it's just not practical for many people to manage their own services. Except perhaps for foreign hosting, which is quite easy to do. They’ve stated very clearly that they take no ownership over your data, so presumably they treat it accordingly. Which still implies that given a subpoena they would give access to the data, just like a bank would to something in a safe deposit box. I don’t know if they’d keep you in the loop enough to fight the subpoena on your own, as it would seem reasonable that you should have that opportunity, but in practice it’s only effective if Google makes sure you have that opportunity. Presumably they have some policy about this sort of thing, and could tell you that policy if asked and given specific scenarios that you are concerned with. For something explicitly legal like a pro bono site, the result might be workable as you have access to the lawyers to setup whatever protocols you require.

Of course, this only relates to civilized legal attacks. Things like national security letters are another approach, and one which Google would be obligated to obey without any opportunity for you to do anything. Archive.org has fought these, but they seem quite alone (though none of us have any way to know). Notably no (US-based) managed service is likely to be any better than Google, which is the norm for most hosting situations anyway. If you own the computer and can regulate physical access to the server, that helps. If you host the server and data outside of the country it also helps a great deal, as it’s just really *hard* to manage the process of dealing with laws in other countries. Though it should be noted that Rackspace has turned over computers it hosts in the UK based on orders received in the US. So… there’s several things to think of, and though it could be more explicit Google doesn’t seem any worse than any other managed service. And it’s just not practical for many people to manage their own services. Except perhaps for foreign hosting, which is quite easy to do.

]]>