NSA whistleblower's revelations may cost US cloud providers billions

Debate begins over whether the EU can really damage U.S. cloud leadership

Edward Snowden's leaked revelations about the U.S. government's data spying program may result in U.S. cloud providers losing 10% to 20% of the foreign market to overseas competitors, according to a new study.

The Information Technology & Innovation Foundation, in its report, said European companies, in particular, may successfully exploit the spying disclosures to challenge U.S. cloud computing leadership in foreign markets.

It is a provocative point, and there is no clear data to suggest a backlash following disclosure of the U.S. spying program, called PRISM.

Daniel Castro, the author of the ITIF report, acknowledged in the report that the analysis is based, so far, on thin data, but argues that the risks are high.

"If U.S. companies lose market share in the short term, this will have long-term implications on their competitive advantage in this new industry," wrote Castro. "Rival countries have noted this opportunity and will try to exploit it," he said.

To counter foreign reaction, the government may have to help U.S. cloud providers by challenging the claims made by foreign officials, said Jason Weinstein, a partner at law firm Steptoe & Johnson LLP and a former federal prosecutor and deputy assistant attorney general who oversaw the computer crime section.

"There are a lot of reasons to be concerned about just how significant those consequences will be," Weinstein said. "This effort by European governments and European cloud providers to cloud the truth about data protection in the U.S. was going on well before anyone knew who Edward Snowden was. It just picked up new momentum once the PRISM disclosures came out."

"Now, it seems like every week you see more hypocrisy and more hyperbole coming out of the EU about data protection in the U.S.," Weinstein said. That data protection, particularly as it relates to government access, is worse in Europe, he said.

In the U.K. and France, a wiretap to get content can be issued by a government official without court authority, a practice that can't be done in the U.S.

In Germany, wiretaps also can be obtained without court approval. But with court approval, authorities can place a computer virus in a provider's network and intercept communications and metadata "without the providers or the customers even knowing about it," Weinstein said.

"The U.S. providers have done nothing other than comply with their legal obligations, and the consequences of these leaks is they are facing potentially significant economic consequences," he said.

The ITIF report says that U.S. cloud providers might lose US$35 billion by 2016. That's the high end of the loss estimate, and it assumes that U.S. providers eventually lose 20% of the foreign market to competitors. The ITIF estimates the global cloud market next year at about $148 billion, with the non-U.S. market at about $76 billion.

One survey that points to economic damage, also cited by the ITIF, was last month's Cloud Security Alliance report, which found that 10% of 207 officials at non-U.S. companies canceled contracts with U.S. service providers since the revelations of the spy program.

"I don't think PRISM does U.S. providers any favors, that's for sure," said Gartner lead cloud analyst Ed Anderson. He added that Gartner has not seen the Patriot Act, which has been cited for years by the Europeans as a privacy threat, as having any impact on U.S. cloud providers.

Similarly, Anderson said his firm has not seen any revenue impact on cloud providers since the PRISM disclosures.

"I think the reality is [the controversy over PRISM] is likely to die down over time, and we expect adoption to probably continue on the path that it has been on anyway," he said.

One reason why U.S. providers may not suffer is because "the alternatives aren't great, if you are European company looking for a cloud service," Anderson said.

Similar to Weinstein's point about European data surveillance, Anderson said European nations also can spy on private data.

"If you think that PRISM is the only program in the world where a government is inspecting private data, than you are pretty nave," said Anderson. Nonetheless, Anderson doesn't discount the risks if "there continue to be missteps on the part of the U.S. government" on data privacy issues, and said it could have a long-term impact on the perception it creates globally about what it means to work with a U.S. provider.

This article, Snowden's revelations may cost U.S. cloud providers billions, says study, was originally published at Computerworld.com.

Patrick Thibodeau covers cloud computing and enterprise applications, outsourcing, government IT policies, data centers and IT workforce issues for Computerworld. Follow Patrick on Twitter at @DCgov or subscribe to Patrick's RSS feed. His e-mail address is pthibodeau@computerworld.com.

See more by Patrick Thibodeau on Computerworld.com.

Read more about cloud computing in Computerworld's Cloud Computing Topic Center.

Join the CSO newsletter!

Error: Please check your email address.

Tags IT industrysecuritynsacloud computinginternetprivacy

More about EUGartnerNSATechnologyTopic

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Patrick Thibodeau

Latest Videos

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

  • 150x50

    IDG Live Webinar:The right collaboration strategy will help your business take flight

    Speakers - Mike Harris, Engineering Services Manager, Jetstar - Christopher Johnson, IT Director APAC, 20th Century Fox - Brent Maxwell, Director of Information Systems, THE ICONIC - IDG MC/Moderator Anthony Caruana

    Play Video

More videos

Blog Posts