When your provider isn't allowed to tell you what it had to do

There is a case running in London in which a provider is fighting a government order concerning the encryption of iCloud data, and for a long time nobody was even allowed to mention it in public. By now US lawmakers are calling for the secrecy around this case to be lifted. The interesting part for you is not the politics, it is the mechanics. A provider can receive an order and at the same time be under an obligation to tell you nothing about it. And its brochure keeps saying what it said before.

Why a promise in a brochure gets you nowhere here

A privacy promise is a statement about your own conduct. It says what a company does and does not do of its own accord. A government order reaches past exactly that voluntary part, and a gag order attached to it makes sure the promise can stay up on the website even though something has changed.

What follows from that is not panic but a sober question. Who is technically able to make the data readable. If your provider holds the key, or can obtain it, then the provider is the right address for an order, and you are not a party to the proceedings. If the key sits with you, the request lands with you. Then you hear about it, you can call your lawyer and you decide yourself how to handle it.

That is the whole difference, and it is technical, not legal.

Sort your data into three tiers

The mistake I hear most often in conversations is all or nothing. Either everything sits comfortably with one large provider, or nothing at all is allowed to leave the building any more. Both are expensive. Take an afternoon instead and sort.

Tier one, everything that goes out anyway. Your website, job ads, the newsletter, posts on Instagram and LinkedIn. If you want to publish on Instagram, you send data to Instagram, there is nothing to rescue there. Take the most convenient route here and save yourself the debate.

Tier two, confidential business data that needs to stay comfortable. File storage, calendars, mail, quotes, project folders. What counts here is not secrecy, it is freedom of choice. The data and the system belong to you, the formats are readable, and whoever maintains it can be replaced without you rebuilding your business. This is the tier where most mid sized companies keep 90 percent of their data.

Tier three, the small bundle where an order served on a third party should come up empty. Passwords and access credentials, design documents, contracts with prices, personnel files, your costings. Here the key sits with you, and the storage location sees nothing but encrypted blocks. Whether that storage stands in your own building or in a data centre then becomes a question of cost, not a question of trust.

The size matters. If tier three covers everything you have, you have not sorted anything, you have only moved it, and you pay for that every single day.

What holding your own key really costs

The price is not the hardware. A solid machine at a provider in Germany runs between 40 and 80 euros a month, which is less than the licences for a single workstation. The price is the fallbacks you give up.

Once the key sits with you, the service can no longer search inside your files for you. The preview in the browser disappears or gets slow. A share link for a customer takes an extra step. And the most uncomfortable point, the one that decides every rollout, is this. Password lost means data lost, because there is nobody left who could reset it. That is where encryption projects fail in everyday use, not on the technology. After three weeks people put an unencrypted copy on the desktop because search did not work.

So tier three always comes with a recovery procedure that works without the provider. That is how we keep our own password safe. The recovery key is on paper, two copies in two places, and the backup follows the rule of three copies, two media, one off site. Without that slip of paper, holding your own key would not be protection, it would be a risk with better press.

Three routes, and the middle one tends to get overlooked

Usually only two show up in the discussion. Either you do everything yourself, with your own administration and your own on call duty, or you rent a service per head per month and take the terms as they come.

Between the two lies the route that rarely gets mentioned. Open software on a server that belongs to you, maintained by somebody who does this for a living. Updates, backups, monitoring and recovery sit with that service provider, the data and the key sit with you, and you can end the contract without having to migrate. This is the category we work in, and for tier two it is almost always the right one. We run our own cloud, the mail server, the password manager, the Git server and this website on a server we keep in our own hands, which is why I know which of this work is real and which of it only exists in sales decks.

Deciding stays a job for people

You can get technical help with the sorting. A tool can walk through folders and suggest what belongs in tier three, because prices, personnel numbers or credentials turn up in there. That makes sense, because nobody looks through 200,000 files by hand.

A list like that is approved by a person, and by someone who knows the business. The same goes for running the systems. Monitoring reports what looks off, and a person decides whether to restart, roll back or just watch for now. A larger version jump that changes data formats gets read, tried out on a copy and then approved, it does not get installed automatically overnight.

The case in London changes nothing about your work, except that it answers a question that would otherwise stay theoretical. For your top tier, do not rely on your provider being allowed to talk. Make sure there is nothing for them to tell.