Is Your Canadian Data Safe in the USA?

During the regular quarterly technology review meetings we hold with our clients, particularly when discussing backup solutions, the question around the storage of intellectual property (in this case, of data) in the US comes up frequently. There appears to be a general feeling of malaise with respect to the idea that the US Patriot Act basically allows the US government to access your business data at their discretion. Let me preface these comments by stating that these comments are truly "off the cuff" and in no way indicate a sound, go-forward strategy for the security of your data. If you are truly concerned about the US government gaining access to your data, you should consult a law firm specializing in that area, or better yet retain the services of a covert team of data security experts.

Basically, the short answer to whether or not the US government COULD access your data is YES! If they chose to invoke the Patriot Act. Keep in mind that doing so would require a high level of authorization within the US government and justification would need to be provided internally as to why NOT accessing this data could result in a national security issue, terrorist act, etc. Further, accessing your data would be very difficult and would actually require a large number of super computers in order to circumvent the encryption. Realistically, only the US government would have access to adequate resources - and realistically, they would really have to WANT to get at your data. Does your business fit such a profile? If so, whatever you do, don't put your data in the United States!

This risk simply does not exist for most legitimate Canadian businesses. For most of our clients in Vancouver and Edmonton looking at leveraging a cost-effective backup and disaster recovery solution, cloud-based e-mail or collaboration solution (e.g. SharePoint), or inexpensive hosting solution - the cost of hosting the solution in Canada far outweighs the risks of the US government attacking their data. There are significant other benefits to working with a Canadian company for hosting/cloud services, this just isn't one of them as far as I'm concerned.

There is an interesting article called Don’t use the Patriot Act as an excuse which touches on how Canadians are often quick to jump to the Patriot Act when considering cloud computing, often for no good reason. Consider also much of your personal data is already resident in the US on Facebook, Hotmail, Yahoo, Gmail, etc. Even businesses with e-mail servers in Canada may frequently be exchanging information with other Canadian businesses who's servers are in the US. In that scenario, your data security is pretty much null and void anyway.

On the other hand, if Bombardier were a client and considering storing blueprints for their next generation airplanes in the US, I might offer different advice!