Home is safer than the cloud!: privacy concerns for consumer cloud storage

Several studies ranked security and privacy to be major areas of concern and impediments of cloud adoption for companies, but none have looked into end-users' attitudes and practices. Not much is known about consumers' privacy beliefs and expectations for cloud storage, such as web-mail, document and photo sharing platforms, or about users' awareness of contractual terms and conditions. We conducted 36 in-depth interviews in Switzerland and India (two countries with different privacy perceptions and expectations); and followed up with an online survey with 402 participants in both countries. We study users' privacy attitudes and beliefs regarding their use of cloud storage systems. Our results show that privacy requirements for consumer cloud storage differ from those of companies. Users are less concerned about some issues, such as guaranteed deletion of data, country of storage and storage outsourcing, but are uncertain about using cloud storage. Our results further show that end-users consider the Internet intrinsically insecure and prefer local storage for sensitive data over cloud storage. However, users desire better security and are ready to pay for services that provide strong privacy guarantees. Participants had misconceptions about the rights and guarantees their cloud storage providers offers. For example, users believed that their provider is liable in case of data loss, does not have the right to view and modify user data, and cannot disable user accounts. Finally, our results show that cultural differences greatly influence user attitudes and beliefs, such as their willingness to store sensitive data in the cloud and their acceptance that law enforcement agencies monitor user accounts. We believe that these observations can help in improving users privacy in cloud storage systems.

[1]  Lee Rainie,et al.  The future of cloud computing , 2010 .

[2]  T. Grance,et al.  SP 800-144. Guidelines on Security and Privacy in Public Cloud Computing , 2011 .

[3]  Bernd Grobauer,et al.  Understanding Cloud Computing Vulnerabilities , 2011, IEEE Security & Privacy.

[4]  Roger Clarke,et al.  Privacy and consumer risks in cloud computing , 2010, Comput. Law Secur. Rev..

[5]  Gerald L. Lohse,et al.  International Differences in Information Privacy Concerns: A Global Survey of Consumers , 2004, Inf. Soc..

[6]  Joseph Gray Jackson,et al.  Privacy and Freedom , 1968 .

[7]  C. Mora.  Cultures and Organizations: Software of the Mind Intercultural Cooperation and Its Importance for Survival , 2013 .

[8]  Lorrie Faith Cranor,et al.  Privacy in India: Attitudes and Awareness , 2005, Privacy Enhancing Technologies.

[9]  Michael Henry,et al.  International Privacy, Publicity and Personality Laws , 2000 .

[10]  Markus Jakobsson,et al.  Controlling data in the cloud: outsourcing computation without outsourcing control , 2009, CCSW '09.

[11]  Wayne Pauley,et al.  Cloud Provider Transparency: An Empirical Evaluation , 2010, IEEE Security & Privacy.

[12]  Chris Jay Hoofnagle,et al.  Research Report: What Californians Understand About Privacy Offline , 2008 .

[13]  Gert Jan Hofstede,et al.  Cultures and Organizations - Software of the Mind: Intercultural Cooperation and its Importance for Survival (3. ed.) , 2010 .

[14]  Joe Weinman,et al.  The future of Cloud Computing , 2011, 2011 IEEE Technology Time Machine Symposium on Technologies Beyond 2020.

[15]  T. S. Raghu,et al.  The Information Assurance Practices of Cloud Computing Vendors , 2010, IT Professional.

[16]  John Leubsdorf,et al.  Privacy and Freedom , 1968 .

[17]  O. P. Sharma.  An Indian perspective , 2005 .

[18]  Alessandro Acquisti,et al.  Imagined Communities: Awareness, Information Sharing, and Privacy on the Facebook , 2006, Privacy Enhancing Technologies.

[19]  Jeanna Neefe Matthews,et al.  The good, the bad and the ugly of consumer cloud storage , 2010, OPSR.

[20]  D. Seligmann,et al.  Comparing privacy attitudes of knowledge workers in the U.S. and India , 2010, ICIC '10.

[21]  Ponnurangam Kumaraguru,et al.  Privacy Indexes: A Survey of Westin's Studies , 2005 .

[22]  Christopher Soghoian,et al.  Caught in the Cloud: Privacy, Encryption, and Government Back Doors in the Web 2.0 Era , 2009, J. Telecommun. High Technol. Law.

[23]  Edwin Baker,et al.  Hey, you, get off of that cloud? , 2009, Comput. Law Secur. Rev..