Awareness about cloud computing and where apps store data in Great Britain

In 2019 Privacy International commissioned a poll with YouGov into the extent to which the GB public are aware that apps on their smart phones store data in the Cloud. This research is part of our campaign on cloud data extraction.

We are concerned that not only is this tech being used in secret and without sufficient transparency, but in addition, the public are largely unaware that large volumes of data that they generate via their smart phones and the apps they use, is stored in the cloud and thus accessible using these technologies. 

Key questions included: 

• How well, if at all, do you understand what the term ‘cloud computing’ means?
• Have you ever thought about where the data created / used by your apps on your smartphone is stored?
• Do any of the apps on your smartphone use cloud storage? 

Key findings

• 47% of GB individuals, when asked whether they understood what the term 'cloud computing' means responded'not well'. 
• 45.6% of GB individuals who have a smartphone, have not thought about where data created / used by apps on their smartphone is stored. 
• 44.3% of GB individuals who have a smartphone, do not know or think that apps on their phone use cloud storage. (10% said 'no' and 35% said 'don't know')

Understanding of cloud computing

Individuals were asked “How well, if at all, do you understand what the term ‘cloud computing’ means?” 

It was a fairly even split between those who felt they understood it well (46%) to those who did not understand it well (47%).  

YouGov breaks down the results into demographics [2], which generally reflected the overall results. 

However, in relation to the breakdown for ‘social media / messaging service used (within the last month)', (above) the figures for understanding cloud computing ‘not well’ in relation for those who have used certain social media sites in the last month are interesting and concerning: 

Facebook 45.2%, Pinterest 44.5%, WhatsApp 44.4% and Instagram 39.1%.  

For example, of those using Facebook in the last month, 45.2% of these respondents do not understand Cloud computing ‘well’. According to our research Facebook data is a key target for companies selling cloud extraction tech. In Cellebrite's UFED Cloud Analyser 7.5 update it included "five brand new capabilities that enable access to activity logs, search histories, pages, user group data and IP address records [for Facebook]."

Cellebrite's software can:

“... extract information from the stories and photos a suspect was tagged in to find new leads or new suspects. Additional data points include identification of connections made when liking a page or adding someone as a friend, as well as comments posted, articles read, videos seen, places visited and more.

For user data on groups and pages, UFED Cloud Analyzer 7.5 can also flag if a suspect is a member or administrator of a certain page or group.

This version can also surface the Facebook Log IP address records to allow you to identify a phone or computer’s location used to access an account.”

Where data created is stored            

Individuals were asked “Have you ever thought about where the data created / used by your apps on your smartphone is stored?”

The poll revealed that 45.6% of people who have a smartphone, polled have not thought about where data created /used by their smartphone is stored. Breaking this down via age, working status and government region revealed the following: 

Looking at this question with the breakdown for social media / messaging service used (within the last month) again the figures for those have not thought about where data is stored despite using social media in the last month, is fairly high: Facebook (44%), Twitter (36%), Instagram (40%), Snapchat (42%) and WhatsApp (45%).

If you backup your WhatsApp it will be stored in the Cloud and is a key target for cloud extraction. We have written to WhatsApp, together with 16 other companies, asking for their position on the use of these technologies given that it avoid official channels for law enforcement requests directly to companies. 

Another interesting breakdown looks at whether those who are parents/guardians have thought about where data created / used by the apps on the phone is stored. This looks at parents overall and then breaks it down further relating to the age of the child. For example, a parent with a 5 – 11 year old is less likely to have thought about where data is stored (51%) compared to the parent of a 17 – 18 year old (63%). 

Cloud extraction technologies are keen not only to obtain data from apps like Instagram and Snapchat, some companies offer facial and emotion recognition analytics which can be used against your images and photographs. 

We are unlikely to remember all the individuals and friends or acquaintances of our kids who took photos of us and our families and shared them on WhatsApp, Instagram and had them automatically saved in the Cloud. Yet these images are saved long term and should anyone have their phone extracted by law enforcement, you or your families' images could end up in a government database and subject to emotion and facial recognition. 

In August 2017 Cellebrite introduced what it called “advanced machine learning technology” for its analytics platform, which can be used to analyse data extracted from the cloud and which included face recognition and matching.

From July 2019, Oxygen Forensics JetEngine module, which is built into the Oxygen Forensic Detective, provides the ability to categorise human faces. Not only do Oxygen provide the categorisation and matching of faces within extracted data, facial analytics allows them to categorise gender, race and emotion recognition.

Lee Reiber, Oxygen’s chief operating officer said the tool can “search for a specific face in an evidence trove, or cluster images of the same person together. They can also filter faces by race or age group, and emotions such as “joy” and “anger”.”

Do any of the apps on your smartphone use cloud storage

Individuals who have a smartphone were asked: “Do any of the apps on your smartphone use cloud storage?” The poll revealed that 44.3% of people do not know or think that apps on their phone use cloud storage. 

Looking at the breakdowns for age, parent/guardian and social media usage revealed the following results: 

What does this all mean? 

Privacy International commissioned the poll alongside our research into the increasing use of Cloud extraction software by law enforcement. We are concerned that not only is this tech being used in secret and without sufficient transparency, but in addition, the public are largely unaware that large volumes of data that they generate via their smart phones and the apps they use, is stored in the cloud and thus accessible using these technologies. 

Whilst there appears to be a general awareness of cloud computing and degree of knowledge in relation to apps storing data in the cloud, when looking at the figures it is clear that often less than half of respondents understood cloud computing; have thought about where data created / used by apps on smartphone is stored and know if the apps on their smartphone use cloud storage. 

We rarely delete data that is stored in the Cloud. Users of social media and smartphones includes very young child. We are very unlikely to know all the people who store data about us, our families and children in the cloud accounts. Yet data from these accounts can be obtained at the push of a button by law enforcement.