Consider Microsoft. It has been willing to share information publicly about intrusions or breakdowns so it can help form public-private alliances to insulate computer networks. It has also taken the bold step of identifying countries such as Iran, North Korea, Russia and China for their roles in orchestrating digital assaults. Amazon, on the other hand, declined to testify at congressional hearings earlier this year about the SolarWinds breach, even though hackers used Amazon's cloud servers to stage digital assaults. Regulators shouldn't continue allowing it to stay mum, but Washington may lack the backbone needed to be more aggressive. A defense bill moving through Congress recently shed provisions that would have required companies to report cyberattacks and ransomware payments to the federal government.
Amazon runs a sophisticated shop, and its cloud architecture sits atop an armada of separate servers with lots of redundancies, abilities to scale and clever ways of balancing vast loads of information so breakdowns can be avoided. But it's not foolproof nor bulletproof. Nothing is.
Recent digging from Wired and the Center for Investigative Reporting examined how cavalier Amazon appears to be with the "vast empire of customer data" it manages on the retail side of its business. The reporting indicated that Amazon's oversight "had become so sprawling, fragmented and promiscuously shared within the company that the security division couldn't even map all of it, much less adequately defend its borders." Amazon disputed that account, noting what it described as a strong track record around digital security. It also emphasized its dedication to securing systems throughout the company.
Given that governments and corporations have outsourced so much of their network management, and given how the internet has become as essential as other necessities such as water and electricity, it would be useful to think of cloud services as a public utility of sorts — with all of the requisite disclosure and supervision that comes with that. After all, it's hazardous out there. Microsoft said on Monday that a federal court gave it the go-ahead to seize 42 websites from Chinese hackers who had been on intelligence-gathering sprees targeting government agencies, think tanks, universities and human rights organizations. Last week, a rural electric utility in Colorado serving 34,000 customers disclosed that a recent hack of its network "led to 90% of internal controls and systems becoming corrupted, broken or disabled." It also said that "a majority of historical data dating back more than 20 years was lost."
Think about all of that the next time your Roomba doesn't respond.
Timothy L. O'Brien is a senior columnist for Bloomberg Opinion.