Legal columnist Mark Rasch at SecurityFocus penned a fascinating and very detailed piece about privacy–or the lack thereof–in email sent through hosted email services. Now cloud-based services, or “software-as-a-service” has gained a lot of attention lately, and it certainly has a place in the enterprise. In fact, with the entrance of Microsoft into the SaaS crowd, it’s use is just inevitable: the era of hosted applications is upon us.

But should cloud computing extend to email? There are plenty of arguments against it, from a privacy perspective. When you are using a hosted productivity suite, the applications are hosted on a third party server, but the actual data that you create is still stored locally.  When you use a hosted email application like Gmail for example, the email application–and the emails themselves–are all stored and hosted on the third party server. Putting aside the privacy issue for a moment, just from a security perspective, this is a bad idea. Email archiving is best controlled internally–giving the users greater control, and easier searchability.

But then, Rasch cites the case of Steven Warshak, illustrating just how little control you have over your email when you use web-based email. In essence, the US government, according to the Stored Communications Act, can override the Fourth Amendment: “in the case of e-mail messages stored and sent in the cloud, the government doesn’t need a warrant, doesn’t need probable cause, and doesn’t need to provide the ‘owner’ of the communications with notice.” This is truly alarming. Of course, when you keep emails internally, the government can also access them, but must go through proper channels: find probable cause, obtain a warrant, and then provide the owner with a list of what was seized. There is no reason the same standard should not apply to web-based email.