The first one is that the program p′ necessarily outputs an encryption of the desired result, not the result itself. This means that the cloud cannot take action based on the result of the computation—it only has an encryption of the result, which it cannot decrypt. Naturally, randomised encryption is used (for otherwise there is no security at all), and therefore even the encryption of a binary output—true or false—tells the cloud nothing about the output itself. Suppose one wished to do email spam filtering in the cloud. We suppose that the cloud has a set of encrypted messages, and a program p which, when applied to a message, determines whether the message is spam or not. The cloud can run p′ on a given encrypted message, resulting in an encrypted Boolean indicating whether the message is spam. Because of the mentioned limitation, the cloud cannot throw away the message if it is spam; instead, it can return the encrypted Boolean to the user, who can decrypt it and herself throw away the offending message. In other words, the cloud can do spam detection, but cannot do spam filtering. This may mean that the user is continually called upon as a decryption oracle, decrypting results to enable the cloud to take actions. Moreover, the user is required to evaluate each time whether it is appropriate to decrypt or not. If she decrypts carelessly, she may accidentally disclose confidential data to the cloud; yet, it may not be easy for her to determine whether a particular decryption is safe or not. It seems unclear whether a practical application of cloud computing could work satisfactorily in this way.