Epic fail
Putting a country's government services on a cloud service owned and operated by a US company strikes me as a criminally negligent act.
Norwegians fell victim to a prolonged Microsoft Azure outage today, which impacted businesses and took down multiple government websites delivering online services to citizens. According to Down Detector, the problems first showed up at 9am local time and lasted for more than three hours, though The Reg could find no official …
I asked Azure Support to make sure all my resources were relocated to the same availability zone. Shortly afterwards, my government's website went AWOL.
I'm not claiming there is a connection between those two events, but I made sure I am not to be found within Norway's border for a while.
I work on one of the sites that went down, so I've been investigating a little.
Looks like the outage was caused by a single rack losing power.
Unfortunately it was an important rack, so it took down SQL for all of Azure Norway East.
Which meant that all kinds of stuff went down. Storage Accounts, Cosmos, etc.
We had one mostly static page, on it's own domain, and it stayed up.
This really shouldn't be possible, and someone needs to fine Microsoft for it.
>This really shouldn't be possible, and someone needs to fine Microsoft for it.
OR, the folks using the Microsoft service could read their terms of service, where they'll clearly see the restriction that Microsof tAzure and Cloud services are not intended for high value use, and specifically bot for any use that could result in environmental damage, threats to safety or wekllbeing of an individual or significant financial loss....
Then they might wonder if it is in fact the right platform for their services at all.
>This really shouldn't be possible, and someone needs to fine Microsoft for it.
OR,
the folks using the Microsoft cloud platform for critical national and government services could read the MS terms of service; where they'll clearly see the restriction that Microsoft Azure and other MS Cloud services are not intended for high value processing, and specifically not for any use that could result in environmental damage, threats to safety or well-being of an individual or significant financial loss....
they might go on to read the guidance form Microsoft on DPIA's for M365 and see the caveat that M365 is not suitable for special category data under GDPR, and that if customers use it for such a prupose that is their responsibility and not Microsoft's.
Then they might wonder if Microsoft Azure and M365 is in fact the right platform for their services at all.