Posts by Secon

How the collapse of local cloud provider caused biz continuity issues in UK government

>Government should have mandated the use of UKCloud only for UK data

They did.

The Government Security Classification Scheme specifically mandated that any data formerly above BIL 2-2-x must be resident in the UK on an approved, assured and accredited platform, right up till it was re-written in June of last year (to remove that requirement).

As a result - formal Ministerially signed HMG policy from 2014 to 2024 was specifically to use UK providers.

had that policy been applied UK Cloud (and probably other UK Sovereign prooviders) would have a solid footprint in the UK today and we wouldn't be exporting our critical data assets around the world.

However.... no-one adhered to that policy, and GDS/CCS/Cabinet Office/etc. all also pushed the 'use Public Cloud' model in favour of the Hyperscalers which was (perversely) NEVER part of the Cloud First policy when it was Ministerially created in 2013 - that was just policy by "blog and innuendo".

Microsoft Azure faceplants in Norway, taking government services with it

Re: "Problems with Azure were confined to one region"

>This really shouldn't be possible, and someone needs to fine Microsoft for it.

OR,

the folks using the Microsoft cloud platform for critical national and government services could read the MS terms of service; where they'll clearly see the restriction that Microsoft Azure and other MS Cloud services are not intended for high value processing, and specifically not for any use that could result in environmental damage, threats to safety or well-being of an individual or significant financial loss....

they might go on to read the guidance form Microsoft on DPIA's for M365 and see the caveat that M365 is not suitable for special category data under GDPR, and that if customers use it for such a prupose that is their responsibility and not Microsoft's.

Then they might wonder if Microsoft Azure and M365 is in fact the right platform for their services at all.

Re: "Problems with Azure were confined to one region"

>This really shouldn't be possible, and someone needs to fine Microsoft for it.

OR, the folks using the Microsoft service could read their terms of service, where they'll clearly see the restriction that Microsof tAzure and Cloud services are not intended for high value use, and specifically bot for any use that could result in environmental damage, threats to safety or wekllbeing of an individual or significant financial loss....

Then they might wonder if it is in fact the right platform for their services at all.

Re: "Problems with Azure were confined to one region"

>Only US Gov in the Gov cloud

100% correct, and yet you would be shocked at how many major IT decision makers in Gov's around the world don;t understand that simple (but key) point..

Re: Epic fail

>Epic fail

>Putting a country's government services on a cloud service owned and operated by a US company strikes me as a criminally negligent act.

At this point everyone in UK Government quietly shuffles backwards into the scenery....

DataVita declares sovereignty with 'National Cloud' for UK

Re: Daft.

<Your data is safe wherever it is, if it is properly encrypted>

Only if your data is never decrypted inside the cloud...

That means you can't PROCESS your data in the cloud - encrypt --> upload to cloud --> download from cloud --> decrypt might = probably secure; but try and work on it INSIDE the cloud? Nope.

Not secured and thus accessible by bad actors, suppliers and foreign governments.

The only people who actually don't want Sovereign Cloud to happen are the Public Cloud providers (who are doing very nicely with the status quo thank you very much)...

Microsoft punches back at Delta Air Lines and its legal threats

True - but they'd also need to ask all those companies who have moved their OOS legacy IT in a 'lift and shift' model on to Azure to vacate the premises...

I think the bigger picture here is that Microsoft can't afford for a precedent to be created in Court where a Cloud Provider (either a Hyperscaler like Microsoft or someone sitting on the Hyperscaler and selling services like CrowdStrike) can be held liable for damages to a customer arising from a loss of service, which occurs for whatever reason.

If a court awards any level of damages to a customer because of losses arising from a Cloud outage, Microsoft lose the 'pseudo-protection' of their heavily caveated Terms of Service, which make the customer responsible for their internal IT not being able to support their business when Microsoft's Cloud goes down, AND for the p*** poor decision to use their shonky cloud platform in the first place.

As soon as a Cloud outage has been formally recognised by a Court as being the Cloud providers responsibility to compensate for Microsoft will face millions of claims every time their platform goes down.

Given the frequency of those outages of late, they can't afford a court making that decision - so they attack Delta hard 'pour encourager les autres'...

UK govt office admits ability to negotiate billions in cloud spending curbed by vendor lock-in

>>PS there was a UK cloud - it was actually called UK cloud - they went bankrupt failing to compete with AWS

Actually no that's not the case.

They went into liquidation principally as a result of Cabinet Office briefing HMG users not to use UK Cloud, but their issues had their root somewhat earlier.

Whilst the HMG data classification policy (the GSCS) placed strong restrictions on the use of Public Cloud and non-UK based Cloud Services for sensitive data (including sensitive personal data); the Government Digital Service (GDS) policy and blog postings increasingly pushed organisations to make more use of Public Cloud.

Crown Commercial Services (CCS) made significant investments in their relationships with both Microsoft and AWS who in turn heavily discounted their services in order to hoover up most HMG business.

(Recently Cabinet Office have been bemoaning the fact that now they have a huge footprint in those cloud providers they can no longer influence them and discounts are much harder to achieve - hardly a surprise...)

UK Cloud expected - realistically, because the Ministerially approved Classification Scheme said so - that some types of UK Public Sector bodies would always have a need for a UK based Cloud service.

After all, Azure was only ever formally approved to process data at Business Impact Level 2 (2-2-4 actually), which was at the old GPMS PROTECT level - so there was good basis for UK Cloud to beleive they qwere on firm ground.

Actually they were on shiting sands - because Cabinet Office removed the functions that would have ensured adherence to the GSCS Cloud requirements, and whole tranches of UK Publice Sector moved to Microsoft and AWS. Some have done so whilst also in breach of UK legislation - the problem is that serious.

So that's really what happened to UK Cloud - like an honest player at a crooked poker game they played by the rules in every expectation that they'd compete in a level playing field with some types of use virtually guaranteed by HMG Policy to come their way.

Turns out that HMG Policy favours the big players more than the little guy.

>>wouldn't it be better to build a UK cloud?

That was the original direction of the G Cloud programme back in 2009/10 (when the UK were recognised by ENISA and others as global leaders on soveriegn based cloud).

When the previous Labour administration (who initiated that work) were replaced with the Coalition Gov, the focus changed - to "let the market decide", and that's exactly what has led us to where we are today.

G Cloud stopped being a 'thing' in its own right, and was changed to a moniker for commerc ial activity to buy Public Cloud, on terms dictated by the emerging Public Cloud Service Providers - initially led by Google, but now mainly AWS & Microsoft.

The work we did in the original G Cloud programme was not however wasted.

The US picked it up to build out their FedRAMP models - so don't let it be said the UK didn't contribute to national wealth and cloud capability delivery.

We did - just not OUR national wealth and cloud capabilities.

Re: The Unacceptable

>>>"Cloud computing - the ability to buy proven solutions on a pay-as-you-go basis - is what lets government make this change. Once we recognise that we're not different and that we don't need special IT, then we can buy what everyone else is already buying and using"

In many cases the UK Government ARE however special; the idea that they are not is one of the biggest falsehoods in the whole Cloud First debacle. Seems you believed it...

GDS and Cabinet Office have tried to hang on to that old chestnut for years, whilst steadfastly ignoring that UK Gov are bound by legislation - both national and international - that commercial organisations are not, and that their data differs significantly from corporate data both in terms of its sensitivity and its scale.

Few companies deal with data that can result in death or serious injury if its incorrectly handled, whereas every local authority in the land does so, and Central Government, NHS and blue-light services do so at massive scale.

To be fair there are plenty of 'digital leaders' across Gov who have done the same - ignoring the factors that should have constrained, informed, or steered their cloud adoption such as Policy, Legislation and just the wisdom of not putting all our national eggs into a couple of (admittedly large) non-UK owned baskets.

These services are of course also not designed for high value Government data - the terms of service for both AWS and Microsoft specifically say as much in their terms of service - and yet HMG continue to put more and more data and critical UK National systems into these commodity platforms.

The nirvana you suggest of simple mobility and SME competition are a pipe dream - we're ten years into Cloud first now and still largely using these Cloud Providers just like we used Managed Service Providers - moving legacy systems with minor change from virtualised datacentres into Cloud. SME's get crumbs from the table whilst managing the move into Cloud remains the preserve of the big SI's and Consultancies,

Where we DO re-engineer its to couple ourselves ever more tightly into the Cloud providers platform - using their services and literally 'coding by technology platform' in many cases - creating systems that are genuinely portable costs money, and the UK Gov has prioritised speed and cost over consideration of how we might exit the Cloud.

The UK also adopted these global spanning Cloud Services at the expense of their own domestic market, and the few who have tried to co-exist with them have been undermined by Gov Policies (or more specifically by those ignoring Government Policies that SHOULD have controlled this sprawl and ensured that high value data never made it on to these platforms). There are few choices available for anyone seeking to move complex AWS or Azure optimised workloads to a different platform - and many of those who continue to exist in the UK are really just satellites of the big boys - offering hybrid solutions, not true alternatives.

Even if we had those platforms, almost the entire UK workforce today have re-trained to become AWS or Microsoft Azure engineers - and who can blame them when the past 10 years has had that as the sole direction of travel?

The article suggests we've now hit a commercial tipping point - AWS & Microsoft no longer need to give introductory discounts, their UK Government business has hit the critical mass to ensure we can't readily leave, and a long-term revenue stream is gauranteed, so we'll of course be reverted to the locked in customer pricing... that's standard practice in most industries, so I can't criticise them too much for doing so TBH.

Its naivety and lack of foresight on the part of UK Gov commercial and digital teams that's led us to this position, along with the headlong rush across Gov Depts to buy into AWS & Microsoft without giving any consideration to the long-term implications. "Buy in haste, repent at leisure" has never been more relevant.

The CDDO suggestion to resolve this?

Lets repackage and re-brand it and then buy more of the same.

That's not a strategy - its capitulation.

I DO hope whomever makes up the new Government has more imagination, gumption, and smeddum than this lot.

UK Cabinet Office hits pause on £9M Microsoft deal

Re: So what did the taxpayer fund?

According to the Contract Finder award the Discovery Phase payment to Microsoft was capped at £1,868,224.

There will have been other costs under the Capgemini wider contract as well.

That contract has a total maximum value of just over £15m, with each phase paid in a series of Purchase Orders (PO's).

If the Discovery and Pilot Phase has a PO figure against it, its been redacted - so not clear what the charges for Capgemini delivery against the Discovery and Pilot were - though comments in the contract and associated documents suggest notional caps per sub-contractor phase of £1.8m also?

You're not seeing double – yet another UK copshop is confessing to a data leak

Re: Where's next?

Actually the NRS said it was published on purpose as part of their normal activity and as such is NOT a reportable breach; but they've taken the data down whilst they review their way of working...

UK's GDPR replacement could wipe out oversight of live facial recognition

A few points (and corrections)

Whilst the general thrust of your article is (boradly) correct, there are a few things that need to be better eplxained and considered - not because they make the Governments position more tenable or acceptable, but because their complexity in operation arguyably make it worse.

GDPR/UK GDPR has zero relevance to Police use of Facial Recognition (by whatever means), or indeed to processing of personal data for a Law Enforcement purpose at all.

The legislation that covers these practices is the Data Protection Act 2018 Part 3 - the UK's implementation of the EU Law Enforcement Directive (2016/679) [LED]

Chris Pounder is normally careful to make clear the distinction (whic h he understands), but many commentators on DP legislation in the UK fail to recognise the difference and thus we can spin off into discussions irrelevant to the matter at hand.

The plans for simplification/emasculation of the regulator are indeed a risk to fundamental rights and freedoms of data subjects. They also undemrine effective controls expected by the EU for UK Data Protection and signed up to by the UK in the TCA (the Brexit Deal). These are important because the UK's EU Adequacy for both GDPR and the LED hinge on the legal commitments given by the uK Government in those late minutes before the clock struck 11pm on 31st December 2020.

The UK's Data Proteciton legislation wrt Law Enforcement processing changed radically at that point, making many of the systems and services used by UK Police, Courts, Prisons and other bodies illegal with immediate effect; from 11pm Dec 31st 2020 UK law prevented routine transfers of LE Personal data to anywhere outside of the UK, and htough the CJS community, UK Gov and the ICO have ignored that, the chnge was in legal terms both massive in effect and consequence.

There are however other changes planned in the DPDI No2 bill that have more direct impacts onthe public and which the Reg and others should be looking at much more closely.

During the TCA negotiations and when the UK's adequacy was being discussed, there was a challenge levelled by the EU to the UK on the basis that there is no clear dividing line between certain National Intelligence bodies and Policing - and that from time to time each appeared to act as the other.

For a European Community with (sometimes not very distant) memories of secret policing this is a serious red flag, but the UK gave assurances in this respect.

The DPDI No.2 bill however contains a proposal to allow a Secretary of State to formalise circumstances where the Police may act as an Intelligence Agency, or vice versa (a "Designation Notice" in the new Section 82A) - writing into a legal framework the specific concern raised by the EDPB, civil liberties groups and other observers

In addition it introduces a whole raft of new exemptions which the Secretary of State can apply into Part 3 (under the new Section 78A). These have really very serious implications for public rights and accountability of Government.

We should be deeply concerned by all of these also.

EU Data Protection Board probes public sector use of cloud

GDPR is one thing - LED (DPA 2018 Pt3 in UK) quite another…

This review is long overdue, but if EDPB reviewed the use of Public Cloud for Law Enforcement processing they’d find more serious and important breaches immediately, since adequacy is both harder to get and less common.

AWS/Microsoft/GCP all ignore LED requirements in their terms of service and in UK terms the DPA 2018 Pt3.

Since Brexit use of any IT service located or supported from outside of UK for Law Enforcement purpose has been illegal on these services inder their terms of service.

Doesn’t stop UK Police and Courts using services ON these platforms however - mainly because ICO has done no enforcement.

Maybe this will change now - even if only because EDPS will inevitably start to look at UK practices and broaden scope from GDPR to LED I am sure.

That UK adequacy is looking shakier by the day…

UK government puts £750m on the table as it looks to deal directly with cloud providers

Whilst the first part of that might appear to favour AWS:

"The government only wants bids from providers with "full and exclusive control" of the infrastructure that underpins their platforms"

The latter part rules out just about every hyper cloud player "which are capable of providing the services primarily from within the UK".

This is potentially just as well IF the UK want to retain any alignment with Europe (but perhaps not if they don't?

European recommendations following Schrems II Privacy Shield ruling cast doubt on cloud encryption practices

Re: What about Office Suites?

It is often assumed that because you seect a UK/EEA region in a cloud provider that your data stays there.

Sadly this is not the case, and even if it were the physical location of data is less important than you may assume.

The Microsoft Terms if Service very clearly state that they can move your data internationally including to countries that do not meet EU requirements for data protection; the systems are in part administrated from outside of EEA and some if the core services within the M365 stack are only available outside of EEA (and your data moves there for processing).

Finally the extra-territoriality of some US legislation means that even if none of the above were true your data is still exposed to disclosure to US authorities.

I’m sorry to say therefore that your assumptions around residency and data protection are quite wrong - though you are correct that for some sectors at least the rules of Data Protection shall change again in January, but sadly these shall become MORE complex, not less.