Posts by Secon

UK politicians to draft outage blueprint after AWS calamity

Re: You could do a lot with that

>For that kind of money, the govt could build its own distributed bit barns complete with its own private “cloud”, whilst creating jobs for the locals too

Back in 2009/10 that was exactly the plan.

At that point AWS and Microsoft were just teeny little offerings and Cabinet Office mostly used Google (and loved them).

G-Cloud then was an actual programme to BUILD a UK Gov Cloud; we knew how to do it, had all the security and assurance stuff worked out and were pretty much good to go.

Then someone in OGC decided we should 'just let the market decide'.

So shortly after we downgraded all our data classifications (cos none of the cloud platforms could meet any of the required standards) and the future of UK Sovereign Cloud was writ.

Could we build it now?

Probably - this used to be 'Definitely,' but nowadays too many folks have sold their technical skills to Microsoft for us to be 100% confident of ever doing anything else.

Bit if we wanted to I daresay enough folks still have the skills, and lots appear to be willing to engage in such a project.

Gov however will never go for it - our politicians and public sector CxO's think the future has to be MS or AWS coloured.

Google lands £400M MoD contract for secure UK cloud services

Re: Maybe repetition helps?

No.

CLOUD Act and other laws relate to communication service providers so desktop OS services are excluded from that scope.

Unless you use Co-Pilot, Teams, etc.

Re: Almost certainly NOT the Google Cloud Platform as most know it

Might be covered by CLOUD Act yep - unless Google find a local company not under their ownership to run it.

With their GDC-AG product being able to run with not wider GCP connectivity that's pretty much what I think theyt will do and if so - its outside of the CLOUD Act entirely.

Almost certainly NOT the Google Cloud Platform as most know it

The headlines suggest this is Google Cloud Platform, but in reality it is almost certainly their new standalone variant which has already found favour in Germany for their military.

On paper that’s an interesting and highly capable secure platform - but is also a physically chunky power hungry beast.

Well suited therefore for centralised defence type purposes in large UK datacentres or for point to point system links as the article suggests.

Definitely not a mobility or fast deployment cloud platform-l for use in theatre or on vehicle based models which in fact none of the mainstream hyperscalers can provide.

Such services do exist - and some are immensely capable, sufficiently secure for SECRET (and above) and very energy frugal; but these are not to be found from Google, AWS or Microsoft.

The £9 billion question: To Microsoft or not to Microsoft?

Re: Really?

"This is m$ salesmen(and women) going into government offices and selling m$ products to people who would not know a mouse from a keyboard(maybe I'm being a bit harsh here, but you get the idea)"

I'm not sure that's true - but if it was the problem woul dbe a whole lot easier to fix.

Actually we have a cadre of digitial leaders who have been brought up on Microsoft since they began using a PC.

Many of them only know that technology - they've never used anything else, and they only want to buy what they know and understand.

It doesn't matter if the product is the right fit - there's no due diligence being done here and absolutely no comparison - because the answer is Microsoft (and to them it always has been).

Coupled to that, we have procurement policies and approaches that don't aim for best fit or engage any big picture thinking.

They don't consider things like lock-in except in the most peripheral manner.

They certainly don't consider the implications of all HMG using a single provider platform operated from outside of the UK and subject to the vagaries and whims of foreign Governments.

Nor do they consider for one second why they are now operating a skewed playing field - requiring domestic providers to continue to adhere to personnel vetting and physical security standards that simply don't apply to Microsoft and their cloud operations.

They still think Cloud = Datacentre, and if the Microsoft UK datacentres have the required badges, then the global Microsoft cloud itself must also be OK??

They whiolly ignore that even on the openly published lists of processors Microsoft admit that they send this data to over a dozen countries (and have always been open in their documentation to Gov that they do so), whilst the G-Cloud copntract specifically requires the processing to be done inside the UK only.

Actually BTW the number of countries used by Microsoft where data uploaded to their online services may be routinely remotelty accessed from is closer to 100 than the 17 they list on their sub-processor document - and each of those countries may have legislation or governmental interests that run contrary to the UK's.

In that list of 100 countries you'll also find China, along with the Hong Kong and Macau SAR's - whihc are probably bad destinations for UK Government data to go to...

So its not really about IT decision makers not understanding technology - its unfair to say that because they do; they just think 'technology' is spelled M-I-C-R-O-S-O-F-T.

They can't consider why you'd ever want to use anything else.

Re: Security Not Mentioned

Microsoft cloud was assessed by the UK National Accreditor in 2010/11 against the then existing HMG standards.

It was accredited as being suitable for BIL2,2,x data - which is data that is really quite benign with little capacity for damage or impact if confidentiality or integrity is breached (hence '2,2')

If you look at Microsoft risk documentation for their M365 and Azure for HMG today you will still see the diagrams used (DBSy models) that show Azure and M365 only as 2-2-x capable networks.

This rating was a problem for Microsoft, because it effectively ruled them out of being able to process most public sector data.

The principle HMG network of the time (GSi) was run at BIL3,3,4 - capable of handling data classified at RESTRICTED (which was the bulk of day to day HMG and public body data).

With a BIL 2,2,x rating Microsoft couldn't play in that lucrative space.

Luckily, the Government - entirely of their own volition and most likely without any co-ercion or persuasion - shortly after decided to upend 50+ years of UK Data Classifications and rework them to push 80-90% of data into a wholly new classification called 'OFFICIAL' which they then deemed to be 'OK for Cloud'.

Happy days for Micrsofot who could then - without ANY uplift to their BIL 2,2,x service - tender for HMG business.

(Although of course they didn;t actually have to tender for it - they just leveraged their existing desktop licences to become 'cloud' licences and bypassed all that pesky procurement stuff.)

BINGO - UK Government adopted Microsoft overnight, with AWS (who had never actually been assessed for their security accreditation to Gov standards at all) shortly after.

Some depts had a brief sojourn with GCP - but mostly MS and AWS won out as the providers of choice.

A masterclass in how to win £bn's of business and influence government policies.

So how good is Microsoft Cloud security?

Actually its kindof OK - average kind of level; but certainly not something that ever met the standards UK Gov applied to all of its data handling systems up till 2014.

If assessed against those standards and policies today Microsoft would almost certainly NOT make the necessary grade - not just in terms of their tech standards, but also because of their operating methodologies. The residual risks would just be too high under those models.

The only way Microsoft were ever able to 'meet' HMG standards was when those standards were dramatically lowered through adoption of the GSCS, creation of NCSC, and the removal of all that pesky regulation, accreditation and mandatory assurance stuff that Gov had relied on for decades to keep UK data and IT systems safe from foreign influences.

There was a UK sovereign cloud initiaitive under the last Labour Government running through 2009/2011.

It was assessed at the time by ENISA as the worlds most advanced thinkjing on national cloud solutions, but was abandoned by the coalition gov when they came in, in favour of 'letting the market decide' and just buying available services.

When the uptake of those services was slow, the UK Gov then changed the data security classification scheme to both allow and arguably force Gov to adopt solutions that fell very far below established Government security standards.

(Microsoft had previously achieved a government assuranceinthe UK only to BIL22x - whihc enabled them only to process data classified at PROTECT, whereas most HMG data was at RESTRICTED or above. The Gov just changed the benchmarks to allow more data at those higher tiers to be reclassified as 'OFFICIAL" and thus 'OK for cloud').

Actually UK Gov policy was only ratified in June 2023 - up till then it specifically banned the use of public cloud services for processing of any data previously considered to be BIL33x or above.

Luckily no-one chose to comply with that national policy and this enabled massive uptake of Azure, M365 and AWS.

Had folks complied witht he ministerially signed policy, followed the NCSC Cloud Security Principles as written and actually done their diligence about where the data is processed the current extensive use of non-UK located public cloud would never have happened.

There's a lot to be said for just ignoring policy and regulation when you want to achieve a government objective that favours your chosen technology provider.... (as arguably this government are showing today)

When hyperscalers can’t safeguard one nation’s data from another, dark clouds are ahead

Re: I think it was news for some people

The contract terms on which G Cloud 14 was competed absolutely require all processing to be conducted inside the UK.

Microsoft (as well as others) sell services through that contract - but far from being UK only they actively support those services from 100 countries outside of the UK (according to Microsoft’s own listing of locations where administrators and persons with need to remotely access M365 or online services data are located.

Only about 64% of those countries have any UK or EU data adequacy.

EVERYONE must by now know that MSoft services have zero capability to support any form of sovereignty - and yet everyone keeps using them…

AWS forms EU-based cloud unit as customers fret about Trump 2.0

100% correct.

The EDPB made quite clear in their post Schrems II interim guidance that if data is decrypted IN the Cloud it cannot be considered an effective measure to protect that data FROM the Cloud provider.

Crypto gives significant benefits, but protection if your data from the cloud provider if you process or access the data in the cloud - even if they don’t hold the key - is not one of them.

How the collapse of local cloud provider caused biz continuity issues in UK government

>Government should have mandated the use of UKCloud only for UK data

They did.

The Government Security Classification Scheme specifically mandated that any data formerly above BIL 2-2-x must be resident in the UK on an approved, assured and accredited platform, right up till it was re-written in June of last year (to remove that requirement).

As a result - formal Ministerially signed HMG policy from 2014 to 2024 was specifically to use UK providers.

had that policy been applied UK Cloud (and probably other UK Sovereign prooviders) would have a solid footprint in the UK today and we wouldn't be exporting our critical data assets around the world.

However.... no-one adhered to that policy, and GDS/CCS/Cabinet Office/etc. all also pushed the 'use Public Cloud' model in favour of the Hyperscalers which was (perversely) NEVER part of the Cloud First policy when it was Ministerially created in 2013 - that was just policy by "blog and innuendo".

Microsoft Azure faceplants in Norway, taking government services with it

Re: "Problems with Azure were confined to one region"

>This really shouldn't be possible, and someone needs to fine Microsoft for it.

OR,

the folks using the Microsoft cloud platform for critical national and government services could read the MS terms of service; where they'll clearly see the restriction that Microsoft Azure and other MS Cloud services are not intended for high value processing, and specifically not for any use that could result in environmental damage, threats to safety or well-being of an individual or significant financial loss....

they might go on to read the guidance form Microsoft on DPIA's for M365 and see the caveat that M365 is not suitable for special category data under GDPR, and that if customers use it for such a prupose that is their responsibility and not Microsoft's.

Then they might wonder if Microsoft Azure and M365 is in fact the right platform for their services at all.

Re: "Problems with Azure were confined to one region"

>This really shouldn't be possible, and someone needs to fine Microsoft for it.

OR, the folks using the Microsoft service could read their terms of service, where they'll clearly see the restriction that Microsof tAzure and Cloud services are not intended for high value use, and specifically bot for any use that could result in environmental damage, threats to safety or wekllbeing of an individual or significant financial loss....

Then they might wonder if it is in fact the right platform for their services at all.

Re: "Problems with Azure were confined to one region"

>Only US Gov in the Gov cloud

100% correct, and yet you would be shocked at how many major IT decision makers in Gov's around the world don;t understand that simple (but key) point..

Re: Epic fail

>Epic fail

>Putting a country's government services on a cloud service owned and operated by a US company strikes me as a criminally negligent act.

At this point everyone in UK Government quietly shuffles backwards into the scenery....

DataVita declares sovereignty with 'National Cloud' for UK

Re: Daft.

<Your data is safe wherever it is, if it is properly encrypted>

Only if your data is never decrypted inside the cloud...

That means you can't PROCESS your data in the cloud - encrypt --> upload to cloud --> download from cloud --> decrypt might = probably secure; but try and work on it INSIDE the cloud? Nope.

Not secured and thus accessible by bad actors, suppliers and foreign governments.

The only people who actually don't want Sovereign Cloud to happen are the Public Cloud providers (who are doing very nicely with the status quo thank you very much)...

Microsoft punches back at Delta Air Lines and its legal threats

True - but they'd also need to ask all those companies who have moved their OOS legacy IT in a 'lift and shift' model on to Azure to vacate the premises...

I think the bigger picture here is that Microsoft can't afford for a precedent to be created in Court where a Cloud Provider (either a Hyperscaler like Microsoft or someone sitting on the Hyperscaler and selling services like CrowdStrike) can be held liable for damages to a customer arising from a loss of service, which occurs for whatever reason.

If a court awards any level of damages to a customer because of losses arising from a Cloud outage, Microsoft lose the 'pseudo-protection' of their heavily caveated Terms of Service, which make the customer responsible for their internal IT not being able to support their business when Microsoft's Cloud goes down, AND for the p*** poor decision to use their shonky cloud platform in the first place.

As soon as a Cloud outage has been formally recognised by a Court as being the Cloud providers responsibility to compensate for Microsoft will face millions of claims every time their platform goes down.

Given the frequency of those outages of late, they can't afford a court making that decision - so they attack Delta hard 'pour encourager les autres'...

UK govt office admits ability to negotiate billions in cloud spending curbed by vendor lock-in

>>PS there was a UK cloud - it was actually called UK cloud - they went bankrupt failing to compete with AWS

Actually no that's not the case.

They went into liquidation principally as a result of Cabinet Office briefing HMG users not to use UK Cloud, but their issues had their root somewhat earlier.

Whilst the HMG data classification policy (the GSCS) placed strong restrictions on the use of Public Cloud and non-UK based Cloud Services for sensitive data (including sensitive personal data); the Government Digital Service (GDS) policy and blog postings increasingly pushed organisations to make more use of Public Cloud.

Crown Commercial Services (CCS) made significant investments in their relationships with both Microsoft and AWS who in turn heavily discounted their services in order to hoover up most HMG business.

(Recently Cabinet Office have been bemoaning the fact that now they have a huge footprint in those cloud providers they can no longer influence them and discounts are much harder to achieve - hardly a surprise...)

UK Cloud expected - realistically, because the Ministerially approved Classification Scheme said so - that some types of UK Public Sector bodies would always have a need for a UK based Cloud service.

After all, Azure was only ever formally approved to process data at Business Impact Level 2 (2-2-4 actually), which was at the old GPMS PROTECT level - so there was good basis for UK Cloud to beleive they qwere on firm ground.

Actually they were on shiting sands - because Cabinet Office removed the functions that would have ensured adherence to the GSCS Cloud requirements, and whole tranches of UK Publice Sector moved to Microsoft and AWS. Some have done so whilst also in breach of UK legislation - the problem is that serious.

So that's really what happened to UK Cloud - like an honest player at a crooked poker game they played by the rules in every expectation that they'd compete in a level playing field with some types of use virtually guaranteed by HMG Policy to come their way.

Turns out that HMG Policy favours the big players more than the little guy.

>>wouldn't it be better to build a UK cloud?

That was the original direction of the G Cloud programme back in 2009/10 (when the UK were recognised by ENISA and others as global leaders on soveriegn based cloud).

When the previous Labour administration (who initiated that work) were replaced with the Coalition Gov, the focus changed - to "let the market decide", and that's exactly what has led us to where we are today.

G Cloud stopped being a 'thing' in its own right, and was changed to a moniker for commerc ial activity to buy Public Cloud, on terms dictated by the emerging Public Cloud Service Providers - initially led by Google, but now mainly AWS & Microsoft.

The work we did in the original G Cloud programme was not however wasted.

The US picked it up to build out their FedRAMP models - so don't let it be said the UK didn't contribute to national wealth and cloud capability delivery.

We did - just not OUR national wealth and cloud capabilities.

Re: The Unacceptable

>>>"Cloud computing - the ability to buy proven solutions on a pay-as-you-go basis - is what lets government make this change. Once we recognise that we're not different and that we don't need special IT, then we can buy what everyone else is already buying and using"

In many cases the UK Government ARE however special; the idea that they are not is one of the biggest falsehoods in the whole Cloud First debacle. Seems you believed it...

GDS and Cabinet Office have tried to hang on to that old chestnut for years, whilst steadfastly ignoring that UK Gov are bound by legislation - both national and international - that commercial organisations are not, and that their data differs significantly from corporate data both in terms of its sensitivity and its scale.

Few companies deal with data that can result in death or serious injury if its incorrectly handled, whereas every local authority in the land does so, and Central Government, NHS and blue-light services do so at massive scale.

To be fair there are plenty of 'digital leaders' across Gov who have done the same - ignoring the factors that should have constrained, informed, or steered their cloud adoption such as Policy, Legislation and just the wisdom of not putting all our national eggs into a couple of (admittedly large) non-UK owned baskets.

These services are of course also not designed for high value Government data - the terms of service for both AWS and Microsoft specifically say as much in their terms of service - and yet HMG continue to put more and more data and critical UK National systems into these commodity platforms.

The nirvana you suggest of simple mobility and SME competition are a pipe dream - we're ten years into Cloud first now and still largely using these Cloud Providers just like we used Managed Service Providers - moving legacy systems with minor change from virtualised datacentres into Cloud. SME's get crumbs from the table whilst managing the move into Cloud remains the preserve of the big SI's and Consultancies,

Where we DO re-engineer its to couple ourselves ever more tightly into the Cloud providers platform - using their services and literally 'coding by technology platform' in many cases - creating systems that are genuinely portable costs money, and the UK Gov has prioritised speed and cost over consideration of how we might exit the Cloud.

The UK also adopted these global spanning Cloud Services at the expense of their own domestic market, and the few who have tried to co-exist with them have been undermined by Gov Policies (or more specifically by those ignoring Government Policies that SHOULD have controlled this sprawl and ensured that high value data never made it on to these platforms). There are few choices available for anyone seeking to move complex AWS or Azure optimised workloads to a different platform - and many of those who continue to exist in the UK are really just satellites of the big boys - offering hybrid solutions, not true alternatives.

Even if we had those platforms, almost the entire UK workforce today have re-trained to become AWS or Microsoft Azure engineers - and who can blame them when the past 10 years has had that as the sole direction of travel?

The article suggests we've now hit a commercial tipping point - AWS & Microsoft no longer need to give introductory discounts, their UK Government business has hit the critical mass to ensure we can't readily leave, and a long-term revenue stream is gauranteed, so we'll of course be reverted to the locked in customer pricing... that's standard practice in most industries, so I can't criticise them too much for doing so TBH.

Its naivety and lack of foresight on the part of UK Gov commercial and digital teams that's led us to this position, along with the headlong rush across Gov Depts to buy into AWS & Microsoft without giving any consideration to the long-term implications. "Buy in haste, repent at leisure" has never been more relevant.

The CDDO suggestion to resolve this?

Lets repackage and re-brand it and then buy more of the same.

That's not a strategy - its capitulation.

I DO hope whomever makes up the new Government has more imagination, gumption, and smeddum than this lot.

UK Cabinet Office hits pause on £9M Microsoft deal

Re: So what did the taxpayer fund?

According to the Contract Finder award the Discovery Phase payment to Microsoft was capped at £1,868,224.

There will have been other costs under the Capgemini wider contract as well.

That contract has a total maximum value of just over £15m, with each phase paid in a series of Purchase Orders (PO's).

If the Discovery and Pilot Phase has a PO figure against it, its been redacted - so not clear what the charges for Capgemini delivery against the Discovery and Pilot were - though comments in the contract and associated documents suggest notional caps per sub-contractor phase of £1.8m also?

You're not seeing double – yet another UK copshop is confessing to a data leak

Re: Where's next?

Actually the NRS said it was published on purpose as part of their normal activity and as such is NOT a reportable breach; but they've taken the data down whilst they review their way of working...

UK's GDPR replacement could wipe out oversight of live facial recognition

A few points (and corrections)

Whilst the general thrust of your article is (boradly) correct, there are a few things that need to be better eplxained and considered - not because they make the Governments position more tenable or acceptable, but because their complexity in operation arguyably make it worse.

GDPR/UK GDPR has zero relevance to Police use of Facial Recognition (by whatever means), or indeed to processing of personal data for a Law Enforcement purpose at all.

The legislation that covers these practices is the Data Protection Act 2018 Part 3 - the UK's implementation of the EU Law Enforcement Directive (2016/679) [LED]

Chris Pounder is normally careful to make clear the distinction (whic h he understands), but many commentators on DP legislation in the UK fail to recognise the difference and thus we can spin off into discussions irrelevant to the matter at hand.

The plans for simplification/emasculation of the regulator are indeed a risk to fundamental rights and freedoms of data subjects. They also undemrine effective controls expected by the EU for UK Data Protection and signed up to by the UK in the TCA (the Brexit Deal). These are important because the UK's EU Adequacy for both GDPR and the LED hinge on the legal commitments given by the uK Government in those late minutes before the clock struck 11pm on 31st December 2020.

The UK's Data Proteciton legislation wrt Law Enforcement processing changed radically at that point, making many of the systems and services used by UK Police, Courts, Prisons and other bodies illegal with immediate effect; from 11pm Dec 31st 2020 UK law prevented routine transfers of LE Personal data to anywhere outside of the UK, and htough the CJS community, UK Gov and the ICO have ignored that, the chnge was in legal terms both massive in effect and consequence.

There are however other changes planned in the DPDI No2 bill that have more direct impacts onthe public and which the Reg and others should be looking at much more closely.

During the TCA negotiations and when the UK's adequacy was being discussed, there was a challenge levelled by the EU to the UK on the basis that there is no clear dividing line between certain National Intelligence bodies and Policing - and that from time to time each appeared to act as the other.

For a European Community with (sometimes not very distant) memories of secret policing this is a serious red flag, but the UK gave assurances in this respect.

The DPDI No.2 bill however contains a proposal to allow a Secretary of State to formalise circumstances where the Police may act as an Intelligence Agency, or vice versa (a "Designation Notice" in the new Section 82A) - writing into a legal framework the specific concern raised by the EDPB, civil liberties groups and other observers

In addition it introduces a whole raft of new exemptions which the Secretary of State can apply into Part 3 (under the new Section 78A). These have really very serious implications for public rights and accountability of Government.

We should be deeply concerned by all of these also.

EU Data Protection Board probes public sector use of cloud

GDPR is one thing - LED (DPA 2018 Pt3 in UK) quite another…

This review is long overdue, but if EDPB reviewed the use of Public Cloud for Law Enforcement processing they’d find more serious and important breaches immediately, since adequacy is both harder to get and less common.

AWS/Microsoft/GCP all ignore LED requirements in their terms of service and in UK terms the DPA 2018 Pt3.

Since Brexit use of any IT service located or supported from outside of UK for Law Enforcement purpose has been illegal on these services inder their terms of service.

Doesn’t stop UK Police and Courts using services ON these platforms however - mainly because ICO has done no enforcement.

Maybe this will change now - even if only because EDPS will inevitably start to look at UK practices and broaden scope from GDPR to LED I am sure.

That UK adequacy is looking shakier by the day…

UK government puts £750m on the table as it looks to deal directly with cloud providers

Whilst the first part of that might appear to favour AWS:

"The government only wants bids from providers with "full and exclusive control" of the infrastructure that underpins their platforms"

The latter part rules out just about every hyper cloud player "which are capable of providing the services primarily from within the UK".

This is potentially just as well IF the UK want to retain any alignment with Europe (but perhaps not if they don't?

European recommendations following Schrems II Privacy Shield ruling cast doubt on cloud encryption practices

Re: What about Office Suites?

It is often assumed that because you seect a UK/EEA region in a cloud provider that your data stays there.

Sadly this is not the case, and even if it were the physical location of data is less important than you may assume.

The Microsoft Terms if Service very clearly state that they can move your data internationally including to countries that do not meet EU requirements for data protection; the systems are in part administrated from outside of EEA and some if the core services within the M365 stack are only available outside of EEA (and your data moves there for processing).

Finally the extra-territoriality of some US legislation means that even if none of the above were true your data is still exposed to disclosure to US authorities.

I’m sorry to say therefore that your assumptions around residency and data protection are quite wrong - though you are correct that for some sectors at least the rules of Data Protection shall change again in January, but sadly these shall become MORE complex, not less.