Slashdot Mirror
Canada Wants To Keep Federal Data Within National Borders (thestack.com)
An anonymous reader quotes a report from The Stack: Canada has released its latest federal cloud adoption strategy, now available for public comment, which includes policy concerning the storing of sensitive government information on Canadian citizens within national borders. The newly-published [Government of Canada Cloud Adoption Strategy] requires that only data which the government has categorized as "unclassified," or harmless to national and personal security, will be allowed outside of the country. This information will still be subject to strict encryption rules. The new strategy, which has been in development over the last year, stipulates that all personal data stored by the government on Canadian citizens, such as social insurance numbers and critical federal information, must be stored in Canada-based data centers in order to retain "sovereign control."
sovereign control served here
Is somebody trying to make an argument against the idea?
“He’s not deformed, he’s just drunk!”
this is actually a requirement in several Provincial Privacy acts. Nova Scotia for example is not allowed to store any personally identifiable information outside of Canada. The feds arnt bound to follow Provincial acts, but its not surprising they would follow what others are doing already.
Its specifically the Patriot act that led to the NS Clause.
During the 2011 census, for instance, 89-year-old Ontario resident Audrey Tobias said she would not fill out the questionnaire because an information technology contract linked to it had been awarded to an American company, Lockheed Martin. Tobias was charged with violating the Statistics Act, but eventually acquitted.
Now that it's back, time to make sure that your data stays your data.
"Transparent" is a shit show that trades on every stereotype going. A man in drag is NOT a transsexual.
Sounds like an excellent idea for the Canadian people. Are corporations "people" in Canada?
Now that the government is willing to jail you if you're not willing to fill out the census, how about we start with that first? It was busy feeding the US war machine back when we had the freedom to refuse. How much you want to bet it still does?
...Canada is buying another computer to go with the one they already have?
So ur saying Canada's data was already going outside? Wow
British Columbia already has this rule; government data (including university data for researchers) must be kept on Canadian servers. There's some wiggle room for opting in to US storage, though.
I think it's important legislation, and it motivates some good duplication of infrastructure within Canada. It makes it harder to abdicate our responsibility to data and makes it just a bit harder for US subpoenas to get a hold of it.
Nobody sane the world over wants their data exposed to the USA.
Hard to protect against for sure, but still a worthwhile goal to shoot for.
Doesn't really help if the servers are in Canada but the people accessing them are in Mumbai does it ?
Translation: the Canadian government wants to be able to spy on its citizens easily.
Domestically storing the *government* curated data that the *government* already controls doesn't provide much of a spying advantage.
Anyways, Canada doesn't have to spy on its citizens. We let the NSA and the MI5 etc spy on our citizens, just like CSEC and the MI5 etc spy on US citizens in a giant circle jerk including Australia and New Zealand.
When the world is covered with clouds, the air gaps are everywhere and nowhere.
This is data that should be nationally controlled and protected. Keeping it with borders makes sense.
The US doesn't have a law. It has regulations the amount to the same. So do other countries.
All the big brother conspiracists, please give the rest of us a break.
This is most likely a question of protectionism (giving contracts to your own data centers) with a privacy smokscreen. It has a coincidental privacy benefit.
Real lawyers write in C++
Like Canada really has data worth stealing . Lol
Doesn't really help if the servers are in Canada but the people accessing them are in Mumbai does it ?
The people in Mumbai won't have the security clearance to access the data in the first place.
1/9th
319 mill/35 miill
there.....
I was often hired by provincial governments to develop technology strategies. The problem with laws like this is that it puts Canada at a technical disadvantage because it prevents the same government from purchasing from leading vendors.
For instance owiing to where they host their data, you cannot use Amazon AWS, and you can't even use most of Microsoft's cloud services yet (they have promised to create a cloud in Toronto and Montreal but haven't turned on the lights yet and even then you pay a premium).
All you can use are some low and Cloud providers or a highly overpriced IBM cloud which costs more than five times more than AWS while providing inferior service.
For cloud based mail you cannot use Google apps, and you can't even use Microsoft Office 365 unless you have at least 60,000 users which is the point after which they will consider hosting your data in Canada as part of your package.
So what you got in the end are self-hosted apps, and private clouds, which in general will never be as well managed or as feature-rich as what you would get from a large cloud provider.
The people in Mumbai won't have the security clearance to access the data in the first place.
They do tend to have the ability to manage the credentials to grant you access to the applications that consume the data. I've seen this approach leave massive holes in healthcare and outsourcing; where there are stipulations about keeping data in the country.
The GP's point is that physical storage/location is only one piece of the puzzle. Separation of duty as you describe is another, regular audits and monitoring, management of encryption keys, securing the network paths (there a lot of hops that bounce back and forth between the US and Canada), etc
Wearing pants should always be optional.
I just typed out my SIN into a file and encrypted it. I stored it on a server in Switzerland. Take that Canada
It actually sounds rather Trumpish.
Of course people will make excuses for them because they are a socialist utopia.
Whoa,whoa, lets not get carried away now. Sure, our dear Lords do provide us with subsidized Tim Horton's coffee "drink" and provide us with "health care", but they also force us to watch pugilistic hockey matches, won't let us purchase assault rifles all willy-nilly and force us to watch Celine Dion and Justin Bieber specials on CBC. I would hardly call it a utopia.
What business is it for other countries to have CANADIAN government data????
Because even though WINDOWS ANNIVERSARY 10 IS FREE
Microsoft is United States Government Spyware.
Some governments think this kind of security is a bad thing, and and wrote in a clause of the Trans-Pacific Partnership treaty to prohibit it.
See also http://www.canadianunderwriter...
davecb@spamcop.net
This is the GOVERNMENT's data. For that reason, for you who's attention span is 15 minutes, a year or two ago, the UK government decided against the cloud, because they could not be assured that UK government data would remain on UK government soil.
You disagree? Really? So it's ok if all of the personal and economic data, including your tax returns, winds up in a data center in China, or Russia, or, for those outside the US, in the US? And you're going to tell me that EVERY SINGLE PERSON who has login or physical access to *all* the servers and their storage has at least some minimal security clearance from your country?
Give me a break.
mark
Its often smaller sub sets of open or worked on data that gets pooled.
e.g. a cold call pretending to be a gov official with a limited list of personal information.
http://www.smh.com.au/business...
Domestic spying is now "Benign Information Gathering"
First I've heard of "sovereign control" which sounds like BS to me.
Anyway this issue has been around for a very long time now and isn't really all that complicated. I've looked into a number of cloud based systems as possible solutions for government projects, but they all run into the same problem.
Bottom line is that Canada has quite good Privacy Laws. The Government as custodian of a lot of personal information has a responsibility to ensure that that information is protected.
The issue first came about really as soon as the US passed the Patriot Act. It effectively gives the US government access to information stored on US soil (for a variety of reasons and methods), as it it subject to US law. So I guess you could call that "sovereign control"... but really all that means is that due to US law essentially not being compatible with Canadian law, it is required to keep things on Canadian soil.
There has been various attempts by US companies to get around this, such as providing technology and the means to host it yourself in your own cloud, but really that sort of defeats one of the big reasons for using cloud technology in the first place (i.e. you don't have to bother hosting it yourself or have to have the infrastructure to do it).
Anyway this issue has been around for a long time. The Feds probably just got around to adopting a "strategy" to guide consistent application of existing policy. I suspect probably because you had some rogue project managers using US based cloud services because it was easier and cheaper than going though the proper processes...
Digital Ocean has a Toronto Data center now, so no fucking excuse.
Should be the policy of all nations, countries, states and unions.