Data sovereignty: who owns that elephant in the room?

So your organisation runs entirely, or almost entirely, in the cloud. That’s the way these days, most larger and even many small organisations do. Owning your own servers is a rare thing, and there are quite a few practical reasons for that. But with that move came consequences, and that is what this talk is about.

There are stickers that jest “there is no cloud, just someone else’s computer”.

If your systems or the services you use are in the cloud, so is your data. And that usually also means other people’s data, such as Personally Identifiable Information (PII), healthcare data, education details, and so on. Let’s focus on that, because it makes the topic less abstract.

Who has control over that data? Who can access it? Would you know if someone were to access it without appropriate permission? What if an agency to which your cloud provider is a subject by law asks for access to that data, but also requires that that cloud provider does not tell you? What are the restrictions on that? Can the rule of law break down so that those restrictions no longer work?

Far fetched? It wouldn’t happen? If you were a betting person you’d lose on both counts. But an organisation doesn’t bet, does it? So then, we must talk about risk, and to be able to assess that, we need to figure out (as exactly as possible) what the threat is.

If a company that is based in country X offers their service hosted within Australia, what does that actually mean?

Is there a problem, if so what is it, and where do we suspect threats might originate?

Is there a way to work around the problem (alternatives), or mitigate it some other way?

The CISO of the Dutch Electoral Commission, Fleur van Leusden, recently suggested that so-called “sovereign clouds” might be “vegan chicken fillets”. What they meant with that was: if the parent company of the cloud provider is foreign, how local or sovereign is the local cloud? It’s a valid question so we will look into that too.

Or, maybe, there is no problem. No elephant. Nothing to see.