German state of Hesse has banned the use of Microsoft 365 in its schools | Hacker News Reader

German state of Hesse has banned the use of Microsoft 365 in its schools

techgenix.com

203 pointspndy115 comments

At the beginning of the pandemic Microsoft Teams was practically forced on everyone with children in Bavaria. With practically forced I mean you could either sign a document to get Teams for free or your child could not participate in online classes. A whole age group of children whose first online experience is Microsoft.

In my opinion we should start there: Instead of unrealistic bans that no one will ever enforce we should not pressure people to use privacy invading software. Instead we should teach our children the use of free and open source tools to accomplish their goals.

In settings where IT knowledge is usually lacking like in school systems, sometimes off the shelf vendor based solutions are better to administer and run than OSS or free tools. I can’t even name an open solution for Teams. The UI/UX is horrible but I’m slightly more confident in Microsoft than what I’ve seen from Zooms security and privacy.

Big Blue Button (https://bigbluebutton.org) is one. We actually used it at work for meetings but it seems they have since pivoted to be for more virtual classroom.

I agree though, even that would need decent IT talent to setup and maintain.

The problem is those free and open-source tools may simply stop existing and all the skills the students learned with those programs could become completely useless. Germany, somehow, is a decade behind most of the other Western industrial powerhouses in terms of digitizing. I think the constant flux and reluctance to just move on is holding them back.

> The problem is those free and open-source tools may simply stop existing and all the skills the students learned with those programs could become completely useless.

That's a really bad argument when history shows the inverse.

Name a FOSS program that no longer exists and I will give you 5 proprietary programs that suffered the same.

Even in the same lineage as Teams there is: Communicator, Lync and Skype for Business.

Now, they simply do not exist.

However I can still run `vim` from the 80s and OpenOffice from the mid-00's without issue, even if there is limited support: it still works.

We're talking about O365 as a whole, not just Teams. Chat in general is a bad example, because it's a product far more in flux and pretty easily replicated/replaced. Show me how not learning Excel is beneficial. Excel is one of the most important programs on Earth, and students should suffer by not learning it...and instead learn LibreOffice? Then they go to their jobs as adults and don't know how to use what most every other company on the planet uses?

When we discuss education, we must also look at what the world does, not just what we -wish- it did. It's cheaper for the schools to have O365 licenses than singular program license for various products that helps to power the global economy. Just like you wouldn't teach a kid command line on some new experimental OS, you'd teach them on UNIX or Windows, same thing. The whole point of schooling is to build real world skills. Much of the O365 suite is used widely, so are some GSuite products. It's just the reality, like it or not.

Even within the very well-worn "core" products of the MS office ecosystem: huge UI design changes de-skill millions of workers.

they're not optional.

https://www.cbsnews.com/news/find-commands-easily-in-word-20...

I can easily imagine a world where other office apps are shutdown, you have the golden children like Excel, Word, Outlook and Powerpoint. Which change UI and design language or change features over the years.

Then there's things like Office Whiteboard, VIVA, Bookings, Lists, Planner, Power Automate, Yammer, Sway. Who knows how long they'll last?- even mainstays such as Microsoft Access have been deprecated, and I bet you didn't know that you had half of those tools.

I mean, I learned graphics design on Macromedia Fireworks. Can I use that now? no. It was the industry standard for raster graphics that were not digital photos- but it's dead now.

Even staying with Excel: Excel on Windows and Excel on MacOS are similar, but not the same. Many features available on the Windows version are simply unavailable on MacOS.

Where-as something like Libreoffice Calc works consistently across platforms.

So, yeah, learning Excel only means that you're Microsoft Windows and Microsoft Office for your entire professional career.

Which is great for microsoft, because you will always take the pain of learning whatever they do over migrating to something else, due to the cost of retraining to more conventional standards.

You can believe whatever you want and come up with every excuse to support your world view but putting "proficient in LibreOffice" on your resume is not going to help you get a job or help the company. "Proficient in Excel" will. The UI of Excel isn't overly important, formulation is and as I said it's cheaper to pay the O365 fee than to pay individual licensing fees, so throwing out random product names that aren't widely used isn't helping your case.

Germany has struggled with digitization, sometimes it feels like you're walking back into the 70s when you're dealing with it. That is in part because of their traditional views (which can be good and bad) which aren't always in tune with how the rest of the global economy has already played out. I feel like every year I read about some Germany state or city upending their previous system to go to Open Source, then 2-3 years later see it walked back.

Your argument is "the status quo is the status quo and therefore it should remain as such because it's the status quo".

Appeals to continuance (perhaps because you have a personal sunk cost fallacy?) are unconvincing.

Your original assertion (that FOSS programs might go away) is a weak one for the reasons stated.

"Getting a job" is subjective, that depends on what skills are in-demand. I don't see many people putting "Skilled at Microsoft Viva" on their CV, and that's not because it's proprietary. It's because desired skills are borne from need, and there are network effects in those.

If nobody had adopted Excel and instead learned R and SQL, then you would be getting jobs based on listing them as skills. Not surprisingly.

EDIT: I should point out that businesses usually follow what schools do: the reason Java is so popular in Germany is because it's what University used to teach so it is (or was) a common denominator, Microsoft knew this and poured billions into getting Microsoft into Education in the 90s when I was coming up. That doesn't mean they get a perpetual license to continue in the event they abuse that position, which they do.

"Germany has struggled with digitization, sometimes it feels like you're walking back into the 70s when you're dealing with it."

From an outsider's perspective it's not only Germany but much of Europe is suffering from the same problem. The EU is such an all-pervasive force in Europe that one wonders why EU objectives haven't been set to rectify this. Why is this so?

I'll explain what I mean by example: if the EU would provide incentives to businesses, governments and schools to use say LibreOffice as well as finding a means to subsidize LibO's development including its potential developers then it would not take that long before LibO would not only be up to speed with O365 but potentially even better than it—in an environment nurtured by the EU, LibO could have thousands of developers.

Here's another example: there has never been a proper and comprehensive WYSIWYG HTML editor that's both open source and free. The closest we've gotten to that is BlueGriffon but one has to pay to get it to work properly. Even then, it's late on updates not to mention short on features and it uses quirky procedures and nomenclature. It is a primary candidate for such treatment by the EU. …And there are many more examples like these.

An EU-wide perspective would set the agenda for determining what are the most relevant/important aspects of programs to develop first, and so on. Moreover, both LibO and BlueGriffon are European based which ought to aid matters considerably.

I find it truly perplexing that the EU hasn't put a high priority on (a) developing a more robust software industry and (b) ridding itself of its dependence on US-based software.

If Europe had a stronger software industry then there'd be much less problem with the GDPR, using European software would ensure that user data would remain on servers located within Europe.

This ought to be a no-brainer, so why isn't it?

Meanwhile, my 500-person company switches from MS Office to Google Docs like it's no big deal. Because it isn't. Excel isn't the main skill, using spreadsheets is. Formulas, tabs, references, filters, sorting, pivot tables, scripting, blah blah blah.

Apart from Excel specialists with highly specialized workflows when the rest of your finance department is also using the same, nobody cares whether you're good at Excel. They just want something to easily tabulate rows and columns of data and get some insight of out if. LibreOffice does that as much as Google and MS.

Don't put "LibreOffice" on your resume, put "spreadsheets" and 95% of the time it won't make an actual difference anyway. You can learn the location/naming of most relevant functions of your employer's preferred spreadsheet app in a matter of hours and then you know several tools, which is always better than just knowing a single one and puts you ahead in other ways.

> Excel is one of the most important programs on Earth

Excel is just a spreadsheet program. It's hardly unique; there's one in LibreOffice. They all descend from VisiCalc.

The idea of a spreadsheet was a revolutionary invention (Dan Bricklin); I believe he failed to patent it. As far as I can see, Excel was just a GUI rewrite of Multiplan, which was supposed to be Microsoft's Lotus-123 killer.

> The whole point of schooling is to build real world skills.

That's called training, not schooling.

Basic technology skills easily transfer. All office software is similar, it does not matter what you learn. And even more important than learning this or that office package are fundamental skills about knowing the basics of what a computer is, how it works and what software is and what it can do.

What german schools need is technically competent people who are able to teach their students actually relevant information. The problem is that it is quite hard to find people who are technically competent and able/willing to teach. (This is somewhat of a structural problem, due to how the teaching profession is set up.)

The best part of my IT school education (in Germany) was when my school hired a professional software developer who taught programming for a semester. The worst part about it was that half the class clearly didn't care.

> Basic technology skills easily transfer. All office software is similar, it does not matter what you learn.

I had the benefit of being taught how to use spreadsheets. Not Excel. Not even 1-2-3. I also had the benefit of being taught how to use word processors. Not Word. Not even WordPerfect. The teacher understood that transferable skills had to be taught since they knew the product we were learning with would never be used in the workplace.

My mother was taking similar courses around the same time, only they were geared towards the workplace. She was provided with three books over an inch thick that walked the students through a particular product. One set of books for Word, then another set of books for WordPerfect. These courses didn't treat skills as transferable, and I'm sure a lot of students suffered because of that approach since I have seen many people freeze up or complain when presented with a product they weren't taught.

> Basic technology skills easily transfer. All office software is similar, it does not matter what you learn. And even more important than learning this or that office package are fundamental skills about knowing the basics of what a computer is, how it works and what software is and what it can do.

Exactly. The big problem with the current status quo is that kids are being taught that SaaS is how everything should work. You log in to your apps, save your data in “the cloud”, and pay forever. By the time they finish school many don’t even know how to use a local file system.

The opposite is the case.

Commercial software has a higher risk of becoming unavailable, because of missing licenses, acquisitions, insolvencies and other things that simply do not affect FOSS.

I have been using Audacity, Gimp, OpenOffice / LibreOffice, Thunderbird and Firefox for many years now and I don't see them disappearing anytime soon.

> I think the constant flux and reluctance to just move on is holding them back.

The reasons are not FOSS or privacy, but underinvestment and incompetence.

I still can't believe with all the other examples MS had they managed to make Teams the worst chat experience I think I ever used

From what I've read at that time here in Poland, the services weren't the problem - teachers either had a free hand in picking the platform to communicate or were told by local gov't which one to use. The problem was with some kids being able to attend this quickly deployed "cloud-run pandemic school" in first place. There were reports about the poorest families who couldn't afford a computer, whose kids had to attend class via phones or were simply called and instructed by their teachers about the curriculum. But that was eventually solved with schools renting machines and later with hybrid classes, which tried to give kids a substitute for normality.

We had already running digital services for schools - there were already remote reports with parents or logbooks, live cameras previews (tho some argued about the privacy side of such idea) but nobody expected we'll need the full remote education that fast.

Son of friends used Google Classroom; I've read about kids joining their classmates on zoom, discord or even facebook messenger

Good thing. During the epidemic the school our kids attend started to use Teams because no one managed to reliably set up BigBlueButton (not the school but some public county resource). I was the only parent to complain but after a lengthy discussion with the principal I finally gave in.

The Microsoft 365 office package cannot be used by companies, public authorities and schools in a legally compliant manner, at least not without additional technical measures. This is the conclusion of a current data protection assessment adopted by the independent federal and state data protection supervisory authorities at their 104th data protection conference. Users must take additional protective measures in any case, warns Federal Data Protection Commissioner Ulrich Kelber. (…)

The corrections are not enough for the data protection authorities. Microsoft has made "progress on individual points," Kelber acknowledges. However, the revised documents do not provide the necessary transparency as to which data can be used by the company "for its own purposes". The controllers are still unable to assess "in some places" what information and diagnostic values are still being collected and transferred to Microsoft. This also makes it impossible to check "whether all steps are lawful".

https://www.heise.de/news/Datenschutzkonferenz-Microsoft-365...

What a clickbaity headline. It's just about one state, and only for schools.

(The first sentence of that article is: "The central German state of Hesse’s local Data Protection Authority (DPA) has banned the use of Microsoft 365 in its schools")

It is a bit clickbaity.

But on the whole i'd say its warranted. Because these judgements are precedents which bind other DPA's.

The scope of the factual findings is broad enough to say that it affects any business using 365 handling personal data. That leaves only the question of legality in the specific case. Which depends on the presence and kind of personal data present in 365.

Data privacy agencies in German federal states do not rely on precedents set by other agencies. They have authority over how the law is interpreted in their federal state.

Coming back to the gp, this title is not only clickbait, it's outright wrong. Similar decisions have been made in recent years in other federal states, nothing has changed for the national state of Germany or businesses in Germany.

This is only partly correct: In so far as Privacy law is based on EU law the DPA has duty apply the law in a consistent manner. In line with the rest of the EU, that is to say. To avoid fractures and discrepancies in EU law.

Obviously these issues can sometimes only be decided at EU level. But the DPA's usually meet each other to discuss and align on contentious issues. And at other times they wait for EU level judgements.

What's worrying in this case is that it's becoming a trend.

> precedents which bind other DPA's.

They aren't legally binding. Neither are they in practice. The German DPAs alone are famous for bickering between one another.

They have a duty to cooperate though: They cannot disregard other rulings.

Conflicts interpretation and by extension conclusions are typically finally resolved at the EU level. When there is bickering.

In practice you see this happening at several levels, in France as well as in Germany there are bans on 365. And in separate states in Germany. etc..

I expect this will come to a head at the EU level.

And I'm nervous customers will move away from 365. Because Azure AD integrations will then need to be replaced. But I suspect things won't move quite so fast.

What I'm wondering is, how is office 365 really any worse than Windows 10/11 itself?

I am also wondering this. But I hope it won't move quite so far or fast as to ban Windows.

Oh, this would be absolutely great and a day to celebrate for me.

Just imagine how lovely things would be if regulatory pressure forced Microsoft to make Windows 12 as non-user-hostile as Windows 7. A man can dream...

From the article:

  Germany’s Federal Office for Information (BSI, in German) has already expressed concern that Windows 10 and 11 operating systems collect telemetry data, including typing data and even speech-to-text.

  In response, German and French public schools switched to Linux operating systems and other Office 365 alternatives for their educational needs.

Meanwhile, Polish gov't uses Microsoft Teams [1] as one of ways of verifying citizens who are applying for trusted profile service.

[1] - https://moj.gov.pl/uslugi/engine/ng/index?xFormsAppName=Wnio... (in Polish)

> Meanwhile, Polish gov't uses Microsoft Teams [1] as one of ways of verifying citizens who are applying for trusted profile service.

Preface: Teams is horrible and it's super bloated for a simple chat app, but it's a mainstay for remote work along Slack and Zoom unfortunately.

It's still better than the architecture using ID.me they built for unemployment benefits during COVID which in FL was subsequently hacked and leaked all kinds of personal info (that was already leaked with Equihax). The CEO then brazenly said it was not his company's responsibility to secure for attacks from hackers!

> The DEO hired ID.me last spring, an identity verification company, in order to confirm the identities of agency clients when they access their CONNECT accounts. However, ID.me was not hired to protect against hackers. Nixon said the DEO recommends that victims of the hacking “monitor their financial accounts, and if they see any unauthorized activity, they should promptly contact their financial institution.”

This kind of nepotism has to be called out for the crime that it is, good on Hesse for taking the initiative to do so, lets see if they move to FOSS. The Libre suite does everything word used to do without all the cloud BS that makes it entirely un-useable if you have ever spent 10 mins using a Linux distro.

I just found a quote from a ID.ME rep on their subreddit [1] that 'didn't age very well' as they say in light of what happened soon after:

Security and the protection of our users is our BIGGEST concern. This is why we are very much user based. Any information that we have is sent through users. You are able to revoke your accounts at any time. We have security teams that work overtime to make sure hacks and fraudsters do not happen. Thorough investigations and screenings happen on the backend to protect our users.

And it gets worse in 2022 [2], they swapped CEOs but the MO remains in place: fleece pubic agencies and lock people out of their UI benefits.

0: https://www.bocaratontribune.com/bocaratonnews/2021/07/hacke...

1: https://www.reddit.com/r/IDmeSupport/comments/n3exk9/comment...

2: https://www.techdirt.com/2022/01/24/biometric-tech-company-i...

Why the teams hate. I personally find it the best conferencing tool for recurring cadence

It’s a resource hog.

I don't know what the experience is like on Windows, but on other platforms it barely works. Super buggy. Super flakey. Super slow.

The audio in conferencing also renders it unusable.

It's also quantitatively worse than the alternatives in every meaningful way.

Takes 520 MB right now for sitting idling in the background. That's how well it runs on Windows...

That's 6.5 % of available memory of a computer with 8 GB of RAM.

That's not a lot. No one bats an eye when Firefox uses triple that amount sitting idle with 5 tabs open, because Firefox is Not Evil.

Firefox can do a lot more than Teams can.

That's akin to saying a car is more impressive than a nuclear power station because it can go to such interesting places. Or something something apples and oranges. Point is, my analogy may be bad, but it's not as bad as comparing Firefox and Teams in terms of what they do.

I don't understand your point then.

Yes, the thing that consumes more resources uses more resources. Because it can do more things. People are also mad about that btw.

Saying "well, x uses more than y" where `y` in this case is using about 5x more resources than its contemporaries is just an insultingly weak argument.

So when you open 5 tabs in Firefox it uses over 1.5GB of memory?

I find that hard to believe.

You make it sound like it's fine for an application that has network i/o in the few KB and miniscule UI refreshes when idle to consume that amount?

What % of your RAM did mIRC use back in the day? I bet it was several times that amount.

Define back in the day?

mIRC used to use ~2MiB when I had 256MiB in 2003 and I was in a lot of channels.

I know this because I used to count every megabyte of usage back then and MSN Messenger with the "animated images" was the real hog back then.

15.75%, for an app doing nothing in the background and a trivial set of data to work with, unless you meant 16 GB. Install just 5 more applications with that same development philosophy and an 8 GB machine is already swapping, which is ridiculous.

Most of our systems here are equipped with 8 GB only, where it's 15.75% as said by somebody else.

With everything else that runs, you're out of RAM pretty quick: Our production software takes around 1 GB when running, Firefox/Chrome with a few tabs, Acrobat Pro...

I'm lucky that I've received an upgrade to 16 GB because I need special software for my work. For the next system I'll ask for 32 GB and 16 GB for my teams. Don't understand why the corporate IT is so sparse with RAM...

> Most of our systems here are equipped with 8 GB only, where it's 15.75% as said by somebody else.

520/8192 = 0.0635

Teams uses sqlite to store data. Are you able to use Process Explorer[1] to see how much of the 520MB is the sqlite file mapped into memory, if sqlite memory mapped IO has been enabled[2]

[1] https://learn.microsoft.com/en-gb/sysinternals/downloads/pro...

[2] https://www.sqlite.org/mmap.html

I haven’t used teams that much, but one annoyance I found immediately is that it uses the lowest resolution of my webcam and doesn’t offer a way to change it to other resolutions. Slack and FaceTime both work fine with the same camera, but with FaceTime it looks like I have a camera from the ‘90s.

In Firefox it is not a conferencing tool

or safari.

Audio quality is very poor by default (you can switch in better with a setting).

Uses a lot of memory and is slow

Frequently crashes my machine

The UI for discussions I find poor. No one uses the "teams" concept and everything is done in private chats.

User mode apps that crash the machine are not the app's fault. It's your machine's fault. You either have buggy drivers or faulty hardware.

This happens on multiple machines (on my macbook and my windows PC). It's not buggy drivers of faulty hardware.

> the best conferencing tool for recurring cadence

What does this mean?

He means having a video call linked to a recurring meeting.

> What does this mean?

Apparently it's corpo/PM speak [0] for meeting #'s, which judging by his stance on the poorly reviewed Teams app so far makes me think that MS product market fit strategy worked in this case: it knows who it built Teams for.

Just look at who this is aimed at:

> Where the Action Is is a book for leaders seeking to make sense of their meetings and master their business.

0: https://www.lucidmeetings.com/meeting-types/team-cadence-mee...

It is super slow. Just a basic thing like switching between different chats or teams takes ages.

> Why the teams hate. I personally find it the best conferencing tool for recurring cadence

Ha!

Even though I know this was addressed to me, you clearly opened the floodgate on the very vocal customer complaints section on HN that has clearly struck a nerve with many more than you anticipated chiming in.

With that said, yes it's full bloat and sounds like utter crap even with audio only on every time I've ever used it; I typically use Signal and only revert to conventional apps for work purposes and it always struggles worse than the other.

> Why the teams hate.

This comes up all the time, to the point where I think people are running different versions of Teams. I would be interested in exploring that angle tbh-

For me:

* The client is "heavy" when compared to contemporaries.

It isn't uncommon for me to need to choose which "essential" apps to turn off to get something done on a maxed-out MBP. So Teams gets turned off, and maybe someone gets annoyed that I don't respond to something, while I run a few VMs in Teams' former memory space.

That aside: why should I severely impede my battery life, cause my fans to spin (audible discomfort) or create discomfort due to heat on my lap: for an app where there are better alternatives that don't do that?

* Web version only works with Chrome.

Firefox, Qutebrowser, Safari have severe limitations. Safari needs to have some security controls disabled globally otherwise it won't even open.

* Notifications are absent or overly-verbose

I miss notifications that are timely and important on the App (like calls which get forwarded to my phone) but an unrelated message on a topic somewhere else will get "promoted" to me.

* UI design leaves a lot to be desired, things are all over the place, finding things is hard.

* New UI refresh for meetings is "top heavy"

Most Video Conferencing programs are trying to make it so that you get close to eye contact with other participants (behind screen cameras in phones for example!); But for Teams: lots of elements are loaded in the top bar which makes people appear to be looking down at something, because the subject they're looking at is lower down on the screen. This is the only video conferencing program to do this.

* Video quality is very low compared to contemporaries.

* Screen Sharing is extremely low quality too

You have to really bump the font point, they've recently added the idea of "content awareness" too, as in sharing Powerpoint slides directly from OneDrive, but it's janky as hell.

* Whiteboards are some kind of extra application which has to be enabled - acts like an external website, not at all integrated and does not live at all with the meeting.

* Having external people invited still requires you to manually allow them into the room (unlike Google Meet, which treats externals that you allow as part of the meeting)

* "Teams" are linked to Sharepoint and will cause Chaos with Onedrive and Sharepoint if you don't remember certain things: like uploading something to a channel will drop it in a weird folder with open permissions, or that "private teams" make brand new sharepoint sites: your org probably has hundreds of these.

* The Client randomly hangs on my machine during meetings (freeze, blocking all incoming and outgoing audio/video) My machine is a Threadripper 3970x with 256GiB of ram: there is no fucking way it's due to resource exhaustion.

* the latency in audio is at least 3-5x higher than contemporaries

* when attempting to launch a meeting in a hurry, it's almost as if teams knows and spends 30s loading. I suspect there is some "Join now" function for a meeting in progress that is actually causing an adverse affect here as I've been able to repeatedly measure this problem.

I suspect that some of these issues are because I'm in Europe and the servers are hosted in the US. It could also be because I use Linux and MacOS.

I often also find that _people who like Teams_, have only really used other Microsoft collaboration tools in a professional setting. (Or worse ones that are known to be worse like AT&T Connect.)

I am also not a huge fan of how they push Teams on people by embedding it in everything else, you could argue that this is vertical integration: but a lot of things do not integrate well with Teams, even outlook (for an example of better integration just look at recorded meetings and presented content in google calendar! it backfills the meeting with the recorded content so you can easily see it! outlook doesn't do that!): https://blog.dijit.sh/teams-microsoft-monopoly

> I personally find it the best conferencing tool for recurring cadence

"Best" is so insanely subjective that it's difficult to answer this.

Audio/Video Quality and ergonomics are better with Google Meet: but Jitsi works absolutely fine on recurring meetings: you just put the link in the meeting request.

To the extent that I'm forced to run Teams by my coworkers' choices, it sure would be nice if it were less of a bucket of ass.

Onboarding alone is enough for plenty of hate. What feels like half a dozen competing SSO systems trying to highjack the funnel, each of them gimped by two other internal Microsoft factions trying to shove in their upselling path. And of course with a Byzantine form flow through the full set of desktop client, OS-level Windows user identity management and multiple browsers (system default, Edge, and iirc occasionally even that pre-webkit edge, perhaps popping up because of some activeX zombie). I recently had the pleasure of participating in a one-off teams call (project handover to an external consultant), from a company network that runs on Microsoft but without 365 and no routine Teams usage outside of some unrelated division, with a non-Microsoft browser as the system default. A day to remember. Spent hours between the onboarding labyrinth and a pre-existing private account that was almost but not quite accepted by the Microsoft maze, before I eventually got in dusting off some ancient Skype account. Yeah, that Skype, the one I stopped using around the time I quit ICQ.

Couldn't just use the join as guest in a browser mode?

In Spain they use Zoom for the same thing.

It's really astonishing how governments, especially the European ones, don't cluster on open-source and self-hosted resources for all of these things. To be honest, I know the "easy answer" to this: "IT consulting firms, incompetence, bureaucracy and corruption", but even with that, it should be possible to do it with open system and not just rely on some other countries even for the software.

Neoliberalism is super entrenched here. It is almost impossible to create a state/county/municipal IT department that would actually have enough sysadmins. All such departments rely almost entirely on external suppliers. One way this happens are salary controls. It is impossible to hire someone and give him the market rate, but it is trivial to tender the work associated with such position to a random external company for thrice the market wage.

This effectively means that the critical advantage of FLOSS - just install it and see if it works for the users - is effectively killed by the red tape. Only software that someone actively sells can ever make it through.

EDIT:

And to be clear, this is not about customer support and whatnot. Number one complaint from most of the public servants who contract out IT services have been that the suppliers are not helping them, are overcharging them and in some instances they even threaten and withhold documentation and read access to their software databases.

> Only software that someone actively sells can ever make it through.

Only software that someone actively supports*

No I think it is the sales that counts. That 200k salesperson will of course make PowerPoint decks showing all the support options. But, the main barrier to take is convincing 10+ people with different incentives to all sign off on your product, and that is what enterprise sales gets done.

If you show up with a PowerPoint deck to use as evidence for your competitor to Microsoft Office you’re off to a bad start

Can concur. A software project could be feasibly implemented in-house but in-house technological teams are both under-staffed (lots of "teams" of just one or two people) and the staff themselves have much lower salaries compared to a similar role in the private sector. As a result, there's no incentive for technologically competent staff to stick around and provide support for software/systems that they implement.

On the other hand, there are very large budgets available for purchasing software with support contracts and even more so for IT consultancy services. In practice, this neo-liberal push to outsource rather than develop in-house capabilities results in all sorts of inefficiencies and deficiencies in the ability of public servants to provide a quality public service.

I worked with European firms for over 5 years, from the company who makes lenses for ASML machines, European telcos, to well known German shoe companies and groceries stores, and luxury French brand conglomerates. They all had slightly less than 0 IT knowledge and outsourced almost all IT work to contracting companies.

I’ve seen large contracting firms get the boot for pulling the let’s withhold docs to get another large change order for producing said doc. It’s BS games.

Indeed, maddening, especially as the wonderful https://mediasoup.org/ is developed here. Europe will never have great tech companies when the answer seems to be throwing €€€ away instead of investing locally

Huh? Rolling some bespoke conferencing solution instead of just integrating an existing commercial solution is the definition of waste.

Navel gazing at open source isn’t a great use of the limited resources of the taxpayer. There’s 100 other priorities to expend resources on, many of which have a meaningful open source component.

>Meanwhile, Polish gov't uses Microsoft Teams [1] as one of ways of verifying citizens who are applying for trusted profile service.

What's wrong with that?

Microsoft is trusted vendor

They’re specifically not trusted: the CLOUD act makes them untrusted.

The state of Hesse, not Germany. Data protection is overseen by the states, not the federal government.

Also the scope is limited to schools.

Headline is somewhat... hysterical.

True. However, the situation is not limited to Hesse, but also data protection officers in Rhineland Palladia made the same call: https://www.heise.de/news/Rheinland-Pfalz-Schulen-duerfen-Mi...

Meanwhile in Hungary someone breached the system used by every school for kids between age 6 and 18 and walked away with everything. We are not just talking of grades but all the personal data, disabilities. Teachers HR data too. Oh and also the source code https://thedailywtf.com/articles/hungry-for-an-education

For office webapps "local servers to store customer information" is not the solution IMHO. Spreadsheets and documents in general can store arbitrary data, including personal information. If MS's customers are told that documents are stored in the USA they can't store personal information in there and I don't understand why this should apply only to schools and not to companies in general.

A solution could be creating a German company using German servers, licensing Office 365 from MS and also paying it to maintain those servers. That should put the data out of the reach of the CLOUD act.

Misleading title. It's not all of Germany it's one state AND it's not a general ban just a ban from schools.

> "The central German state of Hesse’s local Data Protection Authority (DPA) has banned the use of Microsoft 365 in its schools, citing concerns over privacy violations"

> Dropshippers and other online entrepreneurs may want to conduct business outside non-EU countries

That doesn't seem to make sense. Do they mean "in non-EU countries", or "outside EU countries"? Has my reading comprehension failed me?

Both of your options mean the same thing, and I don't think it means either of those but the opposite.

even though currently just one state is implementing that in Germany, that decision shines out. France has recently imposed a similar ban.

I don't understand, why this service cannot be provided from an EU data center. Every hyperscaler has these, MS also.

I need to vent off some steam here. It really bothers that whenever I use a piece of Microsoft software like Teams or if I accidentally login to edge to use some MS service like Minecraft, Xbox etc., it logs me in to a MS account locally. It's infuriating. I can still undo it by going to settings and logging me out of all apps, but I bet there is someone in MS thinking well right now how to silently remove that option as a part of the next batch of updates (and all reasonable people always update their software to stay secure, right?).

Good call, I'm using a software firewall on Windows and the number of unnecessary requests it makes for gaming services, widgets I haven't used once and telemetry is surreal

yes this is very relevant to o365. /s

Actually... the title say Microsoft 365. Assuming the title is correct M356 can include Windows 10 (and shudder 11) licenses.

Great! Now if only more institutions would wake up and follow suit.

There's always the option of collecting LESS personal data.

I note that this was published in September, has there been any follow up? I did search but didn't find anything.

No, the decision was taken yesterday, it counts for all german Bundesländer and will be published today - if if if Bavaria will not hold back the publication.

Its not one Bundesland, but all 18 data protection officers of 16 Bundesländer (federal states; Bavaria has two) plus the Bundes… one. Kind of #Zeitenwende, but in german style. Right now the decision ist not in public. Speaker of Bundesdatenschutzbeauftragter Ulrich Kelber refuses to inform public….

https://www.heise.de/news/Datenschutzkonferenz-Microsoft-365...

Maybe they should deploy it via Constellation https://github.com/edgelesssys/constellation

Ohai, who should deploy what via Constellation? :)

Who are "they"? Microsoft?

The issue is not a technological one but a matter of legislation.

Yes and no. It's a technological problem in the sense that there is a technological solution to this. See the Delos Cloud for example: https://www.handelsblatt.com/technik/it-internet/delos-cloud...

However Confidential Computing and Constellation unlock another technological solution where one can run IT infrastructure while being completely locked out and without access to the any of the data. Ensuring data sovereignty for the users and without building physically separated data centers.

I so understand why anybody would use Microsoft products anymore. You can do all that and more with Linux and SaaS products that works in browser.

What they'll choose as alternative?

> The central German state of Hesse’s local Data Protection Authority (DPA) has banned the use of Microsoft 365 in its schools, citing concerns over privacy violations.

The state of Hesse. Not the 'whole' of Germany. The clickbait title has worked its way to HN unsurprisingly.

MSFT should be leading the way.

In what universe do they need to be collecting data from kids, especially that which cannot be kept locally.

Telemetry data (which I suggest is reasonable that they collect) can be stored in local 'log' style DBs. It's not data they need to repatriate.

Although for login and identity management, it might be reasonable to have that quasi centralized for security reasons. While MS could afford to build for each country, almost no other companies could.

Finally, we need to be wary folks: this is ultimately a kind of regulatory capture.

I'm already working with small startups that are struggling with this - they have customers unwilling to have their data stored in other countries and it's a giant problem.

MS and G can afford to deal with it, startups, not so much.

Edit: Gosh I wonder if that's an PaaS opportunity right there, aka 'transparent nationally stored data' ...

If the customers are unwilling, how is this regulatory capture vs customer protection?

Customers are the entities subject to the regulations and therefore making the demands.

Notably, a lot of it results from a new shift in perspective aka they are developing internal security policies consistent with those regulations.

None of this is entirely irrational - when the Internet was born, I was actually shocked at the ultra liberalism of it.

I remember thinking Google's objective to 'organize the world's information' to be a big gliby arrogant - because what kind of person would believe that data in other nations was their right to manage?

In hindsight I'm thankful that it was 'open' because my purview was a bit too narrow, that said, I'm having a 25 year 'I Told You So' moment and I do think we need to find an equilibrium.

MS, G, AWS will end up offering local datacenters operated by local companies owned by them. They'll cost a little more.

I'm actually expecting they'll be forced to have local ownership of the datacenters as well, but probably with some kind of peering agreement with the global company. Is this the start of something like datacenter franchising maybe?

Yes, I expect that they'll 51+% own those local companies, maybe not the datacenters (there are plenty of them everywhere.)

MS, G and AWS have locally incorporated entities. Google in Germany is 'German'.

Microsoft tried, using some Deutsche Telekom subsidiary as data processor. They sunset it.

Data sovereignty is here to stay, no matter the push back from Silicon Valley.

A government would be stupid to hand over all their citizens data to the US via US technology companies.

There should be two directions of attack on this issue. Legislation to try and force US companies to legally protect personal data of citizens from other countries. And to build competitors to Microsoft, Amazon etc.

Obviously creating a viable competitor is hard, and has been badly neglected. Not least because any non-US competitor would have to fight the US Government itself which would attempt to protect the US tech companies dominant positions.

I'll take the GDPR and other countries attempts at the legislative route as a start however.

This is mixing a few streams.

"A government would be stupid to hand over all their citizens data to the US via US technology companies"

They have been for decades in some cases, and where is the problem, specifically?

It is possibly one of national security, less so one of companies selling data for advertising and other reasons because Slack and MSFT are reliably not doing that, and contracts with companies can make that clear. If the contracts are breached those companies can be wiped out - just the same as any other commercial issue.

So yes, it's reasonable for companies to want to have some data hosted within their own countries, but it most cases it will not matter.

For instance, kids classroom telemetry data in the US vs. Germany will make absolutely no difference.

That data is as 'safe' in the US as in Germany so long as there is a contract in place to specify how that data can be used. MSFT has no very special leverage with customer data in the US as opposed to Germany, if they are contractually bound.

GDPR is a lot about protecting users from willy nilly use of their data which is a different question that national security and other legal issues.

Theoretically, there are some concerns about US spy apparatus, but I suggest that if the CIA wants to access data in what the US deems to be in a 'lawful manner' - that having the data hosted in AWS outside the US won't make a huge difference. That kind of protection would require yet another level of thinking.

I wonder how many Billions or Trillions the GDPR costs European companies.

Pretty much every company has to fight with it. Hire lawyers, change software, implement "cookie banners" etc.

The craziest part is that the GDPR has a competitive disadvantage for European companies built in: European companies have to show cookie banners even for users outside of the EU. While non-European companies only have to do so for users in the EU.

> I wonder how many Billions or Trillions environmental protection costs companies.

> Pretty much every company has to fight with it. Hire lawyers, change machines, implement "dangerous waste disposal" etc.

> The craziest part is that environmental protection has a competitive disadvantage for companies built in: Companies have to demonstrate their pollution prevention even for users outside of the EU. While non-European companies only have to do so for users in the EU.

Analogy aside, no company has to show any banners, you just have to respect your users rights to privacy. All companies may use as many cookies as they want as long as they're strictly necessary for the sites operation.

I know a bunch of startups and they all struggle with the GDPR. None has any issues with environmental protection.

"just have to respect your users rights to privacy" is easier said than done. I don't know a single startup that can say for sure they are GDPR compliant. It's not just "don't use Google fonts". It's really hard questions like "Do we have to replace all our non-EU infrastructure like our CDN, our payment provider, the SaaS services we use with new infrastructure ran by companies in the EU? How do we find those? Do they even exist? Do they work well for non-EU users? Are they compliant? How do we check?".

Reply on news.ycombinator.com