Hacker News Reader

Comment by BartjeD | Hacker News Reader

In the Netherlands, critical infrastructure is required to be hosted in government cloud data centers.

An exception is possible if after a risk assessment and the determination that no state secrets may be exposed, a government body decided to use a commercial cloud provider.

The private cloud providers list is then filtered by whether or not their country of origin / incorporation, or effective control, has an effective cyber-control program it runs against the Netherlands or against Dutch interests. This arguably includes corporate espionage programs.

View on HN

Storage and processing location is a big, big trust issue on the world stage. There are all sorts of wobbly notions of alignment. And no doubt lots of leverage going on behind.

If you made a democratic poll and asked people, "would you like national data stored in your own country or elsewhere?" there would be no ambiguity in the answer. And that would not be an "uninformed" poll, since matters of public trust should direct policy and not technics and economics.

Of course there are good reasons for outsourcing, like geographical diversity, but those raise a new and I think separate questions like "Who would you trust with our backups?". That nuance of examination seems to be missing in the UK at present.

> "would you like national data stored in your own country or elsewhere?"

And if you ask the question "how much more would you pay to host UK data in the UK with UK owned providers only", you get the answer £0. So it doesn't happen.

Yes. I mean it's a fair objection to that question as is. Many people expect technology to happen magically and for free. When it comes to critical infrastructure like roads, reservoirs and the army, nobody asks "how much would I pay?", because people elected a government to make those decisions and raise taxes appropriately. Ironically one big missing source of income is fair tax on overseas tech. Although we have a body that recognises digital as critical national infrastructure [0], some people in London haven't got the memo yet.

[0] https://www.ncsc.gov.uk/news/ncsc-warns-of-emerging-threat-t...

https://www.notifications.service.gov.uk/features/who-can-us...

* central government departments

* local authorities

* the armed forces

* the NHS

* the emergency services

* GP surgeries

* state-funded schools

looks quite critical to me

Yes, personally I don't think it's a good idea to host these things with the US companies. As a citizen I prefer it's in my own country, unless it's really not critical or interesting information / services.

The UK made a different choice.

Is the gov.uk website infrastructure compliant with their own Cyber Essentials requirements? I very much doubt it, as the anti-malware requirements applicable to cloud providers that are not using Windows or MacOS ([1], section 5, subsection "Requirements", option "Application allow listing" on page numbered 14 in the corner) are not implementable as worded. Using Azure instead of AWS could have helped here.

[1] https://www.ncsc.gov.uk/files/Cyber-Essentials-Requirements-...

> GOV.UK Notify makes it easy for public sector service teams to send emails, text messages and letters.

Doesn't seem that critical to me. Important, but doesn't pass the sniff test of "is this a matter of national security" that would justify self-hosting ultimately slowing down development and making it more expensive and in effect less feature-rich for taxpayers

EDIT the API docs suggest this is used for sending formal Notifications en-masse rather than mission-critical comms

The kinds of messages that get sent via email or text are usually pretty unimportant. Important things tend to be sent via letter or a phone call.

It's not likely to be anything critical.

Gov.Uk Notify does support sending letters (as well as email and SMs/text messages): https://www.notifications.service.gov.uk/using-notify

In Norway, I received my residence permit by email, and I mean the official document.

I stressed a bit when after a year I was trying to find the paper letter, until I eventually realized xD

You should also add GCHQ, MI5 and MI6 who all use AWS to host top secret material (https://archive.md/n2cNB).

As an IT professional, I would question whether that makes sense.

But what do I know? I'm sure the people who run the country -- people of the calibre of Liz Truss, no less -- know what they're doing!

Reply on news.ycombinator.com