Switzerland: Data Protection Officers Impose Broad Cloud Ban for Authorities | Hacker News Reader

Switzerland: Data Protection Officers Impose Broad Cloud Ban for Authorities

heise.de

93 pointsTechTechTech45 comments

A lot of Swiss government services do not need to be available 247 outside of the country.

There is no need for the SBB (Swiss national railway) to use cloudflare or AWS when the same can be provided by a local provider that also has the ability to deal with large DDOS and cap off the outside when it comes down to the wire. It is more important for someone in Switzerland to be able to purchase a ticket than someone planning a trip from abroad.

>A lot of Swiss government services do not need to be available 247 outside of the country.

Obviously without talking specifics it's hard to discuss, but I'd hate to be a Swiss who was traveling abroad and had to access the gov website deemed "not 24/7" in an emergency of some kind (planning travel for the next day for the railway for example), or to finish something due to a goverment imposed deadline.

A swiss could be planning a trip from abroad.

quite shameful to me that SBB uses so much AWS stuff, considering the amount of IT workers it has. but what are you gonna do, MGMT hears about cloud being cheaper and better and proceeds to change the whole strategy. hope they'll seriously invest into own DCs again or at least use local providers.

considering how relevant SBB is to a functioning Switzerland it really feels like they should be in control of their own Infra.

> the same can be provided by a local provider that also has the ability to deal with large DDOS and cap off the outside when it comes down to the wire

Local providers often can be 2-3x to 10x+ expensive compared to hyperscalers for the same featureset. If you're willing to compromise on features, you can get down to 2x but with basically vendor lock-in and Swiss German support (!= German - which in Switzerland can fly if you're a medium-small company, but if you want to attract talent you'll need also English). I'm not sure there's any local provider capable of mitigating large-scale DDOS either.

Hyperscalers understood the need for local presence despite being located right across the border and in EU (Germany, Italy, France): Azure, AWS and Google all opened up locations in Switzerland in the past 3-4 years.

Basically every medium/big Swiss client I've worked for was or is still in the process of migrating away from local providers (even the big-S one) due to costs. Add to that that most companies use some form of AD and most were already using Outlook or the Office suite, you can integrate everything with less costs via Azure. If you are a big company and have multiple locations all over the world, you anyway also need hyperscalers to allow the team in Spain, US or India to interact with familiar tools.

EDIT: replying to the "local services, local tools" part: I wouldn't like to be stranded at 2am in Zurich kanton in some god-forgotten town I went to exactly once, because the SBB app relies on a local provider which has a small team of on-call people that still need to wake up. There's also people interacting with government services at all times, I've seen logs of people trying to access apps at 3:30 in the night. While I can agree it can be fixed the next morning, the question becomes: why spend more for the lesser choice?

It is funny that the article cannot be read without accepting marketing cookies

This cracked me up:

> a de facto ban on the use of these services as comprehensive Software-as-a-Service (SaaS) solutions whenever particularly sensitive or legally confidential personal data is involved. For the most part, authorities will likely only be able to use applications like the widespread Microsoft 365 as online storage

Since when is Microsoft 365 the bastion of modern privacy?

I get the impression that this is a temporary measure to ease the transition, not a statement about the privacy guarantees of M365.

This is good news.

At EPFL we observe worrying trends that all services are moved to Microsoft (e-mails, cloud).

What happened to universities to host elemental services themselves?

EPFL also partnered up recently with Omnissa Work Space One to strengthen security of IT on campus. Mandatory (American) software which EPFL IT office wants to install on machines...

École Polytechnique Fédérale de Lausanne, in case anyone else was wondering.

which is a university based in Switzerland and falls under those organizations?

I don't think they were challenging you, just expanding the acronym for HN readers who didn't know what it meant.

Known for example for the Scala programming language.

I'm impressed how USA companies became untrustful. Maybe this comes since Snowden whistle blowing, but it looks like the tendency is accelerating.

The case of Nicolas Guillou was an eye opener for many.

https://www.lemonde.fr/en/international/article/2025/11/19/n...

My first thought was that the sanctions are due to investigations into US presidents (like role of Bush in Second Gulf War or Obama/Clinton's role in Libyan Civil war) but it is due to Israel's PM. It's amazing how US admin is making their displeasure known in most destructive way (for their own and allies soft power) possible.

There are other cases:

Bush issued penalties for Brazilian judges that condemned corrupt ex president Bolsonaro

USA also stole Russian assets (as did before with Cuba and Venezuela)

You're implying that the Swiss government blames the American people for the decisions of the presidential seat, a seat with minimal actual power and three years left in office.

I disagree with your guess. This judge was making a statement about how it's wrong for Netanyahu to judge the people of Gaza by its political leadership. It wouldn't make sense then for the Swiss government to judge the people of America by its political leadership. Such a hypocrisy would make the opposite political statement.

I think it's most likely because of the recent AWS and Cloudflare outages having exposed the fragility of SaaS.

I don't see any reason to project anti American sentiment onto the article where there was none.

that ICC sanction that turned off that judge's outlook will be seen as the trigger point for the US reliquinshing its total domination of services (cloud and otherwise)

prior to that the risk of the US regime turning off its allies IT systems was purely theoretical

national data protection agencies will now ban their companies from storing data in AWS, Azure on GCP (eagerly egged on by their local competitors)

> I'm impressed how USA companies became untrustful.

They started stealing user data, at first discrete, then a bit more shameless and, this days, without even the slightest care.

Unfortunately(?), the original headline was just wrong. The DPOs did not impose a ban, the DPO community of Switzerland just recommended to move out of the cloud. This is not exactly news either, they have been leaning towards more restrictions for quite a while. But in most situations they can only issue recommendations, not binding rules.

The encryption requirement makes sense on paper, but it basically breaks the whole value proposition of SaaS. If you need true end-to-end encryption where the provider can't see plaintext, you lose search, real-time collaboration, most of the AI features everyone's been bolting on lately, etc. You're essentially left using these services as fancy file storage with your own crypto layer on top.

Which is fine for IaaS use cases - spin up VMs, encrypt your disks, manage your own keys. But for productivity software like M365? The Swiss government is basically saying "yeah you can use it but only in a way that makes it almost pointless."

The Cloud Act part is what really matters here though. US providers can be compelled to hand over data regardless of where it's physically stored, and they've been pretty clear they'll comply with US law over local data protection rules when push comes to shove. For a foreign government storing legally confidential citizen data, that's a real problem. I suspect this will get quietly ignored like the previous declarations, because the alternative is either building everything in-house or relying on local providers that frankly don't have the same feature set or reliability.

> If you need true end-to-end encryption where the provider can't see plaintext, you lose search, real-time collaboration, most of the AI features everyone's been bolting on lately, etc.

Proton has all of these features, despite being end-to-end encrypted. Search works well with their Mail and Calendar solutions, real-time collaboration is a core offering of their Document editor. It surely is harder to implement, but not impossible for many use cases.

And proton is a Swiss company operating under the Swiss Jurisdiction too.

The funny thing is that Proton is considering moving our of Switzerland, because of the new proposed surveillance laws...

https://www.swissinfo.ch/eng/ai-governance/proton-does-not-t...

The funnier thing is that they opted for Germany which as I understand have similar laws.

How do they do that? Either they 1) transfer your entire data to your system before searching, 2) use shoddy cryptography, or 3) you have to expose your private key to them. I doubt it's 1).

Apparently, it's (1): https://proton.me/support/search

There are obvious UX/performance issues, but it's an honest approach.

Based on link below:

> Click Enable to confirm. Your messages will then be downloaded from Proton Mail’s servers, decrypted, and indexed locally in an encrypted state.

They just download your emails into your browser and make them locally searchable.

I battled the same issue, in the end I have unencrypted data for fulltext search. But none of these are sensitive. I was thinking that maybe with AES, which is just a XOR, you could do search if you have the key as you just need to know how to XOR the search query and which phrases you can include. So instead of "hello" the XOR would yield "arpe5," and you just look for that in the db. But this could only work with exact matches or prefixes, it would not allow elastic search or anything complex like that.

> because the alternative is either building everything in-house or relying on local providers that frankly don't have the same feature set or reliability.

Neither of these seem like a terrible outcome. Relying on local providers would be better for privacy and would help the local economy. It would also push them to implement the remaining feature set and work on reliability - though I must sincerely question the idea that local providers cannot reach the same level of reliability - particularly when you throw in global network problems that affect the largest cloud providers but don't always affect the smaller guys.

> Relying on local providers would be better for privacy

This is a massive leap. Switching to local providers can eliminate a lot of imaginary threats, but opens the door to a lot of real ones, since most service providers outside of the big clouds have extremely weak or non-existent countermeasures against insider threats.

The threat profile changes, sure, but framing all the threats imposed by using large-scale foreign clouds as "imaginary", and every threat introduced by local providers as "real", is very disingenuous.

> most service providers outside of the big clouds have extremely weak or non-existent countermeasures against insider threats.

Another claim that needs some citations, please.

Anyway, many of those concerns can be addressed by security regulations, hiring processes, etc - which, I would guess, is a pretty critical part of why the large-scale providers supposedly don't have such threats.

Also, this thread is talking about the effects of US companies having access to sensitive data that they're more than willing to hand over to the US government. In other words... there are 2 major insider threats at every US cloud provider, from the perspective of a foreign government: the company, and the US government. That's mostly what I was referring to with the privacy bit.

whatsapp has e2e encrypted messages and searching works fine.

Realtime collaboration — assuming you use CRDTs — can be achieved with e2e encryption as well, with backend acting like a mere router of requests.

> The encryption requirement makes sense on paper, but it basically breaks the whole value proposition of SaaS.

Good. It's high time to flip the status quo on its head - instead of data being something we ship to specific cloud services, for them to lock it away and charge for access, it should be code that should be a commodity, shipped to servers of our choosing and granted access to operate on our data without owning it.

Just like regular, old-school desktop software, back in the day before SaaS was a thing. The provider didn't get to "see plaintext", because the software was operating on your hardware and not communicating with the provider. And if it tried to communicate back to the "mothership", we'd rightfully call it spyware, tell people not to use it, and wonder if there's legal action that could be taken.

> The Swiss government is basically saying "yeah you can use it but only in a way that makes it almost pointless."

this is the typical way governments ban things

they write the rules such as the thing they want are explicitly targeting can't meet them (rather than explictly banning something)

> relying on local providers that frankly don't have the same feature set or reliability.

what, as microsoft?

I can already write the headline of what this will be in five years...

"Swiss Government Moves Back to Cloud After Discovering Cleaning Staff Had More Physical Access Than IT Security Team"

You mean the cleaning staff of AWS, Google, or Microsoft? The goal is to avoid that, I believe.

This gets me wondering, who does the cleaning at data centers and such? Do you need to do background checks to swing the mop in there? Is there a market for high clearance cleaning personnel? (like with the extended PSP in CH)

My hunch is telling me there could be a couple positions with decent money (by normal person standards) for little work in that direction. Wouldn't be the first time I've been wrong though.

A good moment to point out that the infamous "cyber bunker", a data center catering to criminals, was infiltrated by a female police officer who managed to get hired as a cleaning lady.

https://en.wikipedia.org/wiki/CyberBunker#Documentary

Criminal organizations have the problem that they can't exactly run a background check. They need other criminals, and of course there's an obvious problem with that...

A professional enough criminal organization probably has a few paid cops to do this...

Yes, it's routine to hire background-checked cleaning crew, and some higher-security operations even require the company to put up an extra bond. One only needs a clean enough record, but I've known a few people in housekeeping with old drug convictions who still had no problem working in secure areas at defense contractors. When they would go into the secure area, there would literally be a flashing light with someone loudly announcing "INSECURE!", and everyone working there would lock their screens and basically go on coffee break. Obviously not a thing a server room has to do, but those have cameras watching the every move of the cleaner, the racks are in locked cages, and the cleaner has to leave any electronic devices they have in a bin at the door. It's not like they search them thoroughly, but there are severe consequences for getting caught, and they don't have or need much time to clean the server rooms anyway, let alone get away with espionage.

There's still a lot of mischief you could pull off with a cleaning crew, but facilities maintenance beyond housekeeping has a lot more opportunities.

The direction the industry has taken is not to hire elite mop guys, but to make physical access threats less and less relevant.

Probably you can employ cleaning robots quite well in server rooms.

I would be more concerned that many data centers in Switzerland are owned and operated by large foreign companies and some of their physical security is questionable. Not at all what you see in their ads and I would say you are only as secure as the least secure DC you have...

Reply on news.ycombinator.com