Gov’t criticized by tech companies on cloud strategy for sensitive data

In the lead-up to a meeting with Amazon.com Inc., the government was informed that it was facing criticism for its handling of its cloud-first policy for sensitive data. Last June, the government said it would test whether commercial cloud services could adequately house Protected B data -- which the government defines as information that, if compromised, “could cause serious injury to an individual, organization or government.” A procurement process is underway to qualify providers who meet the security and privacy requirements to house that data, the Treasury Board Secretariat (TBS) said in an email last month. The government published its cloud-first policy in 2016. Yet in undated briefing notes -- made either in September and October last year -- prepared for a meeting with Teresa Carlson, vice-president of worldwide public sector at Amazon, Innovation Canada noted that “several large scale vendors have been critical of for not utilizing cloud services at the expected level, primarily due to protocols around ‘protected’ and ‘secret’ documents.” The notes, unveiled through a Wire Report Access to Information request, do not specify which vendors were critical. “The issue of housing Protected B and classified data is under review, and a separate procurement process for cloud services to handle higher data security requirements at a later date,” the notes added. ISED and TBS, which works with Shared Services Canada to distribute money for cloud projects, did not specifically address a question about whether the review will include “classified data” -- a higher level than Protected B -- as written in the notes. The TBS, however, said in an email that national interest data, such as classified, secret and top secret, is currently not allowed on the cloud. The government categorizes data based on levels of security. Protected B data is below classified, confidential, secret and top secret on the security rung. The Treasury Board said the Protected B cloud “initiative is at the design stage as the foundational business and technical elements are being assembled.” On Wednesday, Bloomberg reported that millions of Facebook Inc. records were exposed to the public via Amazon’s cloud servers. It cited cybersecurity company UpGuard, whose director of cyber risk research at the California-based outfit, Chris Vickery, has previously appeared before a Parliamentary ethics committee to talk about Facebook’s past breaches in relation to Cambridge Analytica. The Bloomberg story said Facebook contacted Amazon to close the void. UpGuard wrote on its blog the situation exposes the “inherent problem of mass information collection.” Last year, a closed-door meeting was held to discuss a federal data sharing strategy, the notes and summary points of which were revealed through the same access request. The meeting included officials from Amazon, the Council of Canadian Innovators, the Institute of Governance, the Information and Communications Technology Council (ICTC), Commvault Canada, ISED, Statistics Canada, Public Services and Procurement Canada, the University of Ottawa, Invest Ottawa, and the Centre for International Governance Innovation. The meeting was held around the time the government announced its national data consultations. The meeting notes said that “additional opportunities exist to leverage private cloud solutions for classified data to further simplify infrastructure while gaining financial efficiencies and access to leading edge analytic tools,” adding there are good examples of private cloud adoption for sensitive and high value information in government and the private sector. The notes use the example of U.S. bank Capital One, which is migrating its process and product development to the cloud and reducing its data centres. Based on its “demonstrated robustness,” such as enhanced security, the cloud is “becoming the new normal, even for storage of the most sensitive information,” the notes said. A previous version of that meeting was held in November 2017. The notes from that meeting, also obtained through the same access request, noted that “too much data is currently considered classified, creating a barrier for sharing and using data to improve citizen services across government.” Salesforce, a cloud-based software company, notes on its website that the cloud has other benefits than just security and fluid movement of data: it also allows for automatic software updates and can improve analytical insight from data collection. It also has a contract with the government for cloud services. Amazon currently provides the Canadian government with cloud hosting services, under the AWS monicker, for unclassified data, such as archived material, government-generated open data and big data sets by the scientific community. From December 2017 to May 2018, Shared Services awarded eight cloud service providers with contracts to host unclassified data. Those companies included Microsoft Corp, Alphabet Inc.’s Google, IBM Corp., and Amazon’s AWS. While the contract tender suggests the services only be used for unclassified data, the notes said: “Federal departments may use the existing cloud contracts for more than unclassified data if they accept and/or mitigate security risks.” The 2017 meeting notes said that despite the government releasing cloud contracts, there is still a “lack of understanding around the risks of using cloud technology. There is a need to provide education around cloud technology and getting the government in line with the expected time frame of delivery of services.” The government’s use of the cloud, despite it only being reserved for unclassified information, “solidifies Canada’s commitment to providing first-class digital service and open government,” the June meeting notes said. In the briefing notes, ISED said the contracts had “relieved some pressure on the issue of data centre underutilization.” Earlier this year, Cogeco Inc. sold its Peer 1 cloud services business for $720 million. It followed the sale of the data centre of Quebecor Inc.’s Videotron, called 4Degrees Colocation, for $259 million. Both sold to California-based entities. In 2017, Shaw Communications Inc. sold its Viawest data centre business, which included cloud solutions, for $2.3 billion. Outgoing Videotron CEO Manon Brouillette noted in a press release that the “growth in the market for cloud-based IT solutions continues to accelerate, and the competition is global.” The aggressive push to move data, including highly sensitive information, from on-premise data centres to the internet is largely in-line with what’s unravelling in the United States. The U.S. adopted its cloud-first policy years before Canada, in 2010. The world’s largest e-commerce company is currently in a race with several prominent technology companies to grab a massive $10-billion contract from the Pentagon to house its Joint Enterprise Defence Infrastructure program, or JEDI. Amazon is reportedly considered to be the front-runner for that contract. Mark Ryland, director in the office of the chief information security officer at AWS, was asked about the difference in the two countries’ adoption of the commercial cloud services for sensitive data. “I would be so bold to say they’re kind of different steps along the same journey,” he said in a phone interview. Because the U.S. had its cloud-first policy a while ago, it has had the opportunity to explore, learn and deploy more, he noted. In late 2017, the company announced in a press release its “AWS Secret Region,” which can support “workloads up to the Secret U.S. security classification level” -- essentially the highest level of the intelligence community. A month before that, Microsoft announced its Azure Government would host sensitive government data. Then a year later, Microsoft announced its own secret cloud capability to host the top secret U.S. military and intelligence data on Azure. Amazon, which opened its first Canadian data centres in Montreal in 2016, has ensured its voice is heard on Parliament Hill about the benefits of the cloud, which it argues includes more security and data isolation. The company has consistently lobbied the government on its cloud services: their consultant lobbyists’ registrations include “seeking to influence policy direction related to cloud based services.” So far this year, the company has lobbied government officials at least 11 times with cloud services being on the registration. Some of those communications were with senior officials from ISED, including science minister Kirsty Duncan and assistant deputy minister Nipun Vats; president of Shared Services Canada Paul Glover, and senior policy advisor to Public Safety Canada David Hurl. ISED moved its first application, called Cluster Map, to the AWS cloud in Montreal in October. The Canadian government, through the TBS, has discussed data security concerns in a post on its website. There, it said security becomes a “shared responsibility” with cloud service providers -- that while those providers must secure the cloud itself, the government departments are responsible for security “to, from and in the cloud.” It adds that the users of the cloud can isolate their data to a specific geographic region, which means they can keep data under the laws of that area. Data sovereignty, however, is still a concern, according to the page. The TBS notes that a foreign cloud provider could be required to comply with a warrant, court order or subpoena that would implicate Canadian data and potentially see a loss of “full sovereignty...sensitive GC data could be subject to foreign laws and be disclosed to another government,” it said. The TBS said in the email that there are strict rules about where data can reside, depending on its categorization. Protected B, for example, must reside in Canada, while unclassified data does not need to. It says on its website that it recommends three ways to reduce the risk of unauthorized access to sensitive information: limiting the data categories that can be hosted on the cloud, encrypting the data, and using “standard contract clauses,” which would include stipulations that cloud service providers must disclose to the government all unauthorized access to data. But Ryland said that shouldn’t be a concern. "We have a very strong commitment to data locality,” he said. Canada has “its own network, its own equipment” and data is never automatically copied or replicated to another location, he said. IBM’s vice-president of cloud Frank Attaie also said the government can rest assured about the technology. “With IBM, clients control their data,” Attaie said in an emailed statement. “They decide where it resides and when or where to move it, and the IBM Cloud provides the flexibility and options clients need to make those decisions. Given our deep global expertise in public sector cloud engagements as well as our local delivery ability in Montreal and Toronto, IBM is well positioned to help Canada make ‘Cloud First’ a reality.” — With reporting by Ahmad Hathout at ahathout@thewirereport.ca and editing by Anja Karadeglija at akarad@thewirereport.ca

Gov’t criticized by tech companies on cloud strategy for sensitive data

News | April 3, 2019

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us

Gov’t criticized by tech companies on cloud strategy for sensitive data

News | April 3, 2019

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Related Stories

CRTC lacking in battle against cybercrime: Auditor General

Education key to combating foreign interference on social media, ETHI hears

Educating Canadians is key to address cybersecurity threats: CTS panel

Cybersecurity is national security, panelists tell IIC

Reuse & Permissions

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us