FRESH

Hacker News

Switzerland: Data Protection Officers Impose Broad Cloud Ban for Authorities

93 points by TechTechTech

by sschueller

4 subcomments

A lot of Swiss government services do not need to be available 247 outside of the country.
There is no need for the SBB (Swiss national railway) to use cloudflare or AWS when the same can be provided by a local provider that also has the ability to deal with large DDOS and cap off the outside when it comes down to the wire. It is more important for someone in Switzerland to be able to purchase a ticket than someone planning a trip from abroad.

by estebarb

0 subcomment

by mrbluecoat

1 subcomments

This cracked me up:
> a de facto ban on the use of these services as comprehensive Software-as-a-Service (SaaS) solutions whenever particularly sensitive or legally confidential personal data is involved. For the most part, authorities will likely only be able to use applications like the widespread Microsoft 365 as online storage
Since when is Microsoft 365 the bastion of modern privacy?

by roflmaostc

1 subcomments

This is good news.
At EPFL we observe worrying trends that all services are moved to Microsoft (e-mails, cloud).
What happened to universities to host elemental services themselves?
EPFL also partnered up recently with Omnissa Work Space One to strengthen security of IT on campus. Mandatory (American) software which EPFL IT office wants to install on machines...

by neves

3 subcomments

I'm impressed how USA companies became untrustful. Maybe this comes since Snowden whistle blowing, but it looks like the tendency is accelerating.

by nohillside

0 subcomment

Unfortunately(?), the original headline was just wrong. The DPOs did not impose a ban, the DPO community of Switzerland just recommended to move out of the cloud. This is not exactly news either, they have been leaning towards more restrictions for quite a while. But in most situations they can only issue recommendations, not binding rules.

by 7777777phil

5 subcomments

The encryption requirement makes sense on paper, but it basically breaks the whole value proposition of SaaS. If you need true end-to-end encryption where the provider can't see plaintext, you lose search, real-time collaboration, most of the AI features everyone's been bolting on lately, etc. You're essentially left using these services as fancy file storage with your own crypto layer on top.
Which is fine for IaaS use cases - spin up VMs, encrypt your disks, manage your own keys. But for productivity software like M365? The Swiss government is basically saying "yeah you can use it but only in a way that makes it almost pointless."
The Cloud Act part is what really matters here though. US providers can be compelled to hand over data regardless of where it's physically stored, and they've been pretty clear they'll comply with US law over local data protection rules when push comes to shove. For a foreign government storing legally confidential citizen data, that's a real problem. I suspect this will get quietly ignored like the previous declarations, because the alternative is either building everything in-house or relying on local providers that frankly don't have the same feature set or reliability.

0 subcomment

by belter

3 subcomments

I can already write the headline of what this will be in five years...
"Swiss Government Moves Back to Cloud After Discovering Cleaning Staff Had More Physical Access Than IT Security Team"