Safe Harbour Not Valid

[matt40k]

FYI - for those who don't follow me on Twitter, Microsoft posted this yesterday - A message to our customers about EU – US Safe Harbor - Microsoft on the Issues - it basically says about how they've done the paperwork upfront and any Microsoft Cloud agreements are covered by other policies beyond Safe Harbour agreement, so you're still covered by some EU law.

 

Personal accounts are a big no-no for school business as there is no accountability

 

It isn't just accounts - mobile phones as well.

Edited October 7, 2015 by matt40k

[localzuk]

"Localzuk has covered the questions so far, but I am puzzled why people think that dealing with this is problem."

 

Because people will always argue there is an acceptable level of security. This is the lie, it will never be but we all carry on with our heads in the dirt because that's progress. You will never ever go back to pen paper and the vault.

 

There is no such thing as total security. Paper and pen is prone to fires and other damage. Its also prone to copying via photocopiers or cameras.

 

We live in a digital world, and we draw up what is acceptable. This is done in conjunction with the various laws of the land. Court cases then later decide if these policies and laws work. Safe Harbor is now an example which has proven not to be compliant with the law.

 

It is not burying our heads to create policies and work with them in line with the law.

[sparkeh]

FYI - for those who don't follow me on Twitter, Microsoft posted this yesterday - A message to our customers about EU – US Safe Harbor - Microsoft on the Issues -

If anyone spots anything from Google then post here please

[matt40k]

If anyone spots anything from Google then post here please

 

I wouldn't hold my breath, its going to be a while. If you look at where Google money comes from selling ads, Microsoft money (the bulk) comes from selling Office licenses. I wouldn't be surprised if they use the Safe Harbour agreement to get the data into the US where the rules are a bit more relax - remember they don't have the level of details Facebook has - Facebook knows your a male aged between 25-30 who's just had a their first child - so showing ads for baby stuff will prob work - Google has to be a bit clever how it works it out or waiting till you ask. Anyway, discussion for another day.

 

Anyone else having trouble reading Google answers to this: http://www.edugeek.net/forums/cloud-services/159257-oct-2015-dfe-guidance-cloud-software-services-data-protection-act.html? Wonder if they are updating? More likely my internet connection is playing up again.

[ZeroHour]

Safe harbour being nulled is bad but to be honest if Microsoft are forced to do Microsoft 'must release' data held on Dublin server - BBC News as mentioned by Grumbledook, it will have much further ramifications as it wont matter where the data is located, any US employee can be compelled to give access to the US gov. This would have some pretty big issues for Google/Microsoft/Apple/Any US service to be honest. I hope the US gov see sense but I fear they wont.

 

I can remember myself and @Domino having a *discussion* with @EduTech about the possibility several years ago as well.

Edited October 7, 2015 by ZeroHour

[CyberNerd]

GCHQ/NSA wiretap all the fibre between here and the states anyway: They can get at the data before it even leaves the EU.

 

https://theintercept.com/2015/09/25/gchq-radio-porn-spies-track-web-users-online-identities/

[GrumbleDook]

Safe harbour being nulled is bad but to be honest if Microsoft are forced to do Microsoft 'must release' data held on Dublin server - BBC News as mentioned by Grumbledook, it will have much further ramifications as it wont matter where the data is located, any US employee can be compelled to give access to the US gov. This would have some pretty big issues for Google/Microsoft/Apple/Any US service to be honest. I hope the US gov see sense but I fear they wont.

 

I can remember myself and @Domino having a *discussion* with @EduTech about the possibility several years ago as well.

 

To some extent this supersedes that demand to release the data. The recent pact between authorities in EU and US on data exchange during investigations was to partly deal with the judicial demand, but now this ruling basically means that if it hasn't gone via the new pact then a company would be in serious trouble in the EU if the data is transferred.

 

To some extent the Model Clauses are there to patch up the failings of the Safe Harbor Framework, and it is almost a case that the US judicial system is in complete denial that there are other rules .. and better rules at that!

 

Anyone would think that this is now also getting political ... :-)

 

I have had a chat with the ICO helpline and they have some clear guidance for schools on this, but I can't respond yet.

[Marshall_IT]

GCHQ/NSA wiretap all the fibre between here and the states anyway: They can get at the data before it even leaves the EU.

 

https://theintercept.com/2015/09/25/gchq-radio-porn-spies-track-web-users-online-identities/

 

Since then Microsoft and Google have both changed to encrypt everything in transit.

[edutech4schools]

I wouldn't hold my breath, its going to be a while. If you look at where Google money comes from selling ads

 

Google business is a paid service and has no adds and the education version is based on the business version, Alternatively the free version of hotmail / outlook has lots of adds.

 

BTW Microsoft has never been 100% compliant, it was about 3 years ago that they released a statement saying they would transfer data from the EU to the USA if required

[GrumbleDook]

Google business is a paid service and has no adds and the education version is based on the business version, Alternatively the free version of hotmail / outlook has lots of adds.

 

BTW Microsoft has never been 100% compliant, it was about 3 years ago that they released a statement saying they would transfer data from the EU to the USA if required

 

Did you read the above blog post from Microsoft? A lot has changed over the years.

[ZeroHour]

Google business is a paid service and has no adds and the education version is based on the business version, Alternatively the free version of hotmail / outlook has lots of adds.

 

BTW Microsoft has never been 100% compliant, it was about 3 years ago that they released a statement saying they would transfer data from the EU to the USA if required

 

You do realise Google Apps for Edu was mining pupil data for advert profiling until they were caught and stopped the practice last year?

http://www.edugeek.net/forums/cloud-services/132045-google-admits-data-mining-student-emails-its-free-education-apps.html

[PotNoodleTech]

So it looks as if we are effectively "losing control" any data that is hosted outside of our own server room?

[pcstru]

You do realise Google Apps for Edu was mining pupil data for advert profiling until they were caught and stopped the practice last year?

http://www.edugeek.net/forums/cloud-services/132045-google-admits-data-mining-student-emails-its-free-education-apps.html

Should do, it was pointed out to them at the time Google Fessed up and even before that. Mind you, people do tend to ignore data that disagrees with their worldview - and the force is strong in this one.

[Marshall_IT]

What's the next step for schools with Cloud hosting then?

 

I'm assuming update your risk assessment and what, use an EU Model Clause to update our contracts with suppliers?

 

Has anyone got a list of common cloud services and which hosting service they use?

I'm going to compile a list of ours, it might be worth posting the results on another dedicated thread.

It will hopefully make it easy for schools to check what they need to do.

 

Also, if service A uses Azure and Service B also uses Azure, i'm assuming we'll still need to do the risk assessment and the Model Clause agreement with each one?

[sted]

What's the next step for schools with Cloud hosting then?

 

 

private on premises cloud?

[edutech4schools]

Ha you should read the posts in that thread, things like this

Just to confirm. MS store their O365 data for education in the EU. I had it confirmed straight from the horses mouth so to speak.

 

and this - http://readwrite.com/2013/01/03/googles-ftc-settlement-is-an-epic-fail-for-microsoft

 

MS were caught lying to schools years ago, its why they had to release a statement explaining they did release data to the US even though they had sold web space to schools and companies saying they did not. And look how effective their campaigner of smears has been, you all believe MS are different from Google, but they are not.

[Marshall_IT]

private on premises cloud?

 

Not really helpful is it.

[sparkeh]

Surely the best thing we can do is wait for the considered response and guidance from the ICO? They are best placed to do this.

[edutech4schools]

You do realise Google Apps for Edu was mining pupil data for advert profiling until they were caught and stopped the practice last year?

 

I believe this was US based change that was put back after the court action and did not effect EU GAFE

[ZeroHour]

I believe this was US based change that was put back after the court action and did not effect EU GAFE

 

Where have you seen that stated?

I struggle to believe that's the case considering the platform software is the same and Google literally said it was an automated system that could not be disabled, I would be surprised to hear they wrote a workaround for EU but left it mining in the USA then to say it was automated and they couldn't turn it off. Thats skating pretty close to a lie to US court if they literally have a way to turn it off in the EU. I have seen nothing mention EU didnt have the same systems, they in fact dont mention our situation which is worse than a statement of clarity.

Even if it was only US, which I doubt, its still a pretty awful thing to be doing to pupils email and that was just last year and only because they were sued and HAD to reveal the truth. Thats hardly a sign of a trustworthy company.

Hopefully the EU will take more action against google then the FTC did.

 

MS storing data inside the EU I believe was a case where older 365 installs were on US servers but the whole lot were being migrated to EU but it was a while ago so the memories could be hazy. At least it couldn't mine for ad profiling (until April 2014!), aka if a pupil has dyslexia they wouldn't see google ads showing software for dyslexia after it mined their email sent from their teacher mentioning their learning issues.

Edited October 7, 2015 by ZeroHour

[edutech4schools]

MS storing data inside the EU I believe was a case where older 365 installs were on US servers but the whole lot were being migrated to EU

 

You can back MS all you want but it was way after they had the data servers running in Ireland which at the time was the selling point. I can even remember they released some anti Google advertising based on the fact they held all the EU data in the EU and Google did not but it was all total crap.

[edutech4schools]

EDITED: My main point is not that Google is good or better but that Microsoft Cloud is also not good. Both companies are only around to take our money.

[ZeroHour]

You can back MS all you want but it was way after they had the data servers running in Ireland which at the time was the selling point. I can even remember they released some anti Google advertising based on the fact they held all the EU data in the EU and Google did not but it was all total crap.

 

I think the relevant part was it was legacy installs that were on US (before the EU data center was live) but all the new installs were EU and the last few were being migrated.

I personally find mining pupil email to sell ads far far worse than delayed migration of legacy installs to their new data center, only 1 is an attempt to make money off the data and it was the case for years while all these schools moved over.

 

I am going to edit the top post to add in any collated information we have now for services out there. I believe MS is covered but I have not seen info from Dropbox or Google yet (but no doubt Google will be fixing that), also it may be worth reminding staff iCloud is not covered and never has so if they are syncing documents to edit on multiple devices they will be in breach potentially.

Edited October 7, 2015 by ZeroHour

[Garacesh]

Peter Houppermans, a privacy advisor based in Switzerland, explains:

 

"Safe Harbour has been broken for years - but it’s only now visible. But really it's broken since 9-11. American legislation created so many back doors that there’s no due diligence or scrutiny of law enforcement - so any one can walk in. Safe Harbour was just a political sticking plaster. As a result there's no US entity in the world that can credibly guarantee the privacy of your information. It's legally impossible.

 

He illustrates with a practical example of how US companies are now in breach of EU rights.

 

Imagine you’re a UK resident business, and you're using Google for email. What happens when I email you? You'll receive my message on US-owned infrastructure. Before you've gained my permission, you've exported my personal data - and maybe it’s even privileged information - to a third party entity.

Source: Silicon Valley now 'illegal' in Europe: Why Schrems vs Facebook is such a biggie - The Register

 

I already wasn't keen on the idea of the UK leaving the EU.. but now that the EU looks set to take privacy a bit more seriously definitely I hope we stick around - provided it doesn't all get whitewashed over.

[edutech4schools]

All email is unsecured and always has been, even when we used RM Easy mail we had to have a disclaimer saying it was not a secure messaging service, funny how they always pick on Google.