After all that description of the context and the sequence of events, I believe some reasoning is needed. Reasoning about how I believe our approach, as technicians, IT people, architects and the like, to building solutions must evolve, but at the same time about how the view of the IT world must change, on the part of solution architects as much as of managers or the C-level.
I still see a great many people taking part in the cloud vs on-prem feud. It seems to me, though, also in the light of this bombing, that it has by now become stale and sterile. The point is that IT infrastructures, however and wherever they are, have been essential to modern society for many years, and as such are easy targets in the event of war. More than that: obvious targets, on a par with fuel refineries, railway junctions, logistics hubs. Even the best physical and IT security policies applied by the most diligent of hyperscalers are designed for civilian situations, where the greatest danger is probably a terrorist attack. But here we are beyond the standard dangers, we are in a theatre of war, we are talking about drones, missiles, bombs.
Iran has declared (officially!) practically all the cloud hyperscalers in the area (AWS, Azure, GCP, Oracle, IBM, …) legitimate targets, and among the first things the US did was strike Iranian command and communication centres. Ukraine strikes Russian data centers, Russia Ukrainian ones.
When, as a younger man, I discovered the concept of a Region with 3 Availability Zones, of services with automatic load balancing across 3 data centers, containers with auto-recovery, as a rookie sysadmin going crazy over the best way to put together a vaguely working Disaster Recovery, I found it astonishing, the solution to practically every IT problem I could think of! And for almost 15 years that is indeed how it was. Until February, when a day of bombing by a nation with a perfectly respectable military apparatus, but certainly not a superpower, showed that it was no longer true, that there are cases in which it is not even remotely sufficient, and exposed the incredible (but inevitable) fragility of this system in the face of a direct and targeted physical attack.
Personally I believe that what has been making the situation worse for several years is the tendency, present in a great many (but significantly not all) states and in my opinion for the most part misdirected, to prefer or impose the residency on national territory of the data and services the state needs. I’ll cite a few cases purely by way of example, and may the legislators forgive me for my inevitable inaccuracies:
- in China, critical infrastructure operators must keep personal data and “important data” on national territory, exportable only after a security assessment by the Cyberspace Administration of China (CAC). We are not talking about all data, but the issue is there nonetheless. (Library of Congress - China: New Rules on Cross-Border Data Transfers Released, Arnold & Porter - China Clarifies Cross-Border Data Transfer Rules: Practical Guidance for Compliance)
- in the UAE and Saudi Arabia the constraints differ, but some types of data and services require residency on national territory:
- banking, payment, health, curiously some IoT data, as well as, obviously, government data for the UAE
- government, banking, financial, insurance and even people’s employment data for Saudi Arabia
- Clifford Chance - Doing Business in the Middle East: Data Transfers in the UAE and the KSA
- in Italy it was decided to create the Polo Strategico Nazionale, a group of 4 data centers (2 in the Milan area and 2 in the Rome area) to host the most critical and strategic services of the public administration (as defined by the National Cybersecurity Agency, ACN, Cloud Italia - Polo Strategico Nazionale)
Much as I understand the need to prevent anyone whatsoever from using the data of one’s own citizens, I consider the states’ response of imposing residency for some types of service simply wrong. The underlying problem is ensuring control and ownership of data and services, and residency, from this point of view, is neither necessary nor sufficient to solve it. Which obviously does not mean that data and services can be put anywhere (I firmly believe it is not a good idea for the US to put its data and services in China), simply that it is not necessary to place critical data and services on one’s own national territory. Let me try to make the case.
I believe that in today’s world there are two different needs from this point of view:
- the protection of one’s own critical data and services (including from foreign interference)
- the need to provide essential services that are IT in nature or for which IT is by now an indispensable component (healthcare, public administration, payments, communication, to give a few examples)
The solutions adopted by every state MUST solve both of these problems.
Imposing or preferring residency on one’s own national territory brings with it two obvious additional factors to consider: the size and the location of the state.
For states like the UAE, relatively small and in areas at high risk of fighting, imposing data residency means needlessly putting themselves at risk in the event of war. Data centers are targets, and if they are hit the services shut down or stop working, and with them a significant part of the state.
The only solution I see for this kind of problem, at least when it comes to civilian infrastructure, is to distribute data and services geographically, if possible with auto-recovery: only in this way is it possible to guarantee true continuity for critical services (I am talking about communication, healthcare, payments, to give some examples). Personally, I believe it is much easier to achieve using a service in “cloud” mode in the broad sense, but I have seen companies get hold of physical servers in various parts of the world and achieve the same thing, and that is perfectly fine. The point is to have the service distributed, across several states, across several continents. A single data center, and even a single Region, when it comes to critical services, are no longer enough.
Let’s go further still: there are already organisations and states that, out of necessity, are following and experimenting with more correct paths (at least in my opinion):
- Estonia created in 2017, by agreement with Luxembourg, the institution of the Data Embassy: a fully fledged data center located in Luxembourg but with the same rights as the Estonian embassy (such as immunity). For now it serves as a sort of disaster recovery, with copies of the data and additional computing power. (e-Estonia - Data Embassy).
- The Principality of Monaco, for different reasons (namely the state being too small), did the same thing: Google Cloud - How data embassies can strengthen resiliency with sovereignty.
- Bahrain took its inspiration from Estonia with its Cloud Law, which allows data stored in data centers on its territory to be subject to the domestic law of other states (Wikipedia - Data embassy, Lexology - Diplomatic immunity for data: Bahrain’s Data Embassy Law)
- Very interesting: a few months before the attack, Saudi Arabia was aiming precisely at the Data Embassy. CNBC - Saudi Arabia eyes data embassies amid sovereign AI push. Here’s what we know so far. Note how, before the outbreak of the war, Saudi Arabia, Bahrain and the United Arab Emirates were all very active in the field of data centers and data residency. Unfortunately, I believe this will no longer be the case.
- Ukraine, once the war had begun, moved a very large part of its state data and services to AWS (incidentally, as a technical curiosity, using 3 AWS Snowball Devices), together with the country’s largest bank. Significantly, before the war there was a law requiring data to be stored on national territory, and the government had to pass a law to allow the transfer. The difference in this case was between losing everything and keeping services running for citizens, including Ukrainian refugees (The Register - ‘Russian missiles can’t destroy the cloud’: Ukraine leader describes emergency migration, About Amazon - Safeguarding Ukraine’s data to preserve its present and build its future, AWS - Accelerate Public Service Transformation - Security: Ukraine)
- France seems to have a regulation, SecNumCloud, which does place a limit on data residency, but within the European Union, not French territory; moreover, it aims to use data center/cloud providers not subject to non-European legislation (it is a way of blocking the American CLOUD Act - Security Scientist - 12 Questions and Answers About SecNumCloud (Standard)), from what I understand by constraining the registered offices of companies and their subsidiaries.
- a side note: the new European Region, the AWS European Sovereign Cloud, theoretically created precisely for compliance, does not comply with SecNumCloud (or at any rate does not have the certification), so that, according to some, it could be subject to requests from the authorities of third countries, that is, the US - SoftwareSeni - AWS European Sovereign Cloud and Azure Sovereign Options Assessed Against the Three-Layer Framework
These approaches go, in my opinion, in a more correct direction: they solve the protection point by technical means (I haven’t mentioned them, but obviously everything is always tied to encryption and security standards of the highest levels) and legal instruments, not by imposing and restricting the location of the physical servers to one precise place. And, as a consequence, for the point about delivering essential services, they open the way to what I believe is the best solution, namely geographic redundancy, particularly useful for states with a relatively small surface area (the UAE, precisely, but also Italy and France nowadays) and for holding out even in extreme cases and in theatres of war.
Coming back to geographic redundancy, all the balancing dynamics based on latency or geographic origin commonly found in Content Delivery Networks (CDNs), the shift in mindset in software in general from “pets” to “cattle” and more specifically the transformation from servers to containers and functions (both under way for several years now), my arch-enemy kubernetes with cluster api or even just rancher, SASE technology and in general all forms of distributed VPN, the very concept of cloud and of hyperscaler, even (forgive me if I only touch on this subject of galactic proportions) the communication satellite constellations and the experiments with data centers in low Earth orbit, are all small pieces (which I have only touched on here) that for years have been going in the same direction: making the possibility of exposing one’s own service with geographic redundancy ever more available to everyone in an ever more standard form (and, in my view, soon redundancy in space too) at relatively low and in any case ever-falling costs.
Forgive this hint of futurology, it will certainly age terribly. Still, it is my current reflection, based on what I know now. And forgive me too for the whole legal tome: even if only at a basic level, I thought it was not just useful but necessary to carry the reasoning forward.
Here ends this long article. I have tried to be as complete and precise as possible; on the other hand the field is immense and constantly evolving, and a single small oversight can invalidate the whole argument. I hope it has been in some way useful for understanding a small part of this world a little better. For me, it certainly has.
I’ll close, but first I leave you with my current doubts:
- How simple and cheap can geographic redundancy be, or become? The spread of this practice will depend on this too.
- All of our current IT, simplifying enormously of course, seems to me to be a series of evolutions and superstructures built on point-to-point communication, with ever more elaborate systems for choosing the point: will we hit a wall?
- Objectively, not all systems, state and private, are essential and therefore in need of the geographic redundancy I am talking about. Which ones are? Which ones will become so?
A short space for interesting developments that occurred after the article was written
- Not a development, but an article that came out after the writing (though, more fool me, not after the publication) of my post, which says substantially similar things, but better and more concisely: Il Post - The war is changing data center plans
- as always, thank you Il Post <3
This article was translated from the Italian original with the help of AI (Claude) and reviewed by the author.