Office 365 and the Australian Data Retention Laws

Since October 12th, 2015 all the online communications done in Australia now is being tracked, monitored and stored for 2 years via a new law enforced. The so called Data Retention Bill. All this info is valid as of October 2015, you know…in the cloud, things change rapidly

The Data Retention Bill, also known as "Telecommunications (Interception and Access) Amendment" is a hot topic right now. And as in any new technology, a lot of misconception is around. Let’s talk a bit about it and how does it impact if you have data hosted with Microsoft Office 365.

I am not going into the merit of right or wrong, because I know you came here from a business perspective and with the question in mind “What can I do to make sure I am compliant?”. Also a good place to start is to have a look at my post about Cloud Data Governance.

Explaining the Australian Data Retention Law

To be quite frank, apparently the law has so many loop-holes that it is hard to explain, but the Australian Parliament website has a good summary its intentions which is to force Internet Service Providers to keep "Telecommunications Data" for 2 years, limiting the reach of agencies that are able to access this data and to provide record-keeping and reporting on the use and access of this data.

Important to note here that they are talking about generic, abstract data. Not necessarily content, which takes us to the next point

The Metadata

Quoting the back then Minister for Communications, and now Prime-Minister Malcolm Turnbull:
"The type of data referred to in the bill as telecommunications data, more often described as metadata, is information about a communication but not its content. So, in the telephone world, it reveals that one number belonging to a particular account was connected to another number at a time and for a duration, but does not reveal what they discussed. In the IP world it reveals that a particular IP address, which may have been observed to have been engaged in some unlawful activity, had been at the relevant time allocated to a particular account. In the context of messaging—email, for example—it reveals the sender, recipient, time and date, but again not the content. Access to content, I stress, requires a warrant."

In his explanation, on this telecommunications data monitoring, only source and destination endpoints that are tracked, not the content that is exchanged and any access to the exchange data would require a warrant.  So, the government will know that for example Mr John Bloggs send a message to Mrs Jane Citizen on 13 October 2015 at 11:30 AM but the content of the conversation is not covered by the law.

2 Years Data Retention

All these communications will be retained for a period of 2 years. Data retention is expensive, very expensive. It is still a bit unclear how all this will be paid for and covered, what agreements will be in place, recovery and disaster strategy etc.

How Prepared are Australian Business?

apparently, not much. According to research ~90% of business are not. So much so that Telstra just revealed it needed another 18 months in order to become compliant. That’s a complicated matter, as you can see.

You Have No Reason to Worry

For us, law abiding citizens, I expect we have nothing to worry about. All this things are being tracked, monitored, collected and so on. The amount of data is ridiculous, gigantic, and it is very unlikely that the government will pinpoint someone and start monitoring the internet movements without a good reason. At the moment, there is not enough manpower, bandwidth and time for this. Clearly, these laws are targeting people with criminal intents, people in blacklists and persons of interest. For example, when a crime is committed and a person is identified, then the stored metadata about his/her communications can be used to clarify the root cause of their intentions.

I like compliance, structures and mostly, I like the identified needs to treat about data better. Some might say this is a bit overrated but at least they are this from a security mindset, which is a good thing. If you have nothing to hide, then there is no reason to be worried about it.

On Office 365

We know that now Office 365 has datacenters in Australia, this means that this data falls into the category of the Australian cyber laws initiatives. Luckily for you, Microsoft has a strong tradition of working closely with law makers and make sure that all data in the cloud is compliant and secure. Your data is still YOUR data..

Here are some of the controls in Office 365 that addresses the legislation and regulatory needs. In some cases, you can go through them and make sure they are aligned with the current legislation:

• Information Rights Management: to help prevent sensitive information being printed, transferred, manipulated by unauthorized people.
  1. Azure Rights Management
  2. Office 365 Information Rights Management
• Data Loss Prevention: Controls to identify, monitor and protect sensitive email communications and files
  1. Exchange DLP
• Electronic Discovery: Manages and controls all electronic content required by legislation for a civil litigation or investigation. This is across SharePoint Online, Exchange Online, OneDrive for Business and file shares.
  1. Plan eDiscovery with Office 365
  2. Search eDiscovery
  3. In-Place Hold and Litigation Hold
• Records Management: A set of controls to make sure the lifecycle of documents are compliant with your records management policies
  1. Implement a Records Management Policy
  2. Archive and Retention Policies for Exchange
  3. Privacy and Records Management Control with Skype
• Information Management Policies: Make sure the information management processes and regulations are auditable and has proper retention policies.
  1. Information Rights Management in SharePoint
• Transport Rules: Uses algorithms to discover specific conditions in communications that pass through your organization, and then takes action on them.
  1. Exchange Transport Rules
• Audit Log: Controls what changes are done, by who, when and how.
  1. Exchange Monitoring, Reporting and Message Tracing
  2. Audit Reports for SharePoint

In short, if you are an Office 365 customer you can see that most of the controls needed to make sure your business is engaged with the Australian Data Retention laws are there already. However, this is only the technological part…the biggest challenges are on the business’ processes and procedures.

Azure vs. Amazon AWS EC2 vs Google Cloud

Lately I’ve seen a few articles comparing the size of the clouds. Who is bigger? Who is more secure? Who has more customers? and unfortunately a lot of the links people send me are from 1, 2 years ago a time when Amazon AWS reigned supreme.

In this area things are literally changing every week! So while the number of costumers in Amazon AWS is still larger than anyone, both Microsoft Azure and Google Cloud are make huge leaps catching up with AWS.

Next time you see an article or when you are researching for a real comparison, I suggest to do 1 thing first: Check the date of the article and apply a gain of salt for anything written older than 6 months.

So here’s a summary of the Azure state of play as of October 2015. You can learn more about these numbers here.

Azure Datacenters

Azure has more datacenters than Amazon EC2 and Google Cloud combined.

Azure is also the first cloud service to open datacenters in India, which escalates the numbers of users to billions. Compare this with the size of the Amazon AWS EC2 and Google Cloud datacenters.

 

Trustworthy Computing

Microsoft invests heavily on compliance, data security, controls and transparency initiatives. As of today, Azure is the cloud service that has the broadest numbers of regulatory and data compliance certifications. This means that virtually any business environment can be delivered using Azure. That’s a challenge for Google and AWS for example, if they are not compliant with the Israel Government Data Compliance regulations, cloud solutions cannot be used for their projects.

One interesting fact on this about Google Cloud: With Google Cloud you cannot guarantee where your data will be located. Even if you select your datacenter to be in your own country. If you are an Australian customer, for example, Australian laws requires the data not to leave the country for some industries.

From Millions to Billions to Trillions

An interesting statistic not mentioned here is that more than 40% of the Azure revenue comes from start-ups and small ISVs building the next generation of businesses.

Fortune 500 Weapon-of-Choice

The proof is in the pudding. 80% of the largest companies in the world are using Azure. These guys don’t go picking up a cloud provider easily. They have specialized IT departments that take these decisions very seriously. Leverage their time and knowledge when considering your cloud decision.

Internet Of Things (IoT) Services

A lot of customers are already joining the IoT strategy to help them run their businesses more effectively and in a more innovative fashion. People like Rockwell Automation are using the Azure IoT API to manage gas dispensers across critical infrastructure around the world. From 2015/2016, all Ford vehicles will come out with dozens of IoT sensors and these guys will be streaming this data to the cloud. ThyssenKrupp is using IoT sensors in elevators all across the world tracking the equipment health of millions of elevators across the world and using Azure Machine Learning they will use these IoT signals to predict when these elevators will break down and be able to act of it before they do.

 

The Largest Cloud VM Infrastructure

With Azure, you can have virtual machines running on 32 CPU cores, 450 GB RAM, using SSD up to 6.5 terabytes of space, which combined can go up to 64 terabytes of storage per VM, all this with less than 1 millisecond latency. That’s huge and unparalleled at the moment.

Bring Your Own Enterprise Security Partner

Azure is already a very secure environment with platinum quality, and on top of that if your company already has a trusted security partner relationship you can bring this partner to your public cloud with Azure. The biggest and most common enterprise security firms are certified and can run on Azure as an appliance for your cloud. Implement their security protocols end-to-end with little impact on your security experience.

Windows 10 Hidden Screen Recording Tool

In my last presentation I used the Windows 10 built-in recorder feature. And for my surprise, a lot of people never heard of it!

So I thought about writing a post I can use and refer people to on how to use this “hidden” cool feature.

First think press “Windows Key + G”

This will bring up the following menu. Don’t worry if it is a game bar or not, just choose “Yes, this is a game” here.

Next, you will see the following bar. In there you see the reb button which is the start/stop recording. As soon as you click on it, Windows 10 will start recording your screen.

When you’re happy with your recording, press/click the red button again. The recording will stop and you will see the following message in your notification area,

Your recording is saved in your Videos/Captures folder.

Well, that’s it. Simple, hey? I hope you found this tip useful. Let me know what do you think.

The Valley of the Kings Internet Version

The valley of the Kings is an archaeological site in Luxor, Egypt where 63 tombs and burial chambers are located. As you expect, several illustrious and very powerful people (aka. Pharaohs) from back then are buried there, hence the name “Valley of the Kings”. This was like 15 centuries BC. And they are all located in a small area. This has a strong symbolism.

Nowadays if you exclude the leaders of the powerful nations, the powerful folks are really the giant companies. From tech, to chemical and pharmaceutical…these guys rule our planet and the direction when the winds blow.

The Economist recently created a cool infographic about the Silicon Valley companies and their size in millions of dollars. When I saw this picture I immediately recalled the Valley of the Kings map. Have a look and tell me if that’s not strikingly similar…well, considering these companies are alive and kicking!

I’m Speaking at the Office 365 Saturday Australia 2015 #o365cbr

I am delighted and humbled to have been confirmed again as a speaker for Office 365 Australia.

This fantastic event is held in most capital cities in Australia throughout the year. At each event there are no less than 10 fantastic sessions covering all aspects of Office 365 presented by respected professionals in various fields.

Join administrators, end users, architects, developers, and other professionals that work with Microsoft Technologies for a great day of awesome sessions presented by industry experts.

The Session

My Session is called "eDiscovery and Privacy: All your data are belong to us!"
Abstract: "In the 90s, Legal and IT professionals began compiling computer data and legislation, eDiscovery started its first steps. Back then, nobody would believe email, let alone social media, could be used in court. 20 years later, eDiscovery is here to stay, but is the industry prepared?"

In this session, we will talk about the biggest challenges for eDiscovery and some solutions in the works, with focus on Office 365 technologies."

When and Where

O365 Saturday will happen in Canberra, Australia on 24th October at Cliftons - 10 Moore Street, Canberra ACT 2601. Registrations start at 8:30am.

Come and join the fun. This is a great opportunity to meet with our community, connect and grow friendships and discuss real life, everyday challenges with likeminded folks.

Collab365 Conference Social Media Numbers

We made it! Collab365 was a fantastic event. Truly global, multicultural, multi-time zone, multi-everything.
And I am humbled to have been part of the event sharing knowledge.

During 2 days, across the whole planet, experts on Office 365, SharePoint and Azure bonded in a series of presentations delivered from Europe HQ to the whole world all thanks to the magic of the streaming. At this day and age when everyone mostly (only) talks about the new buzzwords "innovation", "disruption", "internet of things"  the Collab365 team done it and shown it.  I have a few “Thank You” words to the organizers, presenters and attendees. If you this this is a TL;DR kind of text, feel free to skip straight to the nice pictures a bit later in this post. They have the social media data collected.

To the Organizers

You guys are awesome! (I mean, really). From the whole organization with tasks, electronic signatures, forms technology and all that jazz. I don't think people actually understand how big of a deal organizing such a thing is. I don't think I can write enough about how I appreciate your initiative and effort. I wish I could pay you a beer or a cup of coffee or whatever :) you guys and girls did it!

To the Speakers

I mean, we (the presenters) didn't do this for money (I know, I know..I can hear the arguments, but bear with me on this). We do this because we love to share knowledge! I do have a wife and 3 kids and a consulting job that makes me travel a lot, weeks away from home sometimes!! It is hard to find time and put together content, work on demos, test, present, adjust, cut here and there, lots of late nights...all this in the hope that people will find our knowledge useful. I am sure some demos did not go as well as expected, someone must have been sick on the day, the connection was not great, some presentations were longer than expected since we were streaming etc...but the knowledge is there and was shared. I believe that if at the end of the presentation people left knowing something new they didn't know before they started, that's a huge accomplishment. We did it awesome!     

To the Attendees

You guys rocked! all this effort wouldn't mean anything if nobody turned up. We connected at the coolest level, at the intellectual level and with the spirit that 2 + 2 = 5. The sum of our gathering makes something bigger the us. And that is now history, immortal. Be proud of that! If you see any the presenters or organizers online or in person, give them a beer :) It is hard finding the time to put a presso nicely and deliver to the masses. Harder that most people think! Well, some people are naturals at it but I am talking about what I do and what I see out there with other presenters :)

OK, Let’s Talk About the Stats

In the spirit of continuous improvement, I needed to find data about the past to improve the future thus delivering a even better next event. So, at the end of the conference on a Friday night I put the kids to sleep a bit early, prep myself the a cup of coffee and went on to collect data and analyse the numbers of the conference. My criteria used twitter hashtag #collab365 and the event organization handle @colla365 as starting points. No Facebook analysis was done. (Maybe in the next one…) From there a whole bunch of data is collected. Data about geographies, gender were taken from the twitter profiles that had them exposed. Data related to time and date were relative GMT (London). The collection stated 6 hours before the conference started and ended 6 hours after the conference finished. If I tried to collect the same data later tomorrow it is likely to be a bit larger because people might still be posting their sentiment online about the conference and still using the hashtag.

I will come back latter to update the text and stats comments in this post, so feel free to check  back this link from time to time.

Anyway, I won't take much from your time reading my musings here :) Let's go to the numbers.

A Cloud Data Governance Model for Office 365 Delivery

If you have ever been involved in enterprise-wide cloud or collaboration projects (specially using SharePoint) you have heard about governance every second-day. Governance is a big ticket these days to tackle in every serious IT project.

Quickly summarizing, governance is the set all processes of "governing" (as in state governments) the interaction and decision-making steps for a scenario or problem. This set of processes are then normally compiled into a piece of work that outlines how to enforce these rules in the big picture and make sure they are adhered and followed. This is a broad explanation, and because IT is so complex and vast every time someone talks about governance, it is always followed by an area and never a single-monolithic set of rules. That's why we hear about: SharePoint Governance, Cloud Access Governance and so on.

Anyway, today we will talk about cloud data governance. The need this has always been a recurring theme when we talk about data protection and compliance. With Office 365 it wouldn't be different.

Cloud data governance is important because without it, any data protection strategy you want to apply to our Office 365 enterprise compliance will be like a silo, isolated.

For starters, let's try to get a generic picture of data governance and break it down to a bit more specialized areas.

Please bear with me and allow me to start a very simple and generic Cloud Data Governance model which can be used for a classic Office 365 collaboration project. One that can be easily categorized in: Foundations and Leadership.

Leadership is About Structure

Leadership is about structure and the programs that drive the governance enforcement. Executive powers in this category covers what organizational management tasks are required to make sure an ongoing commitment is established and cascaded down to the peers. Data Stewards and Custodians make sure that the RACI matrix is cleared, covering the roles and responsibilities of every individual affected directly or indirectly by the governance plan is addresses.

Foundation is About Initiatives

Foundation is about initiatives that as a whole covers the basics on the compliance, authorities and risk management.

Thinks like business continuity (including disaster recovery) addresses the risk management responsibilities. When events happen which causes the data to change during its lifecycle, the information lifecycle management kicks in, making sure these audit trails are aligned with your data protection rules.
Under the foundational stones, we also can include data architecture addressing master data management; Retention management to make sure analysis tolls are fully functional and addressing data requirements updates for keeping and trashing of data; Data quality to make sure the data is healthy and in perfect quality for its usage; and as expected, Security which in our cloud case addresses data classification and confidentiality. Security can't cover much more than this because, remember we are talking about Microsoft cloud infrastructure, and most of the other aspects are taken care of by the Microsoft security team. There is only so much further we can go on it.

This graph is a quick illustration of what an average cloud data governance looks like from a helicopter view. It does not mean that it covers everything your organization needs. Likewise, it also does not mean that every single data governance control needs to be associated with data protection. The main goal here is not achieve 100% of security (which is in itself, quite a task if you ask me) but instead to minimize the gaps and the surface for attacks and breaches.

The broader you start with your cloud data governance picture the better it is, because it will be like a beacon providing guidance for big and small pieces of projects going on. And at the end of the day, project teams want to have something to aim for. The governance strategy is not static, it adapts to the needs and if something is missing, generally there is no issue, just address it in the strategy and make sure the communication plan is in place for it.

Who Owns My Data Stored on Office 365 ?

OK, so by now you have know that decided to keep your emails, photos, documents in the cloud (using Google, Microsoft, Yahoo, Amazon etc) and talking with people, one question that I get very often is "Hey, since I am keeping my files in the cloud stored in these companies machines, do they own my data now? Can they read my emails?"

I am going to address here the Microsoft point of view. Short answer: No, you still are the owner of the data. Even if they are stored in their servers.

Of course, Microsoft has a very comprehensive process to access the data stored, after all that information stored in the cloud needs to be looked after (backups, storage, etc). There is very, very, very little possibility for someone alone get their hands in your information.

For example, when you open your email or when you see a photo from your online album stored in the cloud, there is a huge amount of processing, exchange and compiling happening behind the scenes to grab your data which is spread in many locations and make it to your computer screen magically as if it was stored in your computer's local drive. If someone had access to the actual physical server where these emails or pictures are stored, it would be virtually impossible (just to not to say 100% impossible) to retrieve that same information.

That's because there is a very complicated and secure process for this to happen and the reason this process exists is to address privacy, regulations and compliance concerns of several institutions and governments. Remember: Just like regular users, Microsoft also has big organizations and even governments as clients and they store data there too.

About Data Visibility and Control

Now, let's talk about what happens when someone first moves their data to the cloud. When this happens, a key tenet of ownership is the visibility level and control that person has over their data. They are basically compost of 3 things: Being able to see the data, being able to perform actions on the data, being aware of what actions were performed on the data at any given time.

And despite these seems to be 'simple things', they are extremely complex to achieve. Nevertheless they are achieved to the perfection by the cloud team. Quite frankly, chances are your data is several times more secure in the cloud than it is in your local computer or hard disk. Want to test that theory, just ask around how many people use any encryption in their computers, mobiles, USB drives? This is a very basic test that many of us don't pass. Another one, if your computer or external disk crashes, would you recover ALL your data in less than 1 hour?

As you can see, the challenge here is because it is on you/us to define and implement consistent configuration with appropriate data access and process and distribution and backups across all your environments. This is a costly process (would you have a separate laptop 100% synchronized with your current laptop just in case it crashes?) and usually requires specialist knowledge for administration. In Microsoft Office 365, that is all baked into the service for you.

Not to mention archiving is built directly into the cloud, so you can take actions like preservation, deletion, auditing, and data loss prevention, and perform search based on who uploaded the data, who modified the data, date range, keyword etc.

To be able to viewing and perform actions on the data are extremely privileged operations and in the Microsoft cloud there are defined roles defined for a specific set of people. If you're not satisfied with it, the scope and reach of these roles can be defined the customer itself (after all, they own the data).

Feel free to share your experience with storing data in the Microsoft cloud or Office 365, or any other cloud provider company for that matter.

I’ll be Speaking at the 2015 Collab365 Conference

I am super excited to be selected as speaker at the Collab365 Conference. The largest Office 365, Azure and SharePoint event of 2015.

It will be 24 Hours of Office365, SharePoint, Azure and more!! This is the event for 2015 if you want to gain in depth insights from experts all over the globe. Whether its the technology that you want to learn about, the applications or the implications of using Office365, SharePoint or Azure, this is the place where you will find answers. Our speakers will bring their lessons flavoured with unique local perspectives directly to your device.

We are 62 MVP's. 6 MCM's. Microsoft Product Managers and experts. The level of submission to the event was staggering.

Starting on October 7th 2015. Following the sun for 24 hours, the COLLAB365 "Global Conference" is THE virtual conference if you want insight into Office365, SharePoint, Azure and more! Register now to be one of an expected 10,000 delegates.

Have a look at the great line up of speakers, sessions and register to not only participate of this massive event but also win prizes!

And as for my session…you know what to expect

Win, Win, Win for everyone!

See you there.