Did you know the FBI could take a copy your data held in New Zealand if it got the legal OK in the US first, and you might never even know it?
Some Māori are expressing concern about the offshore control of New Zealand data. Photo: 123rf
This, and a host of other reasons, are driving a Māori bid to up control over their own data by building cloud storage here.
The cloud - it really just consists of someone else's internet-enabled computers where you can put data, and get help to work on it from anywhere in the world you happen to be - has the quid pro quo that it most often means someone else has access to your data.
And if that cloud storage owner is American or Australian-headquartered, those countries have specific laws that apply to it - and that gives their agencies like law enforcement the ability to access it: The United States through its 'Cloud Act' and Canberra through its 2018 anti-encryption laws.
This is at the extreme end of the problem of cloud control. And if you are not a criminal, you might not have much cause to worry.
But there are plenty of other concerns, and yet the trend is increasingly towards the "offshoring" of more and more data, led by the government.
A new report calls that into question, and outlines ways to make a shift. It is by Professor Tahu Kukutai and the operational arm Te Kāhui Raraunga of the Data Iwi Leaders Group.
"Agencies are rolling out all these different initiatives - most of them are doing it without any adequate engagement," Prof Kukutai told RNZ.
"Instead of just making these unilateral decisions to offshore not just only Māori data, but actually all New Zealanders' data ... Māori need to be involved in system-level decisions."
In 2012 the government was nervous enough about data misuse and loss of control, it curtailed agencies using office productivity public cloud services.
But by 2016 a "cloud-first" policy had come in. Since the country lacked for major cloud providers, this led to offshoring.
Lingering concerns were put to bed when the Privacy Commissioner decided to store their data in Australia with Microsoft in 2018.
An industry player RNZ agreed not to name said: "A lot of agencies saw this as a green light.
"Data sovereignty issues are almost a lost cause because everything has moved very rapidly over to Microsoft and Amazon, and if you try to swim against tide it is very difficult."
The implication since 2016 has been that offshoring is a no-brainer for security, cost and convenience.
Professor Tahu Kukutai. Photo: RNZ /Dom Thomas
But Prof Kukutai's study challenges that, saying onshore, locally owned can be very secure.
"We simply make the point that the offshore, foreign-owned solution is not nearly as overwhelmingly advantageous as the current government discourse makes it seem," the report said.
Prof Kukutai said there needed to be choice, for everyone's sake.
"It actually needs to be a strategic investment in a wider range of options, and taking an intergenerational approach to data, as a taonga, means that we can actually start investing locally - it doesn't mean just putting our data in AWS in Sydney," she said.
AWS, Amazon web services, and Microsoft dominate cloud services globally.
Masses of New Zealand government data is with Amazon in Sydney, though the two US giants have pledged - with few details - to spend billions building cloud storage in this country.
NZTech said AWS is building in Auckland with the data centre on schedule to be working in 2024.
For eight years there has also been a locally owned option, Catalyst Cloud.
It has only just won government approval for public agencies to use it - a "level playing field now", said Don Christie, who heads its parent company, Catalyst IT.
Christie has commercial reasons to speak up about loss of cloud control, pointing to Europeans getting nervy and looking for local providers.
He said the government dashed into offshoring in 2016, and is not listening now.
"We often hear that there's a technical decision being made to choose an overseas service, and that it's above somebody's pay grade to consider the issues of data sovereignty and what happens to it," Christie told RNZ.
"And so it seems to me that most people are just pushing it away as a topic that they don't want to have to think about."
The government is currently refreshing the cloud-first policy.
The Data Iwi leaders group told RNZ it has had two or three meetings with officials, who it said appeared very eager to address the absence of Te Tiriti, Te Ao Māori - Māori world view - and Māori data sovereignty in the existing policy.
Entrepreneurs like Ben Tairea are not waiting. He is seeding micro-clouds of sovereignty - computers in people's cupboards they can connect to from anywhere in the world.
"That's exactly what we see happening.
"We have iwi, hapu, whenua trusts, marae that have these computers hosted wherever, you know, it could be at somebody's house.
"You know, I personally have my own pātaka or family cloud server running in a little closet in my lounge," Tairea said.
The Palmerston North co-founder of whakapapa-recording digital site Ahau said this took a bit of tech savvy, and got around the problem of aligning your values with a big cloud service's values, and your pocket with their charges.
Tairea said the government may be doing great consultation over offshoring cloud services and other digital moves, but if so Māori cannot see it and it must become more transparent.