The government stores our most important data on US-owned cloud infrastructure, making it subject to US laws. Software architect Tamawera Owens explains.<\/p>\n
Before blowing up your whole view of digital identity in New Zealand, let me assure you that you\u2019ve probably done nothing wrong. You\u2019ve likely sought to understand data sovereignty and you might even read privacy policies. You would be forgiven for trusting the government to protect the\u00a0 information you share with it. But what you might not know is your personal data \u2013 your digital identity \u2013\u00a0is governed by American law. And that comes with great risk.<\/p>\n
We\u2019ve been here before: In 1826, several Hauraki Gulf islands were sold for eight muskets<\/a>. The next year, 3,000 acres of land was traded for 50 blankets<\/a>. Our t\u016bpuna making these decisions weren\u2019t foolish, they just had incomplete information about the English concept of ownership <\/a>and laws such as the 10-owner rule, which let individuals sell communal land without the consent of other owners.\u00a0<\/p>\n History is now repeating itself due to lack of information. Like our t\u016bpuna, many New Zealanders today don\u2019t understand what\u2019s truly happening with our data. If eight muskets once bought islands, what are we now trading for cloud convenience?\u00a0<\/p>\n We\u2019ve seen the government gut the expertise needed to oversee digital transformation<\/a>, including dedicated M\u0101ori and Pacific data advisers and 1,120 roles (almost half of that workforce) from Health NZ\u2019s data and digital teams. Alongside the Fast-track Approvals Act <\/a>giving ministers the power to bypass normal checks and balances, there is an emerging pattern of the government prioritising speed over proper process. This is the same mindset now being applied to our digital infrastructure and identity systems.\u00a0<\/p>\n Digital services are being modernised at a rapid pace. The government\u2019s chief digital officer promises a seamless digital experience<\/a>, developing an all-of-government app under the Service Modernisation Roadmap<\/a>. Agencies are racing to deliver interfaces and integrated services. But fundamental questions about who controls the infrastructure \u2013 and which laws govern it \u2013\u00a0are treated as implementation details, not matters of national sovereignty.\u00a0<\/p>\n There are two flagship apps used by the government: the Govt.nz app<\/a> and NZ Verify (Whakat\u016bturu App). The former is described as making it \u201ceasier and safer for people to access government services\u201d, while the latter is used to verify international digital credentials. These are marketed as secure, privacy-protecting systems with credentials stored locally on your device.\u00a0<\/p>\n While technically true, it\u2019s fundamentally misleading.<\/p>\n The backend databases and authentication systems run on cloud infrastructure from Microsoft Azure, which stores data offshore<\/a>, and Amazon AWS, which stores data locally in New Zealand. Despite the local storage by AWS, both American-owned companies are subject to US legal requirements including government surveillance capabilities and data access requests<\/p>\n I have three critical concerns with this:<\/p>\n Our authentication data sits on US-owned servers, subject to American laws including the CLOUD Act<\/a>.\u00a0 The Crown has an obligation to protect our taonga, including our data. Te K\u0101hui Raraunga, the working arm of the Data Iwi Leaders Group, has detailed why this matters<\/a>: Crown agencies must uphold M\u0101ori data governance requirements when procuring new technologies. But given the principles of M\u0101ori data governance \u2013 free, prior and informed consent, collective privacy, and data sovereignty \u2013 it\u2019s unclear whether the Crown has truly considered the risks their flagship apps create.\u00a0<\/p>\n Data sovereignty isn\u2019t about where servers are located. It\u2019s about who has ultimate authority when conflict arises.\u00a0<\/p>\n When New Zealand data sits on American infrastructure, American law is the final authority. No matter how many policies we write, how carefully we word our contracts, we\u2019ve ceded ultimate decision-making power to a foreign government.\u00a0<\/p>\n This isn\u2019t just a M\u0101ori concern \u2013 it\u2019s a matter of national sovereignty affecting every New Zealander.\u00a0<\/p>\n We\u2019re at a crossroads. We can accept offshore storage because it\u2019s cheaper and faster, pretend US corporations will respect our sovereignty, believe voluntary won\u2019t become mandatory and assume nothing will go wrong, or, we can recognise that digital identity infrastructure is too important to risk with offshore corporations.<\/p>\n While the system works as designed, it\u2019s built to depend on foreign infrastructure subject to foreign laws.\u00a0<\/p>\n We can\u2019t stop technology advancing, nor should we want to. But we can insist that critical national infrastructure \u2013 especially identity systems touching every aspect of our lives \u2013 remain under New Zealand control, operated under New Zealand law<\/a> and subject to New Zealand courts. This is about sovereignty, self-determination, and the future we want to build. <\/p>\n","protected":false},"excerpt":{"rendered":"The government stores our most important data on US-owned cloud infrastructure, making it subject to US laws. Software…\n","protected":false},"author":2,"featured_media":230455,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[26380,21913,19736,52142,19584,137244,111,43,139,69,2114,34068],"class_list":["post-230454","post","type-post","status-publish","format-standard","has-post-thumbnail","category-new-zealand","tag-atea","tag-data-privacy","tag-data-security","tag-data-sovereignty","tag-digital-sovereignty","tag-indigenous-data","tag-new-zealand","tag-news","tag-newzealand","tag-nz","tag-opinion","tag-realme"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/posts\/230454","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/comments?post=230454"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/posts\/230454\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/media\/230455"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/media?parent=230454"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/categories?post=230454"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/tags?post=230454"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\nThe RealMe system already stores login data offshore<\/a> in Microsoft\u2019s Azure cloud. New Zealand was the world\u2019s first country<\/a> to store citizen authentication data offshore in a public cloud. We set the precedent that this is normal.\u00a0
\nNew Zealanders are told their data stays on their devices, but the infrastructure making the system work is controlled by foreign corporations under foreign legal jurisdiction.<\/p>\n