Data embassy

Last updated

A data embassy is a solution traditionally implemented by nation states to ensure a country's digital continuity with particular respect to critical databases. It consists of a set of servers that store one country's data and are under that country's jurisdiction while being located in another country.

Contents

Purpose

Data embassies are regarded as a tool to ensure a government's digital continuity, meaning the survival of critical databases to allow the continuation of government even in a situation where governing from within the country's borders is no longer an option. Among threats that might lead to such situation are natural disasters, large-scale cyberattacks, and military invasion. In the worst-case scenario, a data embassy could enable government to provide its digital services without the national territory under its control. [1] This makes data embassies particularly attractive to countries that have already digitalized their most crucial databases and are situated in the vicinity of the aforementioned threat vectors. Additionally, data embassies can offer additional computing power for heightened server traffic, for example during election season or the period of electronic tax return filing. [2]

History

The 2007 cyberattacks on Estonia disrupted websites of Estonian organizations including the Estonian parliament as well as newspapers and banks. Furthermore, Estonia has implemented a stringent paperless policy, meaning that many crucial databases only exist in a digital format. Tasked with ensuring the security and immutability of these databases, the ministries looked towards data embassies as a possible solution for digital continuity. This was crucial not just for Estonia's own citizens but also for e-Residents who rely on these services around the world. These efforts were also written down in the Estonian Cyber Security Strategy 2014-2017 which created an outline for ensuring the digital continuity of the state. [3]

In 2013, then-CIO of the Estonian government Taavi Kotka made active efforts to determine, in which constellation a data embassy would be the most useful and effective. The Estonian government also collaborated with Microsoft on two studies to determine the feasibility of virtual data embassies. [4] [5] The government decided against the option of converting selected Estonian embassies into data embassies because embassies did not possess the necessary technical and crisis response competence, were reliant on whatever telecommunications services they would be offered by virtue of their environment, and were not physically constructed according to safety criteria that datacenters could fulfil.

On 14 November 2016, the Estonian Ministry of Economic Affairs and Communications and Luxembourgish Ministry of Media and Communications signed a Memorandum of Understanding about the hosting of data and information systems. On 20 June 2017, Prime Minister of Estonia Jüri Ratas and Prime Minister of Luxembourg Xavier Bettel signed the agreement to establish an Estonian data embassy in Luxembourg. [6] [7] This agreement was ratified by the parliaments of Luxembourg and Estonia in 2018. In its first iteration, the Estonian data embassy in Luxembourg currently acts as a backup and source of additional computing power for the following datasets that are considered critical for the functioning of the state: e-file court system, treasury information system, e-land register, taxable persons’ register, business register, population register, state gazette, identity documents register, land cadastral register, and national pension insurance register. [8]

In 2018, Bahrain implemented the so-called Cloud Law which allows data stored in Bahraini datacenters to be subject to the domestic law in a third country. [9]

Initially, academic research also considered the application of the 1963 Vienna Convention on Consular Relations or the 1961 Vienna Convention on Diplomatic Relations to ensure the protection and inviolability of data but found that these conventions would require significant changes. [1] As a result of the lack of international legal precedent, data embassies have thus far only been created on the basis of bilateral agreements that are inspired by the wording used in the Vienna Conventions. These bilateral agreements also usually require ratification from the parliaments of the partnering countries.

Sources

  1. 1 2 Kask, Laura; Robinson, Nick (January 2018). "The Estonian Data Embassy and the Applicability of the Vienna Convention: An Exploratory Analysis". Icegov'19 via www.academia.edu.
  2. Kotka, Taavi; Liiv, Innar (September 15, 2015). "Concept of Estonian Government Cloud and Data Embassies". In Kő, Andrea; Francesconi, Enrico (eds.). Electronic Government and the Information Systems Perspective. Lecture Notes in Computer Science. Vol. 9265. Springer International Publishing. pp. 149–162. doi:10.1007/978-3-319-22389-6_11. ISBN   978-3-319-22388-9.
  3. https://www.mkm.ee/sites/default/files/cyber_security_strategy_2014-2017_public_version.pdf Archived 2021-02-12 at the Wayback Machine [ bare URL PDF ]
  4. https://www.mkm.ee/sites/default/files/implementation_of_the_virtual_data_embassy_solution_summary_report.pdf Archived 2021-03-08 at the Wayback Machine [ bare URL PDF ]
  5. https://www.mkm.ee/sites/default/files/transforming_digital_continuity_-_joint_research_report_finaly_may_20.pdf Archived 2021-03-08 at the Wayback Machine [ bare URL PDF ]
  6. https://www.riigiteataja.ee/aktilisa/2280/3201/8002/Lux_Info_Agreement.pdf [ bare URL PDF ]
  7. "Loi du 1er décembre 2017 portant approbation du " Agreement between the Grand Duchy of Luxembourg and the Republic of Estonia on the hosting of data and information systems ", signé à Luxembourg, le 20 juin 2017. - Legilux". legilux.public.lu.
  8. "Data Embassy – the digital continuity of a state". e-Estonia. December 9, 2019.
  9. "Diplomatic immunity for data: Bahrain's Data Embassy Law | Lexology". www.lexology.com. March 2020.

Related Research Articles

<span class="mw-page-title-main">Benelux</span> Western European politico-economic union

The Benelux Union or Benelux is a politico-economic union and formal international intergovernmental cooperation of three neighbouring states in Western Europe: Belgium, the Netherlands, and Luxembourg. The name is a portmanteau formed from joining the first few letters of each country's name and was first used to name the customs agreement that initiated the union. It is now used more generally to refer to the geographic, economic, and cultural grouping of the three countries.

Politics in Estonia takes place in a framework of a parliamentary representative democratic republic, whereby the Prime Minister of Estonia is the head of government, and of a multi-party system. Legislative power is vested in the Estonian parliament. Executive power is exercised by the government, which is led by the prime minister. The judiciary is independent of the executive and the legislature. Estonia is a member of the United Nations, the European Union, and NATO.

The Republic of Estonia gained its independence from the Russian Empire on 24 February 1918 and established diplomatic relations with many countries via membership of the League of Nations. The forcible incorporation of Estonia into the Soviet Union in 1940 was not generally recognised by the international community and the Estonian diplomatic service continued to operate in some countries. Following the restoration of independence from the Soviet Union, Russia was one of the first nations to re-recognize Estonia's independence. Estonia's immediate priority after regaining its independence was the withdrawal of Russian forces from Estonian territory. In August 1994, this was completed. However, relations with Moscow have remained strained primarily because Russia decided not to ratify the border treaty it had signed with Estonia in 1999.

<span class="mw-page-title-main">Schengen Information System</span> EEA database to support law enforcement

The Schengen Information System (SIS) is a governmental database maintained by the European Commission. The SIS is used by 31 European countries to find information about individuals and entities for the purposes of national security, border control and law enforcement since 2001. A second technical version of this system, SIS II, went live on 9 April 2013. An upgraded Schengen Information System entered into operation on 7 March 2023.

<span class="mw-page-title-main">Implementation Force</span> NATO-led force in Bosnia and Herzegovina (1995–96)

The Implementation Force (IFOR) was a NATO-led multinational peace enforcement force in Bosnia and Herzegovina under a one-year mandate from 20 December 1995 to 20 December 1996 under the codename Operation Joint Endeavour.

<span class="mw-page-title-main">International vehicle registration code</span> Codes used to identify where a vehicle is registered

The country in which a motor vehicle's vehicle registration plate was issued may be indicated by an international vehicle registration code, also called Vehicle Registration Identification code or VRI code, formerly known as an International Registration Letter or International Circulation Mark. It is referred to as the Distinguishing sign of the State of registration in the Geneva Convention on Road Traffic of 1949 and the Vienna Convention on Road Traffic of 1968.

Elections in Luxembourg are held to determine the political composition of the representative institutions of the Grand Duchy of Luxembourg. Luxembourg is a liberal representative democracy, with universal suffrage guaranteed under its constitution. Elections are held regularly, and are considered to be fair and free.

<span class="mw-page-title-main">Estonian identity card</span> National identity card of Estonia

The Estonian identity card is a mandatory identity document for citizens of Estonia. In addition to regular identification of a person, an ID-card can also be used for establishing one's identity in electronic environment and for giving one's digital signature. Within Europe as well as French overseas territories, Georgia and Tunisia the Estonian ID-card can be used by the citizens of Estonia as a travel document.

All European countries show eGovernment initiatives, mainly related to the improvement of governance at the national level. Significant eGovernment activities also take place at the European Commission level as well. There is an extensive list of eGovernment Fact Sheets maintained by the European Commission.

<span class="mw-page-title-main">Visa policy of Israel</span> Policy on permits required to enter Israel

Visitors to Israel must obtain a visa from one of the Israeli diplomatic missions unless they come from one of the visa-exempt countries. From January 2025, all visitors from visa-exempt countries must obtain an electronic travel authorization (ETA-IL) before traveling to Israel.

e-Residency of Estonia Estonian virtual residency program

e-Residency of Estonia is a program launched by Estonia on 1 December 2014. The program allows non-Estonians access to Estonian services such as company formation, banking, payment processing, and taxation. The program gives the e-resident a smart card which they can use to sign documents. The program is aimed towards location-independent entrepreneurs such as software developers and writers. The first e-resident of Estonia was British journalist Edward Lucas; the first person to apply for and be granted e-residency through the standard process was Hamid Tahsildoost from the United States.

<span class="mw-page-title-main">Taavi Kotka</span> Estonian businessman

Taavi Kotka is an IT visionary and previously the chief information officer of the Estonian Government known for leading e-residency program. Between years 2005-2012, Kotka was the CEO of Nortal, one of the largest software development companies in the Baltic states. Taavi Kotka proposed "10 million e-residents by 2025" on idea contest by Estonian Development Fund in 2014.

Veriff is a global identity verification service company founded and headquartered in Tallinn, Estonia. The company offers services for online businesses to mitigate fraud attempts and assisting regulatory compliance. Offering protection from identity fraud and identity theft, Veriff verifies a customer's identity automatically, using an AI that analyzes a multitude of technological and behavioural indicators, including facial recognition. The service is provided to companies as an API, which has been compared to Stripe.