4 ms·

How can you be sure that data transmitting between the centre and user in Canada doesn't leave Canadian borders?

a-priori 10y ago
You can't. Most data transmitted between cities in Canada goes through the US. The only mitigation is to make sure you encrypt everything in transit and ensure that the private keys never leave Canada.
- toomuchtodo 10y ago
  And please please please make sure your server is configured to support Perfect Forward Secrecy. https://www.ssllabs.com/projects/best-practices/ https://www.ssllabs.com/projects/best-practices/
  - luhn 10y ago
    A good source for the recommended SSL configuration for Apache, nginx, et al.: https://mozilla.github.io/server-side-tls/ssl-config-generator/ https://mozilla.github.io/server-side-tls/ssl-config-generat...
mynameisvlad 10y ago
I don't believe there's any requirements for the data to never cross borders on transmission, just that it must be stored in Canada.
- unfocused 10y ago
  IT Manager in the Canadian Government here. There is indeed a requirement stating that data must not cross the border. This requirement though depends on the department and level of information security. Whether or not AWS, Azure, etc. can meet this...I honestly don't know.
  - nilved 10y ago
    You should quit
  - mynameisvlad 10y ago
    Yes, for government entities, but the rest of the comments here are talking about businesses, which are going to be the primary consumers of AWS in Canada. There's probably many more requirements that would be needed to be met for any cloud provider to be used for governments. I don't believe any provinces have requirements on border crossing, and there's no federal requirement on data sovereignty at all for private corporations.
    - grecy 10y ago
      I worked for a very, very big Canadian telco. Same requirement - data must not leave Canada, which ruled out basically all "hosted solutions"
      - mynameisvlad 10y ago
        It would be virtually impossible to comply with the never crossing the border as part of a fast link even if you hosted your own data unless you controlled every part of the link. http://www.servercloudcanada.com/2015/09/canadian-privacy-laws-canadian-cloud-primer-canadian-businesses/ http://www.servercloudcanada.com/2015/09/canadian-privacy-la... There are only 3 provinces that require storage in Canada: BC, NS and QC. And even then, that is for public sector organizations only.
        grecy 10y ago
        I was in a territory (not a province) and we owned every meter of fiber in two territories. I can assure you the data we were sending around didn't even leave our territory, let alone the country, seeings we owned every single scrap of networking hardware in a ~10,000km radius.
    - Spooky23 10y ago
      They are landing a govcloud there too. So I'd assume a lot of .gov investment.
psybin 10y ago
It almost certainly goes through the US no matter what you do. Traffic going anywhere out of my city first drops down to a big peer exchange in the US, then back up into Canada.
- betaby 10y ago
  Mind to share a trace route to such destinations?
- voltagex_ 10y ago
  That's odd. I know traceroutes don't always show the truth, but when I was there I could route between Victoria and Vancouver without going through the US, at least. No idea about Vancouver to Montreal.

You can't. Most data transmitted between cities in Canada goes through the US. The only mitigation is to make sure you encrypt everything in transit and ensure that the private keys never leave Canada.

toomuchtodo 10y ago
And please please please make sure your server is configured to support Perfect Forward Secrecy. https://www.ssllabs.com/projects/best-practices/ https://www.ssllabs.com/projects/best-practices/
- luhn 10y ago
  A good source for the recommended SSL configuration for Apache, nginx, et al.: https://mozilla.github.io/server-side-tls/ssl-config-generator/ https://mozilla.github.io/server-side-tls/ssl-config-generat...

mynameisvlad 10y ago

I don't believe there's any requirements for the data to never cross borders on transmission, just that it must be stored in Canada.

unfocused 10y ago
IT Manager in the Canadian Government here. There is indeed a requirement stating that data must not cross the border. This requirement though depends on the department and level of information security. Whether or not AWS, Azure, etc. can meet this...I honestly don't know.
- nilved 10y ago
  You should quit
- mynameisvlad 10y ago
  Yes, for government entities, but the rest of the comments here are talking about businesses, which are going to be the primary consumers of AWS in Canada. There's probably many more requirements that would be needed to be met for any cloud provider to be used for governments. I don't believe any provinces have requirements on border crossing, and there's no federal requirement on data sovereignty at all for private corporations.
  - grecy 10y ago
    I worked for a very, very big Canadian telco. Same requirement - data must not leave Canada, which ruled out basically all "hosted solutions"
    - mynameisvlad 10y ago
      It would be virtually impossible to comply with the never crossing the border as part of a fast link even if you hosted your own data unless you controlled every part of the link. http://www.servercloudcanada.com/2015/09/canadian-privacy-laws-canadian-cloud-primer-canadian-businesses/ http://www.servercloudcanada.com/2015/09/canadian-privacy-la... There are only 3 provinces that require storage in Canada: BC, NS and QC. And even then, that is for public sector organizations only.
      - grecy 10y ago
        I was in a territory (not a province) and we owned every meter of fiber in two territories. I can assure you the data we were sending around didn't even leave our territory, let alone the country, seeings we owned every single scrap of networking hardware in a ~10,000km radius.
  - Spooky23 10y ago
    They are landing a govcloud there too. So I'd assume a lot of .gov investment.

psybin 10y ago

It almost certainly goes through the US no matter what you do. Traffic going anywhere out of my city first drops down to a big peer exchange in the US, then back up into Canada.

betaby 10y ago
Mind to share a trace route to such destinations?
voltagex_ 10y ago
That's odd. I know traceroutes don't always show the truth, but when I was there I could route between Victoria and Vancouver without going through the US, at least. No idea about Vancouver to Montreal.