14 ms·
German state of Hesse has banned the use of Microsoft 365 in its schools
- pndy 4y agoMeanwhile, Polish gov't uses Microsoft Teams [1] as one of ways of verifying citizens who are applying for trusted profile service. [1] - https://moj.gov.pl/uslugi/engine/ng/index?xFormsAppName=WniosekOProfilZaufany https://moj.gov.pl/uslugi/engine/ng/index?xFormsAppName=Wnio... (in Polish)
- Melting_Harps 4y ago> Meanwhile, Polish gov't uses Microsoft Teams [1] as one of ways of verifying citizens who are applying for trusted profile service. Preface: Teams is horrible and it's super bloated for a simple chat app, but it's a mainstay for remote work along Slack and Zoom unfortunately. It's still better than the architecture using ID.me they built for unemployment benefits during COVID which in FL was subsequently hacked and leaked all kinds of personal info (that was already leaked with Equihax). The CEO then brazenly said it was not his company's responsibility to secure for attacks from hackers! > The DEO hired ID.me last spring, an identity verification company, in order to confirm the identities of agency clients when they access their CONNECT accounts. However, ID.me was not hired to protect against hackers. Nixon said the DEO recommends that victims of the hacking “monitor their financial accounts, and if they see any unauthorized activity, they should promptly contact their financial institution.” This kind of nepotism has to be called out for the crime that it is, good on Hesse for taking the initiative to do so, lets see if they move to FOSS. The Libre suite does everything word used to do without all the cloud BS that makes it entirely un-useable if you have ever spent 10 mins using a Linux distro. I just found a quote from a ID.ME rep on their subreddit [1] that 'didn't age very well' as they say in light of what happened soon after: Security and the protection of our users is our BIGGEST concern. This is why we are very much user based. Any information that we have is sent through users. You are able to revoke your accounts at any time. We have security teams that work overtime to make sure hacks and fraudsters do not happen. Thorough investigations and screenings happen on the backend to protect our users. And it gets worse in 2022 [2], they swapped CEOs but the MO remains in place: fleece pubic agencies and lock people out of their UI benefits. 0: https://www.bocaratontribune.com/bocaratonnews/2021/07/hackers-access-data-of-thousands-on-floridas-unemployment-benefits-website/ https://www.bocaratontribune.com/bocaratonnews/2021/07/hacke... 1: https://www.reddit.com/r/IDmeSupport/comments/n3exk9/comment/gwruiwh/?utm_source=share&utm_medium=web2x&context=3 https://www.reddit.com/r/IDmeSupport/comments/n3exk9/comment... 2: https://www.techdirt.com/2022/01/24/biometric-tech-company-idme-continues-to-swallow-govt-agencies-cause-problems-people-trying-to-access-their-govt-benefits/ https://www.techdirt.com/2022/01/24/biometric-tech-company-i...
- bushbaba 4y agoWhy the teams hate. I personally find it the best conferencing tool for recurring cadence
- hestefisk 4y agoIt’s a resource hog.
- fnord123 4y agoI don't know what the experience is like on Windows, but on other platforms it barely works. Super buggy. Super flakey. Super slow. The audio in conferencing also renders it unusable.
- azalemeth 4y agoIt's also quantitatively worse than the alternatives in every meaningful way.
- martin_a 4y agoTakes 520 MB right now for sitting idling in the background. That's how well it runs on Windows...
- lzooz 4y agoThat's 6.5 % of available memory of a computer with 8 GB of RAM.
- kspacewalk2 4y agoThat's not a lot. No one bats an eye when Firefox uses triple that amount sitting idle with 5 tabs open, because Firefox is Not Evil.
- dijit 4y agoFirefox can do a lot more than Teams can.
- darkwater 4y agoIn Spain they use Zoom for the same thing. It's really astonishing how governments, especially the European ones, don't cluster on open-source and self-hosted resources for all of these things. To be honest, I know the "easy answer" to this: "IT consulting firms, incompetence, bureaucracy and corruption", but even with that, it should be possible to do it with open system and not just rely on some other countries even for the software.
- mordae 4y agoNeoliberalism is super entrenched here. It is almost impossible to create a state/county/municipal IT department that would actually have enough sysadmins. All such departments rely almost entirely on external suppliers. One way this happens are salary controls. It is impossible to hire someone and give him the market rate, but it is trivial to tender the work associated with such position to a random external company for thrice the market wage. This effectively means that the critical advantage of FLOSS - just install it and see if it works for the users - is effectively killed by the red tape. Only software that someone actively sells can ever make it through. EDIT: And to be clear, this is not about customer support and whatnot. Number one complaint from most of the public servants who contract out IT services have been that the suppliers are not helping them, are overcharging them and in some instances they even threaten and withhold documentation and read access to their software databases.
- crubier 4y ago> Only software that someone actively sells can ever make it through. Only software that someone actively supports*
- hectormalot 4y agoNo I think it is the sales that counts. That 200k salesperson will of course make PowerPoint decks showing all the support options. But, the main barrier to take is convincing 10+ people with different incentives to all sign off on your product, and that is what enterprise sales gets done.
- tester756 4y ago>Meanwhile, Polish gov't uses Microsoft Teams [1] as one of ways of verifying citizens who are applying for trusted profile service. What's wrong with that? Microsoft is trusted vendor
- robin_reala 4y agoThey’re specifically not trusted: the CLOUD act makes them untrusted.
- Tomte 4y agoThe state of Hesse, not Germany. Data protection is overseen by the states, not the federal government.
- martin_a 4y agoAlso the scope is limited to schools. Headline is somewhat... hysterical.
- riedel 4y agoTrue. However, the situation is not limited to Hesse, but also data protection officers in Rhineland Palladia made the same call: https://www.heise.de/news/Rheinland-Pfalz-Schulen-duerfen-Microsoft-Software-Teams-nicht-mehr-nutzen-7154309.html https://www.heise.de/news/Rheinland-Pfalz-Schulen-duerfen-Mi...
- m1ghtym0 4y agoMaybe they should deploy it via Constellation https://github.com/edgelesssys/constellation https://github.com/edgelesssys/constellation
- F30 4y agoOhai, who should deploy what via Constellation? :)
- Garlef 4y agoWho are "they"? Microsoft? The issue is not a technological one but a matter of legislation.
- m1ghtym0 4y agoYes and no. It's a technological problem in the sense that there is a technological solution to this. See the Delos Cloud for example: https://www.handelsblatt.com/technik/it-internet/delos-cloud-schatzkammer-fuer-daten-wie-sap-eine-cloud-fuer-die-bundesregierung-bauen-will/28729518.html https://www.handelsblatt.com/technik/it-internet/delos-cloud... However Confidential Computing and Constellation unlock another technological solution where one can run IT infrastructure while being completely locked out and without access to the any of the data. Ensuring data sovereignty for the users and without building physically separated data centers.
- ofrzeta 4y agoGood thing. During the epidemic the school our kids attend started to use Teams because no one managed to reliably set up BigBlueButton (not the school but some public county resource). I was the only parent to complain but after a lengthy discussion with the principal I finally gave in.
- schleck8 4y agoGood call, I'm using a software firewall on Windows and the number of unnecessary requests it makes for gaming services, widgets I haven't used once and telemetry is surreal
- rvz 4y ago> The central German state of Hesse’s local Data Protection Authority (DPA) has banned the use of Microsoft 365 in its schools, citing concerns over privacy violations. The state of Hesse. Not the 'whole' of Germany. The clickbait title has worked its way to HN unsurprisingly.
- planb 4y agoWhat a clickbaity headline. It's just about one state, and only for schools. (The first sentence of that article is: "The central German state of Hesse’s local Data Protection Authority (DPA) has banned the use of Microsoft 365 in its schools")
- BartjeD 4y agoIt is a bit clickbaity. But on the whole i'd say its warranted. Because these judgements are precedents which bind other DPA's. The scope of the factual findings is broad enough to say that it affects any business using 365 handling personal data. That leaves only the question of legality in the specific case. Which depends on the presence and kind of personal data present in 365.
- _tk_ 4y agoData privacy agencies in German federal states do not rely on precedents set by other agencies. They have authority over how the law is interpreted in their federal state. Coming back to the gp, this title is not only clickbait, it's outright wrong. Similar decisions have been made in recent years in other federal states, nothing has changed for the national state of Germany or businesses in Germany.
- BartjeD 4y agoThis is only partly correct: In so far as Privacy law is based on EU law the DPA has duty apply the law in a consistent manner. In line with the rest of the EU, that is to say. To avoid fractures and discrepancies in EU law. Obviously these issues can sometimes only be decided at EU level. But the DPA's usually meet each other to discuss and align on contentious issues. And at other times they wait for EU level judgements. What's worrying in this case is that it's becoming a trend.
- Tomte 4y ago> precedents which bind other DPA's. They aren't legally binding. Neither are they in practice. The German DPAs alone are famous for bickering between one another.
- jasmer 4y agoMSFT should be leading the way. In what universe do they need to be collecting data from kids, especially that which cannot be kept locally. Telemetry data (which I suggest is reasonable that they collect) can be stored in local 'log' style DBs. It's not data they need to repatriate. Although for login and identity management, it might be reasonable to have that quasi centralized for security reasons. While MS could afford to build for each country, almost no other companies could. Finally, we need to be wary folks: this is ultimately a kind of regulatory capture. I'm already working with small startups that are struggling with this - they have customers unwilling to have their data stored in other countries and it's a giant problem. MS and G can afford to deal with it, startups, not so much. Edit: Gosh I wonder if that's an PaaS opportunity right there, aka 'transparent nationally stored data' ...
- rhamzeh 4y agoIf the customers are unwilling, how is this regulatory capture vs customer protection?
- jasmer 4y agoCustomers are the entities subject to the regulations and therefore making the demands. Notably, a lot of it results from a new shift in perspective aka they are developing internal security policies consistent with those regulations. None of this is entirely irrational - when the Internet was born, I was actually shocked at the ultra liberalism of it. I remember thinking Google's objective to 'organize the world's information' to be a big gliby arrogant - because what kind of person would believe that data in other nations was their right to manage? In hindsight I'm thankful that it was 'open' because my purview was a bit too narrow, that said, I'm having a 25 year 'I Told You So' moment and I do think we need to find an equilibrium.
- deleted 4y ago[deleted]
- pmontra 4y agoMS, G, AWS will end up offering local datacenters operated by local companies owned by them. They'll cost a little more.
- yayr 4y agoeven though currently just one state is implementing that in Germany, that decision shines out. France has recently imposed a similar ban. I don't understand, why this service cannot be provided from an EU data center. Every hyperscaler has these, MS also.
- t0bia_s 4y agoWhat they'll choose as alternative?
- Jenk 4y agoI note that this was published in September, has there been any follow up? I did search but didn't find anything.
- ciffi 4y agoNo, the decision was taken yesterday, it counts for all german Bundesländer and will be published today - if if if Bavaria will not hold back the publication.
- ciffi 4y agoIts not one Bundesland, but all 18 data protection officers of 16 Bundesländer (federal states; Bavaria has two) plus the Bundes… one. Kind of #Zeitenwende, but in german style. Right now the decision ist not in public. Speaker of Bundesdatenschutzbeauftragter Ulrich Kelber refuses to inform public….
- ciffi 4y agohttps://www.heise.de/news/Datenschutzkonferenz-Microsoft-365-ist-und-bleibt-datenschutzwidrig-7352065.html https://www.heise.de/news/Datenschutzkonferenz-Microsoft-365...
- ciffi 4y agoThe Microsoft 365 office package cannot be used by companies, public authorities and schools in a legally compliant manner, at least not without additional technical measures. This is the conclusion of a current data protection assessment adopted by the independent federal and state data protection supervisory authorities at their 104th data protection conference. Users must take additional protective measures in any case, warns Federal Data Protection Commissioner Ulrich Kelber. (…) The corrections are not enough for the data protection authorities. Microsoft has made "progress on individual points," Kelber acknowledges. However, the revised documents do not provide the necessary transparency as to which data can be used by the company "for its own purposes". The controllers are still unable to assess "in some places" what information and diagnostic values are still being collected and transferred to Microsoft. This also makes it impossible to check "whether all steps are lawful". https://www.heise.de/news/Datenschutzkonferenz-Microsoft-365-ist-und-bleibt-datenschutzwidrig-7352065.html https://www.heise.de/news/Datenschutzkonferenz-Microsoft-365...
- TekMol 4y agoI wonder how many Billions or Trillions the GDPR costs European companies. Pretty much every company has to fight with it. Hire lawyers, change software, implement "cookie banners" etc. The craziest part is that the GDPR has a competitive disadvantage for European companies built in: European companies have to show cookie banners even for users outside of the EU. While non-European companies only have to do so for users in the EU.
- f1refly 4y ago> I wonder how many Billions or Trillions environmental protection costs companies. > Pretty much every company has to fight with it. Hire lawyers, change machines, implement "dangerous waste disposal" etc. > The craziest part is that environmental protection has a competitive disadvantage for companies built in: Companies have to demonstrate their pollution prevention even for users outside of the EU. While non-European companies only have to do so for users in the EU. Analogy aside, no company has to show any banners, you just have to respect your users rights to privacy. All companies may use as many cookies as they want as long as they're strictly necessary for the sites operation.
- TekMol 4y agoI know a bunch of startups and they all struggle with the GDPR. None has any issues with environmental protection. "just have to respect your users rights to privacy" is easier said than done. I don't know a single startup that can say for sure they are GDPR compliant. It's not just "don't use Google fonts". It's really hard questions like "Do we have to replace all our non-EU infrastructure like our CDN, our payment provider, the SaaS services we use with new infrastructure ran by companies in the EU? How do we find those? Do they even exist? Do they work well for non-EU users? Are they compliant? How do we check?".
- chx 4y agoMeanwhile in Hungary someone breached the system used by every school for kids between age 6 and 18 and walked away with everything. We are not just talking of grades but all the personal data, disabilities. Teachers HR data too. Oh and also the source code https://thedailywtf.com/articles/hungry-for-an-education https://thedailywtf.com/articles/hungry-for-an-education
- pmontra 4y agoFor office webapps "local servers to store customer information" is not the solution IMHO. Spreadsheets and documents in general can store arbitrary data, including personal information. If MS's customers are told that documents are stored in the USA they can't store personal information in there and I don't understand why this should apply only to schools and not to companies in general. A solution could be creating a German company using German servers, licensing Office 365 from MS and also paying it to maintain those servers. That should put the data out of the reach of the CLOUD act.
- harryf 4y agoMisleading title. It's not all of Germany it's one state AND it's not a general ban just a ban from schools. > "The central German state of Hesse’s local Data Protection Authority (DPA) has banned the use of Microsoft 365 in its schools, citing concerns over privacy violations"
- weinzierl 4y agoAt the beginning of the pandemic Microsoft Teams was practically forced on everyone with children in Bavaria. With practically forced I mean you could either sign a document to get Teams for free or your child could not participate in online classes. A whole age group of children whose first online experience is Microsoft. In my opinion we should start there: Instead of unrealistic bans that no one will ever enforce we should not pressure people to use privacy invading software. Instead we should teach our children the use of free and open source tools to accomplish their goals.
- wil421 4y agoIn settings where IT knowledge is usually lacking like in school systems, sometimes off the shelf vendor based solutions are better to administer and run than OSS or free tools. I can’t even name an open solution for Teams. The UI/UX is horrible but I’m slightly more confident in Microsoft than what I’ve seen from Zooms security and privacy.
- hk1337 4y agoBig Blue Button (https://bigbluebutton.org https://bigbluebutton.org) is one. We actually used it at work for meetings but it seems they have since pivoted to be for more virtual classroom. I agree though, even that would need decent IT talent to setup and maintain.
- partiallypro 4y agoThe problem is those free and open-source tools may simply stop existing and all the skills the students learned with those programs could become completely useless. Germany, somehow, is a decade behind most of the other Western industrial powerhouses in terms of digitizing. I think the constant flux and reluctance to just move on is holding them back.
- dijit 4y ago> The problem is those free and open-source tools may simply stop existing and all the skills the students learned with those programs could become completely useless. That's a really bad argument when history shows the inverse. Name a FOSS program that no longer exists and I will give you 5 proprietary programs that suffered the same. Even in the same lineage as Teams there is: Communicator, Lync and Skype for Business. Now, they simply do not exist. However I can still run `vim` from the 80s and OpenOffice from the mid-00's without issue, even if there is limited support: it still works.
- acqbu 4y agoGreat! Now if only more institutions would wake up and follow suit.
- CrLf 4y agoThere's always the option of collecting LESS personal data.
- hdjjhhvvhga 4y agoI need to vent off some steam here. It really bothers that whenever I use a piece of Microsoft software like Teams or if I accidentally login to edge to use some MS service like Minecraft, Xbox etc., it logs me in to a MS account locally. It's infuriating. I can still undo it by going to settings and logging me out of all apps, but I bet there is someone in MS thinking well right now how to silently remove that option as a part of the next batch of updates (and all reasonable people always update their software to stay secure, right?).
- denton-scratch 4y ago> Dropshippers and other online entrepreneurs may want to conduct business outside non-EU countries That doesn't seem to make sense. Do they mean "in non-EU countries", or "outside EU countries"? Has my reading comprehension failed me?
- MiguelX413 4y agoBoth of your options mean the same thing, and I don't think it means either of those but the opposite.
- Bellamy 4y agoI so understand why anybody would use Microsoft products anymore. You can do all that and more with Linux and SaaS products that works in browser.