okay well good afternoon everyone and
welcome to the IPP workshop on privacy
security and compliance in the cloud my
name is Brendan Lynch I am Microsoft's
chief privacy officer where I've been
for the last 12 years I Microsoft in the
IPP have had a long history we were one
of its first members 15 or so years ago
we were one of the founding funders of
the certification program for privacy
professionals and we've done many
partnerships with them along the way I
personally served on the board of
directors of the IEP P for five-year
term including being chairman in 2013 so
for me it's wonderful to be back here
wonderful to have a great group of
privacy and security professionals
together to talk about the cloud and
everything that we need to do to ensure
that we have the trust and confidence in
moving to the cloud and leveraging the
cloud for all the wonderful things we
can a quick rundown of the afternoon I'm
going to give some opening remarks and
take some questions from you so begin
start starting to think about what
questions you may have
we're then going to have Doug Miller
who's an industry expert go deeper into
the cloud and the promises and perils
will then hand over to my colleague at
Microsoft Greg Brown who's a standards
expert who will give us a good sense of
the important role that cloud stand your
standards play in the cloud both the
present and in the future before hearing
a really compelling case study from Gina
Holden at taser about how they leverage
the cloud for what you'll discover is
very sensitive information and then
we'll wrap up so with that I thought I'd
begin and make a few comments and before
we dive into the cloud which you'll be
spending the bulk of the afternoon on I
thought it provided a broader context to
begin with and and it's really just
about all the change we see in the world
today there are new ideas every day that
really are off
back of the new technologies that we're
dealing with this time and in this era
that we're in is what the World Economic
Forum dubs as the fourth Industrial
Revolution and I'll explain what that
means in a moment I thought I'd first
back up and say what were the first
three well the first Industrial
Revolution began about 250 years ago and
it was where mechanized production
happened for the first time it was
leveraging water and steam power and if
you think about humanity up to that
point the fastest transportation for
example was the horse so when the steam
engine came along it was obviously very
revolutionary and it did it did have a
big impact on industrial production as
well the Second Industrial Revolution
really brought mass production and
assembly lines and it was heavily
influenced by the advent of electricity
and the broader adoption of that and
then the third Industrial Revolution
which we've been in for the last couple
of decades or a few more has been about
electronics and IT and its impact on
further automating production and so
that's where we are and where we've come
from and what what are the key
characteristics of this fourth
Industrial Revolution we're on we're in
and beginning to to be in in and it's
really the confluence of three broad
spheres of capabilities the physical the
biological and the digital and it's not
just advances in each of these
individually
it's how they interact with each other
about how the digital supports the
biological and so on the physical is is
everything from new materials through to
autonomous vehicles 3d printing robotics
and the like the biological is very much
about genetic testing and genetic
engineering and not just will have
impact on human health but also on
agriculture and livestock more broadly
and then the digital why
range of things but it includes advanced
data analytics quantum computing and the
like and so the the will economic forum
is is that it's the confluence of these
things and the pace that of innovation
that will come from the combinations of
these things and one of the interesting
things about it all the thing that
underpins all of these three is the
cloud the cloud is the new
infrastructure for our world and so
that's it's why it's such an important
topic I think for this workshop in this
day is recognizing the degrees have
changed that were that are undergoing
and the important and crucial and
fundamental role that the cloud plays
here are a few examples these are just
articles that you can't read from the
back I'm sure from the last month these
are just breakthroughs and in these
domains over the last month so the the
one on your far left is is autonomous
driving and a software company that has
has now rolled out the first fleet and
the first pilot of driverless taxis it's
in Singapore in the middle from
University of California Berkeley a
breakthrough which is a sensor the size
of a grain of sand which can be
implanted in your body and can detect
the electrical impulses for muscles and
nerves and and and it's it's sort of
powered by and read by ultrasound and so
you could imagine the real-time ability
to be able to monitor muscles nerve
activities organs which which will have
massive breakthroughs and it will
certainly replace these bands that we
have on our wrists if you're so brave is
to have these things implanted and then
on the far right is is the the creation
of the artificial atom using graphene
and and it's a promise in the the
quantum computing world is supposedly
going to be transformational so these
are just three small examples of recent
things that but they really just show I
think the the types of breakthroughs
that are happening with the confluence
of these technologies also the
underpinning of the cloud
as you might imagine at Microsoft we
have a lot of examples of these things
one of my favorites of how we're
bringing cloud power and data analytics
to help change the world is is this
example from Spain it's from the
Drummond Syndrome Foundation and it's
using the next generation the genetic
sequencing in the cloud to really
advance and and and speed up the time to
diagnosis of diseases so that patients
can get the right treatment early not
get the wrong treatments and and deal
with situations like that this one had
an interesting background it started by
a little boy in Spain called Scioscia
and his situation was that it's six
months old he was started having
seizures and many many many visits to
hospitals all sorts of testing testing
gene by gene to try and work out what
was the underlying disease causing this
and they they did discover and diagnosis
in about eight months time and believe
it or not eight months is actually quite
fast for these types of diseases there's
a lot of complexity sometimes you know
it can be a couple of years of
experimentation of different drugs and
all sorts of things to actually diagnose
what's going on so she has father
happens to be a Microsoft employee in
Spain and he he got together with a few
colleagues and worked started this
foundation and started to think about
how we might be able to leverage the
cloud and transform this type of
diagnosis in the future and that's it
essentially what happened you know
there's 40 terabytes of data they needed
to put in the amount of processing it
takes to work through these things used
to what used to take years can now be
done in a month and it's rapidly sped up
the diagnosis of not only drive it
syndrome but a range of other diseases
as well and has a lot of promise so
that's one example that's you know in
the healthcare space but there are many
many examples and I'm sure you've all
got your own in your own industries
about how technology is transform
and an enabling breakthrough advances
when I think more broadly about this and
and talk to my counterparts around the
world and various industries and
organizations one thing is in common in
all of this is that data is driving
innovation yes it's the computing power
and hyper scale cloud and all these
things help but a lot of innovation is
off the back of data and there's privacy
and security professionals that's
obviously very pertinent to our jobs
understanding the value side of this
help how important it is to advance
society's advanced individual
capabilities and at the same time as
managing the downside risks that come
with data but if you think about it it's
increasingly the digital world the
devices we have the interactions we have
that increasingly have a digital
component we are essentially as
individuals and organisations creating
vast and vast amounts of data which
provide all this promise but at the same
time they they there's some serious
considerations for security and privacy
and compliance it's all cloud-based
increasingly and we'll talk more about
that a lot today and it's all industries
one other example I use which resonated
well in my homeland of New Zealand where
I grew up both my parents were dairy
farmers but even the dairy industry is
getting transformed through technologies
so I'll give the short version of the
story here but it's it can imagine cows
walking around with pedometers on and
then a lot of data analysis happening in
the cloud in the back end and sending
information back to the farmer and the
ability to actually get early diagnosis
of disease because of the way that the
cows movements change very importantly
getting early indication of the
reproductive cycle about to begin so
that they can actually do the artificial
insemination at the perfect time and
really increase the the reproduction
which is crucial for not only milk but
you know growing the herds even to the
point where it's so scientific and look
at the data
they could decide determine the right
time to inseminate to increase the
probability of female which is obviously
what they want more in dairy farming as
well so that's an example of how one of
the most primitive industries that we've
had over time is also being transformed
by digital technologies and by the cloud
more broadly in thinking about things
specific to security and privacy I've
talked about the cloud adoption
organizations all over the world are
recognizing the the the transformational
strategic and economic benefits of
moving to the cloud and and so it's it's
happening at a very fast rate
we've also of course got the the advent
of machine learning and advanced
analytics again powered by the cloud as
a key trend in our space and it's
enabling things like more personalized
experiences you know I think that we
when we look at the world and we look at
all these vast opportunities that
technology is providing us it almost
seems like it's unconstrained but one
constraint that we have is human time
and attention and so we're all seeking
to be more productive without time to to
have our experiences more personalized
to basically make it more efficient to
get things done and we're we're just at
the beginning but we're seeing in the
individual space you know do digital
personal assistance and and I can expect
that we'll we'll see just a lot more of
that people are going to want to use it
they're going to opt into it there's a
lot of sensitive data that can be
collected through it so it's important
for us as privacy and security
professionals to really think through
how we do that in a way that builds
trust and mitigates risk and enables
compliance another big trend in the
space is there's with all this data
there's no surprise that regulators want
to have a say and we're seeing a wave
and I believe even more of greater
regulation around data one key example
right now which I'm sure will be topical
here at the IPP over the next few days
is the general data protection
regulation and Europe
it it it has more owners requirements
and more significant consequences of
getting it wrong I think that and other
things will lead us to a new era of
information management we're
increasingly going to be looking for our
information management systems to be
able to automatically understand and
enforce policies and rules around data
including not just who can have access
but how it can be used so I think that
those are a number of areas of
technology disruption but also areas
where we can use technology to our
advantage to help us in information
governance so switching to the cloud I
thought I'd provide a few perspectives
from from Microsoft as an example of
your major cloud provider in the space
one thing that's inherent in this quote
from our CEO Satya Nadella is that we
recognize that people in organizations
will not use technology that they do not
trust and so for us it's a business
imperative to build trust in confidence
in the cloud and to partner with our
customers in doing that so we make these
series of commitments we make a wide
range of investments to enable that
we're very focused on what are the
standards and practices and how can we
demonstrate those in ways that will give
you confidence give you the information
you need what what can we do to
collaborate with industry and with
regulators to help raise all the boats
to help build confidence in the and the
broader cloud ecosystem and and and
really as a company we're in your shoes
too we've got a lot of exposure to laws
and regulations around the world we
operate in many many countries and we've
got our own rigorous compliance needs
and we apply the same in the way that we
do it so that's sort of the the
commitment from the top down now what do
we do next how do we sort of unpack that
concept of trust what does it mean day
to day and investments to help and it's
across these four dimensions
security privacy control transparency
and compliance so the commitments of
course to implement the strongest
security procedures and controls and get
all the certifications to verify that we
have that that ensure that we're
safeguarding your data privacy and
control a bundle because it's
increasingly it's about how can we give
you control yes it's in its limiting use
and it's having conversations around
liabilities and all those sorts of
things but it's very much about how can
we empower you through our services to
have control over how the data is used
and who has access to it compliance I
mentioned before we we focused a lot on
achieving all the certifications that
there are customers demand honor of us
and in helping thereby you to be able to
comply with your needs and to be very
transparent Trust is always built on
transparency is that saying that
sunlight is the best disinfectant I
think it's especially true here and
there's so much that we and other cloud
providers have published to really live
up to that principle of being clear and
transparent and we're trying to do that
in is clear and plain language as
possible and tailor the content for
different audiences and I'll talk a
little bit more in a moment about what
we're doing specifically for the
security and privacy professionals so in
fact I'll start there right now you have
a vital role I you know I you all know I
bet that that you had you play a vital
role in your organization's around data
generally on one hand you want to be in
a position where you're helping your
organization enable the use of data to
drive that next wave of innovation to
delight your own customers and at the
same time you want to manage that risk
and you're responsible and accountable
for helping manage that risk for your
company so you're depended on and I
probably can't say enough about that you
know I know that in my own role when I
think of
supplier relationships and data crossing
trust boundaries to other organizations
that that we spend a lot of time and
focus on how do we ensure that we have
confidence throughout the data lifecycle
and all its movements that the rules are
being upheld around its use and and so
that is it probably goes without saying
that you have a crucial role the there
are a couple things that we do to help
you with that and first of all it's how
we actually approach our cloud services
and that's in in a number of areas I
talked about standards and regulations
we actually have a history of being
often the first in industry to achieve a
particular certification to it to a new
standard and we've seen that whether
it's the first to get European model
clauses whether it's the first to get
certified to ISO 27001 8 which is a
cloud privacy standard those are
examples of that and you can expect that
from us that we're always going to be on
the forefront always looking around the
corner listening to our customers
understanding what they want might want
next and going and going there we've got
thousands of people security and
compliance professionals around the
company working on this we do a lot of
work to actually stand up for the legal
rights of customers we've been in the
position recently of suing the US
government four times for various things
largely around the ability to provide
more transparency to be able to inform
our customers more about what sort of
law enforcement access is happening to
data or requests that are coming in is
an example of that so that's that's what
we're doing in our own actions and then
finally and then I'll open up for some
questions is we've created this new
portal particularly focused at the legal
and compliance professionals to help
them sift through all the large amounts
of data and have it tailored for them by
industry by region about how we can help
you with this the the website there is
Microsoft cloud assurance com
and you'll find a lot of those resources
there we're also partnering with
organizations to do training and we're
doing a number of customer roundtables
too to listen and understand your needs
this is an example I think of one of
those partnerships of where we're
reaching out to the community and
providing information and bringing a
broad set of perspectives together like
we have in this workshop today so those
are some of the things that we're doing
some of the broader context that I see
for the way the world's changing the
crucial role that the cloud plays the
crucial role that privacy and security
professionals and compliance
professionals play and some of the
things we're doing to help
so with that I'll I'll pause and I'll
open up and take any questions you may
have we've got a microphone up here so
when you're ready raise your hand and
we'll take a question you talked about
genetics as the science that you're
primarily concerned with through their
other areas it wasn't per se that it's
an area I'm concerned with it was more
that it was an area where we expect a
lot of breakthrough and it's the the
whole genetics world because they can
now leverage the power of the cloud for
these advanced computations were over
large sets of data and derive new
insights that are really going to
advance human health and as well as as I
mentioned agriculture and livestock and
and the rest of it so on one hand you
know I'm saying I'm not I didn't raise
it necessarily as a concern but that
said you know our genetic information of
course is I've really some of the most
personal information that we have and so
we need to ensure that all of this is
happening like everything else that we
that we put in place the appropriate
security and privacy protections around
it so that we get all the good out of it
and mitigate the bad hi Jacob Jacob
Abbott Laboratories I'd be interested to
hear your thoughts of like the trend
towards the cloud no question but also
the trends from countries to localize
data and how I sort of like try to meet
those sometimes conflicts yeah I think
it's a it's a very interesting question
there are certainly is we all know
concerns often about where is the
location of the data in addition to
irrespective of where it is how is it
protected who has access and all the
rest of it and I think we're seeing a I
expect a settling out eventually I think
there are certainly some countries are
saying for at least for certain datasets
that we want to have that maintained you
know you know region or our country at
the same time when you look at the pure
sort of economic and agility benefits
that come from the cloud they often
benefit from data movement and from data
video to be able to move around and and
be combined with other datasets unlike
and naturally that will mean often
crossing a national border so those
tensions are at play I I think that
there'll be as I say a settling out it's
probably going to be certainly us and
others looking to see what we can do
from a regionalization of our of our
cloud infrastructure we have at
Microsoft I think more regions than any
other right now I think it's 24 regions
or something like that around the world
where where organizations can can have
move to the cloud and have their data
stay within the region for example in
Europe you know because we've got data
centers in Dublin and Amsterdam and
building more out in other places you
can then enable that that kind of thing
so I think we'll see a combination you
know at the same time there's a big
public policy debate about should it
matter can we establish new norms and
treaties and the like that sort of makes
the makes the about the border
irrelevant in terms of being able to
uphold the people's rights so if your
rights get upheld no matter where the
data is based on your own laws locally
that's certainly a I think an intriguing
prospect and one
we're in our public policy discourse
exploring to see how that sort of thing
might work because that that should if
that could come about that would in in a
lot of ways I think take away there the
concerns and the need for for more
sovereign or localized clouds I see
Suzanne Ames Research Center this kind
of is a good follow-on to that question
how has regulation affected how Micra a
Microsoft approaches cloud services and
if it has what example yeah I think
that's a great question I think you know
one of the one of the things to begin
with is that when we first began in
cloud services and arguably largely
still today there's not cloud specific
regulations so it's all about how are
the existing laws and regulations apply
to this new paradigm and we see this
time and time again with a new
technology when when we first introduced
location-based services how do we apply
the existing law to this new thing
and the same was true for the cloud for
us that actually began 20 years ago
because that's when we had hotmail you
know and and and the consumer clouds of
offering for the first time we're from a
privacy standpoint even though the cloud
today is very different it's hyper scale
and it's got all of these you know all
these other capabilities that come with
it but the concept of putting sensitive
personal information on servers that are
none under your control you know in a
cloud environment and access it through
a web web form a web site was was back
then and so right at that moment I
wasn't at the company at that time but
it was all about how do we apply our
current rules and policies and
everything that you're designed to meet
the laws and regs around the world for
this new thing what are the controls we
should put in place whatever was the
what are the consent we should get what
are the informed choices that people
have how can we enable people to control
it to be able to delete their email you
know
that kind of thing and and and then that
sort of flows through so I think it's a
fairly generic answer but but generally
speaking the the it's it's about really
because a lot of these laws and regs are
principles based it's about applying
those principles to the new thing and
that's why you see our trusted cloud
principles being those cool things
transparency control security the
bedrocks of all privacy and data
protection law since it began you know
federal requirements for all IT if
you're going to work with the federal
government yes is a national institution
of standards in technology 800-53 is
kind of known throughout the federal
government and the federal government
really is only a small part of the yeah
total customer base that you have but it
has affected how how the government
approaches you know cloud services so I
was wondering how regulations affect how
NASA
I mean Microsoft approaches cloud
services yeah absolutely I know it you
know it's that's a good good follow up
because I I stopped short of going there
but but I was talking in the more
general case that's you apply the
principles but of course there are going
to be laws and regs and rules and things
that come out that are specific whether
it's specific to a vertical industry
sector specific to a certain country
where they do get more prescriptive and
and that is that is peak you know to to
the way that we provision out and
operate our cloud services we have and
when Greg comes up I'm sure he'll
explain more about the vast you know
amount of things that we have to deal
with like that but what the approach we
take is to establish what's that common
layer of controls that we need in place
to meet all these things sometimes a new
requirement will come in which means
we've got to add a new control often
it's it's a flavor of something else
that we've already got to control for we
might just need to demonstrate it in a
different way to meet that particular
rule or for that auditor and so but it
does it does these types of things like
nest and FedRAMP and all these other
ones they
we have a very significant impact on the
way that we design operate our cloud
services thank you
hi but Eccleston if I'm an interaction
I'm just going back on the data
sovereignty issue and specifically for
Europe you were quite innovative with
your data trustee model in Germany I was
wondering if you could expand a little
bit on this and and also outline whether
it's more tactical solutions until
things settle down or is this more of a
strategic or more of a strategy for
Europe where you won't deploy sort of
specific agreements with the Turkish tea
providers in order to build that trust
and give control to their customer yeah
it's a great question and I'll might
just take a minute to explain for those
in the audience who might not know what
what the the model that we're that were
adopting and in Germany as a first
instance and it's it's called a data
trustee model so it's a it's a data
center very similar to the ones that we
design and build everywhere in the world
except that Microsoft's not operating it
it's operated by in this case a
subsidiary of Deutsche Telekom so it's
German nationals
it's a Germany based its German
nationals operating it and and and the
reason behind it I think is partially to
is looking at that there is a need and
expectation for some customers
particularly for some workloads or some
data sets that they really do want to
keep its sovereign health health data is
often in that realm but it's part of the
broader approach that we have which is
we want to cater to everybody's needs
and we have hybrid we have everything
from the public cloud through to the
on-premise solution and then variations
in between and this is just somewhere on
that spectrum where it's it's about you
know sort of enabling a certain set now
there is one thing that's important to
understand there is it's a more
expensive model it was the price premium
to that but they may well be demand you
know demand that
will because you back to the benefits of
the cloud and the strategic and economic
benefits if there's a data set or a
workload that's just too sensitive to
put in the public cloud for example this
may well be a really viable option and
for our customers and so that's we made
that announcement a while back in
building towards that one yes and can
you elaborate a little bit on the
scenarios you had talked about the legal
challenges here in the US now what the
there was actually been for legal
challenges to the US government
three of which are pretty much concluded
and one that's ongoing the the first was
in the wake of the Snowden revelations
and us you know we'd already been
publishing a transparency report on the
the law enforcement requests that we get
for data and and the like but we were
prohibited in the national security
sense to be able to do that about FISA
Court requests and like so we were we
with the RET with others in industry
challenged the US government to allow us
to be more transparent around that and
eventually the the Justice Department
agreed and gave some parameters for that
you know we can report and blocks of
like it's between zero and nine hundred
and you know nine hundred and two
thousand or whatever it is but but there
was a successful case there was there
was another one where we were asked for
data relating to an enterprise customer
and our policy is to redirect law
enforcement to the enterprise customer
because we don't know how to finish the
request it's we're just the you know the
story of the data it's them that it
should go to and and we were successful
and
in that case as well then there was a
third one which was cross international
one which we call the warrant case but
it was a warrant in New York which was
seeking to get a data from the Microsoft
cloud relating to a customer whose data
was in Europe a non-us citizen whose
data was in Europe and what we were
really standing up there for was the to
stand up for the principle that the same
protections that you have a place in the
analogue word willed should apply in the
digital world so for example why should
the printed copy of this email in this
individuals house in a foreign country
have more protection than the copy on
the server and and the argument was from
the US government side where there's
these were business records and we had
the ability to hand them over therefore
we should and again we've revealed
prevailed in that case that went to it
went to an appeal and then most recently
we have a case which is again it's a
transparency thing but it's also about
it's about being a right and ability to
be able to inform customers of when
there is a regal request for their data
now often there are situations where
there was a gag order on that because
revealing it to him you know would tip
them off that you know they're the
crimes are about to be busted but what
we noticed over time was that the the
gag orders on these were increasingly
frequent and and were unbound from a
timing perspective and so that's what
this lawsuit is about and we've recently
just got a lot of support and amicus
briefs from another and others in
industry and civil society and etc to to
really try to curtail that and not have
there are places where that makes sense
and as a society we want that but it
really felt like the the government was
overusing this ability to put a gag
order in place
and not set a time limit on it so that's
the one that's more current and active
right now
okay well I will wrap up with one final
question for Brendon I think we have
about another few minutes in our in our
time slide here so Brendon your chief
privacy officer one of the largest tech
technology companies in the world that
puts really real on the front line and
we know all these things are coming down
the pike for example in Europe you've
got the general data protection
regulation which you mentioned we've got
privacy shield which max schrems has
assured us will be challenged in court
what are you going to spend the next 12
months sort of what's going to be
keeping you awake in this coming year
I think the you know in some ways I know
a lot of my counterparts around industry
are going to be spending a lot of time
on how do I reorient my program to meet
these new European rules and and that's
that's true of us as well there are
certain things that we've got to do
we've I think fortunate that there's
been a lot of investment in privacy at
Microsoft over the years I'm actually
the third chief privacy officer say I
was lucky enough to inherit an already
mature program when I joined and so it's
continual improvement so you know we've
got time there's some of these timelines
are short particularly if you've got to
make system changes and things like that
may 28th een will come around pretty
quickly so that certainly got a lot of
my attention to make sure that we we do
all what we need to do not only to
achieve our own compliance but back to
the our cloud in our enterprise
customers what do we need to do and what
can we do to help our enterprise
customers so that'll be a lot of focus I
think the the other broad theme for me
is just the pace of change back to where
I began this talk and when you think
about things like doing a privacy review
to make sure that a new data collection
or a new data use is in with lying with
our values and our policies and our
principles you know the the ability to
kind of take some time to do that review
is disappearing quickly and what it
leads to I think is a shift in the
approach a little bit more emphasis on
how do we create broader awareness how
do we
create more more of the cultural element
so people just know what the rules are
when they're doing this targeting
particular communities we've got a lot
of data scientists at Microsoft how do
we how can we inform them in a way to go
and do all the cool work they're doing
but also to be cognizant of where they
might run afoul of our privacy policy so
it happens more organically and by
design
so I think those are a few of the focus
areas for me