Public data on foreign-controlled, private clouds? Yay!

Assinter Italia, a network with a vital role

Assinter Italia is the network of the in-house ICT companies of the 20 Italian regions. Almost all those companies are consortiums of smaller public software houses, owned by local Public Administrations (PAs), Universities and healthcare facilities of the corresponding Region.

The network has the vital role of representing not just the direct ICT interests and needs of italian PAs, but also those of all italian citizens, whenever their digital data are concerned.

In 2012, a law decree called for a nationwide reorganization of PAs data centers, in order to create National Strategic Poles (PSNs), that is organizations officially qualified to provide cloud services to public administrations.

By their own nature, all members of Assinter Italia should have played a primary role in the definition, creation and management of PSNs.

So far, instead, there is no trace of PSNs in Italy. Even their official list, that should have been available since 2018, is still missing.

No PSNs in Italy. Please move along

In July 2020, there was no information yet on how the private partners for building the italian public cloud would be selected. The screenshots in this post come from:

• an April 2019 introduction to “National Strategic Poles as a security measure for all basic digital services belonging to the Italian Public Administration, saving billions of euros”
• a July 2020 commentary about how a public cloud infrastructure is inescapable, if Italy is to stay independent from “private powers”.

What may (not) happen next

In January 2021, the (lack of) initiatives on the italian public cloud front have been defined as a de-facto decommissioning of a critical infrastructure, or more exactly of the right and will to have it, made easier by COVID-19 filling every public discussion. This is the comment by italian cloud expert R. Barberio, with whom I agree. The next paragraph is my summary of his commentary.

Without a serious change of course…

…The in-house ICT companies of the italian Regions will be excluded by a vital service, that also happens to be an impressive market, to the benefit of (foreign) Big Tech. This, in turn, will lead to over-staffing and serious loss of know-how in the same companies.

Last week Assinter Italia presented the idea of “Fare Sistema” (“Being a complete system”) for a digital republic to the italian government.

Through a project called “Smart Regions 2025”, _“the in-house companies of Assinter Italia would enable italian Regions and Provinces to aggregate the needs of local innovation [leveraging] the skills of in-house ICT companies and the experiences made locally”.

What this concretely means, says Barberio, is hard to say. Assinter Italia is not claiming an active role in the deployment and management of a national public cloud. When it met the government, it did not ask why the italian National Plan for Innovation in 2025…

• does not even mention PSNs that should naturally include Assinter’s in-house companies
• focuses on partnership with the cloud private sector, without any reference to the huge, already existing pool of public resources?

As things stand today…

It can happen, says Barberio, that moving PAs services “in the cloud”, is reduced to little more than issuing a public tender, just to assign it to the tender to Almaviva, an IT provider that also relies on Amazon AWS, Microsoft and Virtustream (DELL Techologies Group).

In such a landscape, it is natural to assume that the tender for Cloud Computing issued by CONSIP, Italy’s main procurement and purchasing body for PAs and closing in March 2021, will end up in similar ways.

The final result will be to dismantle the body of italian ICT public assets, from companies to know-how, with substantial, but exclusive benefits for Big Tech multinationals like Amazon, Microsoft and Google.

In the general indifference, Big Tech have done and are doing a magnificent job of demolishing an italian industry sector, and so far, Assinter Italia’s reaction seems completely inadequate.

Whoever runs the hardware has the data. NOT good

As said on the italian Nexa maling list, what Barberio describes amounts to a real decommissioning of public ICT infrastructures in favor of… someone else’s “Cloud”. It is a move to “Everything-As-A-Service”, through which italian PAs will give up all their computing agency to whoever owns and manages the physical hardware on which those services run. Thus granting those organizations, in practice, free and complete access to all the data managed by the same services. Something pretty complex to make GDPR-compliant, wouldn’t it? But regardless of GDPR, it’s something that should not happen, in Italy or any other sovereign state.