With the now effective global lockdown due to the COVID-19 pandemic, the demand for video conferencing, virtual classrooms and collaboration tools such as Cisco Webex has grown exponentially. For example, Zoom has added 2.22 million additional users in 2020 which was more than the entire 2019. Google Classroom usage base has doubled to over 100 million.
Unsurprisingly there has also been a significant upsurge in the usage of these services in the Caribbean, particularly in the public sector as public service officials work remotely and schools attempt to restart the education system through virtual classrooms.
It is clear that the pressure to find solutions for business continuity has led to short-term decision making based on expediency and the requirement to deliver under pressure. However, now that the short-term demand has been met through the use of online tools provided primarily by Go-To-Meeting, Cisco, Microsoft, Zoom and Google, it is time for Caribbean governments to consider the medium to long-term business continuity strategies. From all of the medical expert comments it is clear that pandemics such as COVID-19 will not be a one off occurrence and medium and long-term strategies will need to be developed to ensure a nimble reaction to socially disruptive events. There is an opportunity now for Caribbean governments to adopt holistic approaches to such social disruptive events which not only covers national health-impacting epidemics such as COVID-19, SARS, Ebola, etc. but also natural and man-made disasters.
Resilience through Self-Reliance
At the core of any strategic approaches by Caribbean governments should be the concept of “self-reliance”. This core objective should be at the heart of any national and/or regional strategic initiatives to mitigate risk in the domain of ICT.
One of the primary collateral outcomes to emerge from the COVID-19 pandemic is the perceived “need” by individual governments to control the manufacture, distribution and export of personal protection equipment (PPE). Demonstrated by EU laws concerning PPE & export laws, and US laws that were similar. Could this requirement to control resources, including ICT, spread to other areas of the economic and social activity that now may be considered strategically critical at a nation state level? For the medium-term it appears that many governments will require those who can work from home to continue to do so. The tools (such as video conferencing and collaboration platforms) that allows a remote working approach to be sustained thus become critical strategic national infrastructure. Similarly the use of virtual classroom platforms may also become a strategic resource. The rapid upsurge in the use of the Google Classroom platform and clearly the strain on the existing infrastructure has prompted Google to issue guidelines on its use to ensure quality of service. Given that almost 50% of students in the USA use Google services could the government of the USA require that priority be given to USA based students?
How would that impact other countries, particularly regions such as the Caribbean, where none of the main players in remote working/collaboration have localised infrastructure?
What can be clearly stated is that, in the current COVID-19 climate, Caribbean governments have outsourced critical national ICT services beyond Caribbean jurisdictional reach.
It is critical that, rather than accepting this precarious status quo, Caribbean governments must urgently refine their strategies to ensure long-term control and sustainability. There are three key critical aspects to a holistic strategic approach to ICT deployment that Caribbean governments must contend with:
- Data sovereignty
- Data privacy
- Platform Security
This relates to the capacity of a nation state to ensure uninterrupted access to critical ICT platforms. Can a government ensure that it has both physical and jurisdictional control to access a particular environment.
Platforms such a Zoom, Microsoft 365/Teams and Google Services operate in their respective public cloud environments. Caribbean usage of these environments requires access predominately to US based data centres for both applications and storage.
This approach eliminates any possible control, by Caribbean governments, to ensure access to these services.
As indicated above in “Platform Access” the principal service providers have no infrastructure located in the Caribbean, this presents a significant data sovereignty issue for Caribbean governments. Where data resides, particularly sensitive or personal data , can be critically important. For example, data that resides in the USA is subject to the Cloud Act.
Concerns by the European Union over mass surveillance by US authorities of EU citizen data stored on USA located servers led to the implementation of the EU-US Privacy Shield agreement. This requires American companies providing US located cloud storage to be certified for compliance with the EU GDPR.
Currently the Caribbean has no such legislation to protect access to personal data. The surge in the use of cloud services for video conferencing, work collaboration and virtual classrooms further exposes potentially sensitive data of Caribbean citizens to ex-jurisdictional access and use.
To learn more stay tuned for Part 2, where we discuss the other critical aspects to a holistic strategic approach to ICT deployment.