Computer data of- and about students and researchers will be stored in the European cloud. Security experts question the choice of storage, but Radboud University made a conscious decision for the cloud.

‘Biased and misleading.’ Those words by Iwan Holleman, the division director of Information & Library Services, refer to a headline in Het Financieele Dagblad (The Financial Times) this past October; the headline claimed that student data would be ‘uploaded en masse to the American cloud.’ That is not at all where the data will be stored, as Radboud University has deliberately chosen the European cloud in collaboration with SURF. There are many reasons for the choise, including security reasons.

According to the FD, which based its findings on research by the TU Delft and the TU Vienna, 75 percent of all Dutch student data is in the cloud storage of American tech companies Microsoft and Amazon. For example, Brightspace and Instructure are part of Amazon, while Blackboard belongs to Google.

European servers

However, the article fails to mention that Dutch universities have made an agreement to keep all data in the European cloud. Iwan Holleman: ‘SURF negotiates with Microsoft and Amazon on behalf of 130 Dutch members of the education- and research communities, and they have agreed to keeping all data on European servers.’

That distinction is very important, because it means that the data falls under the protection of European privacy laws, which is not the case for data in the American cloud. ‘If your data is on American servers, then in some cases the American government will claim access to your data’, according to Jaap-Henk Hoepman, university professor and digital privacy investigator. ‘In that case, your data wouldn’t fall under the protection of European rules or the GDPR.’

Hacker

Storing data in the cloud has its advantages, according to Iwan Holleman; he points out the safety aspects. For instance, Maastricht University was hacked in 2019 and NWO was hacked in 2021, which locked down servers and backups. ‘That threat has become more and more serious, and the idea that the security of local data centres is better than that of massive cloud storage is wishful thinking.’

Maintaining personal data storage comes with other disadvantages. The sheer amount of data storage that the university needs requires enormous, extremely secure data centres. That is not just expensive, but also environmentally unfriendly, as those data centres expend a lot of energy.

Autonomy

However, cybersecurity experts remain sceptical about the use of services from Amazon, Google, and Microsoft. In an opinion piece in de Volkskrant, Nijmegen professor Bart Jacobs responded to the aim to store government data in the American cloud. ‘Schools, universities, and other institutions have switched over to cloud services and lost their autonomy’, according to Jacobs. ‘Big IT players force everyone to use their proprietary software more and more, making the use of (open-source) alternatives impossible.’

Jacobs, who also opposed the use of Office 365 at the university, suggests in his letter that we should ‘ develop a national (or European) cloud market by joining national suppliers, such as Freedom.nl or European ones like Nextloud.nl’, rather than ‘running to foreign parties.’

Lost Data

Those who do use the American cloud, for example as private users of Amazon or Google, are more at risk. Researcher Jaap-Henk Hoepman paints a scenario where data can be lost when the American provider denies you access to the cloud. ‘There have been cases reported where Amazon claims that the license for an e-book you purchased has run out, meaning you not only lost access to the book, but also all notes you made in it.’

That is why, according to Holleman, students would do well not to blindly trust large software providers for their own data storage. For instance, this VU student lost access to all their data earlier this year, when Google suspended his account. ‘If a programme appears free, the payment is data’, as stated by Holleman. ‘That is why it’s important that both employees and students use the systems for which we have made solid agreements. We don’t want to ban everything. A lot of smart people work here; we hope to make them aware of the fact that they need to be careful with their data.’