Hacker News Reader

Comment by davidjgraph | Hacker News Reader

How can you be sure that data transmitting between the centre and user in Canada doesn't leave Canadian borders?

You can't. Most data transmitted between cities in Canada goes through the US.

The only mitigation is to make sure you encrypt everything in transit and ensure that the private keys never leave Canada.

And please please please make sure your server is configured to support Perfect Forward Secrecy.

https://www.ssllabs.com/projects/best-practices/

A good source for the recommended SSL configuration for Apache, nginx, et al.: https://mozilla.github.io/server-side-tls/ssl-config-generat...

It almost certainly goes through the US no matter what you do. Traffic going anywhere out of my city first drops down to a big peer exchange in the US, then back up into Canada.

Mind to share a trace route to such destinations?

That's odd. I know traceroutes don't always show the truth, but when I was there I could route between Victoria and Vancouver without going through the US, at least. No idea about Vancouver to Montreal.

I don't believe there's any requirements for the data to never cross borders on transmission, just that it must be stored in Canada.

IT Manager in the Canadian Government here. There is indeed a requirement stating that data must not cross the border. This requirement though depends on the department and level of information security.

Whether or not AWS, Azure, etc. can meet this...I honestly don't know.

Yes, for government entities, but the rest of the comments here are talking about businesses, which are going to be the primary consumers of AWS in Canada. There's probably many more requirements that would be needed to be met for any cloud provider to be used for governments.

I don't believe any provinces have requirements on border crossing, and there's no federal requirement on data sovereignty at all for private corporations.

I worked for a very, very big Canadian telco.

Same requirement - data must not leave Canada, which ruled out basically all "hosted solutions"

It would be virtually impossible to comply with the never crossing the border as part of a fast link even if you hosted your own data unless you controlled every part of the link.

http://www.servercloudcanada.com/2015/09/canadian-privacy-la...

There are only 3 provinces that require storage in Canada: BC, NS and QC. And even then, that is for public sector organizations only.

I was in a territory (not a province) and we owned every meter of fiber in two territories.

I can assure you the data we were sending around didn't even leave our territory, let alone the country, seeings we owned every single scrap of networking hardware in a ~10,000km radius.

They are landing a govcloud there too. So I'd assume a lot of .gov investment.

Reply on news.ycombinator.com