As Quebec prepares to trust the far majority of its computer data to the private sector, Amazon says its Montreal facilities are ready to take on the mandate and this crucial information would be encrypted and more secure than it is now.

Amazon Web Services claims no negotiations are currently ongoing with the province on the subject, but according to the registry of lobbyists, two individuals currently have a mandate from the company to present cloud computing products to the government if there is a call for tenders.

While many experts worry about what a giant like Amazon could do with the personal information of Quebecers, Stephen Schmidt, a vice-president and chief information security officer at AWS, said the company wouldn’t have direct access to this information.

He said every client that stores its information in AWS’s cloud remains the owner of its data and when a government wants to secure its data, the data is encrypted and only the government has the ability to access the content in its readable form.

“We don’t use this information for marking, profiling, etc. It’s precisely written in our contracts that we don’t use the data for purpose other than what our clients ask,” he said.

At the beginning of the month, the François Legault government announced it plans to entrust the private sector with the far majority of information currently stored in its 457 data centres across Quebec, keeping only two.

Over the next three years, at least 80 per cent of the digital information from every government department will be transferred to private-sector servers, like those of IBM or Amazon, for example.

Patriot Act and Cloud Act

As for concerns certain countries have adopted laws that let them obtain access to data stored by private companies, as is the case in the United States with the Patriot Act and the Cloud Act, AWS responds it would not be able to deliver readable information.

Even if it received a court order, the company would not be able to provide anything other than encrypted material, Schmidt maintained.

“We have received very few requests for access to private information and if we do receive a request from the authorities, it doesn’t matter which jurisdiction, we carefully check the validity of the request. We have a reputation for contesting these requests and we will continue to do that. If it happens that we are required to submit, and the client has not encrypted the data like we suggested, it will be informed before we share the information,” he said.

Savings and better service

Speaking at a press conference in early February, Treasury Council president Christian Dubé, and the minister responsible for government digital transformation, Éric Caire, justified their approach by saying they were looking for efficiency and more security.

The cost of the transfer is estimated at $150 million, but the government is convinced there will be large savings in the long-term.

Caire said the companies that receive the mandate to store government data will have to meet “very strict” standards, notably in terms of security. He added the government is following a “global trend.”

The minister even suggested some government facilities “are not at all up to the standards that can be expected” in a data centre.

Amazon already stores data for governments around the world, including several regions in the United Kingdom, Japan, Australia and Mexico.

Non-confidential data belonging to certain partners of Shared Services Canada, the organization responsible for maintaining federal government data, is stored in AWS servers.