Biohacking and travel cards

Given that Meow-Ludo Disco Gamma Meow-Meow - noted last year - is in the news again it was timely to read 'DIY Bio: Hacking Life in Biotech’s Backyard' by Lisa C. Ikemoto in (2017) 51 University of California Davis Law Review 539.

The peripatic Meow-Meow - recurrent political candidate, cyborg advocate and biohacking enthusiast - has unsurprisingly had his OPAL near-field transit card cancelled after he extracted the chip for subcutaneous insertion. He appears to consider that the resulting litigation - contesting a $200 fine in 2017 for riding the train without a valid ticket and reportedly planning to launch legal action against TfNSW for unlawfully cancelling his cards - will advance cyborg rights.

Australian law does not recognise 'cyborgs' as such and his action would appear to be readily addressed under the terms and conditions for use of his card.

In the Australian Capital Territory there is a prohibition under Regulation 49 of the Road Transport (Public Passenger Services) Regulation 2002 (ACT) of traveling on an ACT government bus using a ticket that has been 'damaged or defaced in a material respect' or 'changed in a material particular', with ticket including a card with a chip or magnetic strip.

In NSW use of the OPAL travel card is governed by the Passenger Transport (General) Regulation 2017 (NSW). The Cards 'are and remain' the property of TransportNSW, which may 'inspect, de-activate or take possession of an Opal Card or require its return at our discretion without notice at any time'.

Users are required to 'take proper care of the Opal Card, avoid damaging it, keep it flat and not bend or pierce it' and - saliently - 'not misuse, deface, alter, tamper with or deliberately damage or destroy the Opal Card'. Further, the user must not 'alter, remove or replace any notices (other than the activation sticker), trademarks or artwork on the Opal Card. Additionally, they must not'modify, adapt, translate, disassemble, decompile, reverse engineer, create derivative works of, copy or read, obtain or attempt to discover by any means, any (i) encrypted software or encrypted data contained on an Opal Card; or (ii) other software or data forming part of the Opal Ticketing System'.

Meow-Meow gained attention several years ago regarding 'biohacking' (centred on a DIY community DNA-modification lab) rather than 'bodyhacking'.

Ikemoto comments

DIY biologists set up home labs in garages, spare bedrooms, or use community lab spaces. They play with plasmids, yeast, and tools like CRISPR-cas9. Media stories feature glow-in-the-dark plants, beer, and even puppies. DIY bio describes itself as a loosely formed community of individualists, working separate and apart from institutional science. This Essay challenges that claim, arguing that institutional science has fostered DIY bio and that DIY bio has, thus far, tacitly conformed to institutional science values and norms. Lack of a robust ethos leaves DIY bio ripe for capture by biotech. Yet, this Essay suggests, DIY bio could serve as a laboratory for reformulating a relationship between science and society that is less about capital accumulation and more about knowledge creation premised on participation and justice.

 She goes on

Popular media depicts biohackers or Do-It-Yourself (“DIY”) biologists as the ultimate science geeks. “DIY bio” refers to noninstitutional science or science performed outside of professional laboratories.  DIY biologists set up home labs in garages, spare bedrooms, and closets or use community lab spaces. The people doing DIY bio range from the self-taught to PhDs. Instead of building computers or creating apps, DIYers play with plasmids, jellyfish, yeast, and polymerase chain reaction in genetic engineering experiments. Media stories and DIY bio websites often feature glow-in-the-dark plants, food, petri dish art, and even puppies.

DIY bio is an emerging set of activities. A range of players, with varied ideologies, are shaping DIY bio’s trajectories. DIY bio’s signature claim is that it exists apart from, and even in opposition to, institutional science. This Essay challenges that claim. Whether all DIY biologists know this or not, DIY bio serves the interests of institutional science and is well-situated for capture by biotechnology. Biotechnology refers not only to the life sciences-based industry, but also to the neoliberal epistemology that values the use of applied science to commercialize the transformation of life itself into technology. DIY bio’s origin stories do reflect resistance to the highly structured and bureaucratic nature of institutional science. Yet these accounts also indicate interest convergence between DIY bio and institutional science. Accounts that forecast DIY bio’s future show DIY bio conforming its practices to mainstream law, policy, and market concerns. Thus far, DIY bio has not crafted its own account of the relationship between science, society, and ethics, and is falling into a science-as-usual practice that situates DIY bio in biotech’s backyard.

Part II sets out a descriptive account of biohacking, and DIY bio, in particular. Part III identifies three overlapping explanations for DIY bio. The first two, explicitly political accounts and nostalgic accounts, are largely consistent with the DIY bio claim that DIY bio is different and apart from institutional science. The third account borrows from Frederick Jackson Turner’s frontier thesis and asserts that DIY bio sustains an ideology of bio-individualism embedded in biotechnology. Part IV reviews and critiques law and policy views of DIY bio and its prospects. These views apply the frames and standards applicable to biotech. Part V makes the case for biotech’s annexation of DIY bio. Part V elaborates on DIY bio’s failure, so far, to re-define the relationship between science and society, and suggests a few initial critical points of engagement for doing so.

She suggests that

As yet, DIY bio has not expressed a commitment to ethical science activity, nor developed a robust ethos. Perhaps, its tacit acceptance of the risk-benefit framework means that its view of ethics aligns with that of institutional science. That is, it conflates a risk-benefit weighing with ethical standards or views ethics as a compliance obligation.

The risk calculus is not devoid of ethical concerns. It maps onto a standard ethical test used in institutional science. The test highlights three criteria — safety, efficacy, and autonomy. That test derives from the Belmont Report’s principlist framework, the FDA’s drug and device approval standards, and neoliberalism’s effects on the life sciences and autonomy. The Belmont Report states four principles — autonomy, beneficence, non-maleficence, and distributive justice. Autonomy’s application is informed consent. The non-maleficence principle is addressed by weighing risk to human health against benefits. Benefits refer to efficacy or improvements to human health. The FDA uses safety and efficacy as its criteria in the drug and device testing requirements for market approval. Efficacy, like safety or risk to human health, is narrowly defined. The FDA requires that the product work, but does not require that it work well or better than existing therapeutics. Market thinking has infiltrated these criteria. Claims that individual choice should trump agency standards in determining access to drugs have gained credence. This indicates that traditional bioethics’ first principle, autonomy, may now be understood as a form of free market individualism. In addition, the pharmaceutical industry has leveraged that version of autonomy to maximize the role of drugs in medical care, and the sale of particular products. While big bio’s risk calculus is not the end-all and be-all of ethics in institutional science, it is part of an impoverished ethical framework.

In 2011, the North American and European DIYbio Congresses issued Draft Codes of Ethics. The codes incorporate principles of open science — open access, transparency, and education; and selfregulation — safety (adopt safe practices), environment (respect the environment), and peaceful purposes (biotechnology should only be used for peaceful purposes). As discussed, the North American Code has one more element — Tinkering. The Code elements are general. As my characterization suggests, the Code elements, like the Belmont Report principles, lend themselves to narrow or broad readings. Read more generously, safety, environment, and peaceful purposes might move DIY bio beyond the issue of forestalling regulation to situating science as a tool for social justice. On the other hand, open access could be read as a right to access, premised on free market individualism. Tinkering invokes the individual, as the nostalgic accounts show. If DIY bio is first and foremost an individualist vision of science, it stands little chance of evolving into a new understanding of science.

The open science principles suggest that DIY bio’s ethos differs from big bio’s, and that DIY bio is not bound by big bio’s norms. Yet, open science goals do not translate to an ethics of science. Open science can be used for different goals, including forms of commercial distribution that are exploitative. In addition, the Code states the elements as universal principles, which in itself is problematic. Typically, dominant readings of so-called universal principles are used to maintain boundaries, and identify the out-group as non-compliant. It is very possible that the universal principles may be used to undercut the inclusive goals that open science asserts.

My comments in the previous subparts suggest, without prescriptive detail, the possibility of using DIY bio to redefine the possible relationship between science and society. Contemporary accounts indicate that DIY bio projects are typically small-scale and are relatively unsophisticated. As such, DIY bio seems underpowered as a platform for re-thinking the political economy of the life sciences. What I suggest here is not that DIY biologists directly challenge or redesign institutional science. Rather, DIY bio might provide an opportunity to create, by deliberate experimentation, a set of practices that are ethos-based and originate from critical social inquiry. The most valorized explanatory accounts speak, in bits and pieces, of social justice goals. Using these as a starting point, DIY bio might craft ways of doing science that embed justice-based ethics into inquiry and practice. Ethics, then, could become not a compliance checklist, but constitutive of good science.

Ikemoto concludes

 DIY bio is many things to many people. That is, undoubtedly, part of its appeal. What is it not, however, is separate and apart from institutional science. Its location in biotech’s backyard, without a fence or substantive alternative vision of DIY bio’s role, makes it vulnerable to annexation. In that scenario, DIY bio and its dream of a new science by the people might disappear. This Essay maps the relationships between DIY bio and institutional science. The mapping also critiques aspects of biotechnology that are inconsistent with DIY bio’s stated goals of access and participatory knowledge formation. If DIY bio takes those goals seriously, this Essay suggests that it move beyond compliance-based thinking, and beyond experimentation using plasmids and pipettes. Acknowledging that science is a social practice, followed by scientific-social inquiry about how and why we engage with plasmids and pipettes, and willingness to experiment with new social methods of doing science, might move DIY bio out of biotech’s backyard, and into society.

Nominalism

'The Ethics and Politics of Child Naming' by Eldar Sarajlic in (2016) 35 Journal of Applied Philosophy examines

 the issue of justification of government's intervention in the parental acts of child naming, a neglected topic in the recent philosophical literature. It questions the ability of some of the current theories in family ethics to respond to this problem, and argues that both permissive and restrictive theories fail to provide a plausible argument about the proper limits of government regulation of child naming practices. The article outlines an alternative solution that focuses on the child's right to authenticity and suggests that only those names that infringe upon this right invite justified state intervention. 

Sarajlic  comments

 Article 7 of the United Nations Convention on the Rights of Child posits that every child has a right to a legally registered name. Article 8 states that governments must respect a child's legally given name. However, the Convention neither specifies what kind of name can be given to a child nor what does government's respect of a name amounts to. Does this right imply that any kind of name can be given to a child, regardless of its meaning, aesthetics and other symbolic implications? Should governments respect all parental decisions about names for their children? 

The issue of naming a child is far from trivial. It is not only a problem of aesthetics, tradition or culture, but also a matter of distinct ethical, and even political concern. It belongs to the domains of moral and political philosophy, where questions about the permissible or desirable forms of child rearing, as well as about the limits of government's intervention in family issues are addressed. 

However, there has been surprisingly little philosophical interest in this question. Despite substantial expansion of philosophical literature about the ethics of family, parenthood and the role of government in child upbringing in recent years, there is a conspicuous lack of normative analyses that would elaborate on the ethics of child naming. 

One of the reasons this is so may be the fact that most philosophers concerned with ethics of parenthood subscribe to a form of what David Archard called the liberal standard. According to this view, provided that parents do not harm their children the content of the principles of child rearing is primarily an internal matter of family life, a domain that is to be isolated from the external, societal or governmental, concern. Therefore, the question about names parents give to their children is a private discretionary matter and governments have no rights to pry. 

But claiming that there should be absolutely no legal limits to parental child naming may be somewhat odd. Think of the little boy from New Jersey whose parents named him ‘Adolf Hitler’, in honour of the notorious Nazi leader. Does it sound right to say that governments should be neutral to these kinds of practices? 

This article has a twofold aim. First, it aims to fill in this gap by addressing the issue of moral and political significance of child naming. I will suggest that this question is not only interesting, but also deeply troubling for the liberal political philosophy. As I intend to show, the existing normative frameworks give us little guidance about how to address it. While it is difficult to say if any alternative framework could do any better, I will offer a tentative proposal. 

Second, the article will challenge the initial assumption that the content and meaning of the name parents choose for their child is a private matter outside of legitimate purview of the state. I will argue that the liberal state has a direct interest in ensuring that child naming practices correspond to a particular ethical standard. 

The article will first establish the theoretical and practical relevance of this issue, and then proceed to discuss the normative approaches that could help us address it. I will draw on the literature concerned with issues of parental autonomy and children rights. In terms of practice, I will primarily draw from American cases and examples. However, this being a normative analysis, it will have a broader appeal.

AI Rights?

'Artificial Agents and General Principles of Law' by Antje von Ungern-Sternberg German Yearbook of International Law (Forthcoming)) comments 

Artificial agents – from autonomous cars and weapon systems to social bots, from profiling and tracking programmes to risk assessment software predicting criminal recidivism or voting behaviour – challenge general principles of national and international law. This article addresses three of these principles: responsibility, explainability, and autonomy. Responsibility requires that actors are held accountable for their actions, including damages and breaches of law. Responsibility for actions and decisions taken by artificial agents can be secured by resorting to strict or objective liability schemes, which do not require human fault and other human factors, or by relocating human fault, i.e. by holding programmers, supervisors or standard setters accountable. “Explainability” is a term used to characterise that even if artificial agents produce useful and reliable results, it must be explainable how these results are generated. Lawyers have to define those areas of law that require an explanation for artificial agents’ activities, ranging from human rights interferences to, possibly, any form of automated decision-making that affects an individual. Finally, the many uses of artificial agents also raise questions regarding several aspects of autonomy, including privacy and data protection, individuality, and freedom from manipulation. Yet, artificial agents do not only challenge existing principles of law, they can also strengthen responsibility, explainability, and autonomy.

Data Ownership and Interference

'Ownership of Personal Data in the Internet of Things' by Václav Janeček comments

This article analyses, defines, and refines the concepts of ownership and personal data. It critically examines the traditional dividing line between personal and non-personal data and argues for a strict conceptual separation of personal data from personal information. The article also considers whether, and to what extent, the concept of ownership can be applied to personal data in the context of the Internet of Things (IoT). 

This consideration is framed around two main approaches shaping all ownership theories: bottom-up and top-down approach. Via these dual lenses the article reviews existing debates relating to four elements supporting introduction of ownership of personal data, namely the elements of control, protection, valuation, and allocation of personal data. It then explores the explanatory advantages and disadvantages of the two approaches in relation to each of these elements as well as to ownership of personal data in IoT at large. Lastly, the article outlines a revised approach to ownership of personal data in IoT that may serve as a blueprint for future regulatory and policy debates in the context of EU law and beyond.

'Your Smart Coffee Machine Knows What You Did Last Summer: A Legal Analysis of the Limitations of Traditional Privacy of the Home under Dutch Law in the Era of Smart Technology' by Lisa van Dongen and Tjerk Timan in (2017) 14(2) SCRIPT-ed 208 comments

Today, the Internet has become one of our prime platforms for communication and consumption. Moving beyond the personal computer or smartphones only, increasingly other devices are being connected to the Internet, from coffee machines and watches to beds and toys. Our homes and our activities in the home are thus becoming more and more transparent, due to such objects entering our homes. Through these objects, new forms of spying can be conducted, both qualitatively and quantitatively, that are more invasive than any spying taking place by physically entering and searching the home today. While the rapidly advancing development of the smart(er) home is both undeniably exciting and promising, it is accompanied by a great deal of inadequately answered or otherwise unanswered questions that seem unable to slow its development down enough for us to properly address them. Potential problems arise from many uncertainties regarding these technologies. For instance, where do the digital perimeters of the protected home end? How will privacy be protected, and from whom? Or, in light of the rise of autonomous technological objects, should we start asking from what? Even though it is not possible to properly address and find an answer to these questions in the limited size of this paper, if at all at the present time, these questions are important to raise and consider for the protection of privacy in an increasingly smart(er) world”. 

Instead, this paper will address the question: are the existing definitions of privacy of the home adequate to deal with today’s challenges posed by ‘smart home’ technologies? The focus of this analysis will be on the legal landscape of the Netherlands. As will be argued throughout this paper, this question is answered in the negative. To demonstrate that some of the privacy-related problems are more pressing than most people seem to realise, this paper will first elaborate on developments and implications of smart technologies for the home environment in the second section. This will be followed by a breakdown of some of the elements of the Dutch “home right” in the third section of this paper, for which the focus will be on the meaning and ramifications of the limited legal definitions used for both the “home” and “entering”. In addition, the potential and limits of data protection to account for these weaknesses will be explored in the fourth section. Furthermore, two smart objects will be analysed in the fifth section, namely the smart thermostat and the smart toy ‘Hello Barbie’. These analyses will be used to illustrate the weaknesses under the existing scope of data protection and the “home right”. 

This paper aims to convey two messages. First, that the traditional understanding of privacy of the home in the Netherlands is in need of reconsideration in the era of smart technology. Second, that the ramifications of smart technologies in the home environment require a (stronger) protection of privacy, not just against the state, but increasingly also in horizontal relations.

Gendering

'Gender Recognition As a Human Right' by Holning Lau in Andreas von Arnauld, Kerstin Odendahl and Mart Susi (eds) New Human Rights: Recognition, Novelty, Rhetoric comments

Governments around the world issue identity documents (IDs) that list people’s gender. These IDs include birth certificates, passports, national identification cards, and driver’s licenses, among others. People are expected to present IDs in everyday life for a wide range of purposes, such as opening a bank account, renting a car, boarding an airplane, and voting. Longstanding human rights principles support the proposition that, if IDs contain gender markers, individuals have the right to obtain markers that match their gender identity. For example, a transgender woman should have the right to identify herself as female on her IDs. A transgender man should have the right to identify himself as male. Individuals should also be given the right to indicate if they identify outside the male/female binary.

This book chapter proceeds in three parts. First, I map out the ways in which the right to choose one’s own gender markers—which I will refer to as the right to gender recognition—derives from other well-established human rights. The right to gender recognition is not explicitly mentioned in any international human rights treaty, but this chapter contends that existing treaty provisions nonetheless cover the right to gender recognition. Second, I examine and ultimately reject potential justifications for overriding the right to gender recognition. Third, I assess the extent to which legal institutions have come to acknowledge and protect the right to gender recognition.

Competition and Consumption

'English Competition Law Before 1900' (Fordham Law Legal Studies Research Paper) by Barry E. Hawk comments

English competition law before 1900 developed over the course of many centuries beginning in the medieval period. That development reflected changes in political conditions, economic theories, and broader cultural values. English competition law mirrored the historical movements in England from the medieval ideal of fair prices and just wages to 16th and 17th century nation state mercantilism to the 18th and 19th century Industrial Revolution, laissez faire capitalism and freedom of contract. The development of English competition law is rich in insights for modern antitrust issues like the adaptability of case law and legislation to changing economic conditions, the role of economic theories in the formulation of legal rules, and the role of political and social values in competition policy. 

Today the predominant if not exclusive emphasis on economics in the application of modern antitrust laws has resulted in a quasi-regulatory system far more technical, specialized and narrowly focused than the case making of generalist English common law judges. Modern antitrust law adapts well to changes in economic theories and conditions but it is less adaptable than English common law to shifts in political and social values. This lack of adaptability is viewed by most commentators as a beneficial insulation of decision-making from political or social influences. Proponents of non-economic policy concerns (like fear of concentration for political or social reasons), on the other hand, are forced to formulate their concerns in economic terms because of the prevailing view that only economics counts in antitrust. They would have had an easier task under the English common law.

For a trip to the dark side - one requiring substantive intervention by regulators - I note the TGA's statement last month regarding encapsulated placentas and other placentophagy.

The TGA states

The TGA is aware of several websites offering expectant mothers services for the preparation of the placenta for consumption; a practice known as placentophagy. We are advising expectant mothers to be aware of the potential risks associated with placenta consumption. 

A range of preparation methods are offered, including cooking or drying and encapsulating, with the intention for you, family members or others to consume the placental material after childbirth. More rarely, websites may also offer placenta or placenta-containing medicines made from other human sources. Often these services are offered by a midwife or doula; generally people who provide support and advice to women during pregnancy, birth and after birth. 

There is currently no evidence to support the claims of health benefits associated with consuming human placenta, and the broader risks are unknown.

Quite so, given that processes for preparing the placenta for ingestion, through for example steaming, are likely to substantially reduce pharmacologically active compounds.

The TGA goes on to refer to 'Potential health risks for consumers'

 As an expectant or new mother, you should be aware of the potential health risks associated with the preparation and consumption of your placenta. 

Human placenta is a biological material and is capable of containing and transmitting infectious agents, including bacteria and viruses. In addition, preparation may inadvertently introduce infectious agents. The risk of transmission may be even greater if your placenta is ingested by another person or you ingest another person's placenta. 

Generally the placenta is discarded after childbirth and as a result there are no regulations on how placental material is to be stored and prepared to ensure it is safe for consumption.

And the legal framework?

Potential legal implications for service providers 

Prepared placenta products, including in capsule or tablet form, are often associated with claims that consumption will have some therapeutic benefit for mothers and/or children, for example, improving mood, energy levels and milk production. 

Such claims run the risk of bringing these products under the regulatory framework that covers 'biologicals', governed by legislation that regulates therapeutic goods. This includes the Commonwealth Therapeutic Goods Act 1989 and corresponding legislation in several states and territories. 

Under the Therapeutic Goods Act 1989, it is an offence to make therapeutic biological products without holding the appropriate licence. The Regulatory framework for biologicals page provides further information on licensing requirements. The licence provisions are designed to ensure that the product is manufactured in conditions that will minimise risk to the user. Products that are classed as therapeutic goods must also be approved by the TGA to ensure they are of good quality, safe and effective for the intended purpose. 

These laws also contain substantial penalties, including criminal sanctions, for people making or supplying unapproved biological products, and prohibit the advertising of biological products to the public. 

Depending on the circumstances and the claims made in relation to the product, these laws could also apply to the midwife, doula or even the mother involved.

2014 comments by the UK Food Standards Agency and some research are noted here.

Clouds

The new Commonwealth Secure Cloud Strategy from the Digital Transformation Agency (DTA) states

The case for cloud is no secret to industry or government. A move to cloud computing - away from on premise owned and operated infrastructure - can generate a faster pace of delivery, continuous improvement cycles and broad access to services. It can reduce the amount of maintenance effort required to ‘keep the lights on’ and refocus that effort into improving service delivery.

Cloud, however, is a new way of sourcing Information Communication and Technology (ICT) services and many agencies will have to change the way they operate to make the most of this new model. In the Australian Government, a number of factors can get in the way of agencies realising their cloud aspirations, from a shortage of knowledge and experience, decades old, stubborn operating models and a struggle to sell the case for cloud across the business.

The Secure Cloud Strategy has been developed to guide agencies past these obstacles and make sure everyone has the opportunity to make the most of what cloud has to offer. This is not a simplistic ‘lift and shift’ view of the transition. Instead, the strategy aims to lay the foundations for sustainable change, seizing opportunities to reduce duplication, enhance collaboration, improve responsiveness and increase innovation across the Australian Public Service.

Some agencies have already embraced the cloud model. A coordinated approach for further adoption will make sure government derives the maximum value from this shift. The strategy will ensure experience and expertise is not locked-up and create opportunities to reuse and share capabilities through increased collaboration.

The strategy is based around a number of key initiatives designed to prepare agencies for the shift to cloud and support them through the transition:

• Agencies will develop their own cloud strategies. There is no one-size-fits-all approach to implementing cloud. Agencies will use the Secure Cloud Strategy as a starting point to produce their own value case, workforce plan, best-fit cloud model and service readiness assessment.

• Cloud implementation will be guided by seven Cloud Principles: − make risk-based decisions when applying cloud security − design services for the cloud − use public cloud services as the default − use as much of the cloud as possible − avoid customisation and use cloud services as they come − take full advantage of cloud automation practices, − monitor the health and usage of cloud services in real time.  

• A layered Cloud Certification Model will be created. The certification model creates greater opportunity for agency-led certifications, rather than just ASD certifications. It creates a layered certification approach where agencies can certify using the practices already in place for certification of ICT systems. 

• Service procurement will be aligned with the ICT Procurement Review Recommendations. As cloud services move more rapidly than services available through panels traditionally do, the recommendations in the ICT Procurement Review align well with creating a better pathway for cloud procurement. 

• cloud qualities baseline and assessment framework will be introduced to clarify cloud requirements. The cloud qualities baseline capability and assessment framework will enable reuse of assessments. 

• A Cloud Responsibility Model will be developed to clarify responsibilities and accountabilities. Traditional head agreements cannot cover all cloud services and their frequent variations. A shared capability for understanding responsibilities, supported by contracts, will address unique cloud risks, follow best practice and maintain provider accountability. 

• A cloud knowledge collaboration platform will be built. The platform will enable secure sharing of cloud service assessments, technical blueprints and other agency cloud expertise, to iterate on work already done rather than duplicating it. 

• Cloud skills uplift programs will be designed. Increase government skills and competencies for cloud aligned with the Australian Public Service Commission Digital Skills Capability Program and create the pathways to leverage industry programs to enhance cloud-specific skills in the Australian Public Service. 

• Common shared platforms and capabilities will be explored including: − Federated identity for government to enable better collaboration in the cloud. − A platform for PROTECTED information management to reduce enclaves in agencies, and continue to iterate cloud.gov.au as an exemplar platform. − Service Management Integrations services to enable agencies to manage multi provider services.

These platforms will include the integration toolkits that enable agencies to seamlessly transition between the cloud services. 

These initiatives will be supported through a Digital Transformation Agency-led community of practice that will support agencies to plan and transition their environments for cloud. It will include delivering training and advice to agencies to build confidence in their ability to manage cloud services. 

The Australian Government has an ambitious agenda to transform its digital service delivery. Cloud offers reusable digital platforms at a lower cost, and shifts service delivery to a faster, more reliable digital channel. Cloud services have the opportunity to make government more responsive, convenient, available and user-focused.

The Strategy comments -

Myth: Privacy reasons mean government data cannot reside offshore. 

“Generally, no. The Privacy Act does not prevent an Australian Privacy Principle (APP) entity from engaging a cloud service provider to store or process personal information overseas. The APP entity must comply with the APPs in sending personal information to the overseas cloud service provider, just as they need to for any other overseas outsourcing arrangement. In addition, the Office of the Australian Information Commissioner’s Guide to securing personal information: ‘Reasonable steps’ to protect personal information discusses security considerations that may be relevant under APP 11 when using cloud computing.” https://www.oaic.gov.au/agencies-and-organisations/agency-resources/privacy-agency-resource-4-sending-personalinformation-overseas 

Additionally, APP 8 provides the criteria for cross-border disclosure of personal information, which ensures the right practices for data residing off-shore are in place. Our Australian privacy frameworks establish the accountabilities to ensure the appropriate privacy and security controls are in place to maintain confidence in our personal information in the cloud.

'The Ethics of Cloud Computing' by Boudewijn de Bruin and Luciano Floridi in (2017) 23(1) Science and Engineering Ethics 21-39 comments

Cloud computing is rapidly gaining traction in business. It offers businesses online services on demand (such as Gmail, iCloud and Salesforce) and allows them to cut costs on hardware and IT support. This is the first paper in business ethics dealing with this new technology. It analyzes the informational duties of hosting companies that own and operate cloud computing datacenters (e.g., Amazon). It considers the cloud services providers leasing ‘space in the cloud’ from hosting companies (e.g, Dropbox, Salesforce). And it examines the business and private ‘clouders’ using these services. The first part of the paper argues that hosting companies, services providers and clouders have mutual informational (epistemic) obligations to provide and seek information about relevant issues such as consumer privacy, reliability of services, data mining and data ownership. The concept of interlucency is developed as an epistemic virtue governing ethically effective communication. The second part considers potential forms of government restrictions on or proscriptions against the development and use of cloud computing technology. Referring to the concept of technology neutrality, it argues that interference with hosting companies and cloud services providers is hardly ever necessary or justified. It is argued, too, however, that businesses using cloud services (banks, law firms, hospitals etc. storing client data in the cloud, e.g.) will have to follow rather more stringent regulations.