The collapse of EU-US Privacy Shield has brought to the forefront a topic that has long been prominent in all significant discussions related to information security and strengthening European digital economic independence. The pandemic has accelerated the digitalization of public administrations, which primarily relies on cloud platforms, and has established the direction of strategies for the establishment of national data centers in all member states. At the same time, it has significantly raised awareness of security and sensitive data protection issues – both for citizens and public administration.
The organization EURITAS, which brings together European companies in public ownership that produce IT solutions for the public sector, adopted a document in May of this year that describes how to strengthen digital sovereignty when using cloud services in digital administration, representing another step forward in ensuring the security of personal data for European citizens. The document is available here.
APIS IT, or the Agency for Support of Information Systems and Information Technologies, a successful company owned by the Republic of Croatia and the City of Zagreb, has been a full member of EURITAS since 2018. The CEO of APIS IT, Saša Bilić, is also the Vice President of EURITAS and revealed the basic characteristics of the digitalization of European public administrations and the status of plans for Croatia in an interview for Lider.
Cloud solutions represent a significant aspect of the digitalization of European public administration. How will American suppliers be able to maintain their current market position given the high information security standards set by the European Union?
Considering that American suppliers such as Google, Microsoft, or Amazon currently dominate the European market, EURITAS, as an organization of public IT providers, has long been warning about the security and data protection issues of European citizens in accordance with EU standards. Regulating cloud services, especially at the level of data collected, stored, and processed by public administration bodies, is considered by us at EURITAS to be an important issue of digital sovereignty.
Therefore, we advocate for a unified European law and promote the construction of our own platforms, which is a solution that allows for partnership cooperation with various partners while avoiding the open questions posed by the use of ready-made cloud solutions.
What is currently the focus of EURITAS?
In the next two years, during my term as Vice President, the focus of the organization will be the development of our own cloud solutions for European public administrations. As there has been a real explosion in the use of ready-made cloud applications and digital collaboration platforms in the context of the pandemic, in May, EURITAS adopted a position paper warning about the importance of preserving digital independence and the security of personal data for European citizens.
The recent ruling by the Court of Justice of the European Union, which annulled the EU-US Privacy Shield, has also validated our stance, declaring the previous European-American privacy protection system inadequate as it does not provide European citizens with the same level of data protection they are entitled to in the European Union. For this reason, we expect a strengthening of the role of national cloud platforms across the EU.
Croatia is also working on its own cloud platform. What is the value of this project and what are its main goals and benefits?
In line with the concept of digital sovereignty, Croatia has decided to build its own cloud platform through the establishment of the Shared Services Center (CDU) regulated by the Regulation on Organizational and Technical Standards for Connecting to the State Information Infrastructure. This is a strategic project of the Ministry of Public Administration in which APIS IT is a project partner, and according to the Regulation, the primary provider of shared services whose scope is defined therein.
The project to establish the Shared Services Center is worth 362 million kuna, of which 85 percent is co-financed by the European Regional Development Fund, and its goal is to provide an infrastructural basis for all users and horizontal services that will support the basic business processes of public administration. By the end of the project period in 2023, the CDU platform will encompass 300 users, but potentially in the longer term, which goes beyond the project framework, we are talking about as many as 2000 bodies and institutions.
Production of the government service bus has also begun. What technology is being used and will we, as a state, succeed this time in avoiding expensive licensing fees?
After signing the grant agreement in May last year, the CDU launched its first services in November 2019. The goal for this year is to include 120 users, and an important milestone was achieved at the beginning of June this year when the government service bus, or Government Service Bus (GSB), was put into production. We at APIS IT consider this one of the most important events in the public IT sector of the Republic of Croatia in recent times, as the GSB platform has been long planned and announced, and several times unsuccessfully launched as a separate project.
The establishment of the government service bus enables fast and secure communication between services hosted on the CDU platform, such as the central civil servant portal and collaboration platform, as well as all e-services outside the CDU platform. The entire GSB was built on open-source technology, which means that the state does not have to pay anyone expensive licenses, and the entire system is maximally open to users.
—
—How will different IT systems used by state and public administration bodies connect to the government service bus considering they are not standardized?
The GSB established within the CDU will give a strong impetus to the complete digitalization of all processes in public administration, whether it is B2G, C2G, or G2G services. The small step that still needs to be taken is for all existing application solutions to implement a special API for connecting to the GSB. Already, different systems such as e-registration, m-Citizens, e-invoices, or e-bulletin boards are at various stages of connecting to the GSB. Together with the Ministry of Public Administration, we invite all state and public administration bodies to include in their business plans for the next year the project of mandatory API development for connecting to the GSB for all existing services and to foresee such an API for all new solutions in development so that the new system can be successfully integrated with other systems in public administration.
We see that the conditions imposed by the COVID-19 epidemic have accelerated the digitalization of a large part of the processes in public administration, and we believe that this pace will continue precisely because of the infrastructure provided through the CDU. One of the advantages of the CDU that we have communicated to our users and the public is the simple and quick establishment of new IT systems, where the implementation time for infrastructure for new solutions is reduced from several days or weeks to practically a matter of minutes.
The importance of this speed was evident in the situation when it took just a few days to introduce the e-Permit system. The private cloud of public administration has proven to be a highly specialized platform that successfully adapts to the current needs of users, while also allowing for high flexibility given that a large number of IT services in the state are currently not standardized.
What information security certificates does the CDU platform and APIS IT possess?
The CDU platform meets the strictest security standards such as ISO/IEC 27001 and PCI DSS, and APIS IT itself has certified the entire scope of its operations according to information security and quality standards ISO/IEC 27001 and ISO 9001, and we have also begun the process of systematically establishing a business continuity management (BCM) program according to the ISO 22301 standard.
However, despite all this, we must not forget that the entire IT is based on human knowledge that manages technology. Therefore, I would say that the main advantage of the CDU is the highly qualified and motivated team that is available to all users from the public sector and their partners 24×7. Established procedures and processes allow for standardized hosting of applications and services on the CDU platform, ensuring high availability and security of hosted solutions at a low infrastructure cost.
Does APIS IT represent a competitor to the private IT services sector, or is this about the benefits that the private sector can also have in doing business with the state since everything will finally be standardized?
We have been and remain open to cooperation with the private sector. We at APIS IT are not unfair competition to private companies but a platform through which they can work for the state on jobs for which they may not have the necessary knowledge and references without us. The CDU does not represent such competition either, as the establishment of the infrastructural basis, especially the GSB, enables the development of an increasing number of simpler and more accessible services that will be developed by the Croatian IT community.
What stage is the construction of the national data center and redundant locations at, and are they all in accordance with TIER3 standards?
APIS IT established its data centers last year at two separate locations, in two different seismic zones. In addition to the primary location that meets all TIER3 standard requirements, we also have a fully functional secondary, or DR (Disaster Recovery) location that allows our service users to maintain business continuity in the event of any unforeseen event.
We kept in mind the importance of the registers that APIS IT hosts, and we particularly took care of the importance of the uninterrupted functioning of our users’ IT systems. In the event that one data center becomes unavailable for any reason, all hosted services will automatically be launched from the other location. We provide the same level of availability and security to users of the CDU platform.
The earthquake has very concretely highlighted the importance of meeting the redundancy requirements of the entire system. However, despite this, the system will struggle to remain operational without competent people. Are you having trouble finding people in the labor market, and are you open to cooperation with the private sector?
The earthquake that occurred in Zagreb only confirms why all serious institutions have redundant data centers in areas with different seismic activity. Thanks to such a level of security, we will be able to be the first choice for storing all IT systems, applications, and data so that, for example, the data about our citizens does not have to be stored outside Croatia.
And here we see an opportunity for cooperation with the real sector, primarily in the colocation segment, where I want us to be number one in Croatia, without neglecting other aspects of our business – primarily the development and maintenance of IT systems. With significant investments in the renewal and modernization of infrastructure, we have also introduced an agile approach to software development and project management similar to that of the largest private IT companies.
In the last year, we have hired more than 100 young software developers, IT specialists, and business analysts and attracted a cloud team from the real sector. This is very important for the state because there is no quality construction of new IT systems without the competencies that we at APIS IT have recently strengthened.
