Proud of the Cloud

Information and technology experts unanimously agree that the proposed cloud centre could indeed improve several issues in the MSAR such as traffic and health, while reducing the costs of data hosting for local online companies.
However, the lack of specific cyber security legislation and of local information security human resources create doubts about the capacity of the government to assure the privacy and security of the data to be collected in the proposed centre.
On August 4, the Macau Government signed a framework agreement with the Alibaba Group to turn the MSAR into a ‘Smart City’.
This development would imply the construction of a cloud platform centre in Macau, in two phases by June 2021.
The first phase is expected to be concluded by June 2019, with the government stating Big Data analysis will allow the improvement of the city’s tourism, transportation, healthcare, governance and talent development during this period.
The development of the centre is said to likely absorb MOP400 million in the next two years, with the platform to be installed on government premises.
“[A data centre] like this won’t be cheap; the final price will depend upon many factors such as requirements for infrastructure,” the Manager of the Information Technology and System Department of the Macau Productivity and Technology Transfer Centre (CPTTM), Thomas Mak, told Business Daily.
“They will have to install fire safety equipment, air conditioning for the entire floor, and assure power supply. It depends upon the quality of materials they choose, high end or low end. With MOP400 million they can build a very advanced cloud system,” he added.
According to Pun Chi Man, Head of the Department of Computer and Information Science at the University of Macau (UM) the centre will require a large investment in software and hardware, requiring plentiful qualified human resources.
However, the UM academic considers that while Macau produces a large number of computer science graduates every year when it comes to human resources for data mining, software development based upon the data collected and information security experts then the city finds itself lacking qualified manpower.
Recently, the Macau Government stated that the agreement with Alibaba would not mean the ‘abandonment of the existing information technology infrastructure, maintaining good flexibility for its expansion in the future’.
According to a government response to Business Daily, just one data centre is being operated by the government at the Public Administration and Civil Service Bureau (SAFP) building, but is currently described as being at ‘full Capacity’.
Mr. Mak told Business Daily that currently there are two public data centres in the MSAR, operated by Companhia de Telecomunicaçōes de Macau (CTM) and MTEL Telecommunication Company Ltd., which already train qualified professionals for their management.
CTM Data Centre – the first to have opened in Macau in 2012 – occupies 1,150 square metres and can operate 24 hours per day, with the company’s website stating it supports the needs of local and multinational organisations, including government departments, the gaming sector, banking and financial institutions.
Business Daily questioned if CTM and the MSAR Government had approached the company to discuss collaboration in the future ‘Smart City’ plan, and if Alibaba would have to use the company’s existing technology and network. CTM only stated that it did not have ‘additional information about the topic’, while the government guaranteed that only Alibaba Cloud technology would be used for developing the new data centre.

Role of advantages
According to the tech experts the cloud centre would improve several aspects of local society such as traffic and public administration, with one advantage not mentioned by the government being a possible reduction in the price of hosting data for online companies.
“Due to the few choice of hosting infrastructure in Macau, hosting prices here can be ten times higher than hosting in Hong Kong, Singapore and Japan (…) Such a large data centre could lower the costs for online companies to build their web services,” Mr. Mak told Business Daily.
According to the tech expert, the average price for storing data in Macau is currently MOP700 to MOP1,000 per month.
In Hong Kong, however, prices can range to MOP1,000 per year due to the existence of “several data centres, with their own power supplies and several floors in industrial buildings”.
“Hong Kong also has many telecom companies, with each one building their own data centre and renting them to IT solutions companies. There’re many choices there,” he added.
So far the government has not stated if private companies will be allowed to store their data in the new cloud centre or if prices will follow the costs charged by Alibaba Cloud in Mainland China.
“Alibaba Cloud has a very flexible price scheme depending upon how much space you use. If you fully run a machine for the whole year, it can be around MOP800 to MOP1,000 per year,” Mr. Mak told Business Daily.

Lack of legislation
After the agreement with Alibaba was inked New Macau Association declared that the project should be “halted” due to concerns that the MSAR Government and Alibaba would not be able to protect or properly use the data gathered in Macau.
On June 1 of this year, Mainland China enforced its new Cybersecurity Law which requires network operators to store select data within China and allows Chinese authorities to conduct spot-checks on a company’s network operations.
The law requires network operators to co-operate with Chinese crime or security investigators and allow full access to data and unspecified ‘technical support’ to the authorities upon request.
According to tech experts, data physically hosted in Macau would fall under local legislation, thus if Chinese companies were to deposit data in the territory it would be subject to the city’s laws and theoretically beyond the central government’s reach.
“Legislation is always dependent upon the physical location of the server. That’s why Piratebay [a website that allows the sharing of links leading to digital content,
entertainment media and software] was always based in Sweden. Because their laws basically protected the service,” the Operations Director of digital studio Virtualmente told Business Daily.
Currently, Macau law demands that any company information deemed to be of a personal nature be stored in Macau, while the security of the data stored in the future cloud centre would depend upon future legislation to be developed.
“The law would decide if the data can or cannot be transferred outside the MSAR. If the government allows the transfer, we would have some kind of monitoring system to control any transfers,” Mr. Pun told Business Daily.
Addressing the security concerns of the new centre, authorities say the Office for Personal Data Protection (GPDP) and the current Personal Data Protection Law guarantee the full protection of the data to be collected.
However, the Legal Affairs Bureau  (DSAJ), Service Director, Liu Dexue, stated during the agreement signing that the Data Protection Law – enacted in 2005 – could be “reinforced” through some “legislation improvements”.
The necessity of creating legislations specifically for cybersecurity issues is a matter that seems to chime with local tech experts and the government.
“From an IT point of view we have enough measures to assure the privacy of data collected, but with no law nobody can monitor [hacking] behaviour,” Mr. Pun stated.
In the aftermath of the WannaCry ‘ransomware’ cyber attack Secretary for Security Wong Sio Chak said that last year a law proposal on cybersecurity had been sent to the Executive Council for consideration.
In a response sent to Business Daily, the Office for the Secretary for Security said the government is currently facilitating the construction of a cyber security system in Macao to provide technical support, alert and guidance for cyber security incidents.
‘The legislation work for the framework of cyber security law(s) will be launched in 2018 in order to establish the layout of the corresponding strategic and executing
entities,’ the response advised.