The MT Conferences section did not involve the reporting or the editorial staff of The Moscow Times.
Ruslan Zaedinov
Deputy Director General
CROC
Ruslan Zaedinov, Deputy Director General for CROC, an IT and data center services firm, speaks about how best to adapt a company's business to accommodate the introduction of the law on data migration to Russia, as well as how IT services can simplify this process.
Starting September 1, 2015, all organizations are required to keep personal data of citizens of the Russian Federation on Russian territory. What will change for companies that will be transferring data from servers overseas?
Honestly, it shouldn't change anything. The law on the transfer of servers to Russia and regulations governing the personal data did not appear out of nowhere. Therefore, those companies that have been serious about information security issues in general, and, in particular, protection against various threats to the personal data of employees and customers, the law will only mean the emergence of some new "checkpoints."
In particular, the country factor is critical now, and this checkpoint issue has been most discussed. That is, all personal data, whatever the information is — customers, partners, or internal company data — are to be stored and processed in Russia. This is perhaps the most talked about aspect today. If before your company kept its data abroad, well, now it has to change its approach.
I am not talking about companies that do not work with information security. For them, whether the law is enacted or not, it changes little.
Will the authorities tighten control over these firms as well?
Of course, control will be tighter in general. For now, we can only speculate what steps will be taken in this regard. But it is reasonable to assume that the first to be placed under firmer control will be subsidiaries of foreign entities and agencies, or those organizations whose information is linked with foreign partners.
When I say subsidiaries of foreign companies, I mean, first and foremost, banks and the most recognized foreign brands: car firms, cosmetic companies, and retailers.
The second group of companies is, for example, airlines using this or that ticket reservation system. As far as I know, there are four such systems in the world, and Russian air carriers use them for the lack of a domestic counterpart. Any airline needs to send its information about passengers to one of these systems. The transfer of such large and complicated sets of information will be a huge task. I am not sure these corporations will have time to accomplish Russia's personal data transfer requirements by September 1.
How will this change lives, their daily business?
For those enterprises whose data assets are located abroad, such data just have to be relocated to Russia. For those whose data is intermixed with that of foreign clients, clearly, it will be more complicated. Either we must persuade partners to transfer data processing to Russia, or create an alternative service provider in Russia to perform the relevant IT tasks.
How should these companies proceed? What should they be doing today?
Well, they are already well along this path. September 1 is quite close...
The easiest and most obvious path is to complete the data relocation to Russia as fast as possible. We see that all foreign banks are already working in this direction. Credit institutions either are transferring data now, or have already stored their information about customers here, as actually, in legal terms, such institutions are Russian banks just associated with foreign brands. For example, Rosbank, which is part of Société Générale, has built two data centers here in Russia. I do not think these banks will need to take extreme measures due to the introduction of the data relocation law.
For others, though, there will be problems. For example, in Russia there are banks that have consolidated all data at international processing centers. This group is in more difficult situation. For years, these banks have carefully collected and located data overseas. Now, they need to essentially "bite off" the Russian part of its business located in their international data center and move it to our country. This is not just technically complex, but also organizationally intricate. To transfer the data correctly, you must understand exactly how and where to send it. It will be necessary to establish an entirely new IT base, including the room, the people, information resources, communication channels, software, and more.
Exactly what can your company offer businesses to facilitate this technically complex and organizationally intricate task?
Everything we have just spoken about. Information technology is our bread and butter. We have been developing our own data centers for a long time, putting a lot of effort to increase the quality of IT services. We thoroughly analyze the multinational vendors' experience in field of cloud technology development in order to ensure our services compliance with international standards. For instance, in January 2015, we became the member of Microsoft COSN Russia. We were pleased to leverage this unique opportunity for closer cooperation with the world-wide IT leader in order to develop world-class cloud services and raise the competence of our specialists.
For us, IT services are our home turf. Ranging from the most straightforward infrastructure services, such as building a data center, to more sophisticated and complex operations, such as data migration — we do it all. The relocation of data resources is a difficult task, which is accompanied by the risk of data loss, and the possibility of business interruption for customers. If a client's business needs swift access to data every day, any loss or reduction of the accustomed tempo of data operations will halt business.
Tell us, what IT services are demanded by business today?
The time left till September 1 is shot. Even if the inspections and checks by authorities don't begin at 8 a.m. on September 1, and even if the regulators don't take a hard line, every entrepreneur knows that the next audit is not far off. The relocation of data is a big organizational task. For example, the equipment procurement is an integral step and takes from two to six months, while there are now only three months left. However, the equipment is not enough. An entity should complete data migration to the equipment and start data processing.
Thus, the following trends are relevant right now. First, there is no need to purchase software. Second, there is no need to build our own data centers. Third, it is not necessary to address the infrastructure maintenance issues. Why do such things, when they can be conveniently done for you? Our company has the hardware, software, infrastructure, facilities, and uninterrupted power supply capabilities. We have all of this already, and customers can use it right now. It's like, for example, water. We don't build a water pipe ourselves so we can drink water. This is also true for IT. It is better and more efficient to benefit from IT services provided by professionals.
There is a transformation taking place in the IT sector. In general, this transformation is referred to as "Cloud Computing." The law on the relocation of data, in fact, served as a catalyst for a natural process that is already well underway. The law is merely pushing the process forward. In practice, this means that more and more companies realize that it is not necessary to buy their own servers, to build data centers, or to license software. Let the professionals migrate your data to the cloud, and you will see how it is comfortable and easy to use.
Specifically, we offer such services based on multiple technological platforms, such as Microsoft platforms, which allows clients to use internationally tried and tested products.
What difficulties do users face during the data migration?
There are two major difficulties with data migration, and they have no bearing on the technology vendors.
The first relates to the amount of information to be transferred. All serious corporate customers have been handling data for many years. As the business grows, so do the volumes of data that are necessary to handle. Nobody is going to delete anything since all information is very important. So now, when you need to relocate this information to Russia, it turns out the migration requires the transfer of hundreds of terabytes of data. The data copying over the communications channels may take two weeks.
So, what does this mean for the company? A knee-jerk reaction would be to send all your employees on a two-week vacation, move your data, and then run checks to see if everything works and was done correctly. In the process of data transfer, users would not be able to access or modify the data. Thus, business would come to a standstill. Hardly anyone can afford such a state of affairs.
We develop tools and mechanisms for a background data migration. This means a company can continue to use and access information while it is being transferred; business does not need to stop. This relocation task is something that is solved in different ways—it depends on the particular company and its scale.
Our job as a systems integrator is to complete data migration in the background, and to ensure the integrity of all data while preserving both customer's information storage technology and business cycle for data handling.
The second difficulty is that few large corporate customers conduct operations in the homogeneous environment. This means that organizations rarely use products of a single technology vendor. Customers may use many systems of other vendors; for example, multiple analytical and database management systems, etc. To transfer all of these systems to Russia while maintaining the same technological diversity — this is another big and complicated issue. Of course, this is included in our range of competencies and responsibilities.
So, perhaps the two biggest challenges are the size of the migration and technological diversity involved.
According to your estimate, how many companies that need to relocate data to Russia have already done so or are actively engaged in the process at the moment?
It is difficult to speak about any specific numbers, because, as I have said before, all depends on the volume of information resources in a particular company. Data transfer speed depends primarily on this factor.
Of course, many organizations have been rushing to transfer their data. These are large companies, often international in nature, but the volume of their information resources is not particularly large, for example, a cosmetic company. According to my observations, almost 100 percent of companies in this segment have already begun the transfer of data to Russia. But if we are talking about larger companies, which have strong IT infrastructures, the picture is not so clear. Some enterprises with complex IT infrastructures, with a mass of technological features, and add-ons, have not even begun to transfer their systems to Russian soil. This may be due to unwieldy organizational structures, combined with a variety of technical difficulties. But even with these types of firms, in the near future we will see an active rise in interest concerning the data migration.
