Working on sensitive data on the cloud

Question

In my current project for an NGO, I have to set up a system that allows members of the organisation to perform basic analysis on highly sensitive data.

The data (reports, or form submissions) is currently stored on secure UNHCR servers through KoBo (a tool for collecting data on the field). For performing analysis, for now, I have a Google Apps Script that fetches the relevant data, strips it of the sensitive bits behind the scenes, and pastes it in a Google Sheets spreadsheet. The problem with this approach is that, obviously, the fetch necessarily parses the whole of the data, so Google has access to it.

I have thought of this solution:

---

Alternative 1

Protocol

• Manually download the data from UNHCR on my computer
• Remove the sensitive bits via a script on Excel
• Paste the data on the Google Sheets spreadsheet
• Remove the data from the computer

Limits

• No real-time fetch of the data, but having someone do this once per day does solve the problem of privacy

---

However, I have two features that I'd also like to implement. After the data collectors send in their reports, some of them may need to be contacted for follow-ups or sent a more in depth form, and I'd like that to be done through a script. Also, the UNHCR servers have a certain size limit for the media that are sent in alongside the reports, so I want to create some database where the media that are above this size limit are indexed against the relevant reports and stored.

---

Alternative 2

Protocol

• Set up a private server with a provider who is based in a EU country with strict data privacy laws
• Have the server fetch the data from UNHCR
• Send out emails to the data collectors, for example to ask them if they have any large media they'd want to attach to their report and the instructions to do so (these emails don't have to be encrypted or anything)
• Store the reports (stripped of the sensitive bits) in an unencrypted CSV
• Have my Google Apps Script fetch the CSV and paste it in the spreadsheet as is
• If I have large media for previous reports, I make report-media files on my computer, encrypt the lot, and upload them to the server, where they'll be stored within a database

Limits

• Find a provider who fulfills the criteria
• The fees and the complexity that this alternative brings are acceptable

---

I realize that another alternative is using Alternative 1, manually sending emails to the data collectors, and storing encrypted report-media files anywhere in the cloud (since they're encrypted), but I'd like the whole process to be as automated and centralized as possible, so: how do I make the alternative 2 work? Where can I find a good cloud hosting provider?

Answer 1

Which of these alternatives would be better all depends on your threat model. If you do not know what this is, please research it, or get someone to help you on that. (Or start asking questions here about it!)

I say this because I do not understand why you are so worried about Google (potentially) accessing that sensitive data, while you just assume by setting up a server in some place with strict data privacy laws all will be fine. If Google is an identified threat (by your model), why are you sharing your (redacted) results via Google Sheets in the first place, and (try to) use some Google Apps script to achieve that? Can't you just use some other (local) tool to obfuscate or strip that sensitive data?

What also boggles my mind is, if this data is so sensitive to your organization, why are you allowed full access to it in the relative insecure manner of either downloading it to your own computer, or to some other server (somewhere else in the world, where you probably can not physically guard it)?

From your story it appears that UNHCR gives you access to that servers' data, so the chances are your organization have accepted some agreement with the UN on using and handling that data. Talk to your organizations' legal counsel and see what is possible and what not.