Do I need to move to hosting in Russia, or Fault tolerance for 242-FZ

Some time ago, in Moscow, the Failover conference was held , devoted to such important issues as ensuring the resiliency of online services. During the day, 19 speakers spoke to the audience, saying a lot of interesting things for developers, testers and operators. We decided that such useful materials should not be “dusted” in the archive and should be made available to an even wider public. And we will start with a speech by Sergei Ryzhikov, entitled “Do I need to move to a hosting in Russia, or Fault tolerance in 242-FZ”.

The subject sounds rather strange. Let's think about what is at stake. I noticed that when it comes to moving hosting to Russia, many people begin to reason emotionally. Like a doctor who treats his child and cannot make rational decisions. Therefore, first of all, I urge you not to give in to emotions and to look at what is happening as distantly as possible. All over the world today there is a trend when all states begin to regulate the Internet in its most diverse manifestations. Why is this being done and is there anything unusual about it? When do you need to regulate anything at all?

When a phenomenon becomes important for people and the state, there is a need for regulation. This is done in order to avoid negative consequences that can have a serious impact on the economy, society, and people's lives. And the importance of the same Internet today is hard to overestimate. Let's assume that somehow TCP / IP has stopped functioning. Can your company continue to operate? Can you do anything without an email? Unlikely.

The activities of government agencies and businesses depend on the functioning of the Internet, which has gradually become a completely indispensable component. And there are people, I emphasize, not only in our country who are responsible for regulating this most important channel of communications.

Let me give you an example of a topic such as Internet-related crimes. Over the past 10 years, I have repeatedly talked with a variety of government agencies protecting the rule of law. I watched their evolution, from a complete inability to do something, even when they are provided with all the data up to IP addresses, to a serious adequate reaction, the ability to make a decision and find intruders.

We all - both companies and individuals - are counting on the protection of the state, and it should be able to do this in a variety of areas, including the web. But regulating the Internet is quite problematic, and the state is constantly trying to figure out how to do it. Surprisingly, in ordinary conditions, citizens react poorly to regulation on the Internet, but at the same time they easily agree to it after terrorist attacks or major scandals with the loss of personal information. After all, such things clearly show people the scale of what can happen to them.

How is this in the world?

I will give some examples. I emphasize once again, let's discuss this topic calmly and rationally, without considering ourselves as residents of a particular country.

Great Chinese Firewall. Arose in 2003, were blocked by Twitter, Facebook, Instagram, Google+, YouTube, etc. There is an excellent lecture on the site www.ted.com - " Behind the Great Chinese Firewall ." From it you can learn how the Chinese live in these conditions, about the national counterparts of all social services, how this internal ecosystem is regulated and operates. But such a situation, as in China, is possible if there is a difference in ideologies.

Germany. A very conservative society. On the one hand, everything is easy, no one forbids anything, but the law requires servers to be located in countries that comply with the European standard for storing personal data. And these include Canada, Switzerland, Argentina, Guernsey and the Isle of Man (how many knows about Guernsey without Google’s help?).

In the United States, most restrictions were introduced after September 11th. The president has almost unlimited powers, since 2002, special services have gained access to telephone conversations, electronic correspondence and much more. The law has very vague wording: "If there is reason to believe that there may be a threat to state security." Often this can be interpreted in such a way that no order is needed to request data stored on the servers. This is such a large-scale phenomenon that large companies simply make access to IMAP for special services.

Law 242-FZ

And how are things in Russia? Let us recall how the first law appeared, expanding the powers of Roskomnadzor. Everyone was afraid that with its introduction many sites would be closed, but this did not happen. Why then passed the law? Officials from Roskomnadzor emphasized that the law is aimed at building relations with a number of companies so that there is some kind of legislative framework that ensures the legitimacy of certain requirements. And this approach is used all over the world. That is, the law is always the negotiating position of the state in dialogue with business.

So, from September 1, 2015 we will have to store personal data in Russia. The law defines limitations and exceptions that govern the procedure for dealing with various data formats. And, of course, there are many vague wordings. It’s not very clear what “personal data” is. Someone will say that this is information that allows you to uniquely identify. But in the modern world a variety of things can be used to identify people.

For example, in German law there is a very interesting point that data intended for different tasks should be processed separately. This means that you cannot use the information collected using one service for some tasks within the framework of another service. Say you cannot use the SMS you sent to determine your location. And such things must be formulated as accurately and unambiguously as possible so that they cannot be circumvented or interpreted for the sake of any side.

The consequences of the ambiguity and understatement of laws

You need to understand that no serious market participant agrees to work on hacked schemes. The basic rule of all Western companies: "We will comply with the laws of the country so as not to risk business." But it’s common for IT professionals to reason “We will outsmart everyone”. For example, take a Russian IP, make a tunnel, and we won’t transfer any data. How do you guess that they, in fact, are not in Russia? But government agencies make up for the lack of their own competence by attracting outside specialists. For example, they conclude contracts with companies that do analysis, decryption, or some other thing.

The second way to circumvent the law is “Let's place part of the data in Russia, and then transfer it to the“ western ”cloud.” This scheme has not yet received distribution, and large companies prefer not to risk it. In any case, in my opinion this is a temporary solution.

I also want to touch upon another aspect that generally goes beyond the scope of the law; this is a matter of honesty with customers. As IT specialists, we traditionally trust Western IT companies. Customers now began to ask questions about where we store personal data, where our servers are located. Everyone decides for himself whether to lie or not. But customers will not put up if you do not comply with the law. You must also remember that the degree to which you comply with this law may be reflected in the loss of personal data. If they are stolen from your foreign server and published, then you will be subject to distribution for violation of the law.

Relocation Bitrix24

Every time this comes up, we are asked one question: “What will you do? You are sitting at Amazon, where will you go? ”More than 70 thousand companies are actively working with the Bitrix24 system every day. We have two data centers in the USA, in Amazon, they serve North and South America and provide fault tolerance. We also have two servers in Ireland, they serve Europe, Ukraine, Russia, Kazakhstan and Belarus.

We have applied a simplified architecture, we are actively using the Amazon balancer. In case of failure of one data center, we switch to the second. Data centers operate in master-master mode, they are interchangeable. Cloud files are located in several data centers, the bases are in two, the web are scaled.

For example, in the USA, depending on the load, a cluster can contain 25-40 cars, in Europe - up to 75, not counting the auxiliary group. This is a bit, given that our customers are companies. And to conduct an aggressive pricing policy allows us to precisely scale. We pay exactly for the amount of resources that is necessary for the work of our customers at the moment. Therefore, we cannot move to physical equipment and pay a fixed amount, this will destroy our financial model. We will either have to raise prices or redo something. Therefore, we decided to use two data centers in Russia. Our position is that we do not violate the law and do not deceive our customers.

How did we choose a provider

We needed providers with at least two data centers so that we could repeat the scheme used today. Moreover, we made our balancer before the start of the search for data centers.

It was necessary to decide what we will be placed on - on physical equipment or on a virtual system? The latter option is closer to us, since it is precisely this that we are using now, in which case the controllability is much higher. Even if we switch to iron, we will still deploy our virtual infrastructure from above. Based on this, it was decided to look for a provider that can provide a virtual layer that is understandable and reliable. We also needed cloud file storages, but in Russia it is not very good.

What else was critical?

• Virtual machines with arbitrary disk configurations. This is necessary for our database, which we shard, very well compacted.
• Dynamic billing, because without this we will not be able to provide the current price level.
• API for enabling, disabling, creating and in the data centers we need, etc.

We are one of the largest Amazon customers in Russia. Unfortunately, we have to migrate, because Amazon has not yet decided to deploy the Russian version of the service. This is their position: “We will not violate the law of any country. If the law changes, we either comply with it or leave. ” But we must give them their due, they help us in every way to migrate.

So, Amazon dropped out, like all serious players existing on the market, with the exception of those not represented in Russia. I had to repeatedly adjust the list of requirements. For example, we initially set the condition that the virtualizer should be non-profit, however, almost everyone uses VMware, Xen is rare. There was another requirement, which sounded like this: "The company should not be an investment." Why? Because if the investment ends, then the business will end. There were plenty of such examples.

The following criterion: the company should be medium-sized, which allows you to maintain the necessary degree of flexibility in decision-making. And this should be her main line of business. We met wonderful providers who, as it turned out later, earn money on something else entirely. It was important for us to understand this, because moving is a hectic, expensive business and I want to do it as little as possible. We are demanding, moody customers, but still there were those who satisfied all our requests. A short list was formed, from which the partner was selected, which we will not name yet.

• Cloud4y
• Dataline
• IT-Grad
• Oncloud
• Cloud library

How do we move

• First stage . We transfer the balancer, solve the technical problem of increasing the access speed for customers. This is already done. The balancer not only balances, but also completely caches graphics, statics, does SSL termination, holds speedy and much more. Thanks to this, we almost completely closed the question regarding the speed of the service.
• Second stage . We are doing this now. In two data centers we raise the database, we do the scaling infrastructure. And since the balancer is already our own, we will transfer part of the traffic from it to the experienced servers. And those customers who use Bitrix24 for free will be the first to start operating the Russian infrastructure. By the way, our exactingness to the quality of the transport system has already helped to identify several problems with the operators of higher uplinks, they have already been eliminated.
• The third stage . Registration will begin already in the new infrastructure. The goal is to ensure the entry into force of the law to ensure the work of six data centers, two of which will be located in Russia.

I emphasize once again that within the project we will carry out the division into regions: in the American data centers the domain will be hosted. Com, Brazil, Spain (because it is more focused on South America), in Ireland - Germany and Ukraine, and in Russia will be moved by Russian partners.

Thanks for attention! If you have any questions, welcome to comment.