MSE907 failover study
Ethics and Māori data sovereignty
Context
Ethics and Māori data sovereignty
Māori data is a taonga, and Māori data sovereignty is the principle that data about Māori should be subject to Māori governance (Te Mana Raraunga, 2018). The CARE principles say something similar internationally (Carroll et al., 2020; Kukutai & Taylor, 2016). Automatic failover puts such data at risk because it moves and copies data without a person deciding. Failover also creates extra copies: a standby, a Kafka log, backups. Each copy needs the protection and retention rules of the original, because a deletion request is not met while a copy remains.
This is treated as a design requirement, not a compliance claim. The experiment uses synthetic data only, so no consent is needed and no real data are at risk. Both clusters are in New Zealand. The exceptions are the baseline’s backups in Sydney and the synthetic payments stored on Cloudflare’s global network for the customers page.
| Area | In place now | Needed for real use |
|---|---|---|
| Location (rangatiratanga) | Both clusters in New Zealand; exceptions: baseline backups (Sydney), Cloudflare dashboard. | An allowedRegions check before promotion; a New Zealand backup store the tool supports. |
| Protection (kaitiakitanga) | TLS, WireGuard, fencing, encrypted keys and Terraform state. | Encryption at rest and customer-managed keys. |
| Second copy (whakapapa) | Logs and backups are known to be copies. | Retention and deletion rules; wipe on request. |
| Access (manaakitanga) | Synthetic data; dashboard on Cloudflare’s global network. | Role-based access and audit; limit the dashboard to counters. |
| Governance | None in code, by design. | A Māori data governance process and adviser before real use. |
Other ethical points
- Privacy. A real deployment would fall under the Privacy Act 2020, including breach notification where serious harm is likely.
- Bias and honesty. The baseline could look like a straw man, so the choice is anchored in independent evidence and the report states what B could have recovered. All 40 runs are reported.
- Legal. Faults are injected only into the author’s own clusters. Components are open source under their own licences. A financial-sector deployment would face further obligations this prototype does not address.
- AI assistance. An AI coding assistant was used. The author takes responsibility for every claim.