How are colleges and municipalities finding themselves in situations where they've signed contracts for someone else's equipment to be installed on their property, sometimes literally on a piece of infrastructure they they own/control and legally unable to physically remove the equipment?
This has a really obvious answer which has been thoroughly explored here but I would like to explore why that answer is bad even though it's true, and pointing out it's true is not bad.
First some postulates:
Government should not be allowed to contract anyone to manage our data.
Government should not hire contractors to work on systems which will be used to manage our data.
Government should never be sending our data out to anyone else or allowing it to be stored on systems not under their control.
Obviously I realize that this is status quo stuff, it's more common than not in fact. Only legacy and defense systems are still held and run by feds and states, everything else is generally outsourced to a contractor (Accenture, Deloitte...) and is also probably running in the cloud — specifically on AWS, Azure, or Oracle.
But these things should never happen specifically because they are each individually poisonous to privacy, let alone all three together. All of this software should be developed in-house like it used to be. Government outsources software development and management so that it can do things it's not allowed to do otherwise, not because it's the only way to do it. It allows them, perhaps most importantly, to hand our data to others. Huge amounts of our PII is being processed not just on cloud instances provided by these players, but actually through their services (e.g. Amazon Transcribe) which are AI-based* and also mean that they actually process all of the data on our behalf and are in a unique and ideal position to harvest it.
* Amazon Transcribe used to support phonetic substitutions but now it doesn't, which I take to mean that they've just handed the whole job purely to a LLM which does it in one stage... you hope.