The great return of the “sovereign cloud”: a history of governance and protectionism

by bold-lichterman

You may have heard of it, Bruno Le Maire wants to set up a “National Strategic Cloud”. If you have a feeling of déjà vu, that’s okay. In 2009, the French government launched the idea of ​​a “French Cloud”: Andromeda. This project, launched in 2011 around Orange, Thales, SFR, ATOS and Dassault Systèmes within the framework of investments for the future (Large loan), Cloudwatt and Numergy were stillborn, despite the 150 million euros invested.

Far be it for us to pretend to know why these two solutions failed. This is how. We will also note the almost insolent form of the French infrastructure provider OVH, which already existed long before any sovereign Cloud project. We will also notice the existence of other alternatives such as Clever Cloud, Scaleway, Alwaysdata and all the others. So why the return of the Cloud SuzerainTM? Well because it’s war!

War, my colonel!

A trade and political war certainly, but a war all the same. Let’s start by talking about Governance. The oil of tomorrow, today in fact, is Data. Whether for geo-strategic interests, to avoid industrial espionage or simply to protect the lives of citizens (thank you the General Data Protection Regulation, or GDPR), it is imperative to control the machines and humans who manage the Data. And there, naively, we say to ourselves that if we use a DataCenter on French soil, then everything will be fine.

Except no. All is not well from a data governance point of view. The CLOUD Act, American law promulgated on March 23, 2018, allows the government, law enforcement and other American intelligence services to access information stored on the servers of American Cloud and Telecom companies, regardless of their geographical location (it is note that the CLOUD Act is only one way of reaffirming theextraterritoriality of American law, that is, American law applies on foreign soil). All this without the owners of said data being informed.

Normally this is sufficient to say that using an American Cloud company is a bad idea (the CLOUD Act also specifies that the reasons for this access to the data can be security or economic intelligence). We can add in the balance the fact that the GDPR and the CLOUD Act seem incompatible, full of future legal puzzles in perspective. Clearly, an American server on French soil is under American law, storing data there therefore corresponds to an export of data. In short, a motionless export. Joy and happiness.

Or are we using a European or French Cloud? Is there going to be a Cloud by geopolitical power? Is the world going to split into multiple sovereign clouds? Isn’t that in total opposition to what the Internet is? It’s a bit early to predict this kind of thing, even if everything suggests that we are slowly heading towards this undesirable future. And the economic perspective in all of this?

A deep economic war already well advanced

The cloud industry is making huge amounts of money. The Cloud creates jobs. The Cloud of the future is very probably greener than the current Cloud and clearly growing, so even more jobs. Really the Cloud, as an investment, it’s a good plan.

So why deprive yourself? Let’s go into protectionism. The GDPR is a first brick already laid and already generating growth (OVH and Clever Cloud are living proof of this, we spend our time benefiting from it), in addition to the moral defense it represents. One or more (never put all your eggs in one basket) Sovereign Clouds would make it possible to go further.

I can already hear the cry of the capitalist who opposes this interventionism coming to disrupt the good old free and undistorted competition. I therefore take this opportunity to recall a widespread cognitive dissonance: the USA, as a good apostle of this free and undistorted competition, have resorted to protectionism. more than any other country in the world, especially since the 2008 financial crisis.

Who says war, says armament; protectionism is the primary defense weapon when attacking a country’s economy, it is the solution to avoid letting its entire economy be shaved and replaced in a game of distorted competition. Why distorted? Because when we deploy a sector by dint of subsidies or massive investments by betting on a future hegemonic situation, allowing to sell at a loss, it is indeed a distortion of competition which makes it possible to attack local competitors, to conquer a market. whole part of the economy and to establish itself, the sole seller of grain in the middle of salty fields.

A concept all the more interesting if we take the funding model of American startups. When we put money in the Cloud, we make sure that the boxes with which we also put money use the said Cloud.

Take a look at Github and Gitlab, for example (two open source social coding tools that are essential in a developer’s life today). Github was acquired by Microsoft. A probable migration to Azure, the Microsoft Cloud, follows. Gitlab, then on Azure, decides to go to the Google Cloud, after Google’s investment fund put an agent in Gitlab, obviously. We are assured that all these movements have nothing to do with possession, but it is obvious that we are talking about information warfare and ground control.

Linked strategies are already observable: some Cloud players offer enough credit to their prospects to make them prisoners of their solution (point “if it’s free, you are the product”). When we offer you the complete transition from your infrastructure to the Cloud, with complete support also free for the road, why deprive yourself? There follows a lasting lockdown by and on a particular solution, endless difficulties if one decides despite everything one day to get out of it, and above all something contrary to common sense: we have just put all our eggs in the same basket.

Let us give a simple example on the fashionable field of Artificial Intelligence (AI), which at the moment particularly illustrates the trend. Google and Microsoft offer value creation “partnerships” to French leaders, providing free dedicated engineers (consultants of specialized service boxes under contract) to the said French leader in AI, in exchange for the fact that the software and data are deployed in the GAFAM Cloud. These giants therefore sponsor the French leaders on these developments, extracting their data in the process and imprisoning them in proprietary technologies.

What to do ?

So, if a geopolitical power needs to control its Cloud, what does it need? It needs a Cloud that sells, a profitable Cloud and above all a Cloud that its citizens / companies / administrations want to use. What first drives IT people to choose a particular cloud? Several factors come into play.

Already, the magical offers mentioned above, which take the customer on board at a low price. Then, a bloated supply often seen as greener grass because it is supposed to be more complete elsewhere. No one is a prophet in his own country. And we cannot say that the “success” of the previous sovereign Clouds has done good for the French Cloud as a whole. Of course, the mastodons have more resources, and therefore a more complete offer. Is it because we went shopping with the pioneers of the American Cloud that they developed more quickly? Or did they start out stronger than everyone else and we go? The egg or the chicken?

Worse still, these past failures firmly anchored the idea that France was simply not capable of producing a qualitative solution. The CIOs who spoke about Cloudwatt yesterday are those who migrate to Amazon Web Services (AWS) today, in a mixture of fatalism and follow-up.

Normally that shouldn’t matter much. After all, the Cloud, the “Digital” as we say at the moment, the digital what, it is software. “It must be able to be easily disrupted, we must be able to make a new Cloud emerge easily. You just need devs ”.

Much more than software

In fact, the cloud as a whole is more than software. If we wonder about the new sovereign Cloud: where should Bruno put his (our) money?

The Cloud starts with real estate. We must build DataCenters to accommodate the machines. It is necessary to bring a significant quantity of electricity there. And it is necessary to plan to dissipate all the energy that this electricity will generate. Without forgetting of course to connect all this to the cables of the world Internet. We are still not talking about software then.

To design and manage all of this, you need humans. To ensure the physical security of the premises as well. We still need humans to install and maintain all the machines that will arrive in the DataCenter. And once we have all this, then yes, then we can start talking about software, to make these machines easily usable by future customers.

It is important to specify the existence of all these professions since the American pioneers of the Cloud for all, AWS in particular, have made them invisible. In addition, these are trades that have existed for a long time, with successful companies and skills available in France. Take for example OVH, “world leader in infrastructure”According to BFM Business, Jaguar Networks, Iliad, still on the infrastructure part. Take Clever Cloud, Scalingo, Scaleway for the Cloud.

So why try to bring out a new player in the Sovereign CloudTM?

A simple and effective roadmap proposal for working together quickly

Three practical angles emerge:

  1. If you absolutely want to intervene and invest, do it with the private players who already exist, but do not build this approach from large French companies, because they do not have the agility of small structures that can afford it. Failure, they find themselves following the market instead of ahead of it, because the sum of human interactions in a group is inversely proportional to its production capacity, causing sluggish reaction in a very lively market. Be very careful not to destabilize this still very young market.
  2. Investing is not necessarily the best or the most urgent approach. What is needed is to strengthen the legislation, and generate more protectionism. In particular by orienting public procurement. For example, all public authorities should be prohibited from buying something dependent on the CLOUD Act.
  3. There is fundamental work at European level to continue. Make sure that the GDPR will indeed be firmly applied by Europeans, and quickly clarify the binding consequences of the GDPR vis-à-vis the CLOUD Act, to begin with. Help to open more firmly the file of the digital independence of Europe, and make it a central criterion of selection of the members of the next European Commission, to continue the excellent work of the current Commissioner for Competition, Margrethe Vestager. It is necessarily a subject that will be settled by businesses, with the help and support of European structures.

Mr. Le Maire, it is absolutely irresponsible to buy American because of the CLOUD Act. Work, you and your services, but also all your national and European colleagues, even more or even exclusively with the existing and innovative actors of the sovereign Cloud, and it should go well (better).

The contributor:

Laurent Doguin has spent more than 10 years working for French and American software publishers. Today he is VP relationship developer at Clever Cloud where he writes and speaks to developers of technology, governance and accountability.