Bastion of pan-Euro regulatory rulings and inter-nation homogeneity, the European Commission has awarded four new contractual agreements designed to elevate and advance cloud sovereignty in the EU.

A current focus of the commission, EU cloud sovereignty is generally centered around efforts to protect data from foreign legal reach, ensuring digital autonomy, and foster local technological self-reliance. The commission has said that it is actively working to “strengthen the digital sovereignty posture of the European Union” with moves in this space.

One of the commission’s contracts has made use of services from S3NS, a joint venture between French multinational conglomerate company Thales and Google Cloud, the (obviously) American-based hyperscaler giant with weighty operations across Europe.

Le Localization Loophole

Regarded as something of a localization loophole, the S3NS arrangement in France and Luxembourg means Google can create so-called sovereign cloud partnerships. This means data can be stored locally inside the EU on Google-powered tech managed by local companies, even if a standard Google-owned datacenter isn’t present.

Google Cloud maintains physical datacenter regions in Belgium, Finland, France (Paris), Germany (Frankfurt and Berlin), Italy (Milan and Turin), the Netherlands, Poland (Warsaw), Spain (Madrid), Sweden (Stockholm), Switzerland (Zurich), and the United Kingdom (London).

Those four sovereign cloud contracts go to: 

• Germany-based cloud computing provider STACKIT (part of Schwarz Digits KG), which offers sister cybersecurity services from its XM Cyber division.
• France-based Scaleway, a company known for its cloud computing and web hosting services.
• A France-Luxembourg partnership driven by joint efforts stemming from Post (a Luxembourgish mobile phone network operator) as well as OVHcloud (hailing from Roubaix in Northern France) and CleverCloud, a difficult-to-assess company that appears (by dint of its founder’s location on LinkedIn) to be in Nantes, France.
• The Belgian-French-Luxembourg partnership, spearheaded by Proximus, that makes use of services from S3NS, plus Clarence and Mistral.

Euro Skepticism, N’est-ce Pas ?

The new cloud contact agreements mean that EU-based organizations and public bodies will be able to buy cloud-based resources and services up to the value of €180 million (around $210 million) for a duration of six years.

The trade association covering cloud services provision in Europe is known as CISPE (Cloud Infrastructure Service Providers in Europe). The 38 regional cloud provider members of CISPE have previously been critical of the EU Cloud Sovereignty Framework, saying that it is loosely worded and likely to award contracts to incumbent suppliers already in place, rather than allow tenders to the most agile and most local operators at any given time.

American Flavored 

With the ‘mostly’ French entity S3NS clearly drawing its backbone services from Thales, but also Google Cloud, some may question whether the U.S. CLOUD Act could ever have an impact on the use of American-originated cloud DNA.

Not a capitalization slapped on for American swagger, the Clarifying Lawful Overseas Use of Data (CLOUD) Act is a United States federal law enacted in 2018 by the passing of the Consolidated Appropriations Act. Subject to legal processes, the Act could allow U.S. access to cloud resources operated by American cloud companies wherever they operate.

CLOUD Act, Classifications

According to the AWS compliance portal, “The CLOUD Act enabled the U.S. government to enter into reciprocal executive agreements with other countries to lift blocking statutes and enable foreign law enforcement authorities to compel production of content data directly from service providers for serious crimes, subject to strong procedural and substantive safeguards. Importantly, the CLOUD Act also created additional safeguards, including recognizing the right of service providers to challenge requests that conflict with another country’s laws or national interests.”

Despite what may appear to be muddied waters to some, S3NS has publicly stated that S3NS is a French entity and is “fully controlled by Thales” with employees and stakeholders that are confirmed European nationals, located in France

Talk in this space will throw up terms like “trusted cloud” and European sovereignty through “physically segregated datacenters” that make use of “dedicated and isolated networks” and more besides. Quite how much “supervised assistance from Google” (another beauty) is invoked in any single day, week, or month is presumably open to question.