Sovereign Cloud: the surprising volte-face of the State in favor of the French ecosystem

Changing gears without seeming to deny yourself: this is the highly perilous – if not impossible – balancing act that the government is tackling in the very sensitive issue of the state’s cloud strategy. On Monday September 12, a shock trio made up of the European Commissioner for the Internal Market, Thierry Breton, the Minister for the Economy, Finance and Industrial and Digital Sovereignty, Bruno Le Maire, and the Minister Delegate for Digital and Telecommunications, Jean-Noël Barrot, was invited to the inauguration of the brand new datacenter – no pun intended – of OVHCloud in Strasbourg. This same datacenter which had burned down in February 2021, burning with it part of the media credibility of the French cloud ecosystem. A few months later, in May 2021, the State announced its cloud doctrine and its Cloud of Trust strategy, in which the dominant American players in the market, in particular Microsoft and Google, were well established. Since then, the fracture was deep between the macronie and the tricolor champions of the cloud.

Bleu, S3ns: why trusted Cloud offers will certainly be subject to the Cloud Act

Eighteen months later, drastic change of atmosphere under the blue sky of Strasbourg. United behind OVHCloud, the entire French industry is finally getting its revenge. In front of an audience of elected officials (MP Philippe Latombe, Senator Catherine Morin-Dessailly, President of the Grand Est Region Jean Rottner…), companies in the sector (Jamespot, Wallix, Clever Cloud…) and of personalities (the director of Anssi Guillaume Poupard, that of the Directorate General of Enterprises Thomas Courbe…), Bruno Le Maire, Thierry Breton and Jean-Noël Barrot have shown clear, massive and unambiguous support for the sector French cloud. A first. The objective: to finally put them at the heart of the national strategy, and remove a certain number of obstacles.

Cloud of trust with Gafam: “Decision-makers should not be naive” (David Chassan, 3DS Outscale)

Opening of SecNumCloud to French cloud SMEs

Beyond its economic potential – the sector’s turnover is estimated at more than 560 billion euros in Europe in 2030 according to a KPMG study – it is impossible to dream of digital sovereignty and technological independence without master the clouds, both in terms of infrastructure and software, through which all our data passes.

While the State until recently encouraged the market to subscribe to trusted Cloud offers with Gafam – which will not arrive before 2024 and are not yet labeled SecNumCloud by Anssi -, it is now pushing French players to obtain this security certification, which previously seemed inaccessible to them because of the cost necessary to obtain it. To lift this brake, Bruno Le Maire announced that Anssi will implement a qualification support system of 2.5 million euros, dedicated to startups and SMEs. that offer platform or software services that can contribute to the modernization and resilience of businesses and administrations “. The unofficial objective: to create other trusted Cloud offers than those currently in the pipeline with Gafam, therefore correcting the political choice made in 2021.

Another announcement: the “clarification” of the State’s cloud doctrine, which involves a finer definition of the notion of sensitive data which must imperatively be processed in a sovereign cloud. ” A circular will be published in the coming weeks to clarify the level of data protection and guarantee their protection against US extraterritoriality “, said Bruno Le Maire.

The two ministers also announced the creation of a Sector Strategic Committee (CSF) provisionally entitled “digital trust”.. This ” common forum for exchanges with the State “, which will be chaired by the general manager of OVHCloud Michel Paulin, will have to ” encourage cooperation and participate in the emergence of a competitive French offer in the coming years “says Bercy. In other words, to unify the French players who are now scattered, so that they can together create common offers capable of competing in number of services offered with those of Gafam. In the name of digital sovereignty, this strategic committee will be excluded from Gafam. ” Only French cloud players can be there “, confirms the General Directorate of Enterprises (DGE). Orange, Capgemini and Thales, which are also technology distributors and resellers, will be able to participate. On his side, Michel Paulin will have to report to the government every six months on the composition, governance and objectives of this new CSF, ensuring good coordination with the existing CSFs (Security Industries and Industry of the Future in particular).

Finally, the government is counting on the regulations in progress in Brussels to “ rebalance the cloud market “. It is counting in particular on the European cybersecurity plan for the cloud, on the Data Act which will regulate industrial data, or on the Important Project of Common European Interest (IPCEI) Cloud, a European project of 5 billion euros. euros, involving more than 180 companies so that the cloud of tomorrow is invented in Europe.

Orwellian erasure of any reference to Trusted Cloud

If the government presents these announcements as the “ reaffirmation of the national cloud strategy, and therefore claims a form of consistency since the announcement of the cloud strategy in May 2021, in reality this is not the case.

The strategic shift announced by Bruno Le Maire and Jean-Noël Barrot is major and spectacular. In May 2021, Bruno Le Maire and the Secretary of State for Digital at the time, Cédric O, had no word for the French cloud sector, except to denigrate it. Cédric O even affirmed that the Gafam offer ” the best cloud services » and assumed the discourse according to which the French are not « not at the level ” and ” do not offer all the cloud bricks essential for the digital transformation of companies and the State “.

Eighteen months later, his successor, Jean-Noël Barrot, said exactly the opposite. ” French cloud and data players master all the essential technological bricks to offer sovereign solutions for all strategic players “, he says. The new Minister of Digital even calls on the State to ” rely on them ” for ” winning the battle for digital sovereignty in the face of American champions – Amazon, Microsoft, Google – of which he paints an unflattering portrait. According to him, the strength of the Americans was to offer ” global solutions “, meeting all the needs of customers on a single platform, which allowed them to obtain a ” economic dominance that leads to technological dependence,” with its batch of “extraterritorial risks to the security of our data “.

For his part, the same Bruno Le Maire who asserted that American offers can be sovereign if they are sold by joint ventures under French law (Bleu for Microsoft with Orange and Capgemini, S3ns for Google with Thales), says today: ” I am opposed to the principle of American extraterritoriality. I do not see in the name of what they could seize essential data for our sovereignty and our independence. No one, even our allies, can have the right to seize our data “. However, more and more legal experts warn that trusted Cloud offers with Gafam will be subject to the extraterritorial FISA law and that Americans may also consider that they fall under the Cloud Act, requiring create a real legal barrier that is both costly and uncertain that the SecNumCloud label is supposed to validate.

A year ago, the American Gafams were presented as ” partners essential, but today they have only been mentioned as data predators, armed arms of a State, the United States, which arrogates, thanks to its extraterritorial laws -Cloud Act and FISA law-, access to our strategic data. In a striking sign of the government’s reversal, not once did the two ministers even name the Cloud strategy of trust in their speech. This is also absent from the government’s press release, as if it had never existed. Nor did Bruno Le Maire and Jean-Noël Barrot once mention the names of the French players – Orange, Capgemini, Thales – at the heart of the strategy presented last year, nor that of its craftsman, Cédric O.

They also seem to have forgotten that Emmanuel Macron himself said, during the presentation of France 2030: ” Will we have a fully sovereign cloud in 5 years? I don’t think it’s true to say it to each other, because we’re way behind schedule.”. But the government today believes that it is possible to quickly create French sovereign solutions.

“Move forward and forget the differences of the past”

Something unthinkable a year ago: Thierry Breton, Bruno Le Maire and Jean-Noël Barrot were warmly applauded by the French cloud ecosystem gathered in Strasbourg.

This is coming three years late but it is a real strategic readjustment which is extremely positive”estimates the deputy (Modem), Philippe Latombe, while relativizing: “ there is still a lack of commitments on public procurement, which is an essential lever for developing French cloud champions “. And to conclude, a little quickly: the trusted cloud strategy is quietly buried “.

For their part, cloud entrepreneurs are delighted with the form and are waiting to see what happens in substance. “Jean-Noël Barrot took the time to receive us, to listen to us and to understand that the 2021 strategy was going straight into the wall. Just that, it changes and it’s huge. Correcting the situation requires political courage, the government must assume to fork but it cannot deny itself, it is not an easy position, it is better to move forward and forget the differences of the past », adds Alain Garnier, the president of the company Jamespot (collaborative software).

If everything indicates that the government will now help to build truly sovereign offers rather than pushing the market into the arms of Gafam, it now remains to be seen how Bruno Le Maire and Jean-Noël Barrot will manage the inevitable response from Bleu, from S3ns , and Gafam, who, without being publicly disavowed, still received a hell of a slap in Strasbourg.

Macron and the Gafam: investigation into an ambiguous relationship