GrapheneOS bails on OVHcloud over France's privacy stance

French cloud outfit OVHcloud took another hit this week after GrapheneOS, a mobile operating system, said it was ditching the company's servers over concerns about France's approach to digital privacy. The project posted on X (formerly Twitter): "We no longer have any active servers in France and are continuing the process of …

[Anonymous Coward]

Privacy and Open Source (...or any source)....

Quote: "....."France isn't a safe country for open source privacy projects...."

Yo!.....what country can we name which IS "a safe country for open source privacy projects."????

There's news EVERY DAY about state-sponsored hacks on almost everything!!

This "sovereignty" chatter is just the usual misdirection.....................

The good folk at Hubble Road (or Fort Meade, or somewhere in China, or somewhere in Iran)

.....they all have instant access to anything connected to the internet.....or to any mobile phone network.

"PRIVACY"........please.......just forget it!

Quote (Scott McNealy, January 1999): "You have zero privacy anyway. Get over it." (Yup.....1999!!!)

[Doctor Syntax]

"If the Canadian position is upheld, it will force the industry to rethink how sovereignty is protected in practice."

It will require a rethink at governmental level, not just industry level. While every government wants an opportunity to pry into data held out of its territory no government will want others to pry into data it holds. They can't have both, however much they want it. How long until the penny drops? And when it does, how long will it take them to realise which choice gives them most to lose?

Settling these issues is becoming urgent.

[Anonymous Coward]

Places Of Interest????

@Doctor_Syntax

.....you forgot the THIRD CHOICE! "Every government wants an opportunity to pry into data held by its own citizens."

.....So your choices amount to this: "Every government wants an opportunity to pry into ANY data at all."

Have you heard about Hubble Road....or Fort Meade???

[PRR]

>> "If the Canadian position is upheld...

> How long until the penny drops....?

In other news: Canada has eliminated the physical (droppable) penny. (USA is on the same path.)

[Gene Cash]

US ends penny-making run after more than 230 years

[kmorwath]

But that's what MLATs are for. Why courts decided to sidestep them? If they were designed for a pre-internet world and now their bureocracy is too slow, update them and make their execution faster - but they can't ask for data abroad just because now they stronghand someone who can have access.

Moreover now trans-national crime requires even more internationl cooperation to be fought - this doesn't like to me the best path to get it.

[Anonymous Coward]

Data Sovereignty

We need something like Sealand, administered by stable, rational, well-principled people, and located in truly international waters.

[NoneSuch]

Re: Data Sovereignty

>> We need something like Sealand, administered by stable, rational, well-principled people, and located in truly international waters.

Sealand can be taken over by the SBS in minutes. If out of any valid jurisdiction, you can be treated like the pirates of old.

As for finding "stable, rational, well-principled people," good luck with that in todays world.

Strong encryption, not designed or approved by the Americans, should be prevalent everywhere. It may not stop them, but it will slow them down. If they come after me and my devices, it delays then going after a journalist.

[Anonymous Coward]

Re: Data Sovereignty

I would assume that a working "Sealand Data" would in actuality be a Crypto AG

[gssdu]

Re: Data Sovereignty

Hmm, the SBS is a television channel here in Oz, didn't know they had a military arm...

Maybe there's an overloaded acronym here I need to Google.

[james 68]

Re: Data Sovereignty

In Oz the SBS is the naval equivalent of the more well known SAS and the Australian military partake in both alongside their British counterparts.

Clarification on a comment not a comment on the story.

[Winkypop]

Re: Data Sovereignty

If it did have one, who else but Lee Lin Chin to run it.

[Softsuits]

Re: Data Sovereignty

Sounds like the dreary parts of Cryptonomicum.

[Jamesit]

Re: Data Sovereignty

Where would you find people like that, do they even exist?

[Nate Amsden]

is this real

Is this real or just a political statement(of sorts)? I mean my impression is GrapheneOS is open source already, so not much to hide there. If France asks(or has already) them to put back doors in, and they refuse would OVH terminate their access anyway? I'm sort of guessing not, I mean they could in theory "ban" GrapheneOS from devices in France(good luck enforcing that?). I just suspect GrapheneOS would never really drive much scrutiny(if nothing else due to the very low number of users they have).

Guessing more of a political statement, which is fine... though it may of been a more powerful statement had OVH said "the government is telling us to terminate your access because you won't put back doors in your software". (certainly not a bad idea to have a backup in place in the event that happened)

[Blazde]

Re: is this real

it may of been a more powerful statement had OVH said "the government is telling us to terminate your access because you won't put back doors in your software". (certainly not a bad idea to have a backup in place in the event that happened)

If it's implemented anything like the UK's attempt they won't be able to say anything. Much better to jump vocally now before any legal gagging takes effect, and in doing so potentially move the needle on the political debate against it going ahead at all.

[doublelayer]

Re: is this real

Of course OVH wouldn't terminate their agreements for a refusal. The refusal has no connection to OVH. What would happen is that their hosting in OVH makes France think they can apply their laws to anything that team produces because some of their operation is in France, and to some extent, France are correct about the legality of that. Only by moving all their stuff away from France can they have a legal claim that France's law doesn't apply to them, but only to individual French users of the software who France can go after individually without any help.

[DecyrptedGeek]

Re: is this real

I think it is more of we don't want to be under indictment by the Police in France for not putting a backdoor into their code. They are closing any offices/presence in France so they can't be subject to their national laws.

[heyrick]

Re: is this real

The thing is, if the encryption is worth a damn, they can't put in special backdoors for Les Rozzeurs because maths just doesn't work like that.

[Skull Issue]

Re: is this real

Take the reasoning one step further: Compliance with the law would mean using encryption that is not worth a damn. They think France will legally require them to change to a backdoored encryption scheme, and they are trying to avoid being compelled to make that mistake. Thus, they are leaving France, QED.

[heyrick]

Re: is this real

You would have thought France would have learned their lesson the last time. They have a bit of a bee in their bonnet about encryption. So in the early days of the internet, they only allowed a really stupidly weak version of SSL (like 40 bit or something) until the banks and online shopping raised a fuss and the beginnings of Linux distributions and the "compile your own" ethos meant that carrying on mandating pointlessly bad encryption was risking economic harm.

These days? It's like trying to close the stable door after the horse has bolted, the stable has fallen into disrepute, and then been burnt to the ground. But, dammit. France is going to close that door anyway.

All that will happen is people with things to hide will use their own encryption within the so-called encryption permitted by the gummint.

[ThatOne]

Re: is this real

> France is going to close that door anyway.

They are not the only ones unfortunately. "Control the Great Unwashed" is high on the agenda of most governments: China has started a huge FOMO epidemic among governments worldwide.

[Yet Another Anonymous coward]

Re: is this real

To be fair,France does have experience of what happens when you don't keep a proper boot on the neck of the great unwashed without breeches

[Anonymous Coward]

Re: is this real

The backdoors would be outside the encryption.

[graemep]

Re: is this real

The thing is, if the encryption is worth a damn, they can't put in special backdoors for Les Rozzeurs because maths just doesn't work like that.

The authorities may not know or care. Remember the Australian Prime Minister who said "“The laws of mathematics are very commendable, but the only law that applies in Australia is the law of Australia," over the same issue?

[Anonymous Coward]

Re: is this real

The first rule of "government forced us to hand over..."

is you're not allowed to tell anyone "government forced us to hand over..."

[Roland6]

Re: is this real

It’s politic’s: the GrapheneOS Foundation is a Canadian nonprofit organisation…

Also if GrapheneOS were serious about not being backdoored, they would not be hosting the project on GitHub and would be very cautious about US involvement.

[TimMaher]

Re: Grapene is Canadian

This has all the smell of the OVHC war and OVHF and the Canadian govt.

[Anonymous Coward]

Always complaining

GrapheneOS are always complaining on Mastodon about how they are being undermined and attacked by other groups offering forms of Android. Sometimes it seems a little extreme, because there's nothing an outsider can see. They also keep complaining that these other providers are misleading people about security or privacy.

I tend to take their rants with a pinch of salt.

[W.S.Gosset]

>GrapheneOS clearly does not trust France.

Errr...more like they DO trust France to follow through on their stated threats.

[Khaptain]

Proton leaving Switzerland

Proton is leaving Switzerland for Norway, or maybe Germany, its not quite established yet. Yes even the Swiss want a backdoor and Proton have said no.

So there must be something good in either of those destinations.

[Khaptain]

Re: Proton leaving Switzerland

Care to say why the thumbs down ?

[Anonymous Coward]

Re: Proton leaving Switzerland

Probably some random griefer-downvoter.

(Anon 'cause I don't want a griefer's attention.)

[Sonic The Screwdriver]

Re: Proton leaving Switzerland

Second that request: why the thumbs down?

I see no swearing, and nothing controversial in the original post.

The nearest thing to an error is where Khaptain calls the future location "good" rather than "net-less-bad".

So, why the thumbs down?

[Anonymous Coward]

Re: Proton leaving Switzerland

Compulsive downvoters. They do exist around here, there have been many sightings: Downvotes which can't be rationally explained (although when I think of it, "rationally" might actually be the issue here).

[Anonymous Coward]

Re: Proton leaving Switzerland

So basically a person whose excitement for the day consists of following someone on an IT forum, clicking the downvote button, whether or not they agree with the comment, and then somehow feeling that they have now something world changing.

How do they manage to live with themselves ?

.

[Anonymous Coward]

Re: Proton leaving Switzerland

(sorry couldn't resist downvoting)

[Infused]

What the Article Didn't Mention

There's a negative campaign being run in the French press claiming GrapheneOS is the criminal's choice of phone. While there have apparently been no official demands for a backdoor, GrapheneOS have decided that discretion is the betted part of valour & have therefore left France. Unfortunately (as other commentators have pointed out) the current political atmosphere is one where governments are taking more active measures against encryption & age verification looks like it will become the default method of accessing the internet. So these battles are going to be replayed in lots of countries around the world.

[Bitsminer]

Re: What the Article Didn't Mention

Soooo, age verification is really a backhanded means of user identification. Hmmmm. Interesting.

[Maventi]

Re: What the Article Didn't Mention

That's exactly what it's always been about!

[Anonymous Coward]

Re: What the Article Didn't Mention

Hmm, If there's a negative media campaign underway, I wonder at which point eOS / Murena might find themselves attracting the attention of the splotlights?

[Chet Mannly]

Re: What the Article Didn't Mention

"There's a negative campaign being run in the French press claiming GrapheneOS is the criminal's choice of phone."

There was also one in Spain - the Guardia Civil said at one point even said that if they see someone with a Google Pixel they assume they are a criminal. Apparently they used to catch-and-release lower level crims after infecting their phones with spyware so they can get ones higher up the food chain. That spyware apparently doesn't work on GrapheneOS (as they have patched security holes), so the Spanish rozzers were calling for GrapheneOS to be banned.

[Chet Mannly]

Re: What the Article Didn't Mention

Sorry that should have been the Catalan Mossos d'Esquadra, not Guardia Civil...

[Brl4n]

Governments acting like governments. Provably incompetent but constantly need more money and more information.

[Winkypop]

Liberté, égalité, fraternité

…oh, and just a little peek.

[JClouseau]

It's complicated...

I live in France and wasn't aware of a "press campaign against GrapheneOS" as someone posted. I did find one article in Le Parisien saying that some cybercops released an internal (and leaked) memo saying that narcos are using GrapheneOS with Pixel phones to thwart attempts to intercept communications and get useful information from confiscated devices.

So far no public request from the French government to GrapheneOS asking for backdoors, although that would seem logical.

Cue the usual "government snooping around = bad for privacy" comments here, which I usually agree with, only in this case I disagree with the "they'll do that to spy on us, the Great Unwashed", or, as said by GrapheneOS themselves (paraphrasing) "the French government is just another bunch of authoritarian fascists".

Yes, they did use the term "fascist law enforcement". Here. ffs.

Sorry if I'm naive enough to think that the majority of people working for these fascist law enforcement forces are just trying to fight actual baddies (narcos, but also terrorists : we're a bit touchy-feely about those around here).

Some would argue that "if the state/police/whatever did their jobs properly they wouldn't need to crack communication devices, there are other ways". Sorry again, it's 2025, digital comms and encryption are available to everybody with half a brain, are police supposed to work with carrier pigeons and telegraph to do their job ?

This is not Luxembourg or Bhutan, this is a large country with LOTS of issues, so please cut some slack to the people trying to sort out some of the mess. I'd be glad if Big Bad Gov't Snooping could prevent another Nov 13th. I'm well aware of what B. Franklin said of Liberty and Safety, I just think times were simpler then. Tough, but simpler. Nowadays Liberty benefits a lot of actual bad guys, not "rebels" or mere pacific opponents.

Will the police use this to snoop on "political" opponents, Gilets Jaunes and the like ? The naive in me would say that it's not that easy, there are laws, they need authorizations, etc... The not-so-naive doesn't have a clue as how it actually happens. Neither do 99.9% of commentards here.

Don't get me wrong : I understand GrapheneOS' position, it's the terms they use to react that irk me, along with some of the comments down here. I don't live in a fascist state yet and there are Real Baddies out there. Deal with it.

PS about /e/OS and iodéOS someone asked about here. According to GrapheneOS, they "make devices dramatically more vulnerable while misleading users about privacy and security. These fake privacy products serve the interest of authoritarians rather than protecting people". So that's sorted (not saying it's not true, I have no idea).

[doublelayer]

Re: It's complicated...

"Sorry if I'm naive enough to think that the majority of people working for these fascist law enforcement forces are just trying to fight actual baddies (narcos, but also terrorists : we're a bit touchy-feely about those around here)."

That is the frequent counterargument and it's not even wrong; that is what a lot of law enforcement is doing and they're not automatically evil. But that doesn't justify ending privacy, which is what the law calls for. The various laws are written in impossible ways requiring that communications not use anything the police can't get access to whenever they want it. It's also important to consider what the minority of people will do. If I put you in a group that consists of 98% normal civilians who want the best for you and 2% assassins with a bounty on your head, how safe do you feel? A minority willing to abuse power can be bad enough that we restrict the actions of many; it's one of the foundational structures of every legal system.

"Some would argue that "if the state/police/whatever did their jobs properly they wouldn't need to crack communication devices, there are other ways". Sorry again, it's 2025, digital comms and encryption are available to everybody with half a brain, are police supposed to work with carrier pigeons and telegraph to do their job ?"

That analogy is ridiculously bad. Police would use digital communication just like everyone else. Older methods don't come into it. The question is whether, because those are available to criminals, police need new powers they didn't have before. And neither are we saying that police always have another way to get the evidence they could get by cracking encryption. Like many other methods we deny them due to the likelihood of abuse, we prohibit this anyway because of the side-effects. For example, there are sometimes criminals who you know full well are criminals but you don't have the evidence. The criminal knows where you could find some. In a just world, that criminal is not convicted until you find some, and if you never can find the evidence then they go free, and even though you could be more successful and faster by punching the criminal until they confess, we don't let you do it. That's true even though most likely, the majority of people would only do that to people they already knew were criminals and wouldn't take it out on the innocent. We know that a minority would attack the innocent for their own gain because they have every other time it was allowed, so we prohibit it for everybody.

"Will the police use this to snoop on "political" opponents, [...] The not-so-naive doesn't have a clue as how it actually happens. Neither do 99.9% of commentards here."

Count me among the 0.1%, then, because I read about how they have. Usually, they do so by using bad access control, for example when a US police officer wanted to stalk people he knew, he managed it by knowing the password to the camera surveillance system. And yes, like all the other systems, there was a log of that and, in that particular case, resulting consequences. But it's not hard to see how people who use a system all the time in the normal course of their job would learn how it worked in case they wanted to abuse it for their own purposes and because most of them wouldn't be suspected, if you needed someone else's approval, you would likely get it by saying it was related to some other investigation you were working on. But if you don't look at how the many surveillance systems have been abused, then you'll continue not to know how others could be.

[JClouseau]

Re: It's complicated...

Hi, thanks for replying. We obviously won't agree, at least not about everything, but I wanted to address a couple of points you make.

About those "minorities" you mention twice : I understand that the "2% assassins" are the law enforcement (OK, not assassins per se, but the bad guys), who may most likely "attack the innocent for their own gain".

You are talking hypothetically about law enforcement going after the innocent. Yes, it may happen, but in this particular case (the article mentions narcos) nothing is hypothetical : this is about cracking encrypted devices to find and put behind bars actual baddies who do harm people, by selling shit and occasionally killing competitors, witnesses and bystanders.

My personal feeling is that we are right now in a room with 2% assassins indeed, actual assassins, and no, I don't feel safe. I am lucky enough to live in a good and quite neighbourhood, but I can't help reading the news and there is grim stuff happening (in France) almost every day linked to drug trafficking. I don't see as much happening in the UK but I tend to read the Guardian. Can't stand the Telegraph.

Sorry about you knowing things because "you read about them", that's just as believable to me as someone from any State agency writing "relax, we play by the rules all the time". See ? We do have little things in common.

I do hope they don't play by the rules all the time when it comes to baddies. I guess I'm going all "Dirty Harry" as I grow old.

Now back to the object of this article, I checked GrapheneOS on X and they just went nuts about those articles, claiming that the Mighty French State is coming after them to put them in jail because they cooperate with the devil. As some sensible people wrote to them, this is hysterically bad communication.

I've read two articles from Le Parisien, and what the cyberpolice memo says is basically "narcs (and other baddies) are using Pixel phones with GrapheneOS and we are currently unable to extract information from these when seized". Nowhere it says "GrapheneOS are scum and we're going after them".

They (GOS) posted a (illegal ;-) ) link to one of the articles, and the lady (head of a cybercrime division) does say at one point "with this new tool (GOS) there is for some users legitimity in the will to protect communications [...] But that won't prevent us from going after the vendors, should ties with a criminal organization be uncovered, and they don't cooperate with the authorities". Fair enough ?

I can assure you Le Parisien is not a very important national media here (one hint being the title) so no, the "French media" is not after GOS. I get GOS are sensitive about security and State snooping, but some of their posts smell of conspiracy theory.

You seem to trust Law and Civilization, and distrust the authorities. I've almost lost faith in some people's ability to be civilized at all.

I hope we're both wrong. Have a pint for being civilized.

[doublelayer]

Re: It's complicated...

A lot is hypothetical. Whenever law enforcement asks for something, they never do it by saying "we think this will kind of help generally". No, they always mention the most convincing case they want to use it in. And then, they use it in many more cases for the same reason anyone would: they've already incurred the expense so why not, which is totally reasonable for them to think which is why we should not let them think something is acceptable when it's not? There are dangerous people,and law enforcement should be given the resources to track them down, but that doesn't mean anything they ask for is legitimate if the stated target is sufficiently evil. You didn't mention if you're supporting coerced confessions from my last analogy, but if you do, consider something you would find abusive and then ask yourself whether, if some criminal was bad enough, you would abandon that stance. Since they will use any tool for any crime, consider whether you would consider it legitimate if it was used for something minor. If it is not, it's not appropriate for the scary things either and they should use those tools we give them for those as well.

I agree that GrapheneOS tends to go paranoid and hyperbolic, which doesn't work in their favor. In a lot of cases, laws get implemented but not enforced when they would lead to backlash, and I wouldn't be surprised if that's what the French law does as well. However, that's not something anyone can count on or know in advance, and the law as written makes the security that is GrapheneOS's reason to exist illegal. People do abuse these things, and I have no idea why you dismiss the reports of them doing it. The one I linked had a specific perpetrator and victims, a specific system, a specific abuse, and specific legal charges. How are those less believable than a nonspecific denial, and are you really deciding that the law enforcement people who arrested that one were lying about the abuses?

I don't distrust law enforcement specifically. I distrust a subset of everybody. That's why we have restrictions on many people. It's why I can't build nuclear power generation in my house; we think the risk that I don't know what I'm doing is high enough that we restrict where you can do that kind of thing. It is why we have license tests to drive cars instead of assuming that people don't want to die so they'll figure out how to and then choose to drive safely. And it's why we don't let someone do whatever they want just because they got a job at a police department and theoretically have a responsibility to stop people we want stopped. We regulate to prevent abuses, and in my opinion, we should tolerate no abuses; if someone deliberately violated the rules with the extra powers we give those trusted to be part of law enforcement, I'd be happy with some rather serious punishments for them and anyone who helped them do it.

[JClouseau]

Re: It's complicated...

Regarding "coerced confession" : it is quite a stretch to put torture at the same level as spying/snooping. You may laugh at this, but I have nothing to hide (not even dodgy tax returns, honest!) and don't give a fliying duck about the DGSI checking on my emails/SMS/etc... once in a while. I would just be pissed off seeing my precious tax money being wasted.

Note that I'm staying local, because that's what we are talking about. I would definitely give a damn if the GCHQ/NSA/CIA/FSB/etc. did the same. If I'm being spied on I want it to be by MY spooks, born and bred here.

I don't dismiss any report, and see no reason to doubt the example you mention, or others revealed by respectable newspapers. It is not an excuse, but that one (stalking his ex) is quite mundane compared to fighting "hard" criminals. Yes, it could have ended badly, with murder for instance. But it didn't. What matter to me are the consequences, not the means.

What I meant is that 99.9% of people have no idea whatsoever about what the powers-that-be actually do in the cyberspace, other than a couple of scandals from time to time in the papers, or successes.

There are black sheeps, but without further information it becomes a matter of perception : you seem to be focused on how bad for privacy and liberty state surveillance can be to innocent people, while I prefer to see it as a necessary evil to fight people who are actively fucking up society. Am I naive ? Are you paranoid ? Who knows ?

I fully agree with your last paragraph, but I am perhaps a bit more optimistic thinking that in our democracies the black sheeps mentioned earlier often end up being exposed by whistleblowers, journalists, colleagues, etc... We are not living in fascist states (assuming you're not in Russia, or China).

I am actually more wary of some private (and filthy rich) endeavours, especially when combined with dirty politics. Cambridge Analytica anyone ?

[EllaReidh]

Thanks for information!

[EllaReidh]

It’s great to see how secure OS options like GrapheneOS are gaining traction, especially with the added privacy protections they offer. For users looking to ensure reliable connectivity on top of security, investing in a 5G signal booster is a smart move. I recently checked out a solid option on Mobile Signal Boosters, which really improved my signal quality. Definitely worth considering if you want both