Europe gets serious about cutting digital umbilical cord with Uncle Sam's big tech

Europe’s quest for digital sovereignty is hampered by a 90 per cent dependency on US cloud infrastructure, claims Cristina Caffarra, a competition expert and a driving force behind the Eurostack initiative. While Brussels champions policy initiatives and American tech giants market their own ‘sovereign’ solutions, a handful of …

[Nerf Herder]

Shout It From The Rooftops

I'd love to see this article or a re-write (co-written?) with an Australian (where I am) focus published in regular (dare I say mainstream) media. Maybe The Guardian Australia might carry such a re-write in its technology section? I'm pretty sure our policy makers don't read El Reg.

I've been vocal for ages about the perils of the US CLOUD Act and have banged on about digital sovereignty for much longer. From what I've read, the UK is in a similar boat - far too dependent on US cloud infrastructure even for critical policing and security functions.

Sovereign digital infrastructure doesn't have to be the biggest, the best or the fastest; it merely needs to be sufficient for important and/or sensitive national functions.

[Like a badger]

Re: Shout It From The Rooftops

From what I've read, the UK is in a similar boat - far too dependent on US cloud infrastructure even for critical policing and security functions.

It is indeed. However, our government's solution is to double down with even more US cloud and AI services. There is no UK government policy on digital sovereignty, no recognition that all government data put into the cloud is open book to the US and probably other governments. The concept simply isn't understood by either politicians or policy makers.

[werdsmith]

Re: Shout It From The Rooftops

Britain is too small on its own to create an independent hyperscale cloud service. Too small in size, too small in thinking.

[Anonymous Coward]

Re: Shout It From The Rooftops

But if any British PM did suggest creating a sovereign UK cloud infrastructure they would be ridiculed by the commentariat here.

[Anonymous Coward]

Re: Shout It From The Rooftops

You’re right, it would be ridiculed. Not for the intent but the implementation. Squillions of pounds, decades in the making and in the small print it would say “Powered by AWS”.

[Snake]

Re: too small on its own

That sounds rather pessimistic - it's digital. You can build data centers almost anywhere you can find high-voltage AC power and a water supply, it's not magic.

HOWEVER..

your "too small in thinking" comment may very, very sadly have a point. The typical British industry "snatch defeat from the jaws of victory"-mindset meant that Great Britain failed to save its civilian aviation manufacturing, failed to save its auto manufacturing *and* failed to save its fighter jet programme, so bureaucracy failing to save its digital sovereignty might sadly be in the cards as well. Never underestimate the power of bureaucracy to protect its own paycheque by 'allowing' everyone else to fall on their sword for the cause.

[LogicGate]

Re: too small on its own

But you got blue passports and pint marks!

[Adrian The Alchemist]

Re: too small on its own

Actually Data centers cannot just be built "anywhere" report last week said over 7000 of the 8800 global data centers are outside the temperature sweet spot of 19 to 27 degrees Celsius

So suddenly not only are they are consuming a huge amount of power, sucking up water, gently cooking the planet, they are not even in the right places for optimum use.

[David Hicklin]

Re: too small on its own

> global data centers are outside the temperature sweet spot of 19 to 27 degrees Celsius

I can understand the upper temperature as these things generate huge amounts of heat but a lower sweet spot ? I doubt you would need any heaters in these things!

[Manc Dude]

Re: too small on its own

CANADA!

(Or Canadia for the MAGA impaired brains)

[MachDiamond]

Re: too small on its own

"(Or Canadia for the MAGA impaired brains)"

It's "Canukistan" you wanker!

[Mimsey Borogove]

Re: too small on its own

(Or Canadia for the MAGA impaired brains)

I'm not sure many MAGA are smart enough for El Reg.

[Roland6]

Re: too small on its own

>” over 7000 of the 8800 global data centers are outside the temperature sweet spot of 19 to 27 degrees Celsius”

Which suggests you can build datacentres anywhere, just that some locations are more suitable and cost effective…

[Danie]

Re: Shout It From The Rooftops

Yet many other countries may use British clouds instead of US ones, so one needs to think broadly. The US has the benefit right now of hosting many other countries too.

[Chaotic Mike]

Re: Shout It From The Rooftops

Do you *really* think that what has managed to remain one of the world's largest economies couldn't build some data centres, and wire them up? The problem is a lack of ambition, a lack of governance, and the absence of a sense of ownership. I have spent nearly 40 years in the Private Sector exclusively supporting civil servants in the commissioning and operation of reasonably secure services: I'll say it again, we could do it if we wanted do, unfortunately for 'reasons' we seem not to want to.

[Pirate Peter]

Re: Shout It From The Rooftops

the problem is we have no UK companies with sufficient money to build data centres and the government won't pay for infrastructure, they only want the private sector to built it, then lease to them at an extortionate cost

vey short sited and then open to a foriegn company / investor buying it then back to square one of data sovreignty

the only way is for the UK gov to build and run it, but. that will never happen

[mistersaxon]

Re: Shout It From The Rooftops

UK ( or any) government could just make it *illegal* for an extra-judicial entity to acquire a sovereign-owned entity that is supporting critical national infrastructure or GDPR(UK)-scoped data. If a private business chooses to put such data into foreign-owned businesses they should have to declare this and customers should then have a legal right to refuse them permission to do so (requiring them to have a split infrastructure, which is just too bad).

Obviously these days that would earn your premier a public lambasting from the Orange One (or other autocratic leader) and, failing sufficient diplomacy of the "bend over and think of <sovereign ruler>" kind, a threat of trade war, sanctions, or invasion (Venezuela and Greenland may be grappling with this existential threat right now), but certainly the legal framework can be created with little effort.

[Roland6]

Re: Shout It From The Rooftops

>” the government won't pay for infrastructure,”

Institutional Tory mindset…

[Doctor Syntax]

Re: Shout It From The Rooftops

"Britain is too small on its own to create an independent hyperscale cloud service."

That word "hyperscale". What does it mean apart from "big"? Big enough for the likes of AWS, Azure and Google.

The issue here is that AWS, Azure & Google are the problem, not the solution. They're the problem because they're running shared infrastructure that sucks in nationally critical operations and exposes them to a foreign power.

What's needed, be it Britain or EU, is capacity to provide services at a sufficient scale for a given application. We used to do that. Then the snake oil grafters sold the beancounters on the economy of scale at - unspoken - the cost of security. Now security has raised its head again.

That word "hyperscale". It needs to be seen as a warning. That's what it means.

[dicksweetginger]

Re: Shout It From The Rooftops

There is NO issue building a sovereign cloud. There are many many "clouds" in Britain and the EU. Many run on the same software stack.

The base services you want to offer is the same. VMs, kubernetes, containers, functions. That all exist as open source.

Hyperscale basically means many copies around the world, connected to eachother f or replication etc.

Then each provider want to build the good stuff, the stuff that makes them money, and that is not generic things like VMs and functions.

They want to offer the "mercedes" of IT. And things that make you stay, or build you in forever in their stack.

Dont go for it.

Generic takes you a long way.

[Mimsey Borogove]

Re: Shout It From The Rooftops

That word "hyperscale". It needs to be seen as a warning. That's what it means.

The US used to have laws to prevent monopolies, but we've pretty much dispensed with them. Just because we're allowing a few corporations to take over everything, though, doesn't mean the rest of the world should. Our corporations are far too large, and far too nosey, to be allowed to take over other countries. Please do everything you can to sever your systems from ours. You'll be glad you did.

[Roland6]

Re: Shout It From The Rooftops

.“Too small in thinking”

Remember the reason why Thatcher created the Single Market was to give UK industry a larger local (protected) market so that they could scale up to be better positioned to take on the US.

Small thinking resulted in: half-hearted political engagement with the EU and Single Market, buying from the US rather than locally invest (Thatcher herself exhibited this streak by favouring US interests over UK interests - Westland was just one of many to suffer…)

>” Britain is too small on its own to create an independent hyperscale cloud service.”

Does the UK actually need a hyperscale cloud service all to itself?

Due to small thinking, the UK missed the cloud boat, with the government deciding to invest in the US cloud companies, facilitating their development into hyperscalers…

[Darkedge]

Re: Shout It From The Rooftops

why would we ever hide stuff from the US, we've always freely given it to them to screw us over like our advances in Computing, Jet Engines, Supersonic plane research, radar, etc.

UK gov has effectively been in an abusive relationship with the US for years, the Shitgibbon make it worse but never was peachy before.

[Roland6]

Re: Shout It From The Rooftops

>” we've always freely given it to them to screw us over like our advances in Computing, Jet Engines, Supersonic plane research, radar, etc.”

To the extent that”freely” applies to an abusive relationship. Remember the UK had to pay the US for its war effort, so whilst the UK and allies won the war, the UK was practically broke and saddled with a debt to service, the US simply took advantage of the situation…

[Mimsey Borogove]

Re: Shout It From The Rooftops

the US simply took advantage of the situation…

Who, us, take advantage of anyone? Say it ain't so!

[Roland6]

Re: Shout It From The Rooftops

>” the UK is in a similar boat”

I suggest the UK is in a worse state to Oz; remember it was the UK who buddied up with the US to scuttle the Australian-French submarine deal in 2021…

With hindsight, the UK should of partnered with the French…

[MachDiamond]

Re: Shout It From The Rooftops

"From what I've read, the UK is in a similar boat - far too dependent on US cloud infrastructure even for critical policing and security functions."

The governments have to make is easy to bring infrastructure in at all levels down to local facilities and add a tincture of pain to use US infrastructure. If it's permits, applications, planning, inspections and Vogons at every level, it's just faster to push the "easy" button.

Edison Motors has been having a fun (by which I mean not fun) time getting approvals to use a diesel engine already approved for stationary generators approved for a hybrid HGV. In the mean time, 15l engines in trucks hauling logs and working mines are perfectly fine. A 9l engine on a truck that's 30% more efficient has been banned for some time due to technicalities that must have been simple to write into legislation, but incredibly difficult to line-out before the regs come up for revue in another several years.

[graemep]

Re: Shout It From The Rooftops

From what I've read, the UK is in a similar boat - far too dependent on US cloud infrastructure even for critical policing and security functions.

The last time I looked at a map the UK was in Europe and the article is about Europe, right? Not any particular region of Europe that excludes the largest and third largest European countries among others. Oh....

The UK, the EU, and everyone else will be a bit better off with sovereign cloud, BUT end point devices remain almost entirely American controlled which means we are all still dependent on the US. If anything governments are strengthening that grip through things such as pushing the use of apps. Sovereignty is good, but cheap is better.

There is heavy use of American SAAS as well.

There is no plan to encourage the private sector to reduce reliance on American technology so the economic dependence will remain. The US could shut down virtually all cashless payment systems, the NHS, and a lot more if it chose to.

[JimmyPage]

You can't have a sovereign digital cloud

if you are running windows ....

[druck]

Re: You can't have a sovereign digital cloud

Open source is the only viable possibility. Moving to a sovereign cloud based on any sort of proprietary stack has the risk of it being bought up by a US firm, where as an open source solutions can be moved to any of the vast number of European bit barns, which will soon be available at knock down prices once the AI bubble bursts.

[Anonymous Coward]

Re: You can't have a sovereign digital cloud

> vast number of European bit barns

???

[Doctor Syntax]

Re: You can't have a sovereign digital cloud

"an open source solutions can be moved to any of the vast number of European bit barns, which will soon be available at knock down prices once the AI bubble bursts."

If they're optimised for LLM processing they're going to be sub-optimal for real work.

[kmorwath]

Re: You can't have a sovereign digital cloud

Because Linux isn't controlled by US entitiies? US can still cut access to it if it wish.

If you could fork it without issue you'd be able to write your own OS.

Open source is just a way to avoid to pay for software. It's not a way to be independent. If there was an OS, fully developed in EU even if it was commercial and closed source, EU could be independent.

[jayp00001]

Re: You can't have a sovereign digital cloud

You do know that EU data is stored on EU soil from all the major cloud providers (although I agree the cloud act and gdpr are not compatible) if you wanted you could use HYOK and encrypt everything (https://techcommunity.microsoft.com/blog/microsoft-security-blog/azure-information-protection-with-hyok-hold-your-own-key/249920) the unless your own police cave in to the cloud act, no one gets your data.

[herman]

Re: You can't have a sovereign digital cloud

The European Commission runs its own cloudy systems in Belgium and it works very well. I access it from four countries over with no issues and it is all multilingual too.

[shane fitzgerald]

Re: You can't have a sovereign digital cloud

But who seriously runs window. Maybe kids into games but even thats diminishing... sql server still is up there. Besides that why run windows?

[Doctor Syntax]

Re: You can't have a sovereign digital cloud

Who runs Windows? Too many.

[herman]

Re: You can't have a sovereign digital cloud

Windows is a small, niche desktop system. Everything else runs Linux.

[Roland6]

Re: You can't have a sovereign digital cloud

Windows is for end user devices, even Microsoft realised this and used Linux for its cloud…

[dicksweetginger]

Re: You can't have a sovereign digital cloud

Actually it doesn't. The Azure host stack is Windows‑family, not Linux. The underlying platform uses a Windows‑based NT kernel plus the Azure Hypervisor (a highly customized Hyper‑V) as the foundation, rather than a minimal Linux kernel.

Btw the windows kernel and the linux kernel are conceptually similar.

[Pete 2]

To buy is to own

> digital sovereignty

In my mind "sovereignty" can extend right the way down to the consumer level. Where ownership is absolute and cannot be withdrawn by an outside entity either because they consider their terms and conditions to be superior to the rights of consumers. Or worse, by retroactively changing the T's & C's after they have taken your monkey.

There might just be some legitimate restrictions on this. Such as owners modifying their property (e.g. a car) to break local safety laws. But the worst that should result from this would be a legal remedy and a reversion to compliance.

[I am David Jones]

Re: To buy is to own

Take my wife! Take my children! Just please don’t take my monkey!!!

[MachDiamond]

Re: To buy is to own

"Just please don’t take my monkey!!!"

Trunk Monkey®?

[Anonymous Coward]

Lovely

So what happens if/when Nextcloud is gobbled up by an American company?

[Doctor Syntax]

Re: Lovely

There is NextCloud the company but there is also NextCloud the FOSS application which was forked from the earlier OwnCloud. Either can be installed by anyone wishing to run their own service - right down to anyone wishing to run their own server in their own home. Likewise the client S/W can also be installed by anyone who wishes to. Any of those could be forked if that became a necessity.

That's why the one guarantee of digital sovereignty is FOSS. It's not any sort of principled choice - FOSS vs evil corporation. It's a strictly practical choice as, of course, is digital sovereignty.

[O'Reg Inalsin]

Re: Lovely

Of course core that software is a prerequisite, but doesn't "cloud" also include a "working system" that include such things as caching, geographically dispersed backup safety, and minimal down time?

[Doctor Syntax]

Re: Lovely

It requires things such as servers and operational skills. Companies used to provide those for themselves. Even quite small copanies would run a small tower server, sufficient for their needs and were able to engage someone to provide the skills as and when needed. There are also UK and EU businesses which will run NC as a service for those who don't want to run things internally. UK and EU users do not need to go to US companies for those.

[Anonymous Coward]

Re: Lovely

> There is NextCloud the company but there is also NextCloud the FOSS application which was forked from the earlier OwnCloud.

It wasn't "forked" as such. Rather, Karl forked off with the VCs money and set up a company that he controls.

> Either can be installed by anyone

Correct…

> wishing to run their own service

…but good luck trying to run it reliably at scale.

I wonder whether the Austrians are trying to run it themselves or just subcontract to Nextcloud (the company). And if they are trying to run it themselves, on whose hardware.

[squigbobble]

Re: Lovely

This is where outsourcing stabs you in the arse. States that are going all in on sovereignty should be building/having somebody build their own server farms for private cloud hosting.

[Roland6]

Re: Lovely

To some extent it has; its repository is on GitHub…

[m4r35n357]

Thank fuck . . .

for our "special" relationship.

We will be fine.

[anthonyhegedus]

Re: Thank fuck . . .

Probably safer to use a Chinese cloud

[Handy Plough]

Re: Thank fuck . . .

At this stage, it's no different. The Yanks aren't our friends and haven't been for a long time, especially with Trumpism so rife.

[Anonymous Coward]

Re: Thank fuck . . .

> Probably safer to use a Chinese cloud

As a corporation: makes not much difference. Someone else is tapping your secrets.

As an individual, you are indeed safer, assuming you have no inclinations to conspire against China.

[Bebu sa Ware]

Re: Thank fuck . . .

"assuming you have no inclinations to conspire against China."

A pretty good assumption for most of the planet, I would have thought — even if only out of apathy.

If I were the leadership of the PRC and had a clear idea of the challenges the nation will face in the next four decades, I might welcome effective conspiracies.

[Anonymous Coward]

Re: Thank fuck . . .

> If I were the leadership of the PRC and had a clear idea of the challenges the nation will face in the next four decades

They do. Try this exercise: access your favourite newspaper archive and read about what China was up to in the late 1970s. You will find they had just chartered a course, which then they followed throughout the 80s, 90s, and 00s.

Meanwhile, the West was busy changing course every four years (before it seemingly started to drift).

[Roland6]

Re: Thank fuck . . .

We will be fined…

Assumed AI autocorrected your comment.

[Doctor Syntax]

The basic situation has been festering since the EU (including the UK at the time) started weakening GDPR with various privacy fig-leaves.

It's taken Trump 2.0 to concentrate minds on the dangers. It was OK with TPTB when it was seen as just little people's personal data. It took Trump to make companies and governments to realise that they were also at risk.

[Steve Davies 3]

re: It took Trump...

I call that the TRUMP DIVIDEND.

[DoctorNine]

Well said. It's analogous to your typical 'reductio ad absurdum' rhetorical argument, but where some poor zealot has gone out and actually done the stupid thing in real life.

[kmorwath]

There still pushes to weaken GDPR because of AI....

[Andy 73]

The UK is in the dark.

We struggle to build large scale IT infrastructure projects even when the American hyperscaler 'experts' are deeply involved, so the idea of building a coherent national IT policy is beyond impossible.

Both political parties and civil service understand only procurement - where do we spend the least money - not consequence. And ironically the definition of 'least money' is only in the context of the prices offered by a handful of suppliers who would never knowingly undercharge.These are the problems of an old-school Oxbridge humanities education dominating a political class that suffers no reputational damage from committing to gilded slop.

[dmesg]

Re: The UK is in the dark.

Yes, Minister!

[Anonymous Coward]

Re: The UK is in the dark.

The problem in the UK (and maybe other countries too, so it's not unique) is that any technical resource, such as a sovereign digital cloud-type service is going to be controlled through the planning and commissioning process by numpties, voted into office based on their ability to coax their local electorate to vote for them to fix the pot holes, or to stop migrants crossing the Channel.

And this is borne out by the over-spending on matters such as the Covid pandemic, where the government of the time had no idea of what to do, and they spent and wasted countless billions on some of their cronies who set up brand new companies so they could wangle their way into being given massive contracts for products they knew nothing about.

And even in the private sector, the entire saga of Fujitsu providing the Horizon software to the UK Post Office and which was found to contain bugs in the coding that lead to over 900 (now mostly overturned) convictions, numerous bankruptcies and suicides of Postmasters who were lied to by "brown tongue" merchants who probably didn't know what they were doing (or if they did, they were allegedly just following orders from higher-ups). (And it now turns out that Fujitsu had a contract to fix and edit transactional records (aka bugs) or pay a £150 fine per instance, which the leaders of the Post Office said in court was NOT possible).

So, as much as operating a sovereign server warehouse would be a perfectly good idea, it's implementation and oversight by politicians who know bu55er all about IT, would make it yet another white elephant - and there are many other examples of IT in the UK that fails - the long awaited Emergency Services replacement communications platform is way behind schedule, as is the supposed upgrade of NHS systems, and don't even get me started on the Make Tax Digital "service" !

[Andy 73]

Re: The UK is in the dark.

Something to note: operating a sovereign server warehouse need not be a government job, so much as encouraged by taxation, procurement rules and all the other levers available to government - just as Europe is proposing.

We could in fact go further and make commitments in government to local suppliers, with some protection against foreign ownership. Knowing that there is a market of over three hundred local authorities all looking for similar infrastructure would be quite encouraging for suppliers if it weren't for the fact that they currently know that the usual global suppliers who heavily lobby our government will be given the red carpet treatment.

[TheIgnorantOne]

Real world implications

Are there any examples of how a CLOUD Act Warrant plays out in real-world scenarios?

In 2019 the European Data Protection Board stated "We are of the view that currently, unless a

US CLOUD Act warrant is recognised or made enforceable on the basis of an international agreement,

the lawfulness of such transfers of personal data cannot be ascertained, without prejudice to

exceptional circumstances where processing is necessary in order to protect the vital interests of the

data subject"

I'd seem to think that if a US based company is getting slapped with a warrant they're going to abide with that over what some EU body says. No doubt I am trivialising this and if I had accountability for EU data, I'd be ensuring stringent data encryption and seriously considering moving away from US companies but that only works to an extent. Nonetheless, I'm curious how this would practically play out.

[Joe W]

Re: Real world implications

1. They come with a gagging order (and that's not an innuendo)

2. Microsoft clearly stated they do not guarantee protection against CLOUD Act even if data is hosted on European infrastructure.

This should be clear enough that hosting data on infrastructure owned by companies with US patent companies does not fulfil the legal requirements of the GDPR.

(But I agree, that's how they framed it then...)

[cd]

Why a hyperscale cloud at all? Sales words...

[steviesteveo]

There are opportunities for large UK institutions to pool resources and go it collectively- if the civil service and the NHS collectively agreed to go to a government cloud service you'd have a huge domestic operation

The basic idea of not having each individual council managing their own kit three floors below the council chamber is sound but no one says we need to pay the US for it

[Anonymous Coward]

Back when such matters were being discussed. HMRC had the scale, need and spare datacentre capacity to have started the move to a sovereign in-house UK government cloud. However, vested interests with hooks into both HMRC and the Cabinet Office used their influence to ensure this didn’t happen and that the work should go out to tender justified by the mantra - don’t build when you can buy…

[v13]

> The issue, she argues, is not that Europe needs to eliminate American providers entirely, but that it has allowed its own market share to collapse to dangerous levels.

Yeah, right. The problem is that Europe will strongly favour legislation over innovation. We're reaching a point where even some opensource software may be illegal in Europe or put authors in risk of being sued if someone uses their software wrongly. European startups need to pay more money on lawyers than in engineering. Not because they're evil but because they need to write a 50-page privacy policy in every European language, following the individual rules of every European country, that nobody will ever read because of how big it is. Only companies with big pockets can do that, and Europe doesn't have these.

Europe needs to start thinking how it can help its companies instead of how to restrict them. And maybe, why not, just throw some money on opensource software like KDE, to have alternative opensource options. Otherwise its just talk.

[abend0c4]

You do realise, in the absence of EU legislation that harmonises the basic data protection principles, you'd still have to do those things if you were trading across the EU because complying with the individual laws of the countries in which you operate and communicating with your customers in their own language are not optional for any business that aspires to continued existence?

The only real innovation that's relevant to this particular issue is scale - the kind of scale that leads to hegemony. While part of that is clearly technical innovation, the principle driver is a monopolistic intention. When that leads to a lack of real competition and choice and has wider economic impacts - such as rapidly inflating the cost of electricity - then we absolutely need legislation to rein in that kind of destructive innovation for the few.

By all means chuck some money at open source software (if you can find enough developers to spend it), but we're not at the mercy of innovation, it's supposed to be our servant. If it isn't we need to innovate in different ways and if that means the oligarchs have a hissy fit, so be it.

[Doctor Syntax]

"Not because they're evil but because they need to write a 50-page privacy policy in every European language, following the individual rules of every European country, that nobody will ever read because of how big it is."

The advantage of EU setting rules is that you don't have rules for every EU country, you have one set. Of course it complicates things a bit if you have to consider countries outside the EU but even there it helps if the country decides to adopt the EU's rules, foregoing the right to participate in the rule making process because somehow doing that erodes sovereignty.

[Anonymous Coward]

"The advantage of EU setting rules is that you don't have rules for every EU country, you have one set."

Not necessarily - the EU can issue Directives or Regulations. A Directive is then implemented by each member country via their own laws, whereas a Regulation is EU-wide.

As an example, the GDPR is a Regulation (the "R" in GDPR) and so it is EU-wide, whereas the law it replaced (Directive 95/46/EC of 1995) was a EU Directive for which each member country had to implement via their own law - in the case of the UK that was via the UK DPA 1998. Don't get confused by the UK DPA 2018, that was an *additional* UK law that sat alongside the GDPR to expand upon it and to also add some other stuff.

[FifeM]

It used to be part of my job to guide a medical device manufacturer through international standards. One set of EU standards and one set of test results allowed us to sell in every EU country and beyond (Switzerland and Russia, for example). Of course customers expect information in a language they understand, but that's true of any product in any country.

EU standards had a worldwide recognition. Getting Canadian approval was a matter of showing that we had EU approval, plus a small extra test to meet Canadian power supply rules. Even China accepted that an EU pass went a long way towards meeting their own requirements. We were a British company, inspected by a German standards compliance tester, who were themselves checked by the Swiss government.

It was only the USA which wasn't worth the trouble. Their rules were deliberately designed to exclude foreign businesses. Just about every document had to be rewritten in a format incompatible with the rest of the world and every test had to be rerun in a marginally different way. It simply wasn't cost effective when the rest of the world was open to us.

[ted ted]

obviously an exceptional case then, becuase the US/EU balance of trade is/was massively in favour of the EU, i.e. the EU found it easier to sell goods intot he US than vice versa, and any third world country will tell you the EU uses regulatory requirements to discourage imports, while demanding their markets are open

[el Duderado]

"It was only the USA which wasn't worth the trouble. Their rules were deliberately designed to exclude foreign businesses. Just about every document had to be rewritten in a format incompatible with the rest of the world and every test had to be rerun in a marginally different way. It simply wasn't cost effective when the rest of the world was open to us."

A simple and effective implementation of basic nudge theory.

[Anonymous Coward]

> they need to write a 50-page privacy policy in every European language,

Only if they're trying to sell or otherwise abuse your data.

Otherwise, two or three short paragraphs, where the first one states: "We do not sell your data, period"¹ suffice.

¹ This is an actual quote from my car's privacy policy, btw

[Doctor Syntax]

"Europe will strongly favour legislation over innovation"

Useful innovation meets requirements. Legislation sets the requirements. They're complementary.

[Anonymous Coward]

> Useful innovation meets requirements. Legislation sets the requirements.

You've described how it should work (and does, to some extent, in China).

In Europe, and the West at large, where there isn't a functional political class, legislation and policy is largely dictated by various lobbies.

Forgive the simplification but grosso modo that's how it works.

[el Duderado]

"We're reaching a point where even some opensource software may be illegal in Europe or put authors in risk of being sued if someone uses their software wrongly"

Am curious - how does that work?

[kmorwath]

"favour legislation over innovation"

Define "innovation".

EU puts citizens' rights over business profits. I've seen very little innovation from US in the past twenty years. Some improvements, yes, but real "innovation", no. I've seen mostly squeezing people to extract more profits. Doctorow spoke about "enshittification" for some reasons...

And still many ideas came from Europeans - probably because they are freerer to think besides pure profits.

A car with no brakes is just dangerous, and mounting them after a crash is useless.

[Anonymous Coward]

Re: "favour legislation over innovation"

> EU puts citizens' rights over business profits

I cannot tell if you're joking, are the most credulous person this side of Pluto, or come from some parallel universe.

> And still many ideas came from Europeans

Oh, some ideas come from Europeans alright, who go to the States so they can actually have a shot at executing them.

If you're in the tech scene, with some regularity you come across talks along the lines of "why I fucked off to the US with my startup"

[Danie]

Many have been highlighting those issues about the US CLOUD Act since it came out, yet politicians were just not listening. And we also need to realise that probably 100% of mainstream social media will be controlled by the US as well after Jan 2026....

[Tron]

Europe is not a sovereign state.

Neither is the EU.

Plus, moving your cloud storage and using Windows/Mac and US AI/SaaS is hardly cutting the cord.

SaaS, AI and the cloud are security weaknesses. Ban all of them. Use Linux, open source or locally-produced applications and your own local storage. Then keep your intranet/data store permanently disconnected from the public internet. Then you have an acceptable degree of security. Anything less and it is a matter of time before something screws you over, so an insurer should not offer you a policy.

[dicksweetginger]

Re: Europe is not a sovereign state.

You said : Then keep your intranet/data store permanently disconnected from the public internet.

And the social worker - handling a request from someone, should that person have 2 computers then?

And write into the other computer connected to that intranet/datastore that is not connected to the internet by copying what was requested from the internet computer?

...

[Anonymous Coward]

Subeditor: don't lie

> Europe gets serious about cutting digital umbilical cord with Uncle Sam's big tech

That headline is a complete lie.

> a handful of public authorities in Austria, Germany, and France, alongside the International Criminal Court in The Hague, are taking concrete steps to regain control over their IT.

That is hardly "Europe". And meanwhile, the EC do their damnedest to make sure data keeps following (in one direction only) never mind Schrems I and Ii

[Doctor Syntax]

Re: Subeditor: don't lie

We've already had articles about others. Others including Denmark and if Denmark has had any inclination to slack off a bit (not suggesting they had) they've just had a further nudge and no doubt other countries will have taken note of that.

The nay-sayer A/Cs (how many are there in reality?) get so tiring.

[Anonymous Coward]

Re: Subeditor: don't lie

What percentage of Europe's public and private data are:

a) stored in autochthonous systems (not just some Amazon data centre in Frankfurt or whatever) and

b) Not reliant on a supplier vulnerable to US cloud act?

[Anonymous Coward]

Re: Subeditor: don't lie

s/supplier/supply chain/

[Anonymous Coward]

> The conflict between the CLOUD Act and European data protection law becomes a practical barrier through Article 35 of the GDPR, which mandates a Data Protection Impact Assessment (DPIA) before deploying any new technology that is "likely to result in a high risk to the rights and freedoms of natural persons."

Which is why the Commission are not sitting idle.

They are trying to water down the GDPR.

[Doctor Syntax]

The game has changed.* Now it's not just little people's data any more. It's governmental an supra-governmental systems at risk. It's economically critical local businesses at risk. It's infrastructure that's at risk.

* Not really, it's just that governments are finally realising what it always was.

[Anonymous Coward]

Nextcloud??

> The ministry recently completed a migration of 1,200 employees to the European open-source collaboration platform Nextcloud

That is going to end in tears.

There is a provider (I cannot remember which though) that forked Nextcloud years ago and provide a solution that, mostly, works. But Nextcloud, I'm sorry to say, is amateur level software with crap security and worse scalability. I'm no fan (and no user) of GAFAM, but the Austrians will come to regret that decision.

[Doctor Syntax]

Re: Nextcloud??

Citation needed but unfortunately A/C can't remember. How convincing.

[Anonymous Coward]

Re: Nextcloud??

AC recalls using a client's cloud that was solid and performant and recalls the client's employee mentioning that it was originally based on Nextcloud but heavily rewritten by their provider. And no, I do not recall the name of the provider, but shouldn't be too terribly hard to find if anyone is really interested.

[Anonymous Coward]

Finally

As an American who has traveled to several SE Asian countries, it's good to see Europe catching up to what is already happening in Asia.

[Anonymous Coward]

Re: Finally

> As an American who has traveled to several SE Asian countries, it's good to see Europe catching up to what is already happening in Asia.

You are perceptive. And yes, completely different ballgame in SE Asia, which does not operate as, fundamentally, a US colony like Europe does (this is merely a descriptive statement, btw; does not imply animosity towards anyone).

We are not catching up, and never will until the loss of US hegemony is complete (anywhere from 2030 to 2060 depending on the source, including US DoD, by the way),.

[david 12]

Feel-good bull-sh

The European Privacy legislation provides exactly the same carve outs for governments, and the European governments assert exactly the same carve outs. We've already seen this in international criminal investigations: the government of France can ask French companies, or ask the Government of Germany etc, for important "security" information, and it overrides the "protections" of the European Privacy legislation,

[Anonymous Coward]

Re: Feel-good bull-sh

I'm not sure we have anything equivalent to US Cloud but you do make a good point.

[Doctor Syntax]

Re: Feel-good bull-sh

AFAICS what prompted the CLOUD Act was various US law enforcement net using the existing legal routes because their fishing expeditions couldn't meet* the standards needed for a warrant in Europe. Those scare quotes protections are real enough if law enforcement don't have a good enough case.

* For whatever reason not enough evidence for a warrant, not prepared to disclose the evidence they had or just plain couldn't be arsed.

[T. F. M. Reader]

Requirements?

A Facebook needs "hyperscale" to handle asynchronous text/image/sound/video updates from billions of users, storing the updates, disseminating them, and crucially analyzing them to sell ad spots to customers. The big advantage of "cloud" (in general, without "hyperscale") is dynamic scaling allowing Amazons of the world to handle seasonal activity surges and the like without major contortions. And these things are known to be expensive, so if you need them prepare to pay through the nose.

For an Austrian government ministry that needs to handle 1200 of its own employees and, say, rarely updated information on 9M Austrians that does not need to be disseminated on a vast scale of analyzed in real time with sub-second latency to run advert placement auctions or anything of the kind (batch or periodic analysis is not similar), and with no foreseen surges of activity, why would US-owned hyperscale cloud providers even be in the running, even without sovereignty considerations? I don't see how their real UVPs would be relevant, the needed services (redundancy, backups, DR in general, moderate scaling facilitated by VMs+containers, technical services personnel etc.) can be provided by local hosters. It is not at all clear that hyperscalers have noticeable advantages in reliability, either (ahem, AWS).

Which parts of Europe's digital infrastructure actually require hyperscale clouds? Serious question. I am not saying they are never needed, just that the requirement does not look universal or even common.

[StewartWhite]

Re: Requirements?

"Which parts of Europe's digital infrastructure actually require hyperscale clouds?"

You can't say that!!! You have to remember that every organisation needs to wave its metaphorical phallic appendage to the maximum to pretend that it's important.

If organisations actually concentrated on what was really important to their customers/users and stopped messing about (hat doffed to Kenneth Williams) with pointless activities (currently "AI" aka LLMs, was Blockchain) then maybe the world would be a better place.

[Anonymous Coward]

Re: Requirements?

> 1200 of its own employees and, say, rarely updated information on 9M Austrians that does not need to be disseminated on a vast scale of analyzed in real time with sub-second latency to run advert placement auctions

I think you might have found the answer to Austria's receding economy and budget woes. >:)

[Anonymous Coward]

a dog is for life

Britain will create an independent hyperscale cloud service and a few years later outsource it to some USA supplier who will send all your data to India to be stored on some unecrypted server.

UK,eager to not get left at the side of the road.

[Meeker Morgan]

American not in the cloud "industry" here ...

... and not a fan of the federal legislation in question.

For once "Europe" (the globalist ruling class) is doing something good for the American people.

If they need to spin it as one in the eye for the Yanks, I'm still OK with it.

[Pete Sdev]

Long overdue

Long before the current orange inhabitant of the WH, or the US Cloud act, the USA has amongst other acts spied on French firms to give US firms a commercial advantage, and bugged the phones of European leaders. They're not to be trusted further than you could throw them.

Slightly missing from the article is that while software such as NextCloud may be part of the solution, it's obviously useless if it's running on US-owned infrastructure - was the NextCloud instance run in house or in an European owned data center?

There needs to be a rapid increase in European data centre capacity.

[Anonymous Coward]

Re: Long overdue

> the USA has amongst other acts spied on French firms to give US firms a commercial advantage

Yes, in terms of resource allocation, the vast majority of spying is industrial, though they still call it "national security", perhaps in the sense of securing resources, skills, and technology, or denying them to the adversary.

Interestingly, it's not just states that do that. Even subnational entities (province, districts) engage in it, both within and outwith their host nations.

[Dave 15]

Move away from toxic USA

The USA has shown itself without any doubt at all to be an unreliable and aggressive pile of arseholes. Buying their software, their computers, their cloud and their weapons is clearly a total and utter mistake. FFKS north Korea at least shows consistency. Resserect Symbian, it's not hard to do, get arm back I to European ownership, build factories and steel mills etc and to hell with the global climate change warming disaster myth and let's protect ourselves against the triple threat, china, Russia and the USA, all 3 should be considered real enemies.

[Zoffster1]

So the USA is doing exactly what it's complaining that China might do? Why does the rest of the world tolerate these hypocrites?

[ted ted]

get serious, the EU is powerless to oppose trumps will if trade is involved, they'll just 'hat their pant's and carry on

[kmorwath]

The fact that NextCloud is a German company greatly helped Austria...

.... if it were a French, Italian or Spanish company they wouldn't have adopted it so quickly. Probably they would like Hezner too, far less OVH or Aruba (the Italian cloud provider, not HP line).

That's one of the problem of EU - despite years of "integration" - most still think "nationally" - and also makes harder to deliver solutions.

Look at many German sites - most of them will show you in German even if they have translated versions and your browser advertise you'd like a different language they have.

And unluckily the lingua franca across Europe is still English - which now is barely the language spoken in Eire - when they don't speak Irish - and not everybody in EU is fluent in English, proper localization costs too... and anyway it's not the only issue. Buying "abroad", even if in the EU, may be frowned upon....

[dicksweetginger]

This was a GREAT article! thumbs up

[MarkTheMorose]

Lightening the mood

All your data are belong US. (Chortle!)

[Wu Ming]

Seven years late

To me it only means European legislators and corporations were happy to comply with the american federation laws. Then the public image of it became more tinted and they had to take baby steps in the right direction.