EU's digital sovereignty boo-boo may be the best thing to ever happen to the project OPINION There's a spy in the court of Europe's digital sovereignty. Actually there are two, the half-siblings Intel and AMD, whose chips power the Old World bit barns on which the sovereign cloud is based. Both companies' chips have so-called Ring -3 management subsystems, complete computers with deep access to the host system, …
Whereas the article by Kim Loohuis that you quoted is brilliant (thorough, well researched, well written, and informative), your "opinion" piece is, quite frankly, insufferably pedestrian.
The only bit where, I suspect by coincidence, your article approaches reality is this:
> Sovereignty can never be guaranteed, only risk-managed.
And it seems clear that you do not understand, or have not considered, the difference between sovereignty and autarchy.
Quotable quote: "...Sovereignty can never be guaranteed, only risk-managed...."
Just me.....but my PERSONAL sovereignty works like this:
(1) One server in a cupboard at home (owned by me)
(2) One firewall (with rules set my me)
(3) One network connection to the outside world
It's not clear to me that this recipe would not also work for your average data centre.
Oh wait.....data centre items (1) and (2) are owned by...Google, Microsoft, Amazon, Meta.......
.....and then there's the problem of my copyright content which I choose to send beyond the firewall.....
OK.....I give up.....probably privacy, security, sovereignty......all impossible!
Quote (Scott McNeally, 1999): "“You have zero privacy… get over it.”
” One network connection to the outside world”
Forgot that, If you work with important things, your fiber will be cut in the middle of the day, and after repair, you will see replay packets in your VPN. Been there, seen that. I know even the agencies doing it.
"(2) One firewall (with rules set my me)"
OK, but...
1. If you want to be *confident* of your internet security, one solitary firewall is never enough, because if it's porous, you'll never know. So from an architecture perspective, a "minimum viable product" is: two different hardware manufacturers and 2 different software stacks. Configure one as your externally-facing firewall, connected to your router/fibre modem... and configure the second as your inner perimeter. If you have *anything* hosted "between" them, then obviously you have only deployed a stripped-down instance of say nGinx, running in reverse-proxy mode? Right?
2. Whose hardware are you using to host your firewall? CWWK? Or one of their derivative / badged clones? If so... are you 100% confident that your Chinese-made appliance is fully secure? If there were an unauthorized access granted via your internet-facing device, how confident are you that you would detect it? Obviously you're not using anything that's US-made, right?
3. How confident are you that you know who made the NIC or NICs [if it's a multi-port card] you are using for your external connection? How confident are you that the NIC *really is* from the manufacturer you see stamped on the physical socket on the back of your machine... as opposed to a functional clone with the brand name put there as misdirection?
4. Whose software are you using to run on your firewall? pfSense? opnSense? ipFire? Something else? Did you compile from source? How confident are you that the code contains no errors... Linking back to my first point... if you want to be *confident* of your firewall setup, you would have 2 different hardware manufacturers and 2 different software products running your firewalls. And when I say, "2 different software products", I don't mean e.g. pfSense and OPNsense, given that OPNsense is a fork of pfSense - which means that if pfSense contains a vulnerability, there is a serious, non-zero chance it also exists in OPNsense...
5. How do you route and trigger your network alerting? You don't mention a honeypot, so it's possible that you're not hosting publicly-facing content, but what about all the other network activity? Do you route all your logs to a central host using e.g. rsyslog? Have something actually monitoring the logs for anonymous events? Sending out alerts to your mobile?
OK... the chances are that you don't have all the above, perhaps because you don't need it. But if your answer is that the "firewall" you have is a packet filter built in to your home router, then, very respectfully, you have the illusion of security and nothing more...
(3) One network connection to the outside world
1. A single network connection is absolutely fine as long as you don't have anything with reliance on a working connection. If the most critical thing about your connection is that your family will kick off if NetFlix is lost, then a single network connection is probably OK. But if you're trying to do anything serious and you don't have any form of backup?
2. You mention the "outside world" like it's everything on the other side of your firewall. Which might be fine. But... do you have any wireless networking? Bluetooth? Do you have devices that have wide area network connections over say 5G and are also configured to your wireless network? Say the sort of smartphone that can be compromised with a single SMS message?
3. If you do run an internal-only wireless network, have you activated MAC Address filtering on it, and configured your mobile devices to use static MAC addresses on that "known, trusted" network?
4. Do you monitor your outbound network traffic for any evidence of compromised hosts?
5. What's your resiliency if your single firewall develops a fault?
It may well be that few [if any] of the questions I ask here are applicable to your network environment - in which case, good for you.
I ask them not to suggest that you have or are doing anything that may be insecure, but to point out that you can only decide "how much security is 'just enough' " when you have a clear picture in your mind of the assets you are protecting - along with their value ... and the threats you want to mitigate - along with their probability and impact.
I am always ready [and would in fact be *delighted*] to come across someone who has a security setup commensurate with their asset values, threat profile and risk appetite... but after many years of professional experience, I have yet to see that setup.
And I'm not talking about "Fort Knox" levels of security, I'm talking about someone who has done a thorough threat analysis, designed and implemented commensurate controls, then actively monitors their control performance and environment to ensure that they are not vulnerable to drift. I'm talking about someone who knows what their risk appetite is, knows how much risk they are taking - and can demonstrate that the former exceeds the latter ... or that they are actively correcting the imbalance.
I make these points only because in my experience having the illusion of security is worse than having no security. At least if you have "no security" you should be aware of the fact. If all you have is an illusion, you're just asking for trouble.
> AC doesn't bother offering up their own informed and considered analysis and solution/s.
AC is under no obligation to so do. Nevertheless, AC has, very kindly, offered feedback to the author and the editor, which is usually welcome. AC offers both praise and criticism in matters within AC's grasp.
Finally, AC has highlighted a different article by a different author in this very same website, which offers a well researched factual perspective on the subject matter, something which, regretfully, seems to have gone over the head of the author of this article.
Quote: ".... open source firmware...."
The firmware does not matter at all!
The manufacturer of the server hardware does not matter at all!!
The manufacturer of the application software does not matter at all!!
It's the firewall software and the firewall rules which make a difference:
(1) Who wrote the firewall software?
(2) Who wrote the firewall rules?
(3) If unknown inbound or outbound IP addresses are used.....just stop the traffic!
I'd hope that any regular Reg reader would see the regular articles countering this view.
The destination IP address can be Cloudflare Pingora cache, or Google's global cache, maybe with a specific user agent trigger to minimise drive-by detection.
Traffic type https or udp / QUIC / instructions by DNS record client-responses.
Using the same source network port as the rest of the PC/Laptop/Wifi router/Printer/Laptop Dock /"insert your own device expected to use internet" etc.
Boy have you missed the point.
What hardware is this perfect firewall of yours running on? Is it one that has an OOB management chip hiding inside it, secretly inspecting network packages as they pass through? It is? How do you know that the firewall didn't quietly pass anything directed to a list of TLA owned IP addresses straight out to the internet before passing it to the firewall software who's rules promptly dropped it?
can lead to so many profitable discussions.
Also, the reasons for wanting sovereignty can change the definition. Are you cost cutting ? Are you trying to ensure resilience ? Are you wanting to control expenditure (not the same as cost cutting) or are you trying to eliminate any possible insecurities ?
I'd wager that well over 80% of businesses interest in sovereignty is to avoid subscription price gouging and to retain the ability to put their data where they want, when they want with not extra costs.
Which means this article is really aimed at (checks notes) less than 20% of companies
The deal was that the US would be part of military operations (NATO*) and by merely being an ally it would persuade non-allied countries that it's not worth their while mounting an attack. The deal was also that western countries buy from the US and the US would sell a lot of overpriced military equipment and receive a lot of money for doing so. Everyone got something from that.
Now Europe and the Gulf states (and probably Japan and Taiwan) have worked out that the only country the US is willing to back up is Israel and the US can't actually deliver orders so they have to be self reliant in terms of military hardware and in terms of everything else sourced from the US because it is not a reliable ally.
* A defensive agreement between participating countries, not an agreement which binds allies to participate in launching attacks.
> The deal was
The deal was nothing like what you describe. In fact, it was hardly a "deal" at all. You may want to take a look at a status of forces agreement covering US forces in the European country of your choice.
The US is not, and post WWII has never been, an ally. The US has to be viewed through the lens of an occupying force protecting its own interests.
One can and should respect the US, if nothing else because, like any other place, it is somebody's country after all, but the US is nobody's ally, not even itself's.
There are documented cases of the US spying on European entities, for commercial as well as political reasons.
There's no reason for Europeans to trust US designed chips anymore than those from China.
Also, some of us aren't relying on the US for national defence, as we know that if we were in trouble, you'd probably turn up 3 years late (again).
The US *was* an ally; it was never a friend.
We're only allied with the USA until it doesn't suit their needs.
If, for example, the UK managed to return a Marxist government to power despite the $millions pouring into America's preferred Nazi party, then the gunboat politics of the middle east will be played out at Dover, until America's distastefully bitter flavour of democracy is restored to our pleasant lands.
So no, we don't rely on the USA for 99.9% of our military - we do however, suck up 99.9% of their bullshit to avoid their military "protection"
No, they did not. They started years before, arguably back in 2010 when they began designing their first custom ARM core, the A6. They began putting their tablet chips into Macs for testing with A9X in 2015.
It would not be a quick road for the EU to develop their own CPU, unless they acquired a company already doing high end ARM or RISC-V custom designs.
Not only Apple, but also Nvidia, Google, and Amazon (all of which are based on Arm with varying amounts of customization) have their own in house chips now.
What is a quick road? The time is less important than actually arriving at a goal.
That depends what your goal is, how much you need it and for what, and whether you can keep it going for the time necessary. For example, if your goal is having all sensitive workloads (for some definition) running on your own hardware by next year, then a company that shows promise and will probably deliver chips with sufficient performance and efficiency in 2034 won't be good enough. There are many proposals describing why something termed sovereignty is necessary, many of which involve theories that some country, US/China usually, is going to use chips they sold to take over the computers that contain them. If you actually fear that, you don't want to take your time replacing them. Others are less fantastical, for example fearing that those countries will seek to hamper progress by refusing to sell their chips anymore the way that the US banned Nvidia from selling their chips directly to China, requiring them to sell to someone else who then gets it to China, in which case you can allow more time because your existing equipment won't break, but you still can't wait forever. Others are seeking long-term European economic competitiveness, and in that case, taking your time to build something excellent is more likely to be useful.
That is assuming that the people making decisions and funding this plan agree on what the goal is and can stick with it. Let's take that example where the goal is to have an EU consortium (private or government-owned) a la Airbus that produces CPUs. Does everyone know that? Is it possible that one country intended this to run government workloads and will withdraw their funding to spend it on something that can do that now? Even if everyone agrees this is worthwhile, will some country decide in 2028 that they don't really see the point anymore and can think of a better use for those funds? Is the UK a trusted country or not, and does this change if they have a new government who might be more or less likely to support the US? So far, there isn't even a stated goal, so it is impossible for people to agree on it. There isn't even consensus about whether chips are important or if the software stack is all that matters, and there's no agreement over on the software side of the argument about whether you need every line written by an EU citizen, projects maintained by an EU organization, something that's open enough that they can be maintained by EU devs, or just something that can be operated by EU admins, or for that matter to which types of software and for which users that decision applies.
> for the EU to develop their own CPU
One thing to ponder: if the EU had the capacity to develope, produce, and deploy its own CPUs, would that power be used for good? Or would it be an enabler of totalitarianism?
In other words: how much do we trust our own societies?
The whole F-35 program is another example of this type of issue. That is a closed source program, with a huge backlog of maintenance and update requests, so unless you're spending hundreds of billions, you've got years to wait for any tweaks or tuning to your needs. And there is always the fact that Trump let the cat out of the bag about kill switches and crippling capabilities built into the aircraft in case you ever are in battle with American forces (which seems increasingly likely to be in the world's future unless something is done about Der Pumpkin Fuhrer and his incestuous billionaire's club of fascists.)
It’s ironic that the E.U. treats open source as a pillar of digital sovereignty, even though open source is created by a global patchwork of mostly unpaid developers. Some from Russia, China, and other not‑so‑open regimes. Sovereignty built on code written by people you can’t regulate is… an interesting strategy.
You don't have to own the supply chain to guarantee sovereignty. You just have to keep your data encrypted and keep backups while maintaining hybrid-multi-cloud multi-jurisdiction redundancy. It's pretty common these days for large enterprises to follow this pattern, and so they become 'sovereign'
