It is no longer safe to move our governments and societies to US clouds
847 comments
·February 23, 2025skrebbel
fasbiner
I certainly don't blame the activists for governments refusing to listen, but this threat was clear at least 15 years ago and I would expect someone as knowledgeable as Bert Hubert to have perceived it at the time.
Is the idea that they're more ready to listen and take action because of recent executive changes in the US, even though the cost of doing so has gone up by 100-1000x and the possibility of a joint retaliation from US tech giants and the government working in concert is now much higher?
I hope you're right, but one of the rough dislocations of the present moment is the disconnect between how europeans conceive of their sovereignty and the reality of their economic, military, and cultural fragility in their relationship with the US and US companies.
No amount of grandstanding rhetoric and appeals to "courage" changes that if there are any serious economic consequences (caused by US/corporate coercion or otherwise), the government would likely fall and be replaced by someone more amenable to the status quo. What feels like a small price to pay for someone focused on security long-term may be an unacceptable price for someone focused on short-term outcomes in their political fortunes.
skrebbel
> Is the idea that they're more ready to listen and take action because of recent executive changes in the US, even though the cost of doing so has gone up by 100-1000x and the possibility of a joint retaliation from US tech giants and the government working in concert is now much higher?
I believe so, yes. I don't think Americans realize how profoundly the last few weeks have affected European political thought. It'll take a while before you see concrete changes. Europe is like a mammoth tanker, slow to change direction, but practically unstoppable. I believe that it's more likely now than ever before for European governments and businesses to sever their dependency on American technology. Lots of comments in this thread explain how hard this is, how big the feature gap between, say, AWS and OVH is, but as a European entrepreneur I gotta say, this looks a lot more like an opportunity than a problem to me.
jerjerjer
Is there a EU-based cloud vendor which offers:
- Compute (vm, k8s, containers, faas)
- Storage (disks, file shares, S3)
- DBs (relational, document)
- User management and access control
- SDN
- Configuration management
- Secrets management
- Key management
- CDN
- DNS
- Domain and cert registration
- Email / SMS
- Messaging broker
- Streaming broker
Preferably all in the same place and at least somewhat integrated with each other. I'm not spelling out logging, auditing, IaC and other supplementary features but rather core functionality.
That seems to me like a minimal set of services a cloud provider must offer so that clients would work on "service assembly" instead of "building from scratch" or "integrating integration-hostile products".
fasbiner
I think the biggest open question right now is asking if there is such a thing as "Europe" and if it's capable of responding in a unified way in a relevant timeframe.
Ie, are you a Europe-wide entrepreneur working to move the whole unstoppable tanker away from american clouds, or do you just have contracts with EU entities in Brussels and perhaps a few EU members like Germany or Denmark?
Do those contracts really help you navigate the digital contracting systems of Italy, Spain, Greece, and Croatia? And is your timetable for growth going to line up with their elections that could result in contract negotiations stalling or even existing agreements being frozen?
Recurecur
The concerns expressed seem a bit silly, unless the various Euro systems didn't take the very basic approach of using open standards and avoiding lock-in. Oh, and they should be backing up their data somewhere besides "in the cloud".
If those very basic precautions had been taken, migrating to a Euro cloud, or a private environment (open cloud stack) would be trivial.
If not, a lot of people should be fired...but granted, there are a lot of stupid people out there...
All that said, I'd say the concerns around this are vastly overblown.
dijit
“the very basic step” is a lot less basic than you imply.
There’s a million little proprietary APIs and the temptation to glue one to another, especially circumstances like AWS where they use lambdas for basic functionality that should have been just provided by the cloud provider itself.
jononor
Why do you say that the cost of throwing out American tech giants has gone up by 100-1000x compared to 15 years ago? I mean before everything became cloud/SaaS, American software companies were still essential to most European business and governmental operations. It was just on more traditional server/desktop systems?
serbrech
If only because there are 100-1000x more system that have now tied themselves ne their data to said cloud
Mossy9
I hope so too, but move where? Does Scaleway or UpCloud or any other EU cloud provider have comparable offerings? Sure, if everything you have is running on containers or VMs, the stuff is easy to port to Hetzner et al., but what to do with the cloud specific apps (Azure functions etc.)? Rebuilding those for other platforms is probably a no-go unless the Union pours billions into supporting this.
Though I've cursed it for years, I'm increasingly glad our org's cloud migration has been so slow that we've only now rolled out the first apps. Pretty much everything we've build can be run anywhere we want, so if it's time to drop the ball and go back to onprem, we've not wasted anything but time on setting up the base
stego-tech
> but what to do with the cloud specific apps
Coming from IT land, the answer is simple: you don't use them in the first place, and you grit-and-bear the replacement cost if and when the time comes. This is a negative on my research notes, slide decks, and papers when it comes to evaluating various cloud platforms for our workloads, and yet it's also the number one reason we're forced into a specific provider (some leader loves their proprietary tooling, and forces us to use it).
Look, I'm not saying these proprietary tools are bad, per se, just that they have a steeper cost than initially presented to the consumer in terms of architecture complexity and inevitable migration. The very first question you should be asking before consuming niche or proprietary products from vendors is, "Can I do this in a standard way that's more portable?" For stuff like Azure Functions, the answer is emphatically yes - but it comes at the cost of managing additional infrastructure, which is often the main reason companies want to use those tools in the first place (a misguided notion about throwing out infrastructure to save money).
As for the solved problem of compute (VMs and Containers), well, literally any cloud provider should have that ready to go. The question is whether or not your org is willing to retain the talent needed to build and support your clouds internally, or if they'd rather pay higher outsourcing costs with vendor lock-in instead.
smackeyacky
One thing that isn't so simple, even if you stuck to VMs or docker containers, is the networking.
The networking stack in Azure or AWS are so different that they require a different mindset to work, especially securely. If your networking needs are simple you are very lucky.
0xbadcafebee
> but move where?
For hosting their government's own specific computing needs, and assuming a respectable GDP, they can build their own datacenters (pretty trivial) and hire contractors to build cloud computing environments (more challenging).
Open source cloud isn't too hard. There's OSS for about 80% of software needed for a cloud computing service provider, and you fill in the rest with proprietary and custom stuff. There's already several providers (one in the US, several in the EU/other countries) that offer "public cloud" using OpenStack. They literally give you, the customer, your own OpenStack cluster, and bill you for what you use. It's insanely easy and powerful. Yet everybody still uses the more popular providers (DO, Hetzner, Scaleway, etc), despite the fact that they all have proprietary interfaces, without anything close to feature parity with OpenStack. I guess people really like vendor lock-in and lack of features.
The hardware is more challenging to source; the chips all come from Taiwan or China, and the US and China make most of the good hardware.
For private business in their country, they might offer grants and tax incentives to EU companies to build out more local cloud hosting services. But since it's the EU I'm sure it's massively more complicated than that.
busterarm
As someone who runs OpenStack clusters and uses public cloud providers, I think it's worth noting a few things:
- Outside of the Telco sector, OpenStack is basically dead.
- Even within Telco, everyone sees the writing on the wall of OS being dead and is looking to make the jump.
- OpenStack is a cluster of poorly-interoperating, poorly-documented products -- The customer experience is fucking terrible.
- DO, Hetzner, etc all offer a superior product.
- None of those products even come close to touching the features of the big three clouds or even Oracle.
If your needs could be well-served by DO, Hetzner, etc., then your needs could be well served by racks in a colo.
Past that scale, American cloud providers are really your only option if you want that level of automation.
(Or Chinese cloud providers, but largely assuming that's a non-option)
Mossy9
Interesting, thank you! Care to link any OpenStack providers? Do you have experience working with any of them?
buildfocus
Scaleway at least is genuinely not a bad alternative for this kind of thing already today - they do have plenty of managed services like serverless functions, object storage, queues, etc, in addition to the simple VMs and container hosting.
neoromantique
Scaleway (and I say this with very deep sadness) is pretty bad in terms of reliability right now, there are at least a couple big outages every year over the course of last few years that I've been using them.
Admittedly they have a new CTO who according to our support agent is very focused on improving that, so here's hoping, because otherwise their tech offering is very convenient.
matt-p
The reliability is pretty terrible, the billing sucks (especially SEPA) but apart from that..
kefirlife
OpenFaaS is one option for your functions. Knative is pretty good as well for the bulk of your applications without exposing developers to kubernetes directly. Between that and Crossplane I think you have all the pieces needed to move away to a self hosted solution where you are managing either metal or VMs through a hosting provider.
I’m not sure what this looks like outside of the US, but colocation providers offer racks of machines, or to host your machines, while providing access to cheap bandwidth and peering capabilities. It’s absolutely possible to move away from the major cloud providers. However, it will require a degree of investment within your organization to support these deployments no matter which you choose, which could be a new investment compared to using AWS, GCP or Azure.
matt-p
You need teams of people, the good news is that they're available here. It's not hard as such just requires time and money (quite a lot).
It's not just kubernetes and openFaaS, what about that thing that's a virtual appliance and requires a VM, now you need KVM. Network and firewalls? Storage as in fully replicated cannot ever lose a byte or have it unavailable storage? Object as well as block. Databases, point in time restores/backups/automated maintenance for postgres and then you've probably got a mssql server for that one app, and mysql for that other app.
It becomes just a fairly massive task back in the real world.
anon84873628
Isn't Google doing some thing where they give the software stack to a local operating partner?
I guess you can say the code is still backdoored / untestable but it seems that could be audited.
decimalenough
From the article:
> People also fool themselves that special keys and “servers in the EU” will get you “a safe space” within the American cloud. It won’t.
The problem isn't sneaky backdoors, the problem is that the King of America can order Google to shut that thing down and Google will have no choice but to comply.
fclairamb
In France we have https://www.s3ns.io/ which is a Google / Thales partnership, where Thales owns 90% of the company, handles the datacenters and Google provides the software and the updates without touching the servers themselves.
They are about to go live in a few months.
This is a good option IMHO, and we're about to migrate some of our workload (currently 100% on AWS) on it.
We use EKS, RDS on standard PG, SSM and S3. S3 is a standard now, SSM can be replaced by something else fairly easily, EKS and RDS are just managed open-source software. So it's mostly an added burden on the devops side.
davidinosauro
In France, this is https://www.s3ns.io/en
riehwvfbk
> but what to do with the cloud specific apps (Azure functions etc.)?
Don't build them. Vendor lock-in is a real problem: even if there are no political issues, it's a business risk because they can charge you whatever they want.
Also, the cost of migrating off these things is usually overestimated. It's an HTTP request, for crying out loud.
Mossy9
Fully agree with you there - building cloud-only stuff has always seemed foolish to me. Even Azure Functions can be done as e.g. simple C# programs which would be trivial-ish to port ovee to VMs.
But my concern is for those that have built something as Azure/AWS only, who are now stuck with the bed they've made. Sure, there are lessons to be learned here, but if the volume of these is too high, then there will be pushback on any meaningful change since it will be too expensive
1over137
>I hope so too, but move where?
On premises.
NomDePlum
The concern isn't new. I've been involved in several UK government projects that considered moving to AWS.
Each time the discussion on moving to a US based provider was a big consideration, particularly the use of managed services that involve data was a hot topic. Part of the risk assessment was considering what the consequences might be if the US government became a bad actor. It was seen as high impact but extremely low probability. Starting to look like we got that part of the assessment wrong.
I think it will take time for the impetus to move to US clouds providers to slow and reverse but I'm not sure I'd be surprised if it does happen now.
svilen_dobrev
heh.
by the course of looking for programming job, i have scanned hundreds of job-ads, incl. governmental. everybody-and-his-dog requires AWS/Azure/GCP knowledge as if it matters thaaaat much. These cloud-y things have become a mandatory buzzword, and i am not talking about sysadmin/devops.
In my last gig the system was kept cloud-agnostic, so moving between providers or on-prem be possible at any time. And i as CTO kept that good thing, although had to resist some pushes. But seems such cases are few - most places now dream of hyper mega-giga-scale and Lambdas and Big-queries.. while doodling few thousands of requests.
Lets see if there's any wind change.. vendor-lock is a real thing, with much deeper (architectural or life-cycle) consequences than usually perceived.
tempodox
Here's to hoping that decision makers will listen to him.
raxxorraxor
The dependence was established sooner by using external infrastructure. The premises that this infrastructure is not under your control is exactly what he now derides.
Someone knowledgeable should have seen this before, this is a core issue when setting up a strategy for digital systems. And this isn't an issue between "purists" and the rest, that is a false dichotomy. The decision was simply to outsource infrastructure to systems you have significantly less control over.
Might work for 15+ years or it might not. I doubt anything will be done now, investments are probably too high. But it is an issue with lacking foresight.
Between countries and the main task for intelligence agencies is industrial espionage. The Dutch government, like many others, decided that exposing themselves is no issue.
I disagree that it has become a problem only now, this is due to his narrow view on politics and a bit naive in my opinion.
speleding
I understand the sentiment, but as a Dutch person: The only thing I am more worried about than the government moving all our data to US clouds, is the government trying to do anything IT related themselves. They do not have the skill and have proven that over and over again in a long list of bungled projects.
I'd rather have my data end up with Google/Amazon/CIA than it ending up everywhere on the internet due to poorly configured DIY servers (and at twice the cost probably).
jononor
If there really is no organizations competent to run government application in the Netherlands, then that is even bigger reason to start doing more of that in the country. I mean, computers are not going away! The competence and infrastructure does not magically appear. It requires consistent investment over time. Not being able to maintain computer based infrastructure is like not being able to maintain water supply of a country. Completely unacceptable. Heck these days maintaining water supply at city scale is difficult without computers and networking...
28304283409234
That is because you only hear about the failures.
28304283409234
Besides: this is not a problem of competence or incompetence of either US companies or Dutch government. It is about the very real threat of US government no longer allowing US companies to provide us with services.
It is Russian gas all over again.
jasonvorhe
I've been interviewing candidates using questions targeted at getting them to talk about experience instead of skill. Like asking about their involvement during production incidents, then drill down to see if there's anything interesting to focus on. Can probably also be gamed by AI but people are usually surprised about my approach and they often provide good feedback after the call, even if I have to decline their application so I guess it works somewhat well for both since it doesn't force anyone to just recite the same phrases.
pclmulqdq
It was never safe for any government to move any secrets to any cloud. The fact that the US government is okay with doing this with its own secrets surprises me to this day. You have no secrets from the person who owns your hardware.
jandrewrogers
It isn't uniform by any means but the US runs on a physically independent cloud, often in their own facilities, designed by the big cloud companies. When using the public cloud for unclassified work (e.g. working with outside vendors), the data is only allowed to reside in specific data centers that have been vetted by the government, not all US regions have the same authorization. For example, government data in an S3 bucket in the public cloud may only be accessed and processed within the same region, which can be annoying if your infrastructure is elsewhere.
The US is far ahead of most countries when it comes to government use of the cloud. Other developed countries often learn how to do it from the US but are less comfortable with the technical requirements, which slows down adoption.
vimbtw
This is a great point. For example, near where I live there’s a massive Google cloud warehouse out in the middle of a field next to the highway. Inside of that warehouse there’s a separate section for servers belonging to the US government that can benefit from all the electricity contracts Google has negotiated, the physical security and fences that Google has set up, and the fiber optic cables they’ve laid.
It’s the best of both worlds, they get the decades of research Google has put into systems engineering and fault tolerance while retaining the security of having their own servers.
KennyBlanken
Other developed countries are less comfortable because all the major cloud providers are US-owned companies and the NSA has a very, very long history of using US companies as information security weapons.
Not that they're the only ones. Israel has been busy stuffing investment cash into the pockets of Unit 8200 members so they can found security software and service startups coughSnykcough
red-iron-pine
for Israel I would have said Check Point firewalls, or the company that owns Express VPN and Private Internet Access
dataflow
Physical isolation is kind of irrelevant for the concerns being voiced here no? It's not like Europe's main worry is random people walking in and yanking hard disks out of servers in datacenters.
radicalbyte
It's not the technology, it's the US Cloud Act which has slowed a lot of it down.
Very few actually qualified and capable techies here trust any of the US-based cloud providers.
tremon
Same for the German cloud, it's Azure Stack but operated by a subsidiary of Deutsche Telekom IIRC.
rapatel0
The US Gov't has their own GOV Cloud Datacenter Regions. It's run by azure and AWS but there are restrictions on who is allowed to use it. It's not really public
https://aws.amazon.com/govcloud-us/?whats-new.sort-by=item.a...
https://learn.microsoft.com/en-us/azure/azure-government/doc...
locusofself
The 4 major cloud vendors (Azure, AWS, GCP and Oracle) all have Air-gapped regions in addition to their "GovCloud" regions.
ocdtrekkie
The point is Amazon and Microsoft surely have vested interests in government data they are not supposed to be privy to.
aprilthird2021
And the government has lots of leverage it can use against Amazon and MS if they use it in a way the government doesn't want. EU govts don't have that
pclmulqdq
It's not just the corporations as a whole that are an issue. It increases the insider risk footprint of that data to include your cloud provider's employees as well as your own. Amazon, Microsoft, and Google almost certainly employ agents of your adversaries (including US agents working without their knowledge) who have weird attack vectors and now have to be part of your threat model.
losradio
I am sure both companies have NDAs and contractual agreements in place that can be enforced and monitored.
null
null
ivanmontillam
Yes, I agree.
I make the parallel with "gold." Whoever has your gold, got you by the hanging spheres.
Given the importance of data today, I am baffled common citizens are not familiar with the "Data at rest" principle.
zhengiszen
Nice comparison
cscurmudgeon
So the US is within its rights to ban TikTok?
ivanmontillam
No, that's overreaching.
If a country's citizens want to give away their data, it's well within their right to do so. At most, the U.S. Government should educate about it, much like tobacco dangers.
Having that said, U.S. citizens with clearance and/or government employees should be subject to data loss prevention measures, like they already do[0].
I'd be forward for a ban if it was an issue of public mental health, but the U.S. Government cannot take that angle because they'd have to kill Meta Platforms as well. They know they can't, Meta lobbyists will not allow that.
But restricting TikTok based on data control and free speech liberties, that's overreaching. I've already seen TikTok videos of people saying they'd stamp their U.S. passport on the forehead and give it to Chinese ByteDance rather than use Instagram. It is well within their rights to do so if they so desire.
--
[0]: https://www.pbs.org/newshour/politics/why-tiktok-is-being-ba...
closeparen
The US government’s secrets are routinely held and processed by contractors. The prototypical government secret is something like the plans of an airplane designed and manufactured by Lockheed Martin.
zombiwoof
Elon Musk will have access to all data.
That should scare everyone given his propaganda machinery aimed at elections he does or doesn’t like
DamnYuppie
Were you this afraid of the propaganda machinery when it was aimed at conservatives? It seems far less radicalized now then it was. Just now other voices are actually allowed.
dcrazy
“Secrets” is a broad term that covers everything from payroll information to the history of CIA clandestine operations. Only some kinds of these are stored in the cloud.
rcpt
Security isn't a "safe" vs. "not safe" bool
dmantis
The world literally has hard proofs of mass espionage by the NSA and CIA after Snowden and Wikileaks Vault 7. Moving your government secrets to the US cloud has been madness for at least 12 years.
rcpt
https://www.usenix.org/system/files/1401_08-12_mickens.pdf
Alright so get a magical amulet.
raverbashing
Cool, encrypt everything before uploading. Keep the key client-side
See, parent is right? Safe/not safe dichotomy helps nobody
dijit
Correct, it's more like a bitmask.
Except if any of the bits are flipped you're f-d; especially so if your adversary is a nation.
cogman10
This does raise a valid question of what secrets can or should the government have.
I think it's obvious that some secrets should be kept. It makes little sense to expose our nuclear secrets, counter espionage, or ongoing investigation efforts. But how far does or should that extend? Should everything the NSA/CIA/FBI/IRS does be secret? Should they stay secret for years or decades or forever?
IMO, the US goes too far in it's secrets. Stuff gets classified that just makes the government look bad and that's dangerous.
And that's where I'm somewhat less concerned about putting US secrets into the cloud. Sure there's highly sensitive stuff that shouldn't go there, but there's also a lot of stuff that shouldn't have been a secret in the first place.
Andrex
FOIA makes the US gov't one of the more transparent democracies, as a counterpoint. So much so it started getting copied by them.
Nullabillity
According to the very link you posted, the US was two whole centuries late to the party. Better late than never of course, but the spin of trying to then frame it as an American Victory(tm) is pretty ridiculous.
thelamest
“Transparency” as leaks from abuse is very, very different from transparency as a policy of easy access – and neither makes you necessarily better informed. In short, a biased selection of information can leave you worse off than having no information.
dangus
Isn't this just kind of willfully ignorant to the way the government cloud works?
GovCloud claims that it's used to "manage sensitive data and controlled unclassified information (CUI)."
I don't think the US government is dumping classified info onto corporate cloud environments judging by this description from GovCloud. But there's plenty of info that's sensitive but unclassified and the government does need to function in a lot of ways that doesn't involve state secrets.
https://aws.amazon.com/govcloud-us/ for more of a description of what GovCloud actually is.
thesuperbigfrog
>> I don't think the US government is dumping classified info onto corporate cloud environments judging by this description from GovCloud.
There are cloud environments specifically for classified info:
https://aws.amazon.com/federal/secret-cloud/
https://techcommunity.microsoft.com/blog/coreinfrastructurea...
dgacmu
and google also, including top secret: https://www.nextgov.com/acquisition/2024/04/google-now-autho...
pedropaulovc
This is nothing new, Microsoft signed an agreement with the French government to build a sovereign cloud called Bleu [1] operated by Orange and Capgemini using Azure and Microsoft 365 technology. The German government did something similar and launched Delos Cloud, operated by SAP and Arvato Systems.
[1] https://www.globenewswire.com/en/news-release/2021/05/27/223...
[2] https://www.bertelsmann.com/news-and-media/news/first-sovere...
layer8
> called Bleu operated by Orange and […] using Azure
This is somehow funny.
zekrioca
Not sure how the person doesn’t realize the contradiction.
maelito
Aweful strategists did that, if they weren't simply corrupted.
pm3003
The reasoning is that, with sufficient security, on premise (more or less) cloud technology is not much different in terms of sovereinty from sourcing your hardware from China.
BiteCode_dev
That was such a low blow, given we have stellar companies like OVH that have demonstrated their skills and willingness to bring great hosting, and are fully local.
nektro
> using Azure and Microsoft 365 technology
then they didn't do what the article is suggesting
red-iron-pine
> The German government did something similar and launched Delos Cloud, operated by SAP and Arvato Systems.
this will be an overpriced nightmare
stego-tech
Good to see this attitude becoming increasingly prevalent. I'm used to being a Cassandra in IT world, and while I'd have greatly preferred being wrong in my 2019 research concerns about data sovereignty, cloud-repatriation, vendor lock-in, and a shifting geopolitical landscape, welp, here we are anyway. I cut my teeth in data center operations and defense contracting, and knew immediately the real cost of public cloud would be the forfeiture of sovereignty to whichever country (and companies) controlled the major providers - surprise surprise, I was right. The solution was never to outsource core government infrastructure to a third party, but to build it in house and recruit the talent needed to keep it running, something easily done on most developed governments' budgets; by outsourcing to public cloud service providers, they traded national sovereignty for empty promises.
Bookmark this comment, because my read is that in five years' time the question won't be whether or not public cloud providers can be trusted, but how to engineer infrastructure on cloud providers you cannot trust. How do you encrypt storage on a cloud platform when you can't trust the vendor's tooling to secure your keys? How do you orchestrate K8s clusters in a provider who knowingly gives a hostile foreign government access to your etcd or network layer? How do you handle data boundaries within your own org when multiple countries with competing standards demand residency of data and infrastructure? I worry it'll be the "Chinese Firewall" problem but on a global scale, as different regions carve out their own digital kingdoms and demand fealty or expulsion.
JFingleton
Perhaps Homomorphic encryption can provide part of the solution in running services on untrusted Cloud platforms?
Although with Microsoft's recent breakthrough in their quantum processor, I'm not sure whether quantum will be a help or a hindrance.
1over137
Canadian government IT is mostly all Microsoft. The government can't even send themselves email without it going through Microsoft, a company based in a country (USA) that wants to take over Canada. Insanity.
sam_lowry_
That's true for most EU governments as well. We lost the ability to host our own email infrastructure long before we moved to US clouds.
red-iron-pine
big tech has been pushing for cloud for a decade.
same companies that also happen to have advertising and data mining as primary functions. is there any surprise they made this call?
gmuslera
Since now? It was safe before, as in what is happening now was totally impossible before, and somewhat it happens anyway? Do they started to care about making backups after they lost data?
Risk is not about "something happened, so it may happen again", but if something bad can happen, if it is possible, and maybe weight it as probable or not. Black swans exists, and if you bet everything on that they not, you may lose everything.
And the process of moving government and societies to some controlled by a foreign power cloud takes time to get in, and to get out. And you can't tell that something bad was being done while showing a smiling face.
It is not something coming out of the blue. There was strong signals of intervention back to the start of internet, and a more or less official confirmation of what was happening in the shadow with Snowden's revelations. But somewhat is now when that is perceived as a risk.
SecretDreams
The only clear difference between now and even not that long ago is the fair perception that the US has flipped from (probably) "lawful neutral" to "chaotic evil".
Secrets in US cloud were probably never fully safe.. but at least the US wasn't previously on a path to inflict pain on the rest of the world.
red-iron-pine
the US government was invading and bombing people for decades and the EU did nothing. "chaotic evil" my ass, the only reason they're moving now is because MAGA is threatening them directly via Greenland, or indirectly, by pulling out of NATO and backing Russia.
Slava_Propanei
[dead]
wongarsu
It has always been unsafe, it is very questionable under the GDPR (though governments are obviously excluded from the GDPR itself), and lots of governments and companies have been using or working on alternatives. But the temptation of of US clouds has been strong, and now is a good time to remember everyone who previously thought the benefits outweighed the risks
cuuupid
One oft forgotten thing is that the US government clouds rated for IL5/6 are secluded on SIPRnet and JWICS. These are totally separate networks with CDS’s being the only way to go from one net to the other.
In practice this means the US Government remains in control of the network backing their cloud. ITAR regulations make it treasonous to have foreign eyes on these clouds. Foreign governments are not afforded any of those protections when sitting on US clouds.
Even among FVEY, there are designations for data relative to member states and information is not as free flowing on JWICS as one might assume. It is more like a controlled stream than a raging river
graemep
Its never been a good idea. I do not think non-EU European countries can rely on EU cloud, not can EU countries can necessarily rely on each other.
The only effect the distrust of the current US government will have is a few articles. It expensive and difficult for this to be sufficient incentive to change anything.
We should probably grateful they have not put it all on Chinese clouds.
altacc
I work at an large Europe based multi-national and hosting has always been a concern due to the big differences in data protection and privacy rules. We never use a service not hosted in the EEA.
The current threats that the US is making to Europe about it's data protection, privacy, consumer protection, etc... laws is very much of concern and is already beginning to be a factor in our ongoing RFPs and procurement process. We're not just following the law, we also don't trust some companies with our reputation.
graemep
A lot of European companies and organisations use services provided by American companies but run on servers in Europe. In the UK the NHS uses AWS, the courts use MS teams, etc.
watwut
America is literally allying itself with Russia, trying to turn Ukraine into basically colony (by demanding their resources forever), threatening annexation of Canada (repeatedly). Oh, and in the process of starting a trade war.
Non-EU can trust EU waaay more then anyone except Russia can trust to America. American leadership made it clear that norms, laws or morality are only for suckers.
The levels of behaviors between the sides here are not symmetrical
Axsuul
It's a bit premature to call it an alliance. So far there have only been talks.
> trying to turn Ukraine into basically colony (by demanding their resources forever)
Keep in mind it was Ukraine that proposed the idea of offering their resources back in October 2024[0]
0. https://www.cfr.org/expert-brief/zelenskyys-victory-plan-ukr...
dralley
>Keep in mind it was Ukraine that proposed the idea of offering their resources back in October 2024[0]
The general idea, sure. They offered that in return for security guarantees or as collateral for continued military aid.
That is not what is being offered them by this administration. Instead the administration has chosen the mafia shakedown route. American military aid to Ukraine to date amounts to around $100 billion dollars (and we're not talking stacks of cash here but rather the "value" of military hardware, much of which already had an expiration date and was literally designed and built for the Russia-invades-Europe scenario). But Trump is demanding $500 million from Ukraine, and offering zero in return. As of today many concessions have been demanded from Ukraine, but zero concessions have been asked of Russia - much the opposite actually.
whimsicalism
EU also demands resources in exchange for military support such as the French+UK-led intervention into Libya. Saying US is an ally of Russia is a pretty big stretch, meanwhile the EU has members that are actually allied with Russia and lots of large Russia-aligned multinationals like Gunvor
Axsuul
To further expand on that, Europe gave aid to Ukraine as a form of a loan with the interest being paid back based off of Russian frozen assets.
serial_dev
I don’t get why you are downvoted.
Every war that the NATO countries somehow miraculously got involved in is an economic war for natural resources and control, and the big EU countries always take their share of the pie.
Ukraine’s resources, one way or another, will be split up between Russia, EU, and the US (or more precisely it will end up in the hands of the oligarchs and “black rocks” of these countries).
rdtsc
> America is literally allying itself with Russia, trying to turn Ukraine into basically colony (by demanding their resources forever)
It was Ukraine/Zelensky who suggested that first not Trump. It was back in November. But we tend to forget such things for some reason...
From https://www.ft.com/content/623c197f-6952-4229-bfbc-0a96e43d6...
> Two of the ideas were laid out in Volodymyr Zelensky’s “victory plan” with Trump specifically in mind, said people involved in drawing it up. The proposals were later presented to Trump when Ukraine’s president met him in New York in September.
So Trump agreed eventually and then Zelensky started a media storm about how Trump wants take their natural resources and turn them into a colony. And everyone somehow immediately forgot that the proposal originated with Ukranian government.
> The levels of behaviors between the sides here are not symmetrical
It comes from a fundamentally different perceptions of reality and politics. There is idea that things have to be just and fair. And when they are not we like to say "it's not fair" and someone comes and fixes it. I am afraid it just doesn't work like that past the childhood age.
> American leadership made it clear that norms, laws or morality are only for suckers.
When weren't they? You're thinking maybe everyone just finally woke up? Morality and laws do not apply in practice on the international arena. It would be nice if they did, I agree, but they don't currently.
EU should have always had it's own strong army, it should have never trusted the US and not relied on them for protection. But they also shouldn't have been buying energy from Putin and funding his operation for years.
def_true_false
The real problem with the resources deal was the lack of security guarantees.
jmclnx
I guess "Make America Great" may spawn a big Cloud Industry in Europe. If I was in Europe, I would never use any US Tech products.
Maybe Linux will end up making big inroads in Europe, replacing Windows and MicroSoft Office and Office 365 along with Google Docs.
vachina
European companies are so deeply entrenched in American software ecosystem I can’t even. Just this past week my EU company deployed an agentic LLM hosted on Microsoft Azure with models developed by… Microsoft, on top of the existing GPT hosted on the same platform. They also recently moved their entire in-house HR platform to Oracle.
It’s no mistake China banned foreign companies with infinite money from setting up shop there. It is dangerous and expensive in the long run.
toomuchtodo
But would they still if the EU used tariff like policy to prohibit it? "The best time to plant a tree was 20 years ago, the next best time is now." Make the law, enforce the law, encourage the behavior and outcomes necessary to achieve the success criteria.
As someone with an infra background a lifetime ago, I am confident I could spin up Kubernetes and Deepseek R1 in OVH or Hetzer within a few days. The primitives exist, the EU simply needs to lean into cultivating and supporting them (orgs, platforms, etc) to push EU entities consuming these services away from US Tech. Perhaps the tech stack is a national security interest, just as a manufacturing base and supply chain is. Better to be prepared than to be entrenched in the US Tech ecosystem and then suddenly be held hostage for reasons.
petercooper
If you look at other countries/regions that impose high tariffs, their companies continue to buy and use American technologies and absorb the cost (to their local customers' detriment).
I'd certainly enjoy the case studies of European enterprises jumping from full-scale Azure and AWS deployments to OVHcloud or Hetzner, though. That'd make for some interesting reading.
nprateem
Everyone knows spinning things up is a piece of piss. It's the on-going maintenance and economies of scale that aren't. Not to mention migration, compliance, etc
hedora
Tariffs don’t really work for software, especially if the software provider holds lots of foreign government contracts, and you assume the foreign government and provider are colluding to get control over your systems.
Axsuul
Hosting Deepseek R1 is not the problem. It's just not great in a lot of use cases.
jimbob45
The EU’s problem is that it doesn’t foster company growth on any level and doesn’t help with problems specific to the EU (e.g. multiple languages, differing laws, varying levels of unionization, and more).
Blaming Trump for their own well-known problems is silly. They were dependent on the US before him and they will continue to be dependent on the US after him until they look in the mirror and decide to fix what is broken.
crimsoneer
Hosting LLMs at scale without Azure/Bedrock is still a massive pain, and they offer EU based data sovereignty, so not clear what the problem is there (or are we now saying no doing business with US companies at all?)
hedora
If Microsoft is providing EU data sovereignty, then they’re either in violation of US law (the US CLOUD Act, specifically) or do not have the technical capability to access data on those servers. (So, for instance, the machines could be air gapped, or they could be configured to never honor MS credentials, including on the software update path).
In practice, this means no US cloud providers provide foreign data sovereignty (though many claim to).
cess11
The CLOUD Act is incompatible with basic data protection rights.
As long as whatever sham of a data protection agency was nominally functional in the US european elites could convince themselves that it was legal to transfer personal data to some US corporations, but now that agency is defunct.
But yeah, it's a bad idea to do business with empires. Sooner or later they turn to bullying and extortion.
TheBlight
The EU doesn't have a significant tech industry.
baq
It doesn’t have megacorps. It’s full of engineers working for US ones.
Fraterkes
Pythonblendervim? Ah sorry thats just the netherlands
sieabahlpark
[dead]
jaybrendansmith
Europe has done this before. Airbus did not exist but now it is the best aircraft maker since Boeing decided to retire all their senior engineers in favor of quick profits. Europe created Airbus, they can do the same with a new Cloud provider.
_DeadFred_
Don't forget Boeing moved their headquarters and leadership to DC. Making the widgets is just the inconvenient part management doesn't really care about/need to be involved with, the focus worthy part of their business is government extraction in Boeing corporate's minds. Our corporate class is such short sigted trash.
layer8
This presumes that today’s Europe is comparable to the one ca. 60 years ago: https://en.m.wikipedia.org/wiki/History_of_Airbus#1970%E2%80...
(I’m not disputing the chances, just the logic of the analogy with Airbus.)
Hikikomori
Evroc in Sweden is trying to do this.
kichimi
They can do even better. I don't know how much I can say but there is an EU funded alternative in the works.
znpy
> I guess "Make America Great" may spawn a big Cloud Industry in Europe.
Unlikely.
I've worked at an american cloud provider and (in another job) i've worked with an european cloud provider (in this context, when I say "worked with" I mean i was in contact with the people actually managing the hardware as well as the software that serves the "cloud").
It's just a completely different mindset, and I don't see that changing any time soon.
The main issue i see is that european cloud providers mostly have technically-ignorant upper management for which providing a cloud offering essentially boils down to "buy this software component from company xyz (likely an american company) and install this open source product abc, then slap a cloud marketing name and unleash the salespeople". They can't even contemplate the idea hiring somebody with FAANG-level skills, paying it FAANG-level money and let it do FAANG-level work. They hire a few underpaid 20-somethings and have them manage, at best, an OpenStack installation.
I kid you not: in late 2021 i was in a meeting with (among the others) the head of cloud engineering of one such companies and asked when are they planning on offering ipv6 connectivity. The guy had a loud laugh and said they had no plans to even consider ipv6 connectivity. And that was at a company that does both "cloud" computing infrastructure and connectivity (!!!). That's the mindset.
I don't see europe building a realistic alternative to american cloud providers, and the core issue is not technical.
nisa
> The main issue i see is that european cloud providers mostly have technically-ignorant upper management for which providing a cloud offering essentially boils down to "buy this software component from company xyz (likely an american company) and install this open source product abc, then slap a cloud marketing name and unleash the salespeople". They can't even contemplate the idea hiring somebody with FAANG-level skills, paying it FAANG-level money and let it do FAANG-level work. They hire a few underpaid 20-somethings and have them manage, at best, an OpenStack installation.
Thank you! As a german that saw how the sauce is made in public sector tenders it's exactly this!
This is not restricted to hosting / cloud sector. It's a good summary for most german IT companies.
Arrogance and incompetence are rampant. Programmers and their managers need to go en masse to have some substantial change.
Everyone is so full of themselves and disconnected from reality it's scary.
dennis_jeeves2
>I don't see europe building a realistic alternative to american cloud providers, and the core issue is not technical.
The brain drain ultimately takes it toll. The most capable people from europe ( and every where else), move to US , be they engineers, management, entrepreneurs etc.
fransje26
> The brain drain ultimately takes it toll. The most capable people from europe ( and every where else), move to US , be they engineers, management, entrepreneurs etc.
And they are going to stay there once the megalomaniac in chief and his South African oligarch have gone with their wrecking ball through the very fabric of the US society and economy?
belter
"AWS Services That Do Not Support IPv6" - https://github.com/DuckbillGroup/aws-ipv6-gaps
thedougd
That’s two years out of date and the AWS announcements page is filled with IPv6 announcements.
znpy
congratulations on missing the point.
the real point is not ipv6 (or this or that specific service). the point is the attitude.
anybody in this subthread bikeshedding what aws service supports what version of the ip protocol has missed the point and would probably fail a text comprehension test.
scarab92
They also move too slowly, so they fall further and further behind each year.
For example, Hetzner has great potential, but they’re only just now releasing object storage after 4 years in the cloud space, and they don’t even have managed database yet.
dijit
"4 years in the cloud space"
Hetzner has existed for a really long time, I'm not even sure what "cloud" means in your context.
Object storage and VMs is what made AWS "cloud" 15 years ago, so by that definition Hetzner only just became a cloud provider.
everfrustrated
And they certainly didn't develop the software themselves either.
Hikikomori
Ipv6 wasn't rally viable in a box until like last year.
sam_lowry_
My local European ISP provided me /64 IPv6 addresses since at least 2020 and had so called sticky IPv4 addresses since at last 1999. They were sticky because they did not change for years if the box was connected within 15 min.
This was possible because motivated individuals held technical positions in the ISP while the management has been totally incompetent and was later jugged outright corrupt.
Because of corrupt management and public scandals, my ISP has been sold to Orange. I am afraid this will end the 25 years of technical excellence as well.
amelius
Ok, that's one datapoint. Another datapoint says that Linux originated in Europe.
znpy
> Another datapoint says that Linux originated in Europe.
Linus moved to the US and since 2010 is an american citizen, according to https://en.wikipedia.org/wiki/Linus_Torvalds#Personal_life
Thank you for backing up my argument, I guess?
yobbo
These datapoints don't contradict each other.
DaSHacka
Great, now pull up a geo-map of originated commits per country....
petercooper
The EU hasn't even got a home-built social network with significant market reach, let alone the wherewithal to pull off ditching Microsoft and Google. It'd be nice to see that change, but there's surely some sort of blocker after 25 years of the Web being a mainstream technology.
danieldk
The used to exist (e.g. Hyves, StudiVZ), but they are murdered by FAANG. However, there are still locally successful companies that could expand to the rest of Europe if US companies were dropped. E.g. just speaking of The Netherlands, Bol.com is much more popular than Amazon, Marktplaats is more popular than eBay (which is pretty much non-existent here) and owned by a Nordic company, etc., iDEAL is much more popular for payments than PayPal, Stripe, etc. (and works far better). Such companies can fill the void.
Microsoft will be tough to replace. There are good alternatives, but retraining personnel, etc. will take years. Google, I am not sure. Their cloud services are replaceable. Search may be tougher, but the quality of Google Search has become so bad that it's often easier to ask an LLM.
Lennie
Takeaway (thuisbezorgd) and Zalando are some pretty large players in the EU markets. Spotify of course.
mettamage
Is Marktplaats not bought out by eBay?
See also: https://mergr.com/transaction/ebay-acquires-marktplaats-bv
selimthegrim
Tuenti?
ozim
With social networks or any EU startup problem is you have to deal with different languages right at the start.
Being US startup with English only you have access to 300m people right away.
There were country specific social networks but then all cool kids were on FB so everyone moved there.
The same with LinkedIn, our country specific business social network closed down finally last year. First 3-5 years it was growing then everyone moved to LinkedIn so that network was ghost town for 15 years someone kept it alive just in case but seems like they stopped wasting money.
c-fe
I think the language problem will become less of a problem in the future due to (1) more (young) people living in citys and (2) all young people in cities speaking english. At least compared to previous generations imo. This could be my subjective view based on luxembourg, netherlands, and visiting other european cities.
Lennie
Network effect is also hugely important.
psychoslave
Maybe so called social network is not something to reproduce. Who cares who runs them if they deteriorate sociality, generate addictive consumption of things detrimental to mental health and favor extremists point of view?
Reventlov
And that's why we need to stop being dependent on the US: everything in there is described in terms of « market share », and not in terms of usefulness, ethics, or independence.
toomuchtodo
There is an active effort currently to have the EU contribute towards funding https://freeourfeeds.com/ (to enable a distributed, global AT Proto network). Does the EU need the network to be home grown or have the valuation matter? I argue no, it is a utility, not a business to be captured and squeezed by investors or other potential controlling interests.
(as of this comment, Bluesky has ~32M users and counting)
bloomingkales
They can fork phpbb. You didn’t really think these social networks are anything more than that?
We just need to see if phpbb can scale to a billion, and if not, why not.
petercooper
Well, I'm all for the return of the classic forum experience!
The UK's largest "social" sites are pretty much forums (e.g. Mumsnet, The Student Room, DigitalSpy, MoneySavingExpert) and while they're good for their respective topics, they don't cover the Reddit/Facebook/Instagram use cases (they could be arguably considered on a par with individual sub-reddits).
Lennie
https://matrix.org/ is partly funded by French government.
darkwater
> We just need to see if phpbb can scale to a billion
No need for that, we are just half a billion in Europe.
fsflover
PeerTube is made in France, Mastodon AFAIK in Germany.
tbrownaw
So we're about to finally get the year of Linux on the desktop?
qwerty456127
Almost every EU company I worked with, migrated from Windows to Ubuntu at some point.
century19
I've worked with many and it was always Windows, with some use of MacBooks in recent years. Never once seen Linux desktops.
DaSHacka
More like "Year of the EU computing independence" this time, totally for real guys!
mattmaroon
It's been one year away for 30 years!
tensor
There is already a decent cloud industry in Europe. OVH has been around for decades, and many companies in North America even use them because they are often a bit cheaper. But you also have newer players like Scaleway and CDNs like Bunney.net that are growing fast.
I think the harder services to replace are things like Github and O365/Google Workplace.
aerhardt
"Cloud" is not boxes like OVH and Hetzner sell. Cloud is a gigantic software layer offering all kinds of features and abstractions.
I think it'd be faster and cheaper to replicate GitHub or even Office, which are complex but fairly feature-stable, than to offer a real cloud competitor with a fraction of the services that Amazon, Microsoft or Google offer in their cloud portfolios.
I heard an interesting thought on the Lex Friedman podcast though. If software engineering really becomes cheaper and more readily available thanks to AI, maybe more companies will start building more of their own services. Then, maybe then, will the European enterprise be able to wean itself off from the big cloud vendors.
tensor
I know what Cloud is, and OVH has a cloud, with many of the same services as AWS. Even Bunny can be configured via terraform. So the reality today is that AWS and other cloud offerings have strong alternatives, but Office and Github don't.
rahkiin
How does Scaleway measure up these days?
Are there good resources for comparing clouds with sovereignty in mind?
matt-p
Are OVH decent? I'm not entirely sure that they're even passable and what other options would you have in Europe?
cgcrob
I think the impact is going to be far greater than that.
I have seen, at least here in the UK, some people speaking about moving entirely back to hardware that is controlled by the organisation. The case is there on a cost basis already but people are reluctant to admit this. If another magical guarantee expires such as a security one, then the reason can be shifted to that and the cost justification is collateral.
Getting out of PaaS systems is going to be horrible and expensive though. We never should have gone further than IaaS.
I suspect the idea of the cloud as it stands today may die fairly quickly.
Xenoamorphous
Not just cloud but military and many other things.
I think MAGA is good for Europe, there’s a big incentive to remove any kind of US dependency.
Mossy9
As someone who has (reluctantly) been advocating and pushing our org to move stuff over to Azure, this is going to get interesting as tomorrow I'll start pushing the cart to the other direction. I never wanted to go to the cloud a a goal itself, but wished for a more modern infra to improve processes and security, which we surely now can achieve onprem as well.
Luckily there's always been scepticism and challenges with tightening data security regulations, so maybe people will mostly be relieved if we need to turn around on this.
Anyway, it will surely be an interesting discussion on Monday...
inetknght
> As someone who has (reluctantly) been advocating and pushing our org to move stuff over to Azure
I get moving off of AWS and GCP. But to Azure? That move doesn't make sense to me at any time that Azure has been a thing. Why have you ever wanted to move things to Azure?
Mossy9
Since practically every government in Europe is a Microsoft "shop", Azure is the first stop when The Cloud is concerned. Unofortunately, often the last one too... Wheels were already moving, I helped rhem gain traction.
So yeah, not my favorite of the whole "not my favorite" cloud migration plan, but the only realistic path forward at the time
belter
"Azure’s Security Vulnerabilities Are Out of Control" - https://www.lastweekinaws.com/blog/azures_vulnerabilities_ar...
inetknght
I get what you're saying. But often it just takes a voice to speak up to fight against wrongdoing.
What made it the only realistic plan?
deadbabe
Come to Cloudflare.
bloopernova
I'm in the process of moving my various google data onto Hetzner storage share[1]. It's a Nextcloud instance with 5TB of storage for $16/month. My wife and I each have a normal user, we can share stuff just as well as before, and we can install things like a simple Kanban app, sync to our Android phones, etc etc.
So far it's been great, I highly recommend it.
jacooper
It's only an option, if you trust hetzner, since there no encryption whatsoever, it's just a managed nextcloud instance.
lazzlazzlazz
I have been banned from Hetzner multiple times now and believe me, nothing I was doing is even strange, let alone worthy of bans. I don't think an EU cloud can ever be trusted.
k8sToGo
Regardless of any cloud:
I hope you have a proper backup strategy
bloopernova
Multiple local copies, a cloud copy, and an archive copy on a different provider.
Zenst
Store a local copy offsite with a friends or relative you visit regularly(encrypted). One fire and all your local copies gone otherwise.
AdrianB1
"Now that we know how you did it, we will raid you and get it. And we will use the $5 wrench to get the passwords from you" :)
k8sToGo
Interesting that I got down voted for this
pphysch
The PRC essentially pioneered the concept of digital sovereignty with the "Great Firewall" approach in the late 90s. It was famously ridiculed by Bill Clinton as a hopeless endeavour.
In the wake of 2014 and souring relations with the West, Russia also started looking more seriously at digital sovereignty. This was castigated as "isolationism" and an attack on the "open Internet".
Now it's nearing a household term among EU tech groups. Because this was never about democratic ideals, it is about power and control, especially in a volatile multipolar world.
dralley
Comparing digital sovereignty w/r/t critical services are hosted to "The Great Firewall" is absurd. It's not the same thing at all.
China and Russia blocking YouTube is different from making sure the entire EU government and economy can't be collapsed by US turning the screws on Amazon.
pphysch
Come on. We can draw a straight line from the GFW to companies like Baidu and Alibaba. Without it, they would (initially) struggle in direct competition with endemic US products.
Slava_Propanei
[dead]
To all the people saying that this is nothing new: to me the key point here is that the author of this article, Bert Hubert, isn't your average activist / purist linux hacker. He's at least somewhat influential in government circles, in that he has held various government IT consulting positions and is listened to by lots of government IT workers. He's one of the few people I know of who deeply understands how tech works, and also deeply understands how government works (at least the Dutch government). He's also a frequent guest in radio and TV shows and the likes.
I'm hoping that this article acts as a catalyst for the Dutch government, and other EU governments, to move everything away from American clouds.