After several months of consultations, the French government, under the aegis of Ministers Bruno Le Maire and Amélie de Montchalin, and Secretary of State Cédric O, announced the outlines of the state’s new “Cloud at the center” doctrine on Monday, May 17.
This new "Cloud at the center" doctrine comes at the right time. Security and data sovereignty considerations have never been more pressing. The strategic nature of the cloud in terms of the resilience and competitiveness of our digital economies is now a given. However, we are operating in markets that are heavily dominated by American and Chinese players - these markets are growing rapidly, which means there are significant opportunities for challengers like Scaleway to shine. It is estimated that in Europe, 80% of companies have yet to make the transition to the cloud. What is more, French and European cloud players have reached an unprecedented level of maturity, enabling them collectively to meet the overwhelming majority of market needs.
We cannot underestimate the impact that the French state's position will have, given the aforementioned context, both in the private sector and at European level. We have therefore been awaiting the publication of this doctrine with baited breath.
In the spirit of trust, transparency and pragmatism, which has always been part of Scaleway’s DNA, it was important for us to take a few days to reflect upon the French government’s announcements before sharing our thoughts with you.
Our analysis is the result of Scaleway’s experience, spanning over twenty years, in the cloud market in France and in Europe. This experience is what has led us to participate in supporting a number of public sector stakeholders for some time now, and, as a founding member and member of the GAIA-X Board of Directors, we are committed to the construction of an innovative and trusted digital ecosystem throughout the European Union, based on rules that are in line with our European values.
Our analysis also reflects the unique positioning that we have managed to build and consolidate over the years - Scaleway is in fact much more than a simple cloud infrastructure provider. We chose to master our entire technological stack, from the datacenter to hardware to software development, in order to deliver our value proposition.
1- A doctrine which supports the cloudification and acceleration of the French government’s digital transformation
2- Creating a label to promote trusted cloud services providers - a commendable ambition that requires further clarification
We fully support the government's approach to building transparency and trust, especially with regard to the location of data stored by administrations in the cloud, compliance with European legislation (Schrems II ruling) or subjecting cloud service providers (and their customers' data) to non-European laws with extraterritorial effect. We urge for this to be implemented at European level so that it can have a real impact.
Should the first criteria put forward for granting this label serve to supplement the existing requirements of the SecNumCloud mechanism, then the following serious questions remain to be answered concerning the scope of the "trust" that this label seeks to define:
- First of all, we believe that the very "high-level" nature of these criteria does not allow us to adequately assess the immunity to extraterritorial laws that would be entailed, from the physical dimension to the software components that make up the cloud.
- When the doctrine was presented, it seemed that, from the French government's point of view, the key to trust lay in the conclusion of partnerships between French and American actors, positioning the former as resellers of licensed American software technology. Encouraging such a position seems problematic and paradoxical to us, as this solution does not provide a long-term solution or legal certainty:
- We believe that the metadata inherent in foreign solutions will always allow for the enforcement of foreign (U.S.) law as well as potential judicial subpoenas on the data or metadata of certain customers, via the FISA (Foreign Intelligence Surveillance Act) or the Executive Order 12333
- The source code of such solutions will probably not be auditable, and will therefore either allow back-doors, or will bring up sensitive information without it being easy to analyze the outgoing data flows; thus a total lack of transparency from a cybersecurity perspective
- The success of these partnerships will depend on the conditions (which are known to fluctuate, in accordance with major political factors) of the U.S. export control regime with respect to licensing. Similarly, how the requirements of the Cloud Act will evolve under U.S. law is anyone's guess. This lack of predictability is in no way a guarantee of trust
Far from solving a problem of sovereignty, this solution exposes the French digital environment to new types of dependencies. We are specifically concerned about the undesirable side effects that this label, as it stands, could have on the market. It could exclude trusted offers from a certain number of French providers who, nevertheless, stand out because of their sovereign approach, which has come at the cost of significant investments.
3- Economic competitiveness: a doctrine with considerable industrial consequences for the future of the French cloud sector
The French government's desire to devote a part of this cloud doctrine to the implementation of an "industrial policy" stems from observations that we fully concur with - namely the overwhelming domination of American and Chinese providers in the cloud market, the creation of value outside our borders using data belonging to French and European citizens and companies, and the resulting loss of control and sovereignty over said data.
Moreover, the analysis expressed by the French Interministerial Directorate for Digital Affairs (DINUM) on May 17 during the presentation of the doctrine is extremely accurate. When talking about the cloud, we are not only talking about infrastructure, but also about a layer of software, generating the highest added value. Naturally, control of this segment of the value chain by a local industrial ecosystem should be a full-fledged objective of any industrial policy for the cloud. Much remains to be done, not only to encourage European players to catch up through innovation, but also to enhance the value of those who are already positioned in this niche, in the face of U.S. entities in a dominant position - and prone to misuse, which has been well-documented, because of this position - for the supply of high-performance solutions.
As a result, the choice to so openly promote the use of licensed software solutions seems difficult to understand in terms of industrial policy: de facto, French cloud service providers will find themselves confined to the role of infrastructure providers, aiming to resell non-European software technology. Yet, government contracts (and not subsidies) are a key lever for industrial policy. Also, by positioning itself as a privileged buyer for this type of solution, the French state seems to be abandoning all ambition for the development of a competitive and innovative French cloud industry in the very segment of the value chain that will concentrate the most value in the future. It will be difficult to compensate for this very negative signal sent to the entire ecosystem by supporting R&D, as the doctrine sets out.
In addition, we fear that such a label will have undesirable effects on French tech start-ups, who are constantly taking risks to develop innovative SaaS solutions (using the underlying cloud, i.e. IaaS and PaaS). Confidence in their entrepreneurial approach could be severely damaged by the introduction of such a label.
From a fiscal point of view, the virtuous logic of the direction the doctrine is taking is also questionable, as the propensity for tax avoidance by large non-European tech players is a well-known issue, against which the French government is rightly fighting.
In conclusion - the real work is just beginning!
The "Cloud at the center" doctrine is now on the table, but everything still needs to be done: building trust around cloud offerings, which will be used to modernize government services, and thus ultimately improve the daily lives of the French general public in their dealings with public services.
By attempting to decree trust, there is a risk of undermining local suppliers who have already earned the trust of their existing clients. For us, trust is reflected through the reliability of our offers. Over the past twenty years, we have proven our reliability to our customers. Trust is also demonstrated by the agility and innovation that characterize our products, and above all, is reflected in our values: Scaleway has always challenged the status quo in terms of security, sovereignty, transparency, innovation and the environment.
Being pragmatic, we are fully mobilized alongside the public sector to support the acceleration of its digital transformation, providing the highest possible level of trust - in line with the legitimate expectations expressed by the French government in its doctrine. We are convinced that we need to find a way for European cloud and software manufacturers, alongside public project leaders, to write the next pages in our technological history together, in a way that we can all be proud of.