Amazon and Google underpin most of the web. Now Europe has a new plan to reclaim data sovereignty
By now, you’ve likely come to terms with the fact that escape from Jeff Bezos is impossible. You may have weaned yourself off that sweet sweet next day delivery, procuring all your worldly needs from a boutique array of small local shops, but if you venture online, Bezos still wins – cutting out Amazon’s cloud computing services renders the internet literally unusable.
This Infrastructure as a Service (IAAS) market, of which Amazon makes up 48 per cent, is worth $42.8 billion (£32.7 billion). It's dominated by five companies – four American (IBM, Microsoft, Google, Amazon) and one Chinese (Alibaba). Their data centres provide the huge humming heat-spewing engines of the internet, and host everything from small startups, to big hitters such as Netflix, Spotify and AirBnb.
Now Europe has a plan to challenge this US and Chinese cloud dominance – it's called Gaia-X. The project is a collaboration between the European Commission, Germany, France, and according to an email from a spokesperson for Germany’s Federal Ministry for Economic Affairs and Energy “some 100 companies and organisations”. (Firms confirmed include SAP SE, Deutsche Telekom AG, Deutsche Bank AG, Siemens and Bosch.) The first proofs of concept for the European cloud are set to be ready towards the end of this year.
“The project centres on users ranging from industrial groups to SMEs and startups, seeking to meet their actual needs and provide added benefit for them,” says the statement. “There is already a great number of potential use-case examples from various sectors and industries – healthcare, finance, public administration, science and academia.”
The driving motivation behind the project is “data sovereignty”, or, more accurately “data governance” – an ambition to bring the flow and storage and data under greater European control. “Data sovereignty is the key to GAIA-X,” says Harald Summa, the CEO of DE-CIX Group AG, a group involved in the project. “Especially given that our society is relying more and more heavily on digital services, it is in the interest of a state or a region to enable a certain level of independence from external service providers.”
The project is a direct response to the dominance of American and Chinese service providers. The European Commission has already locked horns with Google, fining the company €4.34 billion for antitrust violations back in 2018. The US Cloud Act requires American firms to provide law enforcement with customers’ personal data on request, even when the servers containing the information are abroad.
“The GAIA-X initiative is built on the idea that the geography of the cloud matters immensely for anyone thinking about economic and political sovereignty in Europe,” says Mark Graham, professor of Internet Geography at the Oxford Internet Institute. “First, the fact that ever more core business processes will be run on, or mediated through, cloud-based services. Second, the fact that all large cloud providers are US-based companies – subject to US law – which makes Europeans naturally vulnerable that they may not be able to shape the ways that data are managed and governed.”
The theoretical attraction for Gaia-X user, explains Summa, is to exercise far greater control over data and the way it is distributed. Data travelling via the public internet, he says, is routed automatically along many and variable paths – it’s not possible for the owner of the data to control the route it travels along. Amazon says that AWS is participating in Gaia-X's technical working groups and that it welcomes the groups open approach.
“One solution is a point-to-point connection. However, while this is more secure, it also leads via the internet,” says Summa. “A much better solution is a direct connection via an Internet Exchange between the user and provider, for example.” He explains that the service provider connects directly to many users via this exchange, and the users in return can connect directly to many service providers. This exchange offers a user greater control over the pathway that the data takes – they might be able to mandate that their data remain within Europe, for instance.
“There’s also a need for a place where you can store the data shared by the different European “real economy” industry players – like car manufacturers, farmers and so on – as a way to give them more bargaining power vis-à-vis tech giants,” explains Andrea Renda, Senior Research Fellow at the European thinktank CEPS.
Details about what the project will actually look like are thin on the ground – Renda says that, though the project is currently Franco-German, it could easily be scaled up to the full European territory. “The issue is – are we talking about purely national data localisation or a federated cloud,” says Renda. “But I think overall it would be consistent with the ambitions of France and Germany, to have a federation of like minded countries with with sufficient level of mutual trust in terms of data storage and data protection.”
Summa explains that GAIA-X includes the existing cloud infrastructure but will also include “new technologies.” “GAIA-X will have two layers – one is the application layer on which the users will interact with their service, and one is the infrastructure layer consisting of interconnected data centers with flexible and dynamic bandwidths, creating a virtual European cloud infrastructure,” he says. Finance wise, “details are still to be finalized”, but the project will require “extensive upfront investments” that “will pay off in the long run.”
A European cloud network is not a new idea; there have been numerous similar “Google Killers” launched in the name of European “data sovereignty” – none have succeeded. France, for instance, poured more than $200 million (£153 million) into Nuergy and Cloudwatt – both went under. Gaia-X may face a similarly troubled future. Eline Chivot, a senior policy analyst at the Center for Data Innovation, explains that the timeline is unclear and potentially unrealistic, given that no precise technical details – funding or even what the project will look like – exist. This will not be ideal when it comes to persuading potential users of the credibility of the security underlying the project. “The reason why companies still rely on US cloud giants is because they're actually good,” she says. “I've even talked to people who are critical of US giants who say ‘well, they're still the best.’”
Renda worries that one monster European cloud operator could stifle innovation in the field. Getting European states to cooperate may also be a difficulty. Europe is, as you know very well, not the easiest of places,” he says. “Gaia-X only takes off if you manage to convince member states to trust each other in terms of data flows.”
Another issue will be the response from the major cloud providers. Microsoft has stated that, though they are interested in participation, “in the cloud age we think it is wrong to define sovereignty along territorial borders.” An AWS spokesperson said that Germany and France’s plan “removes many of the fundamental benefits of cloud computing for customers – it restricts freedom of choice, flexibility, and ability to scale globally, without increasing security.”
Gaia-X is open to the rest of the world, as long as they follow the project’s, still undefined, rules on data sovereignty. “So what does that mean?” says Chivot. “You know, what does that mean for a company like Microsoft – they're welcome, but at the same time, they will have to comply to a certain vision of digital sovereignty which may not be me make sense for them.”
The project represents another attempt, like China’s Great Firewall and Russia's Runet, albeit far less extreme, to repatriate data. “Countries will increasingly designate parts of the internet to be critical infrastructure and thereby in need of national control,” says Renda. “And this will likely clash with other parts of the EU agenda, such as the free flow of data.”
Digital Society is a digital magazine exploring how technology is changing society. It's produced as a publishing partnership with Vontobel, but all content is editorially independent. Visit Vontobel Impact for more stories on how technology is shaping the future of society.