T-Systems and Google Cloud building 'sovereign cloud services' for Germany
(2021/09/10)
- Reference: 1631278872
- News link: https://www.theregister.co.uk/2021/09/10/tsystems_and_google_cloud_building/
- Source link:
Google Cloud and T-Systems are to create what the companies call a "sovereign cloud offering" for Germany, though details are sketchy and it may not be digital sovereignty as the term is normally understood.
The project involves T-Systems playing a role in managing "a large spectrum of next-generation cloud solutions and infrastructure… powered by Google Cloud," the European integrator-cum consultancy [1]said .
What does that mean in practice? Key questions include the physical location both of data and the applications that process that data, and management and control of the software that is running. We've asked the duo to respond.
[2]
The service is scheduled to be available by mid-2022, the pair said, and is aimed at German enterprises, public sector and healthcare organisations.
[3]
Google Cloud: suitable for a "sovereign cloud" in Europe?
The Register was also told that: "T-Systems will manage a set of sovereignty controls and measures, including encryption and identity management. In addition, T-Systems will exercise a control function over relevant parts of the German Google Cloud infrastructure. Any physical or virtual access to facilities in Germany (such as routine maintenance and upgrades) will be under the supervision of T-Systems and Google Cloud."
Will some data on occasion be processed outside Germany? What is the scope of T-Mobile's control over the systems? Those things are not clearly stated, but it does say that there will be "full public cloud scale as well as version and feature parity to global network," so what is on offer may be a mini-Google Cloud running entirely in Germany, or some sort of hybrid solution.
[4]
[5]
Google's EMEA veep Adaire Fox-Martin, [6]appointed in August , [7]said : "T-Systems will operate and independently control key parts of the Google Cloud infrastructure" for its German customers, leaving open the question of whether other "key parts" will not be under such control.
Fox-Martin described the project as "Cloud on Europe's Terms."
[8]
That may be a stretch. The French think tank Foundation pour L'Innovation Politique says in its [9]paper on digital sovereignty that the concept was first defined in 2011 by Pierre Bellanger, a French executive, as "control of our present and destiny as manifested and guided by the use of technology and computer networks." Running on systems programmed and controlled by a US corporation is unlikely to conform to that definition.
[10]Cutting the ties: European hosting provider OVHCloud to offer Google Anthos, no Google account needed
[11]UK promises big data law shake-up... while also keeping the EU happy, of course. What could go wrong?
[12]Zoom incompatible with GDPR, claims data protection watchdog for the German city of Hamburg
[13]Dutch education IT crisis averted as Google agrees to 'major privacy improvements'
The [14]EU's paper [PDF] on Digital Sovereignty for Europe talks about "Europe's ability to act independently in the digital world" and criticises "global tech-driven players which do not always obey European rules and fundamental values, and which put data appropriation and valuation at the heart of their strategy" – a description which could well be applied to Google and its advertising business. The paper calls for "investing in digital capacities, infrastructure and technologies" which is unlikely to mean a datacentre or two stuffed with Google software.
Google has its own [15]definition of sovereignty , which as you would expect is more amenable to the cloud giant's approach. It describes data sovereignty as "keep all control over encryption and access to your data"; operational sovereignty as "visibility and control over provider operations"; and software sovereignty as "you can run workloads without dependence on provider's software."
This last point is difficult to unpack. Removing dependence on a provider's software suggests using only open source solutions; but Google Cloud Platform is not open source as a whole, even though it has strong elements of open source, such as the core Kubernetes software in Google Kubernetes Engine, and heavy use of the Linux operating system.
Most Google services though are not entirely open source, and have Google-specific APIs, making avoidance of lock-in challenging.
[16]
Sachiko Muto, CEO of Brussels-based think tank OpenForum Europe told us that: "It is a positive sign that companies are adapting their offerings in recognition of the legitimate right of Europe to set its own terms. For users to be sovereign they should also be able to specify terms that are in addition to those defined by the vendor. Where such offerings are also fully open source they enable the user to scrutinize the claims made by the vendor. Open source thus enhances user control and alleviates lock-in.
"There are many definitions of digital sovereignty/independence/autonomy floating around. It would be preferred if the EU clearly adopted a definition and elaborated the principles that support it."
The EU has its own [17]Gaia-X project for a European cloud which is a quite different thing, using federated services and mandated standards to ensure openness. Getting Gaia-X off the ground is hard though, whereas an existing commercial operator like Google can make its systems available immediately.
The T-System/Google project likely does tick some desirable boxes in terms of management and compliance, but it will not tick all of them, nor will it enable the European software industry to keep pace with the US cloud giants in public cloud technology. ®
Get our [18]Tech Resources
[1] https://www.t-systems.com/de/en/newsroom/news/t-systems-and-google-cloud-partner-to-deliver-sovereign-cloud-for-germany-450474
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offprem/paasiaas&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YTuBOyKVjAcx1mviHQ3n7gAAAIA&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://regmedia.co.uk/2018/07/18/shutterstock_1083498080.jpg
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offprem/paasiaas&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YTuBOyKVjAcx1mviHQ3n7gAAAIA&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offprem/paasiaas&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YTuBOyKVjAcx1mviHQ3n7gAAAIA&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://www.theregister.com/2021/07/30/sap_google_partnership/
[7] https://cloud.google.com/blog/products/identity-security/helping-build-the-digital-future-on-europes-terms
[8] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offprem/paasiaas&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YTuBOyKVjAcx1mviHQ3n7gAAAIA&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[9] https://www.fondapol.org/en/study/digital-sovereignty-steps-towards-a-new-system-of-internet-governance/
[10] https://www.theregister.com/2020/11/11/european_hosting_provider_ovhcloud_will/
[11] https://www.theregister.com/2021/08/26/uk_privacy_law_shakeup_information_commissioner/
[12] https://www.theregister.com/2021/08/17/zoom_incompatible_with_gdpr_hamburg_warning/
[13] https://www.theregister.com/2021/08/11/dpa_dutch_google/
[14] https://www.europarl.europa.eu/RegData/etudes/BRIE/2020/651992/EPRS_BRI(2020)651992_EN.pdf
[15] https://cloud.google.com/blog/products/identity-security/how-google-cloud-is-addressing-data-sovereignty-in-europe-2020
[16] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offprem/paasiaas&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YTuBOyKVjAcx1mviHQ3n7gAAAIA&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[17] https://www.gaia-x.eu/what-is-gaia-x
[18] https://whitepapers.theregister.com/
The project involves T-Systems playing a role in managing "a large spectrum of next-generation cloud solutions and infrastructure… powered by Google Cloud," the European integrator-cum consultancy [1]said .
What does that mean in practice? Key questions include the physical location both of data and the applications that process that data, and management and control of the software that is running. We've asked the duo to respond.
[2]
The service is scheduled to be available by mid-2022, the pair said, and is aimed at German enterprises, public sector and healthcare organisations.
[3]
Google Cloud: suitable for a "sovereign cloud" in Europe?
The Register was also told that: "T-Systems will manage a set of sovereignty controls and measures, including encryption and identity management. In addition, T-Systems will exercise a control function over relevant parts of the German Google Cloud infrastructure. Any physical or virtual access to facilities in Germany (such as routine maintenance and upgrades) will be under the supervision of T-Systems and Google Cloud."
Will some data on occasion be processed outside Germany? What is the scope of T-Mobile's control over the systems? Those things are not clearly stated, but it does say that there will be "full public cloud scale as well as version and feature parity to global network," so what is on offer may be a mini-Google Cloud running entirely in Germany, or some sort of hybrid solution.
[4]
[5]
Google's EMEA veep Adaire Fox-Martin, [6]appointed in August , [7]said : "T-Systems will operate and independently control key parts of the Google Cloud infrastructure" for its German customers, leaving open the question of whether other "key parts" will not be under such control.
Fox-Martin described the project as "Cloud on Europe's Terms."
[8]
That may be a stretch. The French think tank Foundation pour L'Innovation Politique says in its [9]paper on digital sovereignty that the concept was first defined in 2011 by Pierre Bellanger, a French executive, as "control of our present and destiny as manifested and guided by the use of technology and computer networks." Running on systems programmed and controlled by a US corporation is unlikely to conform to that definition.
[10]Cutting the ties: European hosting provider OVHCloud to offer Google Anthos, no Google account needed
[11]UK promises big data law shake-up... while also keeping the EU happy, of course. What could go wrong?
[12]Zoom incompatible with GDPR, claims data protection watchdog for the German city of Hamburg
[13]Dutch education IT crisis averted as Google agrees to 'major privacy improvements'
The [14]EU's paper [PDF] on Digital Sovereignty for Europe talks about "Europe's ability to act independently in the digital world" and criticises "global tech-driven players which do not always obey European rules and fundamental values, and which put data appropriation and valuation at the heart of their strategy" – a description which could well be applied to Google and its advertising business. The paper calls for "investing in digital capacities, infrastructure and technologies" which is unlikely to mean a datacentre or two stuffed with Google software.
Google has its own [15]definition of sovereignty , which as you would expect is more amenable to the cloud giant's approach. It describes data sovereignty as "keep all control over encryption and access to your data"; operational sovereignty as "visibility and control over provider operations"; and software sovereignty as "you can run workloads without dependence on provider's software."
This last point is difficult to unpack. Removing dependence on a provider's software suggests using only open source solutions; but Google Cloud Platform is not open source as a whole, even though it has strong elements of open source, such as the core Kubernetes software in Google Kubernetes Engine, and heavy use of the Linux operating system.
Most Google services though are not entirely open source, and have Google-specific APIs, making avoidance of lock-in challenging.
[16]
Sachiko Muto, CEO of Brussels-based think tank OpenForum Europe told us that: "It is a positive sign that companies are adapting their offerings in recognition of the legitimate right of Europe to set its own terms. For users to be sovereign they should also be able to specify terms that are in addition to those defined by the vendor. Where such offerings are also fully open source they enable the user to scrutinize the claims made by the vendor. Open source thus enhances user control and alleviates lock-in.
"There are many definitions of digital sovereignty/independence/autonomy floating around. It would be preferred if the EU clearly adopted a definition and elaborated the principles that support it."
The EU has its own [17]Gaia-X project for a European cloud which is a quite different thing, using federated services and mandated standards to ensure openness. Getting Gaia-X off the ground is hard though, whereas an existing commercial operator like Google can make its systems available immediately.
The T-System/Google project likely does tick some desirable boxes in terms of management and compliance, but it will not tick all of them, nor will it enable the European software industry to keep pace with the US cloud giants in public cloud technology. ®
Get our [18]Tech Resources
[1] https://www.t-systems.com/de/en/newsroom/news/t-systems-and-google-cloud-partner-to-deliver-sovereign-cloud-for-germany-450474
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offprem/paasiaas&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YTuBOyKVjAcx1mviHQ3n7gAAAIA&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://regmedia.co.uk/2018/07/18/shutterstock_1083498080.jpg
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offprem/paasiaas&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YTuBOyKVjAcx1mviHQ3n7gAAAIA&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offprem/paasiaas&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YTuBOyKVjAcx1mviHQ3n7gAAAIA&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://www.theregister.com/2021/07/30/sap_google_partnership/
[7] https://cloud.google.com/blog/products/identity-security/helping-build-the-digital-future-on-europes-terms
[8] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offprem/paasiaas&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YTuBOyKVjAcx1mviHQ3n7gAAAIA&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[9] https://www.fondapol.org/en/study/digital-sovereignty-steps-towards-a-new-system-of-internet-governance/
[10] https://www.theregister.com/2020/11/11/european_hosting_provider_ovhcloud_will/
[11] https://www.theregister.com/2021/08/26/uk_privacy_law_shakeup_information_commissioner/
[12] https://www.theregister.com/2021/08/17/zoom_incompatible_with_gdpr_hamburg_warning/
[13] https://www.theregister.com/2021/08/11/dpa_dutch_google/
[14] https://www.europarl.europa.eu/RegData/etudes/BRIE/2020/651992/EPRS_BRI(2020)651992_EN.pdf
[15] https://cloud.google.com/blog/products/identity-security/how-google-cloud-is-addressing-data-sovereignty-in-europe-2020
[16] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offprem/paasiaas&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YTuBOyKVjAcx1mviHQ3n7gAAAIA&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[17] https://www.gaia-x.eu/what-is-gaia-x
[18] https://whitepapers.theregister.com/
LDS
Yes - it's an interesting matter if the CLOUD Act applies in this case or not. As long as Google only is a supplier maybe not, but if Google actually owns and runs parts of the infrastructure I'm afraid it can apply.
Anonymous Coward
T-Systems used to do exactly this for Azure but it was canned in 2018 because it inevitably ended up a distant second-class citizen to full-fat Azure, and because of the reality that the main thing stopping Germans from going to the cloud is not German Privacy Law, but German Privacy Paranoia.
Which is of course commendable, but ultimately that paranoia will be overcome by a combination of time, certifications, key management and ultimately: discounts.
Anonymous Coward
Here 'cloud' have our commercial secrets... we totally trust you... signed.... world's third largest exporter.
After the NSA + Denmark spied on Merkel, I doubt they would even like to use non-German servers.
https://www.theguardian.com/world/2021/may/31/denmark-helped-us-spy-on-angela-merkel-and-european-allies-report
I have zero trouble explaining to Germans how to protect their democracy from foreign influence they must necessarily protect their privacy. It's like a 'duh!' to them.
already dead
renke
Google will cancel the product before T-Systems starts to implement it, looking at the modus operandi of the two companies :)
Can happen in Italy as well....
LDS
The Italian government is asking proposal to build the cloud system to consolidate all public administration software and data in. One of the bidders is a group involving TIM - which signed also a deal with Google to offer cloud services in Italy. I didn't heard of bids from groups involving AWS or Azure, yet. The other group is made of Almaviva and Aruba (the Italian cloud provider).
Anyway "digital sovereignty" IMHO means you can keep running your datacenters even when you have to cut ties with some or all the suppliers (at least for a while), and those suppliers can't put their noses into the data, especially if they are foreign ones.
If Google is involved (or MS, or Amazon), I can't believe the services will be 'sovereign'. IIRC, the US laws mandate them to provide data if asked, even if they are stored outside the US.