"You can throw away all the trash you want, but in the ministries, there is no Amazon": this is how the cloud project director of Dinum (the interministerial digital department of the State) assured us on Tuesday, March 18, that AWS, the cloud division of Amazon, did not host any data from the ministries. So not Amazon, but Microsoft, another American digital giant... ultimately, yes.
Because a review published on March 14 and spotted by Nexton March 18 revealed that the Ministry of National Education will call on Microsoft for its central services and its establishments. Twenty-four hours later, it was La Lettre A that revealed that a public higher education institution, the prestigious Polytechnique engineering school, was discreetly migrating its data to the American giant's cloud.
The two decisions have put European companies and politicians on their toes, particularly at a time when "geopolitical tensions" with the United States are pushing the Old Continent, which is heavily dependent on American companies for digital technology, to become more autonomous. We explain the controversy.
Side A: Pro-European solutions political discourse
Since Donald Trump's return to the White House and the US geopolitical shift, calls to promote and develop European digital solutions have multiplied. The reason is simple: "Today we are 100% dependent on American tools, which means that in the current context, we risk having a problem," summarizes MP Philippe Latombe (The Democrats).
Washington could use Europe's heavy reliance on American digital solutions (cloud, office automation, email, social networks, security, etc.) to put pressure on the governments of the Old Continent. In terms of the trade war, this could translate into "Microsoft prices increasing very sharply" or even "updates not being made," the elected representative from Vendée tells us.
To reduce this dependency, European political leaders – including French ones – are calling for the development and support of the European tech ecosystem. Just last Tuesday, during the day organized by Dinum, Clara Chappaz, the Minister Delegate for AI and Digital Affairs, declared, regarding cloud offerings, that it was time to make "Europe's political choice." In particular, by favoring solutions from European suppliers over those of the American hyperscalers that dominate the market, namely Microsoft Azure, AWS (Amazon) and Google Cloud.
This message was also found among the French Ministers of Europe and Foreign Affairs, Jean-Noël de Galzain, the president of Hexatrust, a group that brings together nearly 150 French and European players in cybersecurity and trusted cloud, told us.
Side B: Microsoft still chosen, y including for sensitive data
In such a context, one could therefore expect that the École Polytechnique and any ministry would not use American companies for their digital services. This explains why French and European digital companies literally fell off their chairs when the two news items about the use of Microsoft were published this week. These decisions are "unacceptable," the CNLL, the Union of Free Software and Open Digital Companies, said in a press release.
"Despite a stated desire for independence from digital technology providers, many projects continue to be entrusted to non-European players," laments OVHCloud, which we contacted.
For Hexatrust, the association representing French and European players in cybersecurity and trusted cloud, this is simply "sabotage." "I'm fine with calling on Microsoft for legacy projects (which has been done before, editor's note). But for new markets, for these €150 million, let's invest them in our industry instead," pleads Jean-Noël de Galzain, the business leader at the head of Hexatrust, regarding the contract with the Ministry of National Education.
"I invite (this ministry, editor's note) to meet with us. I invite them to enter into a framework contract with our industry. And I invite them to trust us because today, (the 150 members of the Hexatrust association) already work with numerous academies, with research centers, with universities, with CROUS. We have to convince them each time, one by one. And meanwhile, we see Microsoft arrive and take a global contract for the entire National Education system. Well, there's a problem!," he protests.
What do these contracts cover?
Microsoft has indeed won a framework contract that provides for expenditures of up to 152 million euros over four years. Its objective: to equip the central services of the Ministry of National Education and higher education institutions with Microsoft solutions.
As for Polytechnique, its IT services will migrate to Microsoft solutions, as student emails have already been transferred to the American company's servers. According to La Lettre A, this choice by Microsoft was made by management alone, without any real consultation. However, the establishment, "under the supervision of the Ministry of the Armed Forces", deals with "data relating to national security", students carrying out "research and teaching activities in strategic and sensitive areas, including military, dual technologies, cybersecurity and quantum", recalls the National Council for Free Software (CNLL).
This is enough to raise internally "serious concerns regarding the protection of exchanges, research work, regarding the risk of technological plundering or of disclosure of sensitive data," says Philippe Latombe. The Vendée MP has sent two written questions to Élisabeth Borne, the Minister of National Education and Higher Education: the parliamentarian is asking for nothing less than the cancellation of these two contracts. Because for the elected official, these decisions are not in accordance with "the State's doctrine." And "the central National Education is doing the opposite of what it asksits rectors to do in each of the academies. This is not normal," the politician protests.
The two decisions are "illegal," adds the CNLL, "they contravene European law (...), national law (internal security code for sensitive data, priority to free software in higher education, SREN2 law, etc.) and government directives (DINUM, etc.)."
Are these decisions illegal?
In France, administrations and higher education institutions cannot choose just any cloud or digital solutions provider. The "Cloud at the center of the State" doctrine, for example, requires the use of a SecNumCloud-certified provider (the highest level of cybersecurity) for hosting all sensitive data of the State and public actors. This label, which includes a clause of immunity from extraterritorial laws, effectively excludes American cloud giants like Amazon, Microsoft Azure and Google Cloud, all three of which are subject to the "Fisa" law and the "Cloud Act".
These two laws require any American company to share all data requested by the American administration, even if the data comes from the Old Continent, and even if it is strategic or sovereign. This constitutes a "right of inspection" or even a potential interference that the French administration wants to avoid with its "Cloud at the center" rule.
For text editing solutions and others, there is also a circular from last February from the Ministry of Education, which is explicitly addressed to rectorates and general secretariats of academies. She asks them to ensure that all use of Microsoft 365 or Google Workspace ends – including in the establishments they supervise.
So why this choice of an American hyperscaler?
Citing these two rules, one of which is now part of the SREN law (aimed at securing and regulating the digital space), Philippe Latombe, in a first written question, asks Elisabeth Borne how she “plans to force the management of Polytechnique to apply the 2021 guidelines of the interministerial digital directorate, prohibiting the deployment of Microsoft 365 in the administration or (…) the so-called “Cloud at the center” circular.”
In the second question, the politician asks Elisabeth Borne how she “plans to terminate the contract” (cancel it, Editor's note) concluded with the Ministry of National Education, in order to be consistent with the circular of last February.
But "what are we waiting for to reconsider our way of purchasing (digital solutions)," asks the president of Hexatrust, interviewed by 01net.com. If for a long time, the use of American companies was explained by the fact that European offers were not up to standard, now, "there is a digital industry in France and Europe that is flourishing" including "a trusted cloud industry, with players that are developing in all countries such as Outscale, OVHcloud, Clever Cloud, Cloud Temple, Scaleway, etc. We also have digital workplaces that offer alternatives," insists the president of Hexatrust.
"Public procurement must be a strategic lever to allow the European Union to regain control of its digital destiny," adds OVHCloud.
Is this recourse to Microsoft explained by a question of habit or convenience, which would be difficult to change? Philippe Latombe, for his part, does not hesitate to speak of "the weakness of an administration that succumbs so easily to the seductive power of this American giant." "The fact that the administration today does not believe that we can have entered a different era with the Americans and that we must therefore break away from American technology to gain autonomy, and that they do not think about it for a single second, is still very embarrassing," he continues. "At some point, the Prime Minister and the government will have to take responsibility and be courageous," he adds. 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol', 'Noto Color Emoji';">Sovereignty, fed up. We need something concrete, we need action. And now, not in three or five years", insists Jean-Noël de Galzain of Hexatrust. Because the equation is simple, he believes: "if we continue to consume digital technology as we do, we will go bankrupt".
0 Comments