Dusseldorf If data is stored in the cloud, it is often unclear where exactly it is located – storage space, processor power and application software are often distributed somewhere over several servers, possibly even at different locations around the world. And since Edward Snowden’s revelations, it has become clear that American secret services are monitoring the Internet with great effort.
In the face of data protection concerns, more and more American providers are changing their business – and want to set clear limits on data storage. After Microsoft and Google, Oracle announced a “sovereign” cloud offering on Monday. This includes a separate infrastructure within the European Union (EU), which should only be operated by EU citizens.
For customers, digital sovereignty has become a key requirement for cloud use in recent years, Oracle manager Regis Louis told Handelsblatt. In the EU, there are high requirements due to regulation – which is why the group has developed a special offer for the region. The launch is planned for 2023.
“Cloud providers recognize that customers and regulators in some industries are making data more stringent requirements,” Paul McKay, analyst at Forrester, told Handelsblatt. This applies to the public sector, healthcare and the financial services industry, but also to many German mechanical engineering companies.
Top jobs of the day
Find the best jobs now and
be notified by email.
Oracle must react to this, which is far behind AWS and Microsoft with a market share of around two percent for IT infrastructure from the cloud. Digital sovereignty is an important factor in some segments, Louis said, such as in the public sector or highly regulated industries – the new offering has “a direct impact on business”.
What can the secret services see?
The use of cloud services has increased significantly in recent years, but there are still concerns about data security and data protection. In the Cloud Monitor from Bitkom and KPMG, for example, 70 percent of the companies surveyed state that a data center in the legal territory of the EU is essential.
Even if Microsoft, Google or AWS store the data in European data centers, these are not necessarily secure from the point of view of experts. With the Cloud Act, which has been in force since 2018, US authorities can demand the disclosure of information that IT providers store abroad. In view of the findings of the Snowden revelations, the European Court of Justice declared important legal bases for the data transfer from Europe to the USA to be invalid with the Schrems judgments.
The EU Commission is currently negotiating with the US government an agreement that will put data exchange between the two economic areas on a new legal basis. However, many companies don’t want to wait – the uncertainty is bad for business.
>> Read also: Are Facebook and Instagram threatened with extinction in Europe? Irish authority escalates data dispute
For example, AWS and Microsoft have introduced terms and conditions that are intended to limit the transfer of data to the USA as much as possible – the Windows group, for example, even promises a “data limit”. New technologies should also increase the level of protection, for example through encryption.
The companies are also developing trustee concepts. Since the spring, customers have been able to have Google’s cloud solutions operated by T-Systems, and AWS is also planning to work with the Telekom subsidiary. SAP and Arvato, in turn, founded the joint venture Delos to offer public administration cloud solutions from Microsoft.
What exactly does sovereign mean?
Oracle wants to set up its own company for operation and maintenance, in which only EU citizens should work. This construction ensures compliance with EU rules, Louis explained. However, the unit is said to belong to the group and thus be dependent on the management in Austin, Texas.
That raises questions – for example, how Oracle wants to prevent access from US authorities via the Cloud Act. Louis referred to additional guidelines intended to create a framework to ensure customers have control over data and operations. The group will publish details later.
It is therefore unclear whether Oracle meets the requirements of the Federal Office for Information Security (BSI), which tests cloud services before they are used in federal agencies and ministries. These stipulate that clients can operate the systems “independently, irrevocably and thus sovereignly” from the provider.
>> Also read: SAP offers cloud data migration to customers in Russia
The construction of a separate infrastructure is associated with considerable costs. Oracle manager Louis did not quantify the investments, but emphasized that new data centers had to be set up and additional staff had to be hired. The economies of scale promised by the computing factories of the cloud do not materialize.
Nevertheless, Oracle wants to do without higher prices, the services should cost the same as in the existing cloud data centers. The range of products should also be the same. The goal is to achieve “significant differentiation,” Louis said. In other words, the group wants to stand out from the competition.
That is also necessary. IT infrastructure from the cloud is a growth business, in the first quarter the market researcher Synergy Research recorded an increase of 37 percent to almost 53 billion dollars. However, if you exclude China, the market is concentrated in the big three, AWS, Microsoft and Google, according to analyst John Dinsdale. The competitors would therefore have to differentiate themselves.
In view of the many announcements, however, companies can easily lose track. Forrester analyst McKay advises reviewing the concepts closely. “Frankly, some of the promises aren’t worth the paper they’re written on.”
Companies should therefore clarify which applications require a special level of protection – and what price they are willing to pay for it.
More: Strong increase – Every tenth company in Germany uses AI