10 ms·

France bans Office 365 and Google Docs from schools and public administration

403 points by andrepd 4y ago

BMc2020 4y ago
As the ministry explains in its response, in the Dinum circular, it is clearly stated that "the deployment of Office 365 is prohibited in French administrations". The State's interministerial digital director has decided to intervene to protect the "sensitive data" held by several public officials. According to the circular published in 2021, it is written that data should no longer be hosted on Microsoft 365 cloud services, to protect it from a possible security breach or even misuse by US intelligence services.
russianGuy83829 4y ago
Great news! Now ban adobe
eatonphil 4y ago
It doesn't seem from this post nor the source text if there is a product they particularly recommend. But I guess from the "cloud at center" issue they would be fine with normal Office (the offline only suite) and LibreOffice/OpenOffice?
- kasajian 4y ago
  There is nothing to prevent an organization from deploying office 365, and simply use the desktop apps only, never storing any data off-site. The only difference between that and installing the non-365 version of the office products is that the software updates are more seemless.
  - eikenberry 4y ago
    And they only run on a few operating systems.
  - lrvick 4y ago
    A malicious software update could still exfiltrate all documents in plaintext. If you do not trust a third party to store your data, then you cannot trust any of their proprietary binaries to access your data either.
    - gigel82 4y ago
      So, Microsoft will push an update to extract the data? Did you forget a "/s" tag? I mean... Windows is also owned by Microsoft, so they should ban all use of Windows. And also ban any binary distribution of software of any kind (yup, all school teachers will build their Linux from source now). Oh wait, a third party is making the firmware in your CPUs, better build those from scratch too... go get your pickaxe - you're going mining. </s>
      - lrvick 4y ago
        I am totally serious. If the French Government has a goal of digital sovereignty and defending against entities like the NSA taking their data, then this is what it takes to meet that threat model. A state actor could certainly compromise a Microsoft binary signing key with or without the cooperation of Microsoft. Whoever controls the key that signs the binaries that touch your data, controls your data. Using reproducible builds of open/audited software and firmware is a great start to make third party exfiltration of data more expensive. Next would be removing known backdoors like Intel ME until a migration can be made to open/audited hardware as well. The path France is on is an expensive one to be sure, but if they stop at only ceasing use of offshore cloud services they are kidding themselves.
mavu 4y ago
Long overdue. Should happen in all European countries.
- nine_k 4y ago
  What is going to be a replacement?
  - 867-5309 4y ago
    notepad.exe edit: okay then, Wordpad!
  - eternalban 4y ago
    It's not a fusion reactor we're talking about here. I'm sure the very smart and capable CS types in INRIA could manage it. https://www.w3.org/Amaya/ https://www.w3.org/Amaya/ (Started in -1996- "in conjunction with W3C") Can't find where I read this, but in context of [packet switching] and the French variant, it was claimed Valéry Giscard d'Estaing put an end to the French variant, due to US pressure. (I think it was the Louis Pouzin interview in Oral History.) France should be kicking ass in software & computing. The mystery is why it isn't competing with Google, Facebook, etc. [update] An Interview with Louis Pouzin, conducted by Andrew L. Russell, Paris, France, 2012 ---- source: https://conservancy.umn.edu/bitstream/handle/11299/155666/oh416lp.pdf https://conservancy.umn.edu/bitstream/handle/11299/155666/oh... [pp 17-18] ---- But on the other hand, the French délégation à l’informatique were powerful. Fortunately for them, President Pompidou died. And then we had a new president called Giscard d’Estaing. And Giscard d’Estaing was not in the same mentality; Pompidou was still a follower of De Gaulle’s policy. De Gaulle’s policy was to be independent from the American. And CII in building a network was in a way a continuation of the same policy – become independent. But Giscard absolutely had no technology vision. He was interested in politics, but not in technical things. He had advisors who had no technical training. They were people from Ecole nationale d’administration, and people who make rectangles, and put arrows between rectangles, and they think it’s going to work. <laughter> So they dissolved the délégation à l’informatique. Finished. Disbanded. <laughter> And as a result, our funding was cut. And they also joined together CII and Honeywell-Bull and made CII-Honeywell-Bull, a new company. And this new company which had not much experience in networking, they said they would take our technology and develop it in their own system. The guy who was at that time heading Bull was an engineer. He had been at IBM before, and he was a guy who understood very well strategy and technology. So I think he was pretty convinced that it was a good deal to get what we had developed. But he had been put in place by the technical group, which was also a partner in CII, and this group was Thomson. Thomson was typically a company that was making electro-mechanical devices, but also working for the army, for the military, for the aerospace and so on. And here you had CG, which was a huge group – all kinds of electrical things – and téléphonie. CG had apparently put a lot of money into supporting Giscard’s election everywhere. You know, the lobbyists finance the elections. And why did they finance the elections? It’s because they didn’t like the government policy with Thomson, because Thomson had decided to go into téléphonie. And that was extremely displeasing for General Electric, for CG, because they were not the monopoly but the dominant provider in France. There were other ones, but they were the big one. And to them, introducing another competitor in téléphonie was not very attractive. In addition to that, the délégation à l’informatique had put up an industrial group called Unidata. And Unidata was CII, Siemens, Plessey in the U.K., Olivetti in Italy, and Phillips in the Netherlands. So this Unidata group had a strategy to develop a product series by sharing engineering, sharing development, and having each one a particular specialty. And they had decided, for example, that Siemens... Siemens also was in computing, but they were not very dominant. And so they had decided that Siemens would close down the computing subsidiary they had in France. And on the other hand, the French would close their computing subsidiary in Germany. So each one would have its own clean territory. And that means that for Compagnie générale d’electricité in France that Siemens was becoming a partner of a big French company and, therefore, it certainly would be detrimental to their market for the téléphonie. The delegate from the informatique told me that. They wanted to scatter Thomson’s enterprises in téléphonie, and financing Giscard was probably a way to push them to that direction. And once Giscard was elected, so they disbanded Unidata. Siemens was furious about that because it was really treason for them. <laughter> -- end -- https://en.wikipedia.org/wiki/Louis_Pouzin https://en.wikipedia.org/wiki/Louis_Pouzin
drpixie 4y ago
Nice to see someone taking privacy a little more seriously. The cloud has it's place but I've never been happy with the underhanded way that Office 365 "encourages" users to save to the cloud. When someone pays for one service, and is continuously pushed to use another (with additional downstream costs), I wonder isn't it time to pursue antitrust?
- busterarm 4y ago
  France isn't taking privacy seriously. They're the most advanced nation on the planet in terms of industrial espionage. What they're concerned about is not having their businesses operate at the whims of and be open to disruption by Americans. I work at a company that has a French government service as a customer. They are super sensitive to their data transiting across US servers but have zero concerns about transit through the rest of Europe...including Europe's "fourteen eyes" nations.
  - PoignardAzur 4y ago
    > They're the most advanced nation on the planet in terms of industrial espionage. Citation needed. (Especially given that the other two contenders are the US and China)
    - busterarm 4y ago
      https://www.france24.com/en/20110104-france-industrial-espionage-economy-germany-russia-china-business https://www.france24.com/en/20110104-france-industrial-espio... https://www.lawfareblog.com/french-espionage https://www.lawfareblog.com/french-espionage https://www.cbsnews.com/news/wikileaks-france-leads-russia-china-in-industrial-spying-in-europe/ https://www.cbsnews.com/news/wikileaks-france-leads-russia-c... This is pretty widely known. Especially in the Defense industry and their world class industrial espionage skill goes all the way back to the eighteenth century. It's not "citation needed", you're just ignorant of history.
      - hikingsimulator 4y ago
jojobas 4y ago
About time.
cloudking 4y ago
Zoho has entered the chat. Seriously though, what are they supposed to use now?
- chris_wot 4y ago
  LibreOffice.
  - trelane 4y ago
    Or some version of Collabora (LibreOffice with support)
    - chris_wot 4y ago
      That would be the ideal! These guys (and Allotropia) do amazing work.
- mig39 4y ago
  I guess they could use normal Microsoft Office (not the cloud version).
- jeroenhd 4y ago
  Microsoft Office, locally, for document editing. For simultaneous cloud editing they'll have to switch to alternatives such as NextCloud, OnlyOffice, Open-Xchange, you name it. Plenty of fish in the sea, each with their own advantages and disadvantages. Some scale great for small primary schools, others scale better for high schools and universities. This entire problem could've been solved years ago when the GDPR grace period started; then when Safe Harbor blew up as expected by just about everyone, they had another chance to start working on a fix. Then the fix should've had priority since Privacy Shield was invalidated, because they have been in violation of the law since. I'm sure institutions will cry foul and beg the government not to fine them because they could've never seen it coming, because the solution to privacy laws always seems to be "ignore the law and pretend you'll never get caught".
- npteljes 4y ago
  ONLYOFFICE can also do collaborative online editing, and sharing, for free (and it's also open source!) https://personal.onlyoffice.com/ https://personal.onlyoffice.com/
MichaelZuo 4y ago
How will this law be enforced?
- 4str0n0mer 4y ago
  Since it is about public institutions, any public servant disobeying will be disciplined. That can include strongly worded letters, demotions or even firing. For public institutions spending money on (for them) illegal goods, activities or licenses is not possible, which means that any receipt they hand in for that won't ever get reimbursed. Which also means they wouldn't get the goods in the first place, because the business selling them knows they will get stiffed.
  - MichaelZuo 4y ago
    Isn’t it notoriously difficult to fire or demote anyone in the french bureaucracy?
- Bayart 4y ago
  IT departments in the various branches of the administration have to follow the guidelines of the government, it's not really hard to implement in that sense. What's harder is avoiding shadow IT.
  - MichaelZuo 4y ago
    Shadow IT implies that IT departments don’t care enough to expend effort to crack down. Is that common in France?
    - Bayart 4y ago
      My work experience is that it happens everywhere crackdowns and directives get in the way of productivity. Ultimately between getting things done and sticking to the rules, people often pick the first option. I'm also guilty of it to an extent.
lousken 4y ago
what other email services are good enough for enterprise and government? apart from exchange on-premise
- ksidudwbw 4y ago
  smtp protocol
- Torwald 4y ago
  Avaya maybe?
- vouaobrasil 4y ago
  What about a plain old email server set up in house? Maybe it would cost more and have less features, but it sounds like a good price to pay to avoid Google and Microsoft. Email after all does not have to be centrally managed because of the way it works.
g42gregory 4y ago
I think that this move isn't so much about privacy. I think that French government is beginning to realize that these types of products and services constitute critical IT infrastructure for the country. As such, these products can not be offered by a foreign country, no matter how friendly. I suspect the government offices will be next. I am not actually sure, what alternatives are out there for MS Office and Google Docs?
- zahma 4y ago
  Libre Office. Not so sure that it integrates very well with cloud services, though I’ve not tried. It’s a bit of a step back from collaboration on a Google Doc. However, for basic functionality, I’m quite fine with word processing on Libre Office.
  - judge2020 4y ago
    Microsoft Office isn't banned, just Workspace / M365 / Azure Active Directory as users' IDP.
- thwayunion 4y ago
  You can still just buy Office and not use the 365 offering [1]. The ban on Office 365 doesn't look like it's relevant to Office 2021. Aside, both LibreOffice and Apple's office suite are perfectly serviceable for K12 education and most public administration. [1] https://support.microsoft.com/en-us/office/what-s-the-difference-between-microsoft-365-and-office-2021-ed447ebf-6060-46f9-9e90-a239bd27eb96 https://support.microsoft.com/en-us/office/what-s-the-differ...
  - JamesianP 4y ago
    I can't read the article (but gazing at the words, I almost feel like I can...) but I'd guess that all of their software needs are covered by other software systems licensed by the govt. And that this ban is more to make people stop using free cloud services instead of them.
  - westcort 4y ago
deleted 4y ago
[deleted]
StephenAmar 4y ago
The article specifically refers to the free edu versions of office and workspace. What about the paid ones?
- pcurve 4y ago
  “The CNIL recommends that institutions use collaborative suites offered by service providers exclusively subject to European law and "that host data within the European Union and do not transfer it to the United States". The centrist deputy had asked the Ministry of Pap NDiaye to find out if Microsoft's free offer in schools did not "become a form of dumping and unfair competition". Sounds like there are multiple angles to this. Privacy. Monopoly. National security. So it’s not just about it being free.
bubblicious 4y ago
Just to clarify, they are only banning the usage of the free offerings of Office and Workspace which do not provide the data governance / compliance features. The higher tiers of Workspace/Office provide this functionality.
- darknavi 4y ago
  That's a pretty critical distinction.
  - makeitdouble 4y ago
    It's an important point, but doesn't remove weight from the decision. First, Google Docs is out of window either way. Then a specific budget needs to be approved to use Office, which will reduce its use to only people actually needing it (just reading docs produced elsewhere won't be enough)
    - dmak 4y ago
      > but doesn't remove weight from the decision. Why? They can still use it, but under the non-free version which is under the necessary compliance.
      - edgyquant 4y ago
        Which costs cash that has to come from a budget
        _8j50 4y ago
        Which they have to pay for anyways since they are schools and public admins.
        belltaco 4y ago
        Who uses the free version of Office 365?
Eleison23 4y ago
I'm a traditionally very paranoid, very DIY admin/hacker type. A knowledgeable friend turned my opinion to the cloud a few years ago. He simply asked me whether I had DLP, an IPS and enterprise-grade firewall for my home systems. With that line of questioning, he made me realize that no jerry-rigged home-built network system can hold a candle to the security and robustness of a cloud solution, even a mere consumer-grade OneDrive or BackBlaze or something like that. Since then I haven't really kept anything important on local storage. It's in the cloud, for better or worse now.
- neffy 4y ago
  The cloud is just as vulnerable as everything else is: https://www.amazon.com/Hack-Like-Ghost-Sparc-Flow-ebook/dp/B08FH9SQNG https://www.amazon.com/Hack-Like-Ghost-Sparc-Flow-ebook/dp/B...
- jeroenhd 4y ago
  Cloud can certainly be secure, assuming the security can be verified (through audits and/or open source clients) and the data is end-to-end encrypted. The cloud isn't the problem, the active data collection that cloud companies do on your unencrypted data is.
- numpad0 4y ago
  But do those firewalls work…? They seem to be too often serving as an attack vector.
- stephen_g 4y ago
  Yeah, but who’s going to seriously spend much time and effort to try and attack you? Obviously you are always at risk of automated attacks when a vulnerability comes out and attackers scan the internet for any exposed service vulnerable to it, but otherwise you’re not anything like the kind of target that a cloud provider would be (that they’d try to random for millions of dollars if they’re successful, and would have the personal data of millions of people to sell on the dark web when they don’t pay). Unless you’re known to have data that’s particularly interesting, your risk is nothing like what they face…
johndhi 4y ago
This is the type of thing that would be more effective if they focused on publicizing it and publicly pressuring the company to provide a solution that meets their needs. Once they say "bye," msft has no incentive to fix it.
robust-cactus 4y ago
CNIL is a pretty ridiculous organization of buearcrats. They'd rather pummel even a French company to the ground with fines rather than discuss anything. Their policies aren't particularly best practice either - you could build things better than they recommend but if it doesn't meet their requirement they'll annihilate you with fines.
- Rexxar 4y ago
  Can you give us at least one example ?
  - robust-cactus 4y ago
    Look at their password requirements : 1 symbol, 1 uppercase letter, 1 lowercase letter, 1 number - when we know that security folks at this point would say "any easy to remember phrase is better than random characters". And they will fine you to death if you don't enforce all the characters. There's a few mentions online about companies that have gone out of business or fined like crazy - whether they're warranted or not isn't the question. There's an article on tech crunch about Fidzup that shares a nice extreme case. I don't think 1 nations DPA should be able to unilaterally make decisions for entire platforms or the planet. Moreover, they're absolutely terrible to work with.
    - Rexxar 4y ago
      I see what you say in old recommendation but a recommendation is just a baseline you can change if you justify it. The new version seems to be in line with what you want : https://www.cnil.fr/sites/default/files/atoms/files/draft_recommendation_-_passwords_and_other_unshared_secrets_version_for_public_consultation.pdf https://www.cnil.fr/sites/default/files/atoms/files/draft_re... For Fidzup there was no monetary sanction. Investor have just walk away when they learned there was an inquiry. All sanction are published : https://www.cnil.fr/fr/thematique/cnil/sanctions https://www.cnil.fr/fr/thematique/cnil/sanctions I don't find anything crazy.
khana 4y ago
ExecutiveDre 4y ago
Wish I knew French. What’s the TLDR in English lol
- bhauer 4y ago
  TLDR: https://addons.mozilla.org/en-US/firefox/addon/firefox-translations/ https://addons.mozilla.org/en-US/firefox/addon/firefox-trans...
mdmglr 4y ago
What about on-prem office?
hnburnsy 4y ago
32 Connected experiences that analyze your content in Microsoft 365 Apps for enterprise... https://learn.microsoft.com/en-us/deployoffice/privacy/connected-experiences https://learn.microsoft.com/en-us/deployoffice/privacy/conne...
Kukumber 4y ago
Congrats! This should have been banned many years ago, in whole Europe Asia/Africa follow along and encourage local or free, non-profit open source alternatives
- Hnrobert42 4y ago
  What should have been banned specifically? This isn’t a ban on commercial software.
mr90210 4y ago
Brazil is years ahead of EU countries in this matter.
martin_henk 4y ago
We probably need a new way of handling these dependencies on tech firms. I don't think libre office or any other thing can replace MS Office. There should be another way to deal with it.
gigel82 4y ago
I'm curious about what alternatives they're proposing. That's 98% of the market right there (citation needed).
Brian_K_White 4y ago
Good. It doesn't matter that it's incomplete. They can still use Office without 365, etc. It's not a real principled fundamental policy about all public/government code and documents and data and formats etc. It doesn't matter what the real reason is. Even for example the cynical idea that it's just to force favoring some other private entity. Still good. It's good even purely for the optics that it's even possible, for any reason at all. As it is it does do a lot of direct good already, but even if it did nothing more than make the concept of "we don't need to use office365 or google" less crazy sounding the next time someone tries to take a government open source and open data and open data formats, or even merely reject the servicication of things that don't actually require it, that is already a good thing all by itself. And the fact that it pushes back against the indoctrination of kids to accept that as just a universal fact of life is just that much better.
mmmpop 4y ago
abraham 4y ago
Good time for Google Workspace to be testing client side encryption. https://support.google.com/a/answer/10741897 https://support.google.com/a/answer/10741897
calacatta 4y ago
According to Peter Zeihan, France (along with Turkey & a few others) will be emergent empires of the post-globalist age. There is ample precedent for and, and for some countries, explicit codification of using commercial tech products for state ends, particularly espionage. So a) this is not a surprising direction at all and b) this sets up a nice little pre-fertilized, fully-walled-off plot for a French omnibus tech company to explode into.
aborsy 4y ago
Andrew Bustamante says on Fridman podcast that French government intelligence agency is number one in the world in industrial espionage. France might also be the country that “bans the most”. Privacy is probably used as a tool in business.
sontek 4y ago
I like the genera idea of not using the big companies and forcing them into compliance but if the France government is anything like the USA gov I can't imagine them running a self-hosted solution like NextCloud at the same level of security, compliance, and reliability that are imposed on MS and Google.

403 points by andrepd 4y ago

BMc2020 4y ago

As the ministry explains in its response, in the Dinum circular, it is clearly stated that "the deployment of Office 365 is prohibited in French administrations". The State's interministerial digital director has decided to intervene to protect the "sensitive data" held by several public officials. According to the circular published in 2021, it is written that data should no longer be hosted on Microsoft 365 cloud services, to protect it from a possible security breach or even misuse by US intelligence services.

russianGuy83829 4y ago

Great news! Now ban adobe

eatonphil 4y ago

It doesn't seem from this post nor the source text if there is a product they particularly recommend. But I guess from the "cloud at center" issue they would be fine with normal Office (the offline only suite) and LibreOffice/OpenOffice?

kasajian 4y ago
There is nothing to prevent an organization from deploying office 365, and simply use the desktop apps only, never storing any data off-site. The only difference between that and installing the non-365 version of the office products is that the software updates are more seemless.
- eikenberry 4y ago
  And they only run on a few operating systems.
- lrvick 4y ago
  A malicious software update could still exfiltrate all documents in plaintext. If you do not trust a third party to store your data, then you cannot trust any of their proprietary binaries to access your data either.
  - gigel82 4y ago
    So, Microsoft will push an update to extract the data? Did you forget a "/s" tag? I mean... Windows is also owned by Microsoft, so they should ban all use of Windows. And also ban any binary distribution of software of any kind (yup, all school teachers will build their Linux from source now). Oh wait, a third party is making the firmware in your CPUs, better build those from scratch too... go get your pickaxe - you're going mining. </s>
    - lrvick 4y ago
      I am totally serious. If the French Government has a goal of digital sovereignty and defending against entities like the NSA taking their data, then this is what it takes to meet that threat model. A state actor could certainly compromise a Microsoft binary signing key with or without the cooperation of Microsoft. Whoever controls the key that signs the binaries that touch your data, controls your data. Using reproducible builds of open/audited software and firmware is a great start to make third party exfiltration of data more expensive. Next would be removing known backdoors like Intel ME until a migration can be made to open/audited hardware as well. The path France is on is an expensive one to be sure, but if they stop at only ceasing use of offshore cloud services they are kidding themselves.

mavu 4y ago

Long overdue. Should happen in all European countries.

nine_k 4y ago
What is going to be a replacement?
- 867-5309 4y ago
  notepad.exe edit: okay then, Wordpad!
- eternalban 4y ago
  It's not a fusion reactor we're talking about here. I'm sure the very smart and capable CS types in INRIA could manage it. https://www.w3.org/Amaya/ https://www.w3.org/Amaya/ (Started in -1996- "in conjunction with W3C") Can't find where I read this, but in context of [packet switching] and the French variant, it was claimed Valéry Giscard d'Estaing put an end to the French variant, due to US pressure. (I think it was the Louis Pouzin interview in Oral History.) France should be kicking ass in software & computing. The mystery is why it isn't competing with Google, Facebook, etc. [update] An Interview with Louis Pouzin, conducted by Andrew L. Russell, Paris, France, 2012 ---- source: https://conservancy.umn.edu/bitstream/handle/11299/155666/oh416lp.pdf https://conservancy.umn.edu/bitstream/handle/11299/155666/oh... [pp 17-18] ---- But on the other hand, the French délégation à l’informatique were powerful. Fortunately for them, President Pompidou died. And then we had a new president called Giscard d’Estaing. And Giscard d’Estaing was not in the same mentality; Pompidou was still a follower of De Gaulle’s policy. De Gaulle’s policy was to be independent from the American. And CII in building a network was in a way a continuation of the same policy – become independent. But Giscard absolutely had no technology vision. He was interested in politics, but not in technical things. He had advisors who had no technical training. They were people from Ecole nationale d’administration, and people who make rectangles, and put arrows between rectangles, and they think it’s going to work. <laughter> So they dissolved the délégation à l’informatique. Finished. Disbanded. <laughter> And as a result, our funding was cut. And they also joined together CII and Honeywell-Bull and made CII-Honeywell-Bull, a new company. And this new company which had not much experience in networking, they said they would take our technology and develop it in their own system. The guy who was at that time heading Bull was an engineer. He had been at IBM before, and he was a guy who understood very well strategy and technology. So I think he was pretty convinced that it was a good deal to get what we had developed. But he had been put in place by the technical group, which was also a partner in CII, and this group was Thomson. Thomson was typically a company that was making electro-mechanical devices, but also working for the army, for the military, for the aerospace and so on. And here you had CG, which was a huge group – all kinds of electrical things – and téléphonie. CG had apparently put a lot of money into supporting Giscard’s election everywhere. You know, the lobbyists finance the elections. And why did they finance the elections? It’s because they didn’t like the government policy with Thomson, because Thomson had decided to go into téléphonie. And that was extremely displeasing for General Electric, for CG, because they were not the monopoly but the dominant provider in France. There were other ones, but they were the big one. And to them, introducing another competitor in téléphonie was not very attractive. In addition to that, the délégation à l’informatique had put up an industrial group called Unidata. And Unidata was CII, Siemens, Plessey in the U.K., Olivetti in Italy, and Phillips in the Netherlands. So this Unidata group had a strategy to develop a product series by sharing engineering, sharing development, and having each one a particular specialty. And they had decided, for example, that Siemens... Siemens also was in computing, but they were not very dominant. And so they had decided that Siemens would close down the computing subsidiary they had in France. And on the other hand, the French would close their computing subsidiary in Germany. So each one would have its own clean territory. And that means that for Compagnie générale d’electricité in France that Siemens was becoming a partner of a big French company and, therefore, it certainly would be detrimental to their market for the téléphonie. The delegate from the informatique told me that. They wanted to scatter Thomson’s enterprises in téléphonie, and financing Giscard was probably a way to push them to that direction. And once Giscard was elected, so they disbanded Unidata. Siemens was furious about that because it was really treason for them. <laughter> -- end -- https://en.wikipedia.org/wiki/Louis_Pouzin https://en.wikipedia.org/wiki/Louis_Pouzin

drpixie 4y ago

Nice to see someone taking privacy a little more seriously. The cloud has it's place but I've never been happy with the underhanded way that Office 365 "encourages" users to save to the cloud. When someone pays for one service, and is continuously pushed to use another (with additional downstream costs), I wonder isn't it time to pursue antitrust?

busterarm 4y ago
France isn't taking privacy seriously. They're the most advanced nation on the planet in terms of industrial espionage. What they're concerned about is not having their businesses operate at the whims of and be open to disruption by Americans. I work at a company that has a French government service as a customer. They are super sensitive to their data transiting across US servers but have zero concerns about transit through the rest of Europe...including Europe's "fourteen eyes" nations.
- PoignardAzur 4y ago
  > They're the most advanced nation on the planet in terms of industrial espionage. Citation needed. (Especially given that the other two contenders are the US and China)
  - busterarm 4y ago
    https://www.france24.com/en/20110104-france-industrial-espionage-economy-germany-russia-china-business https://www.france24.com/en/20110104-france-industrial-espio... https://www.lawfareblog.com/french-espionage https://www.lawfareblog.com/french-espionage https://www.cbsnews.com/news/wikileaks-france-leads-russia-china-in-industrial-spying-in-europe/ https://www.cbsnews.com/news/wikileaks-france-leads-russia-c... This is pretty widely known. Especially in the Defense industry and their world class industrial espionage skill goes all the way back to the eighteenth century. It's not "citation needed", you're just ignorant of history.
    - hikingsimulator 4y ago

jojobas 4y ago

About time.

cloudking 4y ago

Zoho has entered the chat. Seriously though, what are they supposed to use now?

chris_wot 4y ago
LibreOffice.
- trelane 4y ago
  Or some version of Collabora (LibreOffice with support)
  - chris_wot 4y ago
    That would be the ideal! These guys (and Allotropia) do amazing work.
mig39 4y ago
I guess they could use normal Microsoft Office (not the cloud version).
jeroenhd 4y ago
Microsoft Office, locally, for document editing. For simultaneous cloud editing they'll have to switch to alternatives such as NextCloud, OnlyOffice, Open-Xchange, you name it. Plenty of fish in the sea, each with their own advantages and disadvantages. Some scale great for small primary schools, others scale better for high schools and universities. This entire problem could've been solved years ago when the GDPR grace period started; then when Safe Harbor blew up as expected by just about everyone, they had another chance to start working on a fix. Then the fix should've had priority since Privacy Shield was invalidated, because they have been in violation of the law since. I'm sure institutions will cry foul and beg the government not to fine them because they could've never seen it coming, because the solution to privacy laws always seems to be "ignore the law and pretend you'll never get caught".
npteljes 4y ago
ONLYOFFICE can also do collaborative online editing, and sharing, for free (and it's also open source!) https://personal.onlyoffice.com/ https://personal.onlyoffice.com/

MichaelZuo 4y ago

How will this law be enforced?

4str0n0mer 4y ago
Since it is about public institutions, any public servant disobeying will be disciplined. That can include strongly worded letters, demotions or even firing. For public institutions spending money on (for them) illegal goods, activities or licenses is not possible, which means that any receipt they hand in for that won't ever get reimbursed. Which also means they wouldn't get the goods in the first place, because the business selling them knows they will get stiffed.
- MichaelZuo 4y ago
  Isn’t it notoriously difficult to fire or demote anyone in the french bureaucracy?
Bayart 4y ago
IT departments in the various branches of the administration have to follow the guidelines of the government, it's not really hard to implement in that sense. What's harder is avoiding shadow IT.
- MichaelZuo 4y ago
  Shadow IT implies that IT departments don’t care enough to expend effort to crack down. Is that common in France?
  - Bayart 4y ago
    My work experience is that it happens everywhere crackdowns and directives get in the way of productivity. Ultimately between getting things done and sticking to the rules, people often pick the first option. I'm also guilty of it to an extent.

lousken 4y ago

what other email services are good enough for enterprise and government? apart from exchange on-premise

ksidudwbw 4y ago
smtp protocol
Torwald 4y ago
Avaya maybe?
vouaobrasil 4y ago
What about a plain old email server set up in house? Maybe it would cost more and have less features, but it sounds like a good price to pay to avoid Google and Microsoft. Email after all does not have to be centrally managed because of the way it works.

g42gregory 4y ago

I think that this move isn't so much about privacy. I think that French government is beginning to realize that these types of products and services constitute critical IT infrastructure for the country. As such, these products can not be offered by a foreign country, no matter how friendly. I suspect the government offices will be next. I am not actually sure, what alternatives are out there for MS Office and Google Docs?

zahma 4y ago
Libre Office. Not so sure that it integrates very well with cloud services, though I’ve not tried. It’s a bit of a step back from collaboration on a Google Doc. However, for basic functionality, I’m quite fine with word processing on Libre Office.
- judge2020 4y ago
  Microsoft Office isn't banned, just Workspace / M365 / Azure Active Directory as users' IDP.
thwayunion 4y ago
You can still just buy Office and not use the 365 offering [1]. The ban on Office 365 doesn't look like it's relevant to Office 2021. Aside, both LibreOffice and Apple's office suite are perfectly serviceable for K12 education and most public administration. [1] https://support.microsoft.com/en-us/office/what-s-the-difference-between-microsoft-365-and-office-2021-ed447ebf-6060-46f9-9e90-a239bd27eb96 https://support.microsoft.com/en-us/office/what-s-the-differ...
- JamesianP 4y ago
  I can't read the article (but gazing at the words, I almost feel like I can...) but I'd guess that all of their software needs are covered by other software systems licensed by the govt. And that this ban is more to make people stop using free cloud services instead of them.
- westcort 4y ago

deleted 4y ago

[deleted]

StephenAmar 4y ago

The article specifically refers to the free edu versions of office and workspace. What about the paid ones?

pcurve 4y ago
“The CNIL recommends that institutions use collaborative suites offered by service providers exclusively subject to European law and "that host data within the European Union and do not transfer it to the United States". The centrist deputy had asked the Ministry of Pap NDiaye to find out if Microsoft's free offer in schools did not "become a form of dumping and unfair competition". Sounds like there are multiple angles to this. Privacy. Monopoly. National security. So it’s not just about it being free.

bubblicious 4y ago

Just to clarify, they are only banning the usage of the free offerings of Office and Workspace which do not provide the data governance / compliance features. The higher tiers of Workspace/Office provide this functionality.

darknavi 4y ago
That's a pretty critical distinction.
- makeitdouble 4y ago
  It's an important point, but doesn't remove weight from the decision. First, Google Docs is out of window either way. Then a specific budget needs to be approved to use Office, which will reduce its use to only people actually needing it (just reading docs produced elsewhere won't be enough)
  - dmak 4y ago
    > but doesn't remove weight from the decision. Why? They can still use it, but under the non-free version which is under the necessary compliance.
    - edgyquant 4y ago
      Which costs cash that has to come from a budget
      - _8j50 4y ago
        Which they have to pay for anyways since they are schools and public admins.
      - belltaco 4y ago
        Who uses the free version of Office 365?

Eleison23 4y ago

I'm a traditionally very paranoid, very DIY admin/hacker type. A knowledgeable friend turned my opinion to the cloud a few years ago. He simply asked me whether I had DLP, an IPS and enterprise-grade firewall for my home systems. With that line of questioning, he made me realize that no jerry-rigged home-built network system can hold a candle to the security and robustness of a cloud solution, even a mere consumer-grade OneDrive or BackBlaze or something like that. Since then I haven't really kept anything important on local storage. It's in the cloud, for better or worse now.

neffy 4y ago
The cloud is just as vulnerable as everything else is: https://www.amazon.com/Hack-Like-Ghost-Sparc-Flow-ebook/dp/B08FH9SQNG https://www.amazon.com/Hack-Like-Ghost-Sparc-Flow-ebook/dp/B...
jeroenhd 4y ago
Cloud can certainly be secure, assuming the security can be verified (through audits and/or open source clients) and the data is end-to-end encrypted. The cloud isn't the problem, the active data collection that cloud companies do on your unencrypted data is.
numpad0 4y ago
But do those firewalls work…? They seem to be too often serving as an attack vector.
stephen_g 4y ago
Yeah, but who’s going to seriously spend much time and effort to try and attack you? Obviously you are always at risk of automated attacks when a vulnerability comes out and attackers scan the internet for any exposed service vulnerable to it, but otherwise you’re not anything like the kind of target that a cloud provider would be (that they’d try to random for millions of dollars if they’re successful, and would have the personal data of millions of people to sell on the dark web when they don’t pay). Unless you’re known to have data that’s particularly interesting, your risk is nothing like what they face…

johndhi 4y ago

This is the type of thing that would be more effective if they focused on publicizing it and publicly pressuring the company to provide a solution that meets their needs. Once they say "bye," msft has no incentive to fix it.

robust-cactus 4y ago

CNIL is a pretty ridiculous organization of buearcrats. They'd rather pummel even a French company to the ground with fines rather than discuss anything. Their policies aren't particularly best practice either - you could build things better than they recommend but if it doesn't meet their requirement they'll annihilate you with fines.

Rexxar 4y ago
Can you give us at least one example ?
- robust-cactus 4y ago
  Look at their password requirements : 1 symbol, 1 uppercase letter, 1 lowercase letter, 1 number - when we know that security folks at this point would say "any easy to remember phrase is better than random characters". And they will fine you to death if you don't enforce all the characters. There's a few mentions online about companies that have gone out of business or fined like crazy - whether they're warranted or not isn't the question. There's an article on tech crunch about Fidzup that shares a nice extreme case. I don't think 1 nations DPA should be able to unilaterally make decisions for entire platforms or the planet. Moreover, they're absolutely terrible to work with.
  - Rexxar 4y ago
    I see what you say in old recommendation but a recommendation is just a baseline you can change if you justify it. The new version seems to be in line with what you want : https://www.cnil.fr/sites/default/files/atoms/files/draft_recommendation_-_passwords_and_other_unshared_secrets_version_for_public_consultation.pdf https://www.cnil.fr/sites/default/files/atoms/files/draft_re... For Fidzup there was no monetary sanction. Investor have just walk away when they learned there was an inquiry. All sanction are published : https://www.cnil.fr/fr/thematique/cnil/sanctions https://www.cnil.fr/fr/thematique/cnil/sanctions I don't find anything crazy.

khana 4y ago

ExecutiveDre 4y ago

Wish I knew French. What’s the TLDR in English lol

bhauer 4y ago
TLDR: https://addons.mozilla.org/en-US/firefox/addon/firefox-translations/ https://addons.mozilla.org/en-US/firefox/addon/firefox-trans...

mdmglr 4y ago

What about on-prem office?

hnburnsy 4y ago

32 Connected experiences that analyze your content in Microsoft 365 Apps for enterprise... https://learn.microsoft.com/en-us/deployoffice/privacy/connected-experiences https://learn.microsoft.com/en-us/deployoffice/privacy/conne...

Kukumber 4y ago

Congrats! This should have been banned many years ago, in whole Europe Asia/Africa follow along and encourage local or free, non-profit open source alternatives

Hnrobert42 4y ago
What should have been banned specifically? This isn’t a ban on commercial software.

mr90210 4y ago

Brazil is years ahead of EU countries in this matter.

martin_henk 4y ago

We probably need a new way of handling these dependencies on tech firms. I don't think libre office or any other thing can replace MS Office. There should be another way to deal with it.

gigel82 4y ago

I'm curious about what alternatives they're proposing. That's 98% of the market right there (citation needed).

Brian_K_White 4y ago

Good. It doesn't matter that it's incomplete. They can still use Office without 365, etc. It's not a real principled fundamental policy about all public/government code and documents and data and formats etc. It doesn't matter what the real reason is. Even for example the cynical idea that it's just to force favoring some other private entity. Still good. It's good even purely for the optics that it's even possible, for any reason at all. As it is it does do a lot of direct good already, but even if it did nothing more than make the concept of "we don't need to use office365 or google" less crazy sounding the next time someone tries to take a government open source and open data and open data formats, or even merely reject the servicication of things that don't actually require it, that is already a good thing all by itself. And the fact that it pushes back against the indoctrination of kids to accept that as just a universal fact of life is just that much better.

mmmpop 4y ago

abraham 4y ago

Good time for Google Workspace to be testing client side encryption. https://support.google.com/a/answer/10741897 https://support.google.com/a/answer/10741897

calacatta 4y ago

According to Peter Zeihan, France (along with Turkey & a few others) will be emergent empires of the post-globalist age. There is ample precedent for and, and for some countries, explicit codification of using commercial tech products for state ends, particularly espionage. So a) this is not a surprising direction at all and b) this sets up a nice little pre-fertilized, fully-walled-off plot for a French omnibus tech company to explode into.

aborsy 4y ago

Andrew Bustamante says on Fridman podcast that French government intelligence agency is number one in the world in industrial espionage. France might also be the country that “bans the most”. Privacy is probably used as a tool in business.

sontek 4y ago

I like the genera idea of not using the big companies and forcing them into compliance but if the France government is anything like the USA gov I can't imagine them running a self-hosted solution like NextCloud at the same level of security, compliance, and reliability that are imposed on MS and Google.