10 ms·

Digital vassals? French Government ‘exposes citizens’ data to US'

255 points by ColinWright 1y ago

ColinWright 1y ago
Seen here: https://www-senat-fr.translate.goog/compte-rendu-commissions/20250609/ce_commande_publique.html?_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=en https://www-senat-fr.translate.goog/compte-rendu-commissions... ================================================================ Quoting the translation: Mr. Dany Wattebled , rapporteur . - Mr. Carniaux, as Director of Public and Legal Affairs, you represent Microsoft France before public decision-makers. Can you guarantee before our committee, under oath, that the data of French citizens entrusted to Microsoft via UGAP will never be transmitted, following an injunction from the American government, without the explicit agreement of the French authorities? Mr. Anton Carniaux . - No, I cannot guarantee that, but, again, it has never happened before. ================================================================ Original: M. Dany Wattebled, rapporteur. - Monsieur Carniaux, en tant que directeur des affaires publiques et juridiques, vous représentez Microsoft France auprès des décideurs publics. Pouvez-vous garantir devant notre commission, sous serment, que les données des citoyens français confiées à Microsoft via l'Ugap ne seront jamais transmises, à la suite d'une injonction du gouvernement américain, sans l'accord explicite des autorités françaises ? M. Anton Carniaux. - Non, je ne peux pas le garantir, mais, encore une fois, cela ne s'est encore jamais produit. ================================================================ Thread on Mastodon: https://toot.cat/@devopscats/114879479938557566 https://toot.cat/@devopscats/114879479938557566
- Disposal8433 1y ago
  > Mr. Anton Carniaux . - No, I cannot guarantee that He's smart, he doesn't want to go to jail. But all the governments and current and/or past administrations are guilty of pretended to be retarded since we all knew for the past 30 years that Microsoft was not to be trusted.
Saline9515 1y ago
Having worked for the French state and wrestled a few times with its IT services, I can tell you that the reason for choosing Microsoft isn't cost, or "efficiency". It's that they only know Microsoft, they don't want to learn something else, and if there's a problem, it's Microsoft's fault, no theirs, so they don't have to deal with their own incompetence. If you want an anecdote, we were working with SAS, a statistical software which required costly licences (more than a million € for a few dozens of workers). I suggested to switch to R or Python to the top director, who agreed. First meeting with the service in charge, the chief opens with "ok, we are asked to change, but the goal here is to show that we tried, and found that it's not possible." I resigned a few months after, as everything was in the same vein.
- mananaysiempre 1y ago
  The French state is one thing, the Polytéchnique is another. My impression is the old-school network administrators at French universities are fiercely protective of their de facto right to make technical decisions regarding equipment and software. So this part surprises me.
- stef25 1y ago
  This addiction to Microsoft is everywhere and it's terrible for everyone involved. So many small orgs and NGOs paying through the nose for what can be done for free with Google Docs & Sheets.
  - mr_mitm 1y ago
    Relying on yet another American mega corp instead of Microsoft doesn't seem very wise.
  - gunalx 1y ago
    ^foss alternatives like onlyoffice, nextcloud...
  - sam_lowry_ 1y ago
    NGOs pay little compared to businesses, AFAIR.
SpicyLemonZest 1y ago
There's simply no option for digital sovereignty other than cultivating a strong domestic software industry. As the source details, much of this exposure is being done with full understanding of the risks and costs. The article also refers to some report claiming that European solutions are "wrongly judged to be too costly or inefficient". I'd be interested to read it if anyone has a translation. Even for something as basic as word processing software, every case I've seen so for the alternatives quickly lands on "you have to accept rough edges because that's the cost of data sovereignty" - much easier for a hobbyist or politician to say than an IT director charged with making sure your organization runs well.
- Saline9515 1y ago
  The French state is working on a google-docs open source alternative: https://docs.numerique.gouv.fr/home/ https://docs.numerique.gouv.fr/home/
- ajb 1y ago
  The sad part is, both the EU and the UK (which has the same issue) have the capacity to do this as we have enough software engineers. But most software companies end up being bought out by US ones at some point.
- sunshine-o 1y ago
  > There's simply no option for digital sovereignty other than cultivating a strong domestic software industry. Yes, but they tried and can't. Those ideas of domestic computer industry and digital sovereignty have been around since the 60s. The French had Bull which is now Atos and they failed miserably. France was very impressive after WW2, they build almost on their own a nuclear weapons, a nuclear energy, aeronautic, military industry and impressive space capabilities. After that you would expect them to have built a serious competitor to Intel and Microsoft but they didn't. They can't even built basic digital capabilities to support a bureaucracy. My guess is a very different generation arrived in the 60s-70s in the workplace and in charge: the Silent Generation and the Boomers. Those generations were not about building anything but more about entitlements and collecting dividends. But of course it takes quite some time for things to get really bad. Information technologies slowly took over many aspects over our societies over the last 50 years and now they find out they do not have sovereignty anymore.
mananaysiempre 1y ago
Time[1] and time[2] again, the CJEU has ruled that the US stance of noncitizens having no standing on privacy issues is incompatible with EU law. Time[3] and time[4] again, the European Commission has negotiated a functionally identical agreement codified in executive orders and declared it “adequate” until the court could decide otherwise. Not even the Congress explicitly giving[5] the US government powers to compel (among others) EU subsidiaries of US multinationals, regardless of what EU law says, has changed the equation. Now there’s been a presidential election in the US that many in the EU are unhappy about. *Shocked Pikachu* > [French MP Philippe] Latombe criticised the US-EU Data Privacy Framework (DPF) deal, saying it no longer served EU interests due to the US president’s “impulsive” nature. Am I wrong to say that there’s something profoundly rotten in that statement with regards to the rule of law? [1] https://en.wikipedia.org/wiki/Max_Schrems#Schrems_I https://en.wikipedia.org/wiki/Max_Schrems#Schrems_I [2] https://en.wikipedia.org/wiki/Max_Schrems#Schrems_II https://en.wikipedia.org/wiki/Max_Schrems#Schrems_II [3] https://en.wikipedia.org/wiki/EU%E2%80%93US_Privacy_Shield https://en.wikipedia.org/wiki/EU%E2%80%93US_Privacy_Shield [4] https://en.wikipedia.org/wiki/EU%E2%80%93US_Data_Privacy_Framework https://en.wikipedia.org/wiki/EU%E2%80%93US_Data_Privacy_Fra... [5] https://en.wikipedia.org/wiki/CLOUD_Act https://en.wikipedia.org/wiki/CLOUD_Act
- kergonath 1y ago
  > Am I wrong to say that there’s something profoundly rotten in that statement with regards to the rule of law? Why do you think that? The agreement was negotiated under certain conditions, it’s not really surprising that a change in circumstances would make it unfit for purpose.
- hulitu 1y ago
  > Am I wrong to say that there’s something profoundly rotten in that statement with regards to the rule of law? No. The laws are applied as long as they serve the rulling elite. See GDPR for examples. Or the copyright law for examples at the other end of the pond.
- sunaookami 1y ago
  All you need to know is that the EU Commission sues their own data protection commissioner because he ruled that the usage of MS365 in the Commission is illegal. So the EU Commission happily works together with Microsoft: https://www.heise.de/en/news/Microsoft-365-EU-Commission-takes-EU-data-protection-commissioner-to-court-9791192.html https://www.heise.de/en/news/Microsoft-365-EU-Commission-tak...
ronin-red 1y ago
[dead]
isodev 1y ago
I think we need a lot more accessible disclosure on the subject for the public. Even beyond government services, products exposing one to the US should come with a big fat warning.
- hulitu 1y ago
  > products exposing one to the US should come with a big fat warning You mean products like Microsoft Windows, Apple's iOS and MacOS, Google's Android, Chrome and ChromeOS, Cisco, Fortinet, HP, Dell, AWS, Linux, Meta's Whatsapp Facebook and Instagram and so on and so forth.
  - fsflover 1y ago
    > Linux Citation needed.
    - LargoLasskhyfv 1y ago
      Systemd's default dns settings, depending on distro defaults. Yes, it's not the kernel you are probably starting to nitpick about, but it doesn't run anywhere else, so far.
      - fsflover 1y ago
        So it's not Linux but certain privacy-unfriendly distros.
        LargoLasskhyfv 1y ago
        I'm not exactly sure, anymore. I think I've first read about it, some years ago, at the time not using systemd anywhere, personally. IIRC it was about the default dns servers pointing to cloudflare and google in upstream. So it would rather be the other way around. The upstream default was(is?) privacy unfriendly. What the distros do with this is another matter. Similar stuff arose with timesyncd (ntp), and some other small thing which I can't remember anymore, atm.
rdm_blackhole 1y ago
It's always the same issue. If you want to move away from <insert US tech giant>, you either need to embrace Linux and open source software which requires the state's employees to learn a new "stack" of applications which means they need to be given appropriate training or you need to have you home grown solutions that are as easy to use as their US counterparts and were developed within the EU by the EU's member countries with the EU's values embedded in them. The first solution is not going to happen, as Linux is still relatively unknown all things considered and I don't see the French government employees learning how to use this OS and/or the applications running on it by themselves. Secondly in times of budget cuts like in France currently, the government is not about to rip all the Microsoft products off and replace them with something that would take years to transition to and cost a fortune to implement. So that leaves the homegrown solution. Unfortunately the work to move off of Microsoft et al should have started 10 years ago but it hasn't. Europe has completely dropped the ball on tech and now it's coming back to bit it in the ass. The Draghi report from last year was supposed to kick things into gear but we will be lucky to see anything coming through within the next 5 years and by this stage the US tech giants will have entrenched themselves even more in the EU. I am sorry to say but this is a failure that will resonate for the many decades to come.
- luckylion 1y ago
  I doubt that the average employee could tell Linux and Windows apart if you applied a Window-style skin to Linux. But at least in Germany, I've seen Windows being written into agreements between state governments and trade unions representing clerks and employees. Good luck changing those without a negotiation running 3 years.
  - harvey9 1y ago
    Lots of people would be disrupted by having to move off MS Office. Not insurmountably so, and MS ironically helps make the case that people can learn new things by often changing their own product interfaces.
    - realusername 1y ago
stef25 1y ago
This site has a heavy pro Russian bias, see for example https://brusselssignal.eu/2025/07/europe-still-has-the-power-of-what-exactly/ https://brusselssignal.eu/2025/07/europe-still-has-the-power... Turns out it was founded by an American, who was arrested on suspicion of bias-motivated crimes, second-degree assault and harassment after attacking a reporter in the USA but currently living in Hungary and running some media org there, with ties to the right wing Fidesz party. And he is on paper as being the founded of brusselssignal.eu His organization received a big loan from an undisclosed source to set up the Brussels organisation and it seems to made up of or advised by a rag tag of European right wing politicians. The whole thing stinks of Russian meddling in Europe. Sources https://www.szabadeuropa.hu/a/szazhetvennegy-millios-kolcsonnel-indult-az-orban-kormanyhoz-kozeli-brusszeli-hiroldal-mogott-allo-ceg/32761770.html https://www.szabadeuropa.hu/a/szazhetvennegy-millios-kolcson... https://www.companyweb.be/company/0793608171/free-pub/23106871 https://www.companyweb.be/company/0793608171/free-pub/231068... https://edition.cnn.com/2024/12/28/us/patrick-thomas-egan-accused-tv-reporter-attack https://edition.cnn.com/2024/12/28/us/patrick-thomas-egan-ac...
- phtrivier 1y ago
  Good catch. The OP article is mostly transcript from a Senate hearing, so the bias is limited.
- alt187 1y ago
  Yeah, anyone who wants Europe to move away from Our Holy American Benefactors, are, uh, uhhh, yeah, russian plants!
  - asdff 1y ago
    One of these days Europeans will realize they are also part of the American empire just in a bit of a dominion status. If you host an American military installation, you are part of the empire with a fig leaf of domestic policy control that keep the bulk of the populace from realizing this. Take a look at a map of American military installations. The sun never sets on this latest roman empire.
hollowonepl 1y ago
I many time heard here in Europe not to trust Chinese appliances as these devices do listen to us… is #USA any different?
- moffkalast 1y ago
  I think given the NSA's capacity they'll find a way to listen to us regardless which devices we use. But we're certainly going out of our way to make it easy for them.
  - deleted 1y ago
    [deleted]
  - hulitu 1y ago
    > But we're certainly going out of our way to make it easy for them. As someone said before: "citation needed". Just FYI: DE-CIX.
afarah1 1y ago
I don't see enough talk about reducing the amount of data collected in the first place. Even if it's kept within one jurisdiction, it can still be the target of a breach by a local criminal, a foreign spy, or a new government agency... Cameras on every street, cellular antenas on every car, biometrics for everything... It may vary from country to country, but an expansion on citizen data collection (in one area or another) seems commonplace across most governments, and usually with zero opposition in "the real world". And unlike products or platforms that you can chose to not use, there's hardly any escape from those.
- AndyMcConachie 1y ago
  > I don't see enough talk about reducing the amount of data collected in the first place. It's because the power's that be want all the data and none of the liability. The easiest way to comply with any privacy regulation is to not collect, store, or process any personal data. Just don't store or process data about humans and 99% of the problems go away. But data is the new oil. And sometimes when you store or process oil there are leaks that spill everywhere, contaminate things, and even sometimes kill people. That's never stopped us from collecting, storing, or processing oil.
motohagiography 1y ago
these seem like solved problems. in canada, many govt depts have procurement rules that state all data must be hosted nationally by a custodian subject to national or even provincial law, and this has been standard for decades. the firm I work for also doesn't use google or microsoft clouds for similar reasons. the deeper problem is governments are not technology builders and cannot produce tech products because they have no unique ability to deliver anything anyone subject to them actually wants.
phtrivier 1y ago
It's interesting that there at least starts to be two opposing camp in the executive (some people in French government start to push for more sovereignty, some EU governments too, some MEPs, etc...) Of course the rest of the administrations are not there yet, there are contracts to abide to, habits, etc... But there is the start of a general recognition that overdependence on the US is a liability at some level. Also, it would incredibly more feasible to move IT infrastructure back and have some reign on data, then it would be to recover from our overdependence on China in terms of... Well, in terms of everything physical. Which means that the first milestone would be to host pour data on "sovereign" data centers... Using East-Asian made hardware. One thing at a time, I guess ?
- alephnerd 1y ago
  > Using East-Asian made hardware. Most DCs are already using "Asian made" hardware such as Korean memory chips, Taiwanese power supplies and fabricated chips, and Japanese designed storage. Unless you mean Chinese-made hardware, which would put much of Europe in the exact same position, with the added downside of supporting a nation that is cooperating with Russia, and is strongly in support of a Russian victory [0] in Ukraine. China has also begun leveraging export controls on tech transfers and outbound FDI as well, so dependency on an external nation would remain. The reality is there is no choice other than America+ or Chinese made hardware for EU member states, and as long as Russia continues to leverage Chinese dual-use technology, it will be a no-go. And the European (in reality German+Dutch) ecosystem has largely been stagnant since the 2000s, and critical technology like EUV is nominally owned by EU companies but developed and manufactured by autonomous JVs within the US. Either the EU supports Ukraine, in which case there is no choice but to deal with America+ or the EU leverages China, in which case support for Ukraine would have to stop. [0] - https://www.scmp.com/news/china/diplomacy/article/3316875/china-tells-eu-it-cannot-afford-russian-loss-ukraine-war-sources-say https://www.scmp.com/news/china/diplomacy/article/3316875/ch...
  - tsimionescu 1y ago
    You're absolutely right for the short term, but for the medium-long term (say, 15-30 years from now) there is absolutely no reason why the EU couldn't produce/design its own hardware. There are plenty of advanced pieces of hardware being designed in the EU even today, it's just happening mostly for US companies (e.g. Microchip has big HW design centers all over Europe).
guiriduro 1y ago
Honestly how hard can it be given Microsoft size (and AWS, and Google's) to mandate the intervention of a EU corporate entity to manage their IP in the region, full source code, EU cloud assets, encryption keys, EU-only support access, collect their royalties etc., but essentially act as a privacy buffer wholly unanswerable to any US head office or any obligations US law holds the company to wrt any EU person, its just a black hole that grants them the right to earn money and hold a large market share in the EU. The Chinese aren't afraid to do it.
- alephnerd 1y ago
  > Honestly how hard can it be given Microsoft size (and AWS, and Google's) to mandate the intervention of a EU corporate entity to manage Very difficult. Countries like Ireland, Poland, Czechia, Romania, and Bulgaria are heavily dependent on American FDI in their tech industry, and the European Council has final say and requires unanimity. A rule such as the one you mentioned would smother VC/PE in much of the EU, as European funds like Index Ventures and Munich Re Ventures are heavily dependent on the US to raise capital and build dealflow. Major European employers like Volkswagen AG, Siemens AG, NXP, Phillips, Infineon, and others would also face severe retaliation as a result. It would also set a precedent that would make an alternative like China extremely hesitant to invest, as the Chinese government heavily utilizes export controls on tech transfers. For example, BYD investment in Hungary is largely CDK with the core high value components like Batteries being manufactured in China. Biren, Huawei, and SMIC would face similar export controls.
  - guiriduro 1y ago
    Major Cloud providers would still need to invest eu-customer money in providing eu IT services, this is more a legal, security and privacy isolation for big tech players in order to maintain their share, extract royalties etc. Startups that are not in a large marketshare situation wouldn't trigger the need for intermediary/isolation so the effect on FDI would be limited, and anyway, the tides are turning on US capital in general. Retaliation: I'm not sure the US fiscal and legal overreach isn't already in place, e.g. VW dieselgate, export controls etc. The US looks after its interests (fair enough), but its time the EU levelled the field to protect its citizens, a small loss of regional sovereignty for those companies in exchange for the EU revenue they continue to make.
crop_rotation 1y ago
The EU majorly screwed up by not focusing on a homegrown software ecosystem. The Chinese, due to either luck or competence or both, have a parallel big tech ecosystem compared to America and that is a huge advantage.
- jjani 1y ago
  In the Chinese case, competence. Korea also has such an ecosystem - and is a much better example for the EU to look towards - but stems from more of a mix between competence and luck.
  - crop_rotation 1y ago
    Where are the Korean cloud providers? Even Samsung uses American ones.
    - alephnerd 1y ago
      Naver Cloud [0] and Samsung SDS Cloud [1] which is basically a Samsung managed AWS ecosystem (sort of like how AWS China is whitelabeled Tencent Cloud). Those tend to be used by a plurality of Korean organizations within Korea. Unlike in Europe, both Naver and Samsung began investing in building their own domestic cloud capabilities in the early 2010s. [0] - https://www.navercloudcorp.com/ https://www.navercloudcorp.com/ [1] - https://cloud.samsungsds.com/serviceportal/index.html https://cloud.samsungsds.com/serviceportal/index.html
      - cess11 1y ago
        Scaleway and OVHcloud, much better comparisons than Hetzner, started in the late nineties. UpCloud and Exoscale, arguably even better comparisons, started in 2011. Then there are many more which I can't be bothered looking at their founding dates, like gridscale, Elastx, Open Telecom Cloud, Fuga, Seeway.
        alephnerd 1y ago
CalRobert 1y ago
Europe is in love with azure too bizarrely.
- sofixa 1y ago
  Anyone using Azure is bizarre. Just search for Azure on wiz.io's blog, the amount of terrible yet easy to exploit security vulnerabilities, often with shit responses from Microsoft, is terrifying. It clearly demonstrates nobody with power within the Azure org cares about security. How can anyone trust them with anything remotely critical? Let alone the terrible UX and absurdly eventual consistency. Yeah, yeah, I know, the people who know and understand this aren't the ones getting wined and dined to buy it. But still..
  - nicce 1y ago
    Until customers start to disappearing due to issues, why bother. That is usually what matters.
hunglee2 1y ago
EU obviously needs a Great Firewall - this would force foreign big tech to host data within the EU and subject these companies to ironclad EU legal jurisdiction. Naturally, some companies will not comply and withdraw services, clearing the way for domestic EU operators to emerge. This may seem like an unpalatable choice but it really is the only way back toward digital sovereignty - right now, the EU has been in 'trust me bro' situation with US big tech - a huge and accumulative risk
- alephnerd 1y ago
  They are trying with the Digital Privacy shield, but the issue is there is no domestic alternative to act as an alternative to the US. And a grand bargain with China is highly unlikely given Wang Yi's recent visit with Kaja Kallas [0] where he announced Chinese moral support for Russia in Ukraine, which is diametrically opposed to the EU's foreign policy, while Von der Leyen condemned China for providing unrestricted support to Russia and causing industrial overcapacity [1]. Unlike Japan or South Korea, the EU holds no cards that it can leverage against the US or China - JP and SK can offer China a trilateral FTA which acts as a negotiating tool against the US, and SK+Japan can offer additonal military support for the US within the APAC domain which can act as a negotiating tool against China. What can the entire EU offer either US or China which cannot be vetoed by a COE member. The EU has an added issue that the COE requires unanimity amongst heads of state to pass EU wide legislation, and US FDI representing €900B in inward FDI stock [2] within Ireland means there is a guaranteed veto against any tech decoupling. It's a similar story in Czechia, Poland, Romania, and Bulgaria as well. [0] - https://www.scmp.com/news/china/diplomacy/article/3316875/china-tells-eu-it-cannot-afford-russian-loss-ukraine-war-sources-say https://www.scmp.com/news/china/diplomacy/article/3316875/ch... [1] - https://www.scmp.com/news/china/diplomacy/article/3317442/von-der-leyen-deepens-gloom-over-china-eu-summit-attack-beijings-russia-stance?module=inline&pgtype=article https://www.scmp.com/news/china/diplomacy/article/3317442/vo... [2] - https://www.cso.ie/en/releasesandpublications/ep/p-fdi/foreigndirectinvestmentinireland2023/intro/ https://www.cso.ie/en/releasesandpublications/ep/p-fdi/forei...
  - tsimionescu 1y ago
    > The EU has an added issue that the COE requires unanimity amongst heads of state to pass EU wide legislation This is vaguely similar to the truth, at best. The Council of Europe (CoE) has nothing to do with the EU, you're probably confusing it with the European Council (EUCO). But the EC is not normally involved in the legislative process. Instead, EU legislation is proposed by the European Comission (EC) and must be accepted by both the European Parliament and the Council of Ministers. The Council of Ministers is the closest body to what you probably meant, but it's made up of heads of government of member states, not the heads of state. It also doesn't require unanimity to pass a law - it takes at least 4 countries to outright block legislation. There is a procedure in which a single country which is unhappy with a law passing can raise this to the EUCO for additional review, but it doesn't apply to ordinary legislation. So, no, Ireland can't unilaterally block any such legislation, it has to convince other countries to join in.
bpavuk 1y ago
wait, do they (at least attempt to) spearhead it with Mistral and La Suite? La Suite works good... regard français perplexe
MEMORYC_RRUPTED 1y ago
I mean, same story in Belgium, The Netherlands, and (I'm gonna assume) every other EU government. Specifically for The Netherlands, https://berthub.eu/articles/posts/demystifying-european-digital-sovereignty/ https://berthub.eu/articles/posts/demystifying-european-digi... is a good read, from someone that really understands how this works in government. Sadly, I understand why: they have a tonne of systems, that all, at least somewhat, work, that people know how to use, with established contacts and support contracts. IT departments trained and certified on how to run and deploy MS software. And that's before we start talking about lobbying. edit: added a link to a good resource about the topic. We should have started moving over yesterday, but it's a long and difficult process, I just hope we start moving forward on this.
AndyMcConachie 1y ago
This is everywhere in the EU. The Dutch government put out an RFP for MS Outlook licenses. RFPs are supposed to be vendor neutral, so I don't understand how an RFP for something that only a single company sells can be vendor neutral. They outsource all their email, but they don't put out RFPs for "email". MS is burrowed so deep into EU governments good luck getting them out.
reestr 1y ago
If control flows through data infrastructure, does it matter who “owns” the platform? Once exposure is built into the structure, sovereignty becomes a user illusion.

255 points by ColinWright 1y ago

Seen here: https://www-senat-fr.translate.goog/compte-rendu-commissions/20250609/ce_commande_publique.html?_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=en https://www-senat-fr.translate.goog/compte-rendu-commissions... ================================================================ Quoting the translation: Mr. Dany Wattebled , rapporteur . - Mr. Carniaux, as Director of Public and Legal Affairs, you represent Microsoft France before public decision-makers. Can you guarantee before our committee, under oath, that the data of French citizens entrusted to Microsoft via UGAP will never be transmitted, following an injunction from the American government, without the explicit agreement of the French authorities? Mr. Anton Carniaux . - No, I cannot guarantee that, but, again, it has never happened before. ================================================================ Original: M. Dany Wattebled, rapporteur. - Monsieur Carniaux, en tant que directeur des affaires publiques et juridiques, vous représentez Microsoft France auprès des décideurs publics. Pouvez-vous garantir devant notre commission, sous serment, que les données des citoyens français confiées à Microsoft via l'Ugap ne seront jamais transmises, à la suite d'une injonction du gouvernement américain, sans l'accord explicite des autorités françaises ? M. Anton Carniaux. - Non, je ne peux pas le garantir, mais, encore une fois, cela ne s'est encore jamais produit. ================================================================ Thread on Mastodon: https://toot.cat/@devopscats/114879479938557566 https://toot.cat/@devopscats/114879479938557566

Disposal8433 1y ago
> Mr. Anton Carniaux . - No, I cannot guarantee that He's smart, he doesn't want to go to jail. But all the governments and current and/or past administrations are guilty of pretended to be retarded since we all knew for the past 30 years that Microsoft was not to be trusted.

Saline9515 1y ago

Having worked for the French state and wrestled a few times with its IT services, I can tell you that the reason for choosing Microsoft isn't cost, or "efficiency". It's that they only know Microsoft, they don't want to learn something else, and if there's a problem, it's Microsoft's fault, no theirs, so they don't have to deal with their own incompetence. If you want an anecdote, we were working with SAS, a statistical software which required costly licences (more than a million € for a few dozens of workers). I suggested to switch to R or Python to the top director, who agreed. First meeting with the service in charge, the chief opens with "ok, we are asked to change, but the goal here is to show that we tried, and found that it's not possible." I resigned a few months after, as everything was in the same vein.

mananaysiempre 1y ago
The French state is one thing, the Polytéchnique is another. My impression is the old-school network administrators at French universities are fiercely protective of their de facto right to make technical decisions regarding equipment and software. So this part surprises me.
stef25 1y ago
This addiction to Microsoft is everywhere and it's terrible for everyone involved. So many small orgs and NGOs paying through the nose for what can be done for free with Google Docs & Sheets.
- mr_mitm 1y ago
  Relying on yet another American mega corp instead of Microsoft doesn't seem very wise.
- gunalx 1y ago
  ^foss alternatives like onlyoffice, nextcloud...
- sam_lowry_ 1y ago
  NGOs pay little compared to businesses, AFAIR.

SpicyLemonZest 1y ago

There's simply no option for digital sovereignty other than cultivating a strong domestic software industry. As the source details, much of this exposure is being done with full understanding of the risks and costs. The article also refers to some report claiming that European solutions are "wrongly judged to be too costly or inefficient". I'd be interested to read it if anyone has a translation. Even for something as basic as word processing software, every case I've seen so for the alternatives quickly lands on "you have to accept rough edges because that's the cost of data sovereignty" - much easier for a hobbyist or politician to say than an IT director charged with making sure your organization runs well.

Saline9515 1y ago
The French state is working on a google-docs open source alternative: https://docs.numerique.gouv.fr/home/ https://docs.numerique.gouv.fr/home/
ajb 1y ago
The sad part is, both the EU and the UK (which has the same issue) have the capacity to do this as we have enough software engineers. But most software companies end up being bought out by US ones at some point.
sunshine-o 1y ago
> There's simply no option for digital sovereignty other than cultivating a strong domestic software industry. Yes, but they tried and can't. Those ideas of domestic computer industry and digital sovereignty have been around since the 60s. The French had Bull which is now Atos and they failed miserably. France was very impressive after WW2, they build almost on their own a nuclear weapons, a nuclear energy, aeronautic, military industry and impressive space capabilities. After that you would expect them to have built a serious competitor to Intel and Microsoft but they didn't. They can't even built basic digital capabilities to support a bureaucracy. My guess is a very different generation arrived in the 60s-70s in the workplace and in charge: the Silent Generation and the Boomers. Those generations were not about building anything but more about entitlements and collecting dividends. But of course it takes quite some time for things to get really bad. Information technologies slowly took over many aspects over our societies over the last 50 years and now they find out they do not have sovereignty anymore.

mananaysiempre 1y ago

Time[1] and time[2] again, the CJEU has ruled that the US stance of noncitizens having no standing on privacy issues is incompatible with EU law. Time[3] and time[4] again, the European Commission has negotiated a functionally identical agreement codified in executive orders and declared it “adequate” until the court could decide otherwise. Not even the Congress explicitly giving[5] the US government powers to compel (among others) EU subsidiaries of US multinationals, regardless of what EU law says, has changed the equation. Now there’s been a presidential election in the US that many in the EU are unhappy about. *Shocked Pikachu* > [French MP Philippe] Latombe criticised the US-EU Data Privacy Framework (DPF) deal, saying it no longer served EU interests due to the US president’s “impulsive” nature. Am I wrong to say that there’s something profoundly rotten in that statement with regards to the rule of law? [1] https://en.wikipedia.org/wiki/Max_Schrems#Schrems_I https://en.wikipedia.org/wiki/Max_Schrems#Schrems_I [2] https://en.wikipedia.org/wiki/Max_Schrems#Schrems_II https://en.wikipedia.org/wiki/Max_Schrems#Schrems_II [3] https://en.wikipedia.org/wiki/EU%E2%80%93US_Privacy_Shield https://en.wikipedia.org/wiki/EU%E2%80%93US_Privacy_Shield [4] https://en.wikipedia.org/wiki/EU%E2%80%93US_Data_Privacy_Framework https://en.wikipedia.org/wiki/EU%E2%80%93US_Data_Privacy_Fra... [5] https://en.wikipedia.org/wiki/CLOUD_Act https://en.wikipedia.org/wiki/CLOUD_Act

kergonath 1y ago
> Am I wrong to say that there’s something profoundly rotten in that statement with regards to the rule of law? Why do you think that? The agreement was negotiated under certain conditions, it’s not really surprising that a change in circumstances would make it unfit for purpose.
hulitu 1y ago
> Am I wrong to say that there’s something profoundly rotten in that statement with regards to the rule of law? No. The laws are applied as long as they serve the rulling elite. See GDPR for examples. Or the copyright law for examples at the other end of the pond.
sunaookami 1y ago
All you need to know is that the EU Commission sues their own data protection commissioner because he ruled that the usage of MS365 in the Commission is illegal. So the EU Commission happily works together with Microsoft: https://www.heise.de/en/news/Microsoft-365-EU-Commission-takes-EU-data-protection-commissioner-to-court-9791192.html https://www.heise.de/en/news/Microsoft-365-EU-Commission-tak...

ronin-red 1y ago

[dead]

isodev 1y ago

I think we need a lot more accessible disclosure on the subject for the public. Even beyond government services, products exposing one to the US should come with a big fat warning.

hulitu 1y ago
> products exposing one to the US should come with a big fat warning You mean products like Microsoft Windows, Apple's iOS and MacOS, Google's Android, Chrome and ChromeOS, Cisco, Fortinet, HP, Dell, AWS, Linux, Meta's Whatsapp Facebook and Instagram and so on and so forth.
- fsflover 1y ago
  > Linux Citation needed.
  - LargoLasskhyfv 1y ago
    Systemd's default dns settings, depending on distro defaults. Yes, it's not the kernel you are probably starting to nitpick about, but it doesn't run anywhere else, so far.
    - fsflover 1y ago
      So it's not Linux but certain privacy-unfriendly distros.
      - LargoLasskhyfv 1y ago
        I'm not exactly sure, anymore. I think I've first read about it, some years ago, at the time not using systemd anywhere, personally. IIRC it was about the default dns servers pointing to cloudflare and google in upstream. So it would rather be the other way around. The upstream default was(is?) privacy unfriendly. What the distros do with this is another matter. Similar stuff arose with timesyncd (ntp), and some other small thing which I can't remember anymore, atm.

rdm_blackhole 1y ago

It's always the same issue. If you want to move away from <insert US tech giant>, you either need to embrace Linux and open source software which requires the state's employees to learn a new "stack" of applications which means they need to be given appropriate training or you need to have you home grown solutions that are as easy to use as their US counterparts and were developed within the EU by the EU's member countries with the EU's values embedded in them. The first solution is not going to happen, as Linux is still relatively unknown all things considered and I don't see the French government employees learning how to use this OS and/or the applications running on it by themselves. Secondly in times of budget cuts like in France currently, the government is not about to rip all the Microsoft products off and replace them with something that would take years to transition to and cost a fortune to implement. So that leaves the homegrown solution. Unfortunately the work to move off of Microsoft et al should have started 10 years ago but it hasn't. Europe has completely dropped the ball on tech and now it's coming back to bit it in the ass. The Draghi report from last year was supposed to kick things into gear but we will be lucky to see anything coming through within the next 5 years and by this stage the US tech giants will have entrenched themselves even more in the EU. I am sorry to say but this is a failure that will resonate for the many decades to come.

luckylion 1y ago
I doubt that the average employee could tell Linux and Windows apart if you applied a Window-style skin to Linux. But at least in Germany, I've seen Windows being written into agreements between state governments and trade unions representing clerks and employees. Good luck changing those without a negotiation running 3 years.
- harvey9 1y ago
  Lots of people would be disrupted by having to move off MS Office. Not insurmountably so, and MS ironically helps make the case that people can learn new things by often changing their own product interfaces.
  - realusername 1y ago

stef25 1y ago

This site has a heavy pro Russian bias, see for example https://brusselssignal.eu/2025/07/europe-still-has-the-power-of-what-exactly/ https://brusselssignal.eu/2025/07/europe-still-has-the-power... Turns out it was founded by an American, who was arrested on suspicion of bias-motivated crimes, second-degree assault and harassment after attacking a reporter in the USA but currently living in Hungary and running some media org there, with ties to the right wing Fidesz party. And he is on paper as being the founded of brusselssignal.eu His organization received a big loan from an undisclosed source to set up the Brussels organisation and it seems to made up of or advised by a rag tag of European right wing politicians. The whole thing stinks of Russian meddling in Europe. Sources https://www.szabadeuropa.hu/a/szazhetvennegy-millios-kolcsonnel-indult-az-orban-kormanyhoz-kozeli-brusszeli-hiroldal-mogott-allo-ceg/32761770.html https://www.szabadeuropa.hu/a/szazhetvennegy-millios-kolcson... https://www.companyweb.be/company/0793608171/free-pub/23106871 https://www.companyweb.be/company/0793608171/free-pub/231068... https://edition.cnn.com/2024/12/28/us/patrick-thomas-egan-accused-tv-reporter-attack https://edition.cnn.com/2024/12/28/us/patrick-thomas-egan-ac...

phtrivier 1y ago
Good catch. The OP article is mostly transcript from a Senate hearing, so the bias is limited.
alt187 1y ago
Yeah, anyone who wants Europe to move away from Our Holy American Benefactors, are, uh, uhhh, yeah, russian plants!
- asdff 1y ago
  One of these days Europeans will realize they are also part of the American empire just in a bit of a dominion status. If you host an American military installation, you are part of the empire with a fig leaf of domestic policy control that keep the bulk of the populace from realizing this. Take a look at a map of American military installations. The sun never sets on this latest roman empire.

hollowonepl 1y ago

I many time heard here in Europe not to trust Chinese appliances as these devices do listen to us… is #USA any different?

moffkalast 1y ago
I think given the NSA's capacity they'll find a way to listen to us regardless which devices we use. But we're certainly going out of our way to make it easy for them.
- deleted 1y ago
  [deleted]
- hulitu 1y ago
  > But we're certainly going out of our way to make it easy for them. As someone said before: "citation needed". Just FYI: DE-CIX.

afarah1 1y ago

I don't see enough talk about reducing the amount of data collected in the first place. Even if it's kept within one jurisdiction, it can still be the target of a breach by a local criminal, a foreign spy, or a new government agency... Cameras on every street, cellular antenas on every car, biometrics for everything... It may vary from country to country, but an expansion on citizen data collection (in one area or another) seems commonplace across most governments, and usually with zero opposition in "the real world". And unlike products or platforms that you can chose to not use, there's hardly any escape from those.

AndyMcConachie 1y ago
> I don't see enough talk about reducing the amount of data collected in the first place. It's because the power's that be want all the data and none of the liability. The easiest way to comply with any privacy regulation is to not collect, store, or process any personal data. Just don't store or process data about humans and 99% of the problems go away. But data is the new oil. And sometimes when you store or process oil there are leaks that spill everywhere, contaminate things, and even sometimes kill people. That's never stopped us from collecting, storing, or processing oil.

motohagiography 1y ago

these seem like solved problems. in canada, many govt depts have procurement rules that state all data must be hosted nationally by a custodian subject to national or even provincial law, and this has been standard for decades. the firm I work for also doesn't use google or microsoft clouds for similar reasons. the deeper problem is governments are not technology builders and cannot produce tech products because they have no unique ability to deliver anything anyone subject to them actually wants.

phtrivier 1y ago

It's interesting that there at least starts to be two opposing camp in the executive (some people in French government start to push for more sovereignty, some EU governments too, some MEPs, etc...) Of course the rest of the administrations are not there yet, there are contracts to abide to, habits, etc... But there is the start of a general recognition that overdependence on the US is a liability at some level. Also, it would incredibly more feasible to move IT infrastructure back and have some reign on data, then it would be to recover from our overdependence on China in terms of... Well, in terms of everything physical. Which means that the first milestone would be to host pour data on "sovereign" data centers... Using East-Asian made hardware. One thing at a time, I guess ?

alephnerd 1y ago
> Using East-Asian made hardware. Most DCs are already using "Asian made" hardware such as Korean memory chips, Taiwanese power supplies and fabricated chips, and Japanese designed storage. Unless you mean Chinese-made hardware, which would put much of Europe in the exact same position, with the added downside of supporting a nation that is cooperating with Russia, and is strongly in support of a Russian victory [0] in Ukraine. China has also begun leveraging export controls on tech transfers and outbound FDI as well, so dependency on an external nation would remain. The reality is there is no choice other than America+ or Chinese made hardware for EU member states, and as long as Russia continues to leverage Chinese dual-use technology, it will be a no-go. And the European (in reality German+Dutch) ecosystem has largely been stagnant since the 2000s, and critical technology like EUV is nominally owned by EU companies but developed and manufactured by autonomous JVs within the US. Either the EU supports Ukraine, in which case there is no choice but to deal with America+ or the EU leverages China, in which case support for Ukraine would have to stop. [0] - https://www.scmp.com/news/china/diplomacy/article/3316875/china-tells-eu-it-cannot-afford-russian-loss-ukraine-war-sources-say https://www.scmp.com/news/china/diplomacy/article/3316875/ch...
- tsimionescu 1y ago
  You're absolutely right for the short term, but for the medium-long term (say, 15-30 years from now) there is absolutely no reason why the EU couldn't produce/design its own hardware. There are plenty of advanced pieces of hardware being designed in the EU even today, it's just happening mostly for US companies (e.g. Microchip has big HW design centers all over Europe).

guiriduro 1y ago

Honestly how hard can it be given Microsoft size (and AWS, and Google's) to mandate the intervention of a EU corporate entity to manage their IP in the region, full source code, EU cloud assets, encryption keys, EU-only support access, collect their royalties etc., but essentially act as a privacy buffer wholly unanswerable to any US head office or any obligations US law holds the company to wrt any EU person, its just a black hole that grants them the right to earn money and hold a large market share in the EU. The Chinese aren't afraid to do it.

alephnerd 1y ago
> Honestly how hard can it be given Microsoft size (and AWS, and Google's) to mandate the intervention of a EU corporate entity to manage Very difficult. Countries like Ireland, Poland, Czechia, Romania, and Bulgaria are heavily dependent on American FDI in their tech industry, and the European Council has final say and requires unanimity. A rule such as the one you mentioned would smother VC/PE in much of the EU, as European funds like Index Ventures and Munich Re Ventures are heavily dependent on the US to raise capital and build dealflow. Major European employers like Volkswagen AG, Siemens AG, NXP, Phillips, Infineon, and others would also face severe retaliation as a result. It would also set a precedent that would make an alternative like China extremely hesitant to invest, as the Chinese government heavily utilizes export controls on tech transfers. For example, BYD investment in Hungary is largely CDK with the core high value components like Batteries being manufactured in China. Biren, Huawei, and SMIC would face similar export controls.
- guiriduro 1y ago
  Major Cloud providers would still need to invest eu-customer money in providing eu IT services, this is more a legal, security and privacy isolation for big tech players in order to maintain their share, extract royalties etc. Startups that are not in a large marketshare situation wouldn't trigger the need for intermediary/isolation so the effect on FDI would be limited, and anyway, the tides are turning on US capital in general. Retaliation: I'm not sure the US fiscal and legal overreach isn't already in place, e.g. VW dieselgate, export controls etc. The US looks after its interests (fair enough), but its time the EU levelled the field to protect its citizens, a small loss of regional sovereignty for those companies in exchange for the EU revenue they continue to make.

crop_rotation 1y ago

The EU majorly screwed up by not focusing on a homegrown software ecosystem. The Chinese, due to either luck or competence or both, have a parallel big tech ecosystem compared to America and that is a huge advantage.

jjani 1y ago
In the Chinese case, competence. Korea also has such an ecosystem - and is a much better example for the EU to look towards - but stems from more of a mix between competence and luck.
- crop_rotation 1y ago
  Where are the Korean cloud providers? Even Samsung uses American ones.
  - alephnerd 1y ago
    Naver Cloud [0] and Samsung SDS Cloud [1] which is basically a Samsung managed AWS ecosystem (sort of like how AWS China is whitelabeled Tencent Cloud). Those tend to be used by a plurality of Korean organizations within Korea. Unlike in Europe, both Naver and Samsung began investing in building their own domestic cloud capabilities in the early 2010s. [0] - https://www.navercloudcorp.com/ https://www.navercloudcorp.com/ [1] - https://cloud.samsungsds.com/serviceportal/index.html https://cloud.samsungsds.com/serviceportal/index.html
    - cess11 1y ago
      Scaleway and OVHcloud, much better comparisons than Hetzner, started in the late nineties. UpCloud and Exoscale, arguably even better comparisons, started in 2011. Then there are many more which I can't be bothered looking at their founding dates, like gridscale, Elastx, Open Telecom Cloud, Fuga, Seeway.
      - alephnerd 1y ago

CalRobert 1y ago

Europe is in love with azure too bizarrely.

sofixa 1y ago
Anyone using Azure is bizarre. Just search for Azure on wiz.io's blog, the amount of terrible yet easy to exploit security vulnerabilities, often with shit responses from Microsoft, is terrifying. It clearly demonstrates nobody with power within the Azure org cares about security. How can anyone trust them with anything remotely critical? Let alone the terrible UX and absurdly eventual consistency. Yeah, yeah, I know, the people who know and understand this aren't the ones getting wined and dined to buy it. But still..
- nicce 1y ago
  Until customers start to disappearing due to issues, why bother. That is usually what matters.

hunglee2 1y ago

EU obviously needs a Great Firewall - this would force foreign big tech to host data within the EU and subject these companies to ironclad EU legal jurisdiction. Naturally, some companies will not comply and withdraw services, clearing the way for domestic EU operators to emerge. This may seem like an unpalatable choice but it really is the only way back toward digital sovereignty - right now, the EU has been in 'trust me bro' situation with US big tech - a huge and accumulative risk

alephnerd 1y ago
They are trying with the Digital Privacy shield, but the issue is there is no domestic alternative to act as an alternative to the US. And a grand bargain with China is highly unlikely given Wang Yi's recent visit with Kaja Kallas [0] where he announced Chinese moral support for Russia in Ukraine, which is diametrically opposed to the EU's foreign policy, while Von der Leyen condemned China for providing unrestricted support to Russia and causing industrial overcapacity [1]. Unlike Japan or South Korea, the EU holds no cards that it can leverage against the US or China - JP and SK can offer China a trilateral FTA which acts as a negotiating tool against the US, and SK+Japan can offer additonal military support for the US within the APAC domain which can act as a negotiating tool against China. What can the entire EU offer either US or China which cannot be vetoed by a COE member. The EU has an added issue that the COE requires unanimity amongst heads of state to pass EU wide legislation, and US FDI representing €900B in inward FDI stock [2] within Ireland means there is a guaranteed veto against any tech decoupling. It's a similar story in Czechia, Poland, Romania, and Bulgaria as well. [0] - https://www.scmp.com/news/china/diplomacy/article/3316875/china-tells-eu-it-cannot-afford-russian-loss-ukraine-war-sources-say https://www.scmp.com/news/china/diplomacy/article/3316875/ch... [1] - https://www.scmp.com/news/china/diplomacy/article/3317442/von-der-leyen-deepens-gloom-over-china-eu-summit-attack-beijings-russia-stance?module=inline&pgtype=article https://www.scmp.com/news/china/diplomacy/article/3317442/vo... [2] - https://www.cso.ie/en/releasesandpublications/ep/p-fdi/foreigndirectinvestmentinireland2023/intro/ https://www.cso.ie/en/releasesandpublications/ep/p-fdi/forei...
- tsimionescu 1y ago
  > The EU has an added issue that the COE requires unanimity amongst heads of state to pass EU wide legislation This is vaguely similar to the truth, at best. The Council of Europe (CoE) has nothing to do with the EU, you're probably confusing it with the European Council (EUCO). But the EC is not normally involved in the legislative process. Instead, EU legislation is proposed by the European Comission (EC) and must be accepted by both the European Parliament and the Council of Ministers. The Council of Ministers is the closest body to what you probably meant, but it's made up of heads of government of member states, not the heads of state. It also doesn't require unanimity to pass a law - it takes at least 4 countries to outright block legislation. There is a procedure in which a single country which is unhappy with a law passing can raise this to the EUCO for additional review, but it doesn't apply to ordinary legislation. So, no, Ireland can't unilaterally block any such legislation, it has to convince other countries to join in.

bpavuk 1y ago

wait, do they (at least attempt to) spearhead it with Mistral and La Suite? La Suite works good... regard français perplexe

MEMORYC_RRUPTED 1y ago

I mean, same story in Belgium, The Netherlands, and (I'm gonna assume) every other EU government. Specifically for The Netherlands, https://berthub.eu/articles/posts/demystifying-european-digital-sovereignty/ https://berthub.eu/articles/posts/demystifying-european-digi... is a good read, from someone that really understands how this works in government. Sadly, I understand why: they have a tonne of systems, that all, at least somewhat, work, that people know how to use, with established contacts and support contracts. IT departments trained and certified on how to run and deploy MS software. And that's before we start talking about lobbying. edit: added a link to a good resource about the topic. We should have started moving over yesterday, but it's a long and difficult process, I just hope we start moving forward on this.

AndyMcConachie 1y ago

This is everywhere in the EU. The Dutch government put out an RFP for MS Outlook licenses. RFPs are supposed to be vendor neutral, so I don't understand how an RFP for something that only a single company sells can be vendor neutral. They outsource all their email, but they don't put out RFPs for "email". MS is burrowed so deep into EU governments good luck getting them out.

reestr 1y ago

If control flows through data infrastructure, does it matter who “owns” the platform? Once exposure is built into the structure, sovereignty becomes a user illusion.