A presentation at Brest is AI in in Brest, France by Horacio Gonzalez
Souveraineté des données. Horacio Gonzalez @LostInBrittany
Who are we? Introducing myself and introducing OVH OVHcloud
Horacio Gonzalez @LostInBrittany Spaniard lost in Brittany, developer, dreamer and all-around geek Flutter
OVHcloud: A Global Leader 200k Private cloud VMs running 1 Dedicated IaaS Europe 30 Datacenters Own 20Tbps Hosting capacity : 1.3M Physical Servers 360k Servers already deployed Netwok with 35 PoPs
1.3M Customers in 138 Countries
OVHcloud: Our solutions Cloud Web Hosting Mobile Hosting Telecom VPS Containers ▪ Dedicated Server Domain names VoIP Public Cloud Compute ▪ Data Storage Email SMS/Fax Private Cloud ▪ Network and Database CDN Virtual desktop Serveur dédié Security Object Storage Web hosting Cloud Storage Over the Box ▪ Licences Cloud Desktop Securities MS Office Hybrid Cloud Messaging MS solutions
Do you remember old times? The stories of the grumpy old dev…
In a time almost forgotten When even internet was young…
Data was a scarce resource Mon IBM PC 5155 in the 80s and its big 360 KB floppy disks
Even in big systems… A big mainframe disk from 1985… at 1000$ / MB
Things have changed a lot And we all have some tens of GB in the pocket
Data centers instead of mainframes With petabytes of data capacity…
You are losing me… WTF is a Petabyte? 1 PB = 1 000 TB = 1 000 000 GB
How much data is produced in a year? In 2018 we produced 18 zettabytes 1 ZB = 1 000 EB = 1 000 000 PB
How do we produce so much data? In 2018 every minute: ● Twitter users sent 473,400 tweets ● Snapchat users shared 2 million photos ● Google processes more than 2.5 million searches
Not all the data is the same Some are more important that other
But for all there are critical questions Who is the owner of the data? Who can access the data? Who can monetize the data? Who does control the data?
What are the risks? For an enterprise and for an individual
Data is the new oil, they say In any case, data is vital to business
Risk: data theft The first we think of…
Risk: industrial spying The chic version of data theft…
Risk: data loss Either permanent or temporary
Risk: data alteration Accidental… or not
Risk: no access to data No internet, no cloud…
External risk factors: Geopolitics
External risk factors: Geoeconomics
External risk factors: Distortion of competition
But today we look at another one What rules apply to data? Which jurisdictions?
Data sovereignty Who controls the data… and why should I care?
Data has ethical value For good… and for evil
Data has economic value Fortunes are built around data
Data has a strategic value Key to the independence
Data sovereignty The idea that data are subject to the laws of the nation it is collected
It began with Snowden And the revelations on the PRISM program
And the CLOUD Act The CLOUD Act states that American companies must provide information properly requested by law enforcement “regardless of whether such communication, record, or other information is located within or outside of the United States.”
EU & US: very different views on data Privacy vs Profit
General Data Protection Regulation Protects all personal data for European citizens
New rights for individuals ● The right to access ● The right to be forgotten ● The right to data portability ● The right to have information corrected ● The right to receive a Breach notification
Irresistible force paradox What happens when an unstoppable force meets an immovable object?
Answer: nobody knows for sure And unknowns are never good news…
Data Sovereignty and SaaS Spoiler: it’s complicated
Reminding cloud service models The problem is different for each model
Data Sovereignty and SaaS Well… it’s complicated…
SaaS: Where the data will be stored? Not easy to know in many cases… How about when accessing from the EU to a service hosted in US via un VPN UK?
SaaS: data livecycle Do GDPR protections apply to that SaaS?
SaaS: who owns the data? And what jurisdiction applies?
SaaS: how is data secured And will you get informed from a breach?
Data Sovereignty and IaaS/PaaS A bit clearer
You are using your own services In a third part platform
GDPR is a powerful tool And most providers try to show conformity
But often you have some work to do There is a subtle difference between GDPR ready et GRPD compliant
Vendor lock-in Easy to get in, impossible to get out
Having only a cloud provider Comforting sensation of simplicity
One Cloud to run your apps all Is it really a good idea?
What could possibly go wrong?
Specialy if my data is strategic What can I do?
I can always go away Can’t I?
Well, not so simple… Vendor lock-in
Technical vendor locking Proprietary APIs and products
Cost-based vendor locking Data transfer prices
What can I do then? Quit the Cloud? Going raise goats in Larzac?
The European reaction What cloud do we want?
There are European alternatives Transparent and compiant
European players are ready Alternative solutions respecting our values and rules
Trusting on European actors Building ecosystems, growing champions
Cloud of confiance European initiatives to leverage on European ecosystems
France and Germany initiatives Building souvereign clouds
Protect critical data From extra-territorial threads
Initiatives like GaiaX Transnational working groups Industrial partners
What that means for you? ● Empowering companies and institutions ○ To take more out of your data ● Based on standards and openness ○ A complete offering ● Your data get protected
Conclusion That’s all, folks!
Si tout le monde s’accorde pour dire que le futur est dans le Cloud, les avis sont moins tranchés sur comment faire coexister dans ce Cloud des intérêts, des modèles et des philosophies de société aussi éloignées que l’Europe, les USA ou la Chine.
Dans ce contexte la souveraineté des données devient un enjeu majeur. Vie privée, éthique, économie, géopolitique… les données sont partout et la façon de les gérer est structurante.
