Amazon, the world’s largest provider of cloud services, is building a separate, ‘sovereign’ system for remote computing power and data storage for European customers. It thus responds to their changing needs, says Daniëlle Gorlick, Benelux director at Amazon’s cloud branch, AWS. European companies and governments are increasingly asking American companies such as Amazon for guarantees that their data is stored outside the reach of the American government.
Gorlick describes Amazon’s new product, AWS European Sovereign Cloud, as an “independent cloud for Europe – European owned and run by Europeans. But without customers missing out on innovation. They can still use everything Amazon offers.” The group is investing almost 8 billion euros in the development.
In European hands, you say. But it is and remains a service of the American company Amazon.
“We have set up a separate European entity. We are bound by European laws. And we have an advisory board in which two independent members have been appointed in addition to three people from Amazon. It is an Amazon company, but there is no dependence on infrastructure outside the EU. All metadata also remains in the EU.”
How can you be sure that AWS does not have to follow orders from the US government for this product, for example under the Foreign Intelligence Act (FISA) Section 702? Or under the Cloud Act, which obliges American tech companies to provide data in criminal investigations?
“Our customers can encrypt their data and keep the keys themselves, so our people can never access that data.”
“And as for the Cloud Act: it is often misunderstood. The American government does not simply have unlimited access to data. There are strict requirements; among other things, it must be made plausible that data has probably been used for a crime. Since we started keeping track of this in 2020, we have never provided information from customers outside the US to the American government under that legislation.
“With regard to FISA 702: the Court of Justice of the European Union ruled positively in September on the data-sharing agreement between the US and the EU.”
Daniëlle Gorlick, director of Amazon Web Services Benelux
Photo AWS Benelux
That does not mean that the law does not apply. The bottom line is: Does a US entity or individual own, manage or control the data within this product?
“All regions into which AWS is divided are sovereign. Customers are completely in control of their own data, where it is located, how it is stored and who has access. We have systems where customers can choose to encrypt everything and also keep the keys themselves, so that our people who work there can never access them.”
I was hoping for the question whether you could provide certainty. The term ‘control’ (management of the data) is relevant to who directs the management and the board members. Can Amazon in the US fire the leadership of the European Sovereign Cloud, and does the head office determine the level of salaries and bonuses?
“I’m not the best to answer that question. We have to come back to that.” The question also remained unanswered in the hours after the interview.
Does the AWS European Sovereign Cloud only fall under European law or also under American law?
“Every global organization has to deal with rules in different jurisdictions. You have to look at this on a case-by-case basis. With this cloud, the ESC, the business model is based on European law. Decisions must comply with German laws and regulations. And the European citizens who control the ESC have a copy of the source code. In the extremely hypothetical case, they could continue to run the cloud themselves.”
A hypothetical scenario is a conflict between the US and the Netherlands. Can Amazon in the US then order services or products to be disabled in the Netherlands?
“I don’t like to discuss hypothetical situations, but the ESC is built for operational autonomy. If something like this happens hypothetically, we can provide continuity in our services.”
You have announced the construction of one ‘local zone’ in Amsterdam. What is that?
“A localzone is a data center with a limited part of our services. It is intended for customers in a specific region, who, for example, have requirements regarding where exactly data is stored or for whom there must be absolutely no delay in the connection. We already announced in 2022 that we would build a local zone in Amsterdam. After discussions with customers about their changing sovereignty needs, we decided to incorporate their wishes into the ESC design.”
AWS does not want to say where exactly the data center will be located, what the capacity will be and how large the investment will be.
The American company Kyndryl is working with AWS on the new European cloud. Kyndryl came into the news after taking over the company that runs DigiD. Will DigiD soon come from the new AWS data center in Amsterdam?
Also read
Solvinity boss tries to remove concerns about DigiD. ‘DigiD is and remains Dutch, and it remains safe’
Is the ESC more expensive than the ‘normal’ cloud?
“Of course the price of the ESC will be different from that. The price will reflect what it costs to build and maintain an independent and fully sovereign European cloud with all the trimmings, and run by Europeans.
You are from America. How do you view the European need for sovereignty?
“In conversations with customers, I notice that there is not one definition of sovereignty. There are a number of trends. They want certainty about where data is located, operational autonomy, resilience, governance, transparency. I think we offer all that with the ESC.”
Shouldn’t European companies build a European sovereign cloud?
“Our European sovereign cloud has a long history, it was not invented last year. We hear from our customers that they need sovereignty, but also that they do not want to miss out on innovations. This is especially important for Dutch companies and organizations, because they are at the forefront of AI innovation in Europe. They do not want to lose that.”
Also read
American tech companies try to make their cloud look as European as possible
The journalistic principles of NRC