In her guest commentary, Andrea Wörrlein recently sharply criticized the EU cloud project Gaia-X. In the much-discussed article, the managing director of VNC found that they are now working too closely with those internet giants from whom they actually wanted to make themselves independent with the sovereign cloud. In an interview with the iX she continues her criticism – and explains how it could still work with an EU cloud.
Ms. Wörrlein, in your comment you are severely judging Gaia-X. What is bothering you about the plan to build your own EU cloud infrastructure?
Basically nothing bothers me about the project. However, the question arises to me what “EU-owned” means. The EU is a confederation of states, a heterogeneous structure with national legislations. Fortunately, this association is also in competition with one another in many areas. And that results – at least for now – in the strength of Europe as an association. And in my opinion nothing should change in the foreseeable future.
Which service number can you call if there is a problem with the “EU Cloud”? Who actually operates this cloud? Who has “Root Admin Access” to Core Services? Who decides on issues such as encryption and the algorithms used? Isn’t there a huge potential for conflict? The massive problems of centralization and the associated dependency in terms of availability, security and censorship would only be shifted to another bureaucratic monster.
In your opinion, what would be the better approach to setting up a cloud for local companies?
My suggestion: The EU should create a best practice environment that interested nations and states can then use and adapt as a blueprint. I firmly believe that these components must be 100% open source. This is the only way to ensure trust in the stack. The inclusion of companies such as Amazon, Google, Alibaba, Microsoft & Co. in Gaia-X is certainly not expedient.
But what does the stack actually consist of? In very simple terms, it is about three components: Infrastructure (I (aaS)), platforms (P (aaS)) and software (S (aaS)) – either as a service or on premises.
If you leave out the costs, what is the problem with setting up the infrastructure required for the first layer, i.e. concrete and sheet metal, or integrating existing data center operators within a hybrid EU cloud? The container orchestration in the second layer, i.e. the platform, is also no rocket science thanks to Kubernetes. All other software components in the third layer come from various manufacturers who are sensibly Kubernetes-enabled. And with that you are almost there.
And providers such as Amazon AWS or Microsoft Azure could also play along on this basis – or should these be excluded as much as possible?
Gaia-X should become an interoperable European alternative to cloud services from hyperscalers such as Amazon, Alibaba, Google or Microsoft. The Federal Minister of Economics and Technology, Peter Altmaier, who was in office until recently, said that American companies are now getting involved in the project, but that they do not contradict the policy stipulations. I see that a little more critically. At the core of Gaia-X is a truly European perspective and an unrestricted recognition of values such as data protection, interoperability, trust, transparency and openness with a clear commitment to free software.
The still open question is: How does this fit with the US “Cloud Act”? In addition, I had previously understood the project to mean that Gaia-X would also be a technology competition between European and the currently dominant US players. Why then exactly do these competitors get insight immediately? It’s almost as if BMW or Daimler, in their current latecomer position, were to invite a company like Tesla to look over their shoulders to get feedback on whether the electric drives they have just developed might have a chance. To be honest, I find that downright absurd. Do you have so little confidence in your own abilities or are there other reasons?
In concrete terms: How can Europe change course now – is there still any chance of repositioning the EU cloud?
The goal of building a European cloud platform is certainly worth striving for. But you also have to implement it. The ideal begins with a European “concrete initiative” that builds data centers certified according to European standards or certifies existing data centers across Europe. The best thing to do is to provide “sheet metal”, i.e. hardware and racks as well as an Internet connection. Both together, i.e. concrete and sheet metal, then result in a European IaaS. This is where the largest investment is required, but at the same time it is the least technically demanding.
Companies can then use these data centers at fair prices, usually for a fee per kWh. Innovative start-ups could be sponsored for a certain period of time or receive an incubator credit – if successful, this subsidy is repaid from part of the proceeds. This creates an incentive to develop sustainable and beneficial software.
Of course, this IaaS alone is by no means sufficient. The next step is the actual cloud. It is what makes Google, Amazon and Microsoft so unique: Nowadays you need a cloud operating system. This cloud OS is also already available as an open source version, for example Kubernetes based on open source operating systems such as Red Hat or Ubuntu. This would allow the creation of hybrid cloud environments that are equivalent to GCP, AWS or Azure and even superior in the long term, which extend over the secure and certified European cloud as well as cloud environments on premises – that would be a real innovation and the second layer within the European Cloud Platform: PaaS.
The well-known SaaS model is then located on the third layer, i.e. the part that is really visible to the customer, the software. In addition to the classic SaaS, a kind of “Dedicated SaaS” would be desirable – a really dedicated, protected instance for the respective customer. But in more complex environments we need platform technologies such as cloud database, cloud index and cloud storage software, on the basis of which the actual applications are developed.