Microsoft cloud data trap?
Computer Scientists: Germany Is Falling Into a Data Trap in the Microsoft Cloud
More and more government agencies want to move to the Microsoft cloud, warns the German Computer Science Society. Germany is in danger of ending up “in Microsoft’s golden cage.”
With the preference of some states and the federal government for Microsoft’s cloud services, “increasingly sensitive citizen data is also being entrusted to the tech giant,” warn the Executive Committee’s Working Group on Digital Sovereignty and the Working Group on Data Protection and IT Security of the German Computer Science Society (GI). They see this as posing “unacceptable risks to Germany’s digital independence” as well as to the protection of citizens’ and businesses’ data: “The alarming dependence on Microsoft is not only being cemented but further expanded.”
One trigger for the GI’s warning: According to a c’t survey, at least six federal states —including Bavaria, Lower Saxony, and North Rhine-Westphalia— plan to introduce the Teams video conferencing system or the complete Microsoft 365 cloud office suite into their administrative systems. Recently, Chancellor Olaf Scholz (SPD) also voiced support for the Delos cloud project by SAP, Arvato, and Microsoft, which, however, advertises itself as offering more “sovereignty” than purely U.S.-based solutions. Such efforts lead the GI to fear that “Germany could soon find itself trapped in a golden Microsoft cage.”
MI6 Chief Speaks of a “Data Trap”
The GI cites a 2021 interview with Richard Moore, head of the British intelligence agency MI6. The espionage expert spoke of a “data trap”: “If you allow another country to gain access to truly critical data about your society, that will erode your sovereignty over time.” Applied to Germany, the Computer Science experts say, the data trap would close if the plans of some federal states to migrate to the Microsoft cloud were to be implemented.
The authors explain that this has to do with the Cloud Act. It authorizes U.S. authorities to “legitimately access data held in Computing Centers of U.S. service providers outside the United States.” The providers are obligated to maintain confidentiality. In a 2019 study cited by the authors, auditors pointed to “pain points in the federal administration” caused by this situation. Digital monopolies could drastically raise their prices, the report continues. Another surge in spending is expected in the public sector. In 2023 alone, the federal government increased its spending on software licenses from approximately 771 million euros in 2022 to over 1.2 billion. A large chunk of that goes to Microsoft.
Doubts About Security and Legal Compliance
The GI is pessimistic due to serious security incidents in Microsoft’s Azure cloud. Furthermore, there are doubts regarding the legal compliance of awarding contracts of this magnitude without a prior EU-wide competitive bidding process. Alternative solutions are well known and would be preferable for reasons of data protection, IT security, and cost. Schleswig-Holstein is leading the way with its open-source approach. “Germany’s future must not depend on the whims of large foreign corporations,” the Computer Science experts emphasize. It is crucial “that we can shape our digital future independently, autonomously, and securely.” The federal government must finally put its guiding principle of strengthening digital sovereignty into practice. The states also bear a special responsibility in this regard.