European Cloud for sovereignty over our data? Wake up

There’s a spy in the backyard of Europe’s digital sovereignty. There are actually two, half-siblings Intel and AMD, whose chips power the Old World bits that underpin the dominant cloud. Both companies’ chips feature so-called Ring-3 management subsystems, integrated computers with deep access to the system while remaining largely opaque to the people who own and manage them.

All of this is not a secret, even if it is not widely discussed.

See more articles from iGuRu.gr when you search for news on Google.

iGuRu.gr preferred source

The management subsystems are designed to be controlled over the same networks that servers use, making them theoretically and practically vectors for remote attacks. With Intel and AMD subject to US laws that can force them to act secretly for the state, the multi-billion euro effort to raise the European flag over an impenetrable cloud fortress seems utopian.

Cloud dominance starts with supply chains. If you don’t control the components that protect your nation from a malicious attack, you don’t have dominance. This is most evident during wartime, not just in the military supply chain in the field, but also in the industrial base that keeps the machinery running. Japan’s strangulation of oil and other raw materials during World War II severely limited what its military could do. In technology, America controlled the supply of high-quality quartz needed to make radio crystals, which gave its battlefield communications a very serious advantage.

The most ironic part is that during the Cold War, the titanium needed for the Mach 3 SR-71 spy plane came from the Soviet Union. Which sold it to a chain of shell companies set up by the CIA. The same CIA that secretly took control of the Swiss cryptography company Crypto AG to put backdoors in its products. Supply chain attacks can take many forms. Dominance can never be guaranteed. And if we want to talk about one thing, it's risk management.

Managing the risk of Europe’s autonomous cloud security should be a major part of the specification. Ignoring the risk that exists in the CPUs would be an incomplete task. This risk can extend throughout the entire infrastructure. The routers and switches within data centers, as well as the connectivity between them and users, offer a huge space for attacks where backdoors are hidden by the manufacturers.

The best solution, of course, is for Europe to start manufacturing its own chips for data centers. Of course, it is overly pessimistic to say that the only way to do this is to wait for Risc-V to mature for a decade or so.

If the EU wanted to, it could have asked a third party to build Arm designs to digital sovereignty specifications. It could have started its own design office, hired talent, and kept everything in-house. Apple did it, Qualcomm and Broadcom did it, Samsung and MediaTek did it. It’s a well-trodden path.

You can only have true digital sovereignty when you control or trust the supply chains that connect data and the network. This is the perspective that Europe needs and the only one that can offer. Open source is the obvious basis for the software component, but not necessarily for the hardware.

Away from Intel and AMD. The best control is maximum control for dominance.

newsbot

Although the press releases will range from very select to rare, I said I'd pass...because sometimes the editors hide.