“For € 500 million, we’d set up an independent Tuta Drive instance on BND infrastructure – with quantum-resistant encryption.”
To be able to exchange classified information more quickly, Germany’s Federal Intelligence Service (Bundesnachrichtendienst, BND), Federal Office for the Protection of the Constitution (Bundesamt für Verfassungsschutz, BfV) and Military Counterintelligence Service (Militärischer Abschirmdienst, MAD) plan to set up a joint cloud system – together with Google. Where does that leave digital sovereignty?
Tagesschau reports that the German Federal Intelligence Service (BND) wants to pay 500 million euros to Google – for hosting highly classified information. Source.
We at Tuta are astonished to learn this. Honestly, for 500 million euros, we would set up an independent Tuta Drive instance on BND infrastructure – with quantum-resistant encryption. Tuta’s hybrid encryption protocol makes sure that all data is transmitted end-to-end encrypted so that no third parties – not even we at Tuta (let alone Google) – could gain access to this highly classified information. Plus, the code is open source and can be verified by anyone, making sure there are no backdoors. When the authorities talk about digital sovereignty, they must back up their words with actions – instead of falling into the trap of Big Tech once again.”
Security assessment: High risk
The NDR and WDR report that the cloud will be based on the Google Distributed Cloud (GDC), specifically on a so-called “air-gapped” version. This system will operate separately and will not have a direct connection to Google or the Internet. Instead, the data is supposed to be stored in Germany under a separate, specially protected IT network. The problem, however, as Sven Herpig, Head of Cybersecurity & Emerging Threats at Interface, an independent organization of IT professionals and cybersecurity experts, points out is: “every Google update”. While the system at launch will be vetted and properly secured, every update changes this system, and these updates are done by Google. Herpig says: “This, in turn, raises the question: How significant do the changes have to be for an updated version to require re-evaluation and re-approval?”
It also remains unclear whether the “air-gapped” cloud infrastructure will ultimately have to be maintained and operated on-site by Google employees, as is the case, for example, with Palantir systems in Hesse or Bavaria.
The decision to buy Google Cloud leaves sensitive data at risk. Plus, there’s also the question of independence: What if Google decides (or is pressured by the U.S. government) to include a hidden backdoor in an update? What happens if the U.S. government orders Alphabet to hand over specific data under the U.S. CLOUD Act, FISA, or Executive Order 123333? Will Alphabet deny the request of the U.S. government or hand out German data?
This risk remains true and valid, and considering the value of the sensitive information, it must be classified as high.
Digital sovereignty, anyone?
And finally, where does this leave Germany on the topic of digital sovereignty? Is it all just talk? Instead of rigorously implementing the goal of digital sovereignty - at least in the area of internal security - the German federal government is falling into yet another dependency and relying on assurances from the U.S. hyperscaler Google.
But now is the chance to support and build European alternatives, and the authorities must lead by example! Choosing Google over German providers is the worst possible decision the BND could have made here.