In February, Le Canard enchainé revealed that EDF had decided to use Amazon Web Services to manage part of the data from its nuclear power plants. It was about “ “predictive maintenance” of power plant spare parts ”, according to our colleagues.
EDF selects several IT partners, including AWS
The company immediately confirmed: “ To support the nuclear fleet in operation over the long term, EDF has decided to modernize part of its so-called management information system. As part of this work, several IT partners (IT and technologies), including AWS [Amazon Web Services, ndlr]were selected to complete the offering of data storage centers and internal skills », as reported by Le Figaro at the beginning of the year.
A source close to the matter tempered the issues around the data: it is “ manage a catalog of spare parts, pumps, etc. for power plants », Explain our colleagues. But the question of sovereignty still arises, especially since many French and European actors exist. Why then prefer Amazon?
Confidential data “will not be on the cloud”
Luc Rémont, CEO of EDF, provided a response and wanted to temper the debate, as reported by Usine nouvelle: “ We have not entrusted all of our data to Amazon. We are doing a test with Amazon on a number of applications as any company would do. Our confidential data on nuclear power plants will not be on the cloud. They remain in protected bases and are obviously not shared ».
When asked why Amazon and not a European player, the boss has a ready answer: “ We deployed a test with Amazon, a great expert in the cloud but also in logistics to help us optimize the management of our spare parts. ».
Amazon finally refuses the contract
Patatras, the super contract worth 860 million euros falls through, “ Amazon refuses to host sensitive EDF data in France », headlines Le Canard enchainé. “ Behind this decision is a standoff between American and French intelligence services around national sovereignty », add our colleagues. A story reminiscent of the Health Data Hub with French health data at Microsoft.
Around ten months after the announcement of the partnership between EDF and AWS, the first feedback seemed positive on the EDF side, according to our colleagues.
The latter nevertheless specify that French Intelligence was less enthusiastic and would require that the data recovered by Amazon be stored on French servers. Still according to the Duck, “ the American refused to comply with the requirements of this “sovereign cloud”, on the pretext that this would make the contract with EDF significantly less juicy for it ».
For a senior official interviewed by our colleagues, the truth lies elsewhere: “ Amazon simply refuses to write in black and white that it will not provide the data of its French customers to American intelligence services or the Department of Justice ».
EDF could use S3NS from “Thales x Google Cloud”
Amazon is not the only American player concerned, Microsoft is also and has even admitted, to the Scottish police authority, that the company could not guarantee the sovereignty of the data hosted in its Azure infrastructure.
EDF would have a backup solution: go through S3NS – which is in the ANSSI SecNumCloud certification process –, the joint venture between Thales and Google, which would be impervious to the Cloud Act and other American regulations such as Section 702 of the Foreign Intelligence Surveillance Act (FISA). At least that's the promise of the protagonists.
There is also another cloud based this time on Microsoft services: Blue, with Orange and Capgemini. Bleu is also aiming for SecNumCloud certification and hoped to submit a file to ANSSI before the end of the year, but we have not heard anything since.
The same question “will arise everywhere”
On The same question now also arises for the State's tender platform – a sovereign issue if ever there was one. It will land everywhere ».
He takes the opportunity to return to the charge indirectly on the history of the HDH: “ With on the one hand, obligations and cardboard labels for French and European companies who have been asked to make efforts for nothing. And on the other side, American companies which spare themselves these efforts and will win markets to the detriment of our sovereignty, and the possibility for French companies and citizens to be preserved from the inquisitive gaze of the American administration. ».
« To put it another way, French players are being ousted one after the other from the markets of their own country, by foreign companies who do not even respect the legislation and the constraints that are asked of them. to respect “, he says by way of conclusion.
The issue of the Health Data Hub rises at the ECHR
After the validation by the Council of State of the CNIL's authorization to store the Heralth Data Hub's EMC2 data warehouse in Microsoft Azure, Clever Cloud and other companies announce that they are seizing the European Court of Human Rights (ECHR).
They point out that this hosting at Amazon exposes the data “ to possible interceptions by American intelligence services under the extraterritorial application of American intelligence law, and in particular the FISA Act ».
Related News :