Huawei Frightens Europe's Data Protectors. America Does, Too

(Bloomberg) -- A foreign power with possible unbridled access to Europe’s data is causing alarm in the region. No, it’s not China. It’s the U.S.

As the U.S. pushes ahead with the “Cloud Act” it enacted about a year ago, Europe is scrambling to curb its reach. Under the act, all U.S. cloud service providers from Microsoft and IBM to Amazon -- when ordered -- have to provide American authorities data stored on their servers regardless of where it’s housed. With those providers controlling much of the cloud market in Europe, the act could potentially give the U.S. the right to access information on large swaths of the region’s people and companies.

The U.S. says the act is aimed at aiding investigations. Some people are drawing parallels between the legislation and the National Intelligence Law that China put in place in 2017 requiring all its organizations and citizens to assist authorities with access to information. The Chinese law, which the U.S. says is a tool for espionage, is cited by President Donald Trump’s administration as a reason to avoid doing business with companies like Huawei Technologies Co.

“I don’t mean to compare U.S. and Chinese laws, because obviously they aren’t the same, but what we see is that on both sides, Chinese and American, there is clearly a push to have extraterritorial access to data,” Laure de la Raudiere, a French lawmaker who co-heads a parliamentary cyber-security and sovereignty group, said in an interview. “This must be a wake up call for Europe to accelerate its own, sovereign offer in the data sector.”

Matters of espionage and foreign interference will be at the center of talks at Europe’s biggest telecoms and technology conference, the MWC Barcelona, that started Monday.

Irish Case

The Cloud Act (or the “Clarifying Lawful Overseas Use of Data Act”) addresses an issue that came up when Microsoft in 2013 refused to provide the FBI access to a server in Ireland in a drug-trafficking investigation, saying it couldn’t be compelled to produce data stored outside the U.S.

The act’s extraterritoriality spooks the European Union -- an issue that’s become more acute as trans-Atlantic relations fray and the bloc sees the U.S. under Trump as an increasingly unreliable ally.

Europe may seek to mitigate the impact of the law by drawing on a provision in the act that allows the U.S. to reach “executive agreements” with countries allowing a mutual exchange of information and data. The European Commission wants the EU to enter into talks with the U.S., and negotiations may start this spring.

EU Action

France and other EU countries like The Netherlands and Belgium are pushing for the bloc to present a common front as they struggle to come up with regulations to protect privacy, avert cyber attacks and secure critical networks in the increasingly amorphous world of information in the cloud.

A Dutch lawmaker at the European Parliament, Sophie in ’t Veld, recently expressed frustration at what she called the EU’s “enormous weakness” in the face of the U.S.’s “unlimited data hunger.”

“Because of the Cloud Act, the long arm of the American authorities reaches European citizens, contradicting all EU law,” she said. “Would the Americans accept it if the EU would grant itself extraterritorial jurisdiction on U.S. soil? And would the Commission also propose negotiations with Russia or China, if they would adopt their own Russian or Chinese Cloud Act?"

An internal memo crafted by the French government in November states that “the Cloud Act could be a test from the U.S., and they expect a political response, which ought to be European to be strong enough.”

French Response

The Cloud Act was enacted just weeks ahead of Europe’s data-protection law, the General Data Protection Regulation, or GDPR, which states that all businesses that collect data from EU citizens have to follow the bloc’s rules, which could put the two laws at odds.

While waiting for the EU to get its response together, some countries are preparing their own, with the French leading the pack. President Emmanuel Macron’s teams are readying legal and technical measures to shield the country, four government officials involved said. The president’s office, the finance ministry and the state’s cyber security agency ANSSI have worked on it for the last 10 months.

“The more we dig into the Cloud Act, the more worrying it is,” said ANSSI chief Guillaume Poupard. “It’s a way for the U.S. to enter into negotiations... but it has an immediate extraterritorial effect that’s unbearable.”

Not OK

The French government has held meetings with banks, defense contractors, energy utilities and others, asking them to use “Cloud Act-safe” data providers. It’s also studying legal options, a finance ministry official said. One way might be to refresh a 1968 “Blocking Statute,” which prohibits French companies and citizens from providing “economic, commercial, industrial, financial, or technical documents or information” as evidence in legal proceedings outside the country.

“No one can accept that a foreign government, even the American one, can come fetch data on companies stored by a U.S. company, without warning and without us being able to respond,” Finance Minister Bruno Le Maire said in a speech on Feb. 18.

France has been more vociferous in its opposition to the Cloud Act because its companies have borne the brunt of other extraterritorial U.S. laws. In 2014, BNP was slapped with an $8.97 billion U.S. fine for transactions with countries facing American sanctions. French oil company Total SA walked away from a $4.8 billion project in Iran after Trump pulled out of its nuclear deal.

Local Providers

One consequence of the Cloud Act is that European companies and organizations will start looking for local alternatives. Europe’s phone operators, many of whom are already being steered away from Huawei, see the act making providers from the U.S. a threat, too.

“On the one hand you have this Chinese expansion and on the other these new U.S. rules are putting American companies at the mercy of the administration,” Gervais Pellissier, deputy chief executive officer of Orange SA, told reporters on Thursday in Paris. “The hardware bricks are either American or Chinese. We need to now find a software layer to deal with the situation.”

Local cloud providers are using the Cloud Act and GDPR in their sales pitches. French company Atos is telling customers it’ll keep their most-sensitive data physically on servers in Europe. It struck a deal with Google to safeguard client data.

OVH Groupe SAS, presenting itself as a Europe-grown rival to Amazon’s cloud business, is growing sales 30 percent a year and making profit running data centers in Europe.

“We can guarantee our customers the sovereignty of their data, which is more than Amazon or other rivals can offer,” Founder and CEO Octave Klaba told reporters in October.

--With assistance from Ben Brody, Angelina Rascouet and Natalia Drozdiak.

To contact the reporters on this story: Helene Fouquet in Paris at hfouquet1@bloomberg.net;Marie Mawad in Paris at mmawad1@bloomberg.net

To contact the editor responsible for this story: Vidya Root at vroot@bloomberg.net

©2019 Bloomberg L.P.