🔴 How the State Confiscated the Digital Sovereignty Market

Context

Toward the end of Macron's first term, three crises (Covid, the polarization of Trump I, and the outcry over the Health Data Hub being hosted at Microsoft) served as a pretext for the state to take back control of "sovereignty," sidelining the historic players.

It is a Machiavellian and brilliant plan, built on a semantic inversion, that will have fooled and left by the wayside nearly all the so-called historic players of sovereignty. For now, while it is holding despite delays in its rollout, it remains a gigantic bet that has to prevail before the end of the second term.

As a former military officer who moved into the private sector explained to me, for the administration, sovereignty means the state; the technostructure cannot allow this sector to develop without control.

After the planning state and the strategist state, we are witnessing the era of the operator state (read: of digital sovereignty).

Before getting into the details of this plan, it is worth remembering that it was made possible because the "leaders of French cloud" never managed to agree on technological interoperability or even a viable shared vision, despite the repeated (and sadly fruitless) attempts of some of us.

Over this period, every one of them, at one point or another, agreed to play the useful idiot in the service of the operator state's strategy.

Even today, the digital sovereignty market is split between those who have understood, those who are panicking because they are only just beginning to understand, and those who, blinded by their ego or their delusions of grandeur, still haven't seen anything coming.

And there are those, like me, who, faced with so much waste, have turned away from this sector.

That is why I now prefer to talk about resilience, and why I have moved up to the European level, where there is far more to build.

How the original vision of sovereignty was hijacked

To grasp the French state's "secret" digital sovereignty strategy, you have to understand that the current technostructure, which runs industrial and digital policy, has never believed in the spontaneous emergence of a genuine sovereign tech industry.

From one extreme to the other: in the 1990s, their predecessors wanted to fight the Internet to preserve the Minitel. Today, a generation of senior civil servants fascinated by Silicon Valley believes that a compromise with Big Tech, pairing them with trusted players like Thales or Orange, is the only realistic solution.

Digital sovereignty timeline

• For me, as early as 2004, it was about promoting European and French software know-how, a form of software sovereignty (report on P2P for ADAMI, the performers' rights society).
• For Laurent Sorbier and Bernard Benhamou (in a 2006 text), it was about the sovereignty of European Internet networks in the face of ICANN's dominance.
• For Pierre Bellanger, in his book La souveraineté numérique (2010), it was about turning Orange into a national super-champion and centralizing state services. It should be remembered that this served as his platform when he was angling for the company's chairmanship.
• For Bernard Charlès (Dassault Systèmes), it was the idea of a professional sovereign cloud, Andromède, announced in 2011 (with Orange and Thales), the start of their vision of a secure state cloud. He pulled out of the project to acquire and develop Outscale.

PS: the first sovereign cloud remains Jolicloud (2009/2015); it was admittedly aimed at consumers, but it was built and hosted in France (1.3 million users at its peak). Without any support from the state or from Fleur Pellerin's chief of staff, who told me there was no point in fighting because, in his words, Google or Apple had already won.

After Dassault Systèmes withdrew, Fleur Pellerin decided to entrust the sovereign cloud (CloudWatt, Numergy) to two telecom operators (Orange and SFR), a decision that would come to be seen as a commercial failure, even if it has to be weighed against the fact that the state never committed to any purchase orders, which didn't exactly help.

• Scaleway (Online) and OVH didn't believe in the cloud at the time; they dominated the cheap dedicated server market.
• Outscale, founded in 2010 by Laurent Seror, would be absorbed by Dassault in 2017 to become the industrial continuation of this vision of a "sovereign digital power plant."
• In 2013, Catherine Morin-Desailly published a report with a crystal-clear title: L'Union européenne, colonie du monde numérique (The European Union, Colony of the Digital World).
• In 2019, I published an op-ed in Le Point, the French weekly, titled Comment la France s'est vendue aux GAFAM (How France Sold Itself to Big Tech), which reopened the question of dependence on, and deference to, the big American platforms.

But it was Covid and the Health Data Hub affair that made the subject of sovereignty central enough for Macron to decide to assign the "digital sovereignty" portfolio to the Ministry of the Economy and to activate the operator state strategy.

The semantic shift: digital sovereignty → trusted cloud

The first essential step in any capture strategy is a change of vocabulary.

And so we went from the notion of "digital sovereignty" to that of the "trusted cloud." This shift, seemingly innocuous, nonetheless carries significant consequences:

• Digital sovereignty: a geopolitical dimension.
• Trusted cloud: a cybersecurity dimension.

This change in terminology made it possible to hand the file over to ANSSI (France's national cybersecurity agency), now the competent authority on the matter, which de facto neutralizes the geopolitical dimension. Yet that dimension falls exclusively to the President of the Republic.

Work on the trusted cloud was therefore split among several players: ANSSI, the SGDSN (the Secretariat-General for Defense and National Security), the DGE (Bercy's enterprise directorate), and DINUM (the government's interministerial digital directorate). Their approach was limited to a standardization logic, directly inspired by their historic competencies: protecting state secrets and operators of vital importance.

A truly effective strategy, however, cannot be reduced to standardization alone or to a strictly security-driven logic. You have to go further: create and structure a new, viable economic sector. The doctrine absolutely must include credible sovereign digital offerings, including for services deemed non-strategic.

Beyond standardization, a complementary strategy jointly steered by the Élysée and Bercy had to emerge: the "Cloud au Centre" directive goes even further and proposes a new vision of digital sovereignty.

The architects of the trusted cloud

Three poles thus shaped the current doctrine, each according to its own interests:

• The technical grands corps (DGE, ANSSI) built an extremely rigid regulatory framework, SecNumCloud (ANSSI's security certification for cloud providers), locking the market to any player not anointed.
• The Ministry of the Economy followed the recommendations of the big CAC 40 groups and of Cigref (the association of large French companies' CIOs), which were demanding a sovereign Office 365, thereby excluding sovereign collaboration-software startups.
• The presidency wants to keep supporting a Startup Nation heavily dependent on Big Tech, while claiming there is a plan to eventually achieve real digital sovereignty.

When the "Cloud au Centre" directive was launched, new players began to emerge. A cynic might think they were created to carve up the trusted cloud market among themselves:

• S3NS (Thales + Google) intends to dominate infrastructure cloud.
• Bleu (Orange + Capgemini + Microsoft) targets the whole range of services tied to Office 365 and office productivity tools.

At the time, all their competitors believed these services could never obtain SecNumCloud qualification, given their close ties to Big Tech.

Personally, I always thought they would get there, because in the minds of those in charge they were not simply one option among others, but the very sovereign cloud the state wanted to impose.

A third player would also be needed, able to cover whatever gaps the other offerings left.

That is the role DINUM would claim for itself; in a few years, driven by Vincent Coudrin, it has become a key player in the cloudification of the state.

This past year, it has shown it has the appetite of an ogre and hopes to grab a place in the government IT market: open source projects, Kubernetes, even an office suite, and this even though private players offer the same services.

The deliberate legal limits of the trusted cloud

The trusted cloud, promoted by the state, officially aims to meet a security imperative: preventing sensitive government data from being subject to the extraterritorial reach of foreign laws.

It is therefore first and foremost a legal answer, not a technical one.

In practice, this approach has structural limits. The trusted label offers no protection whatsoever against laws like FISA (the Foreign Intelligence Surveillance Act), which, since 2024, no longer covers only access to software but extends to surveillance of the infrastructure itself.

Even though ANSSI stated in a parliamentary hearing that it supposedly has a solution to guarantee immunity from FISA, it has never demonstrated it publicly.

And which FISA are we talking about? Since 2024, the law has been broadened: it no longer covers only the tapping of cables, but now targets any software connected to a network, including when it is deployed on premises.

In public debates, Cédric O seemed unaware of the real implications of these extraterritorial laws. He quickly appropriated our arguments, however, to ask the agencies under his authority (notably ANSSI, even though it reports to the Prime Minister) to structure the trusted cloud strategy so as to avoid any break with the United States.

Remember that at the time, we were under the Trump I administration.

The priority of the trusted cloud is therefore to eliminate the risk tied to the Cloud Act (economic intelligence), but not the risk tied to FISA (espionage). That requires creating a structure that is independent, both technically and legally. Prestigious law firms have seized on the subject and are helping these companies obtain SecNumCloud qualification.

I am curious to see whether Bleu will get access to the code of Office 365 and Copilot. To date, no information has leaked on the subject.

The growing wave of op-eds about sovereignty being achievable through Big Tech/large corporate partnerships (notably from Gilles Babinet, among others) began to plant in decision-makers' heads the idea that these solutions deserved a chance.

But while Google was marrying S3NS and Microsoft was marrying Bleu, it became necessary to prepare the ramp-up of these two offerings, and above all to structure the market so as to make this dominance a matter of regulation.

But one issue remains: how do you eliminate all the irritants of digital sovereignty?

This is where we are dealing with a genuine master class.

Regulatory capture: a strategy of gradual exclusion

This strategy rests on three steps:

1. Raising the security bar

• The creation of the SecNumCloud label aims to impose extremely high security criteria, originally designed for cloud infrastructure, not for software.
• In practice, only large groups have the capacity to comply. Estimated cost (off the record): several million euros and, on average, two years to obtain qualification.
• Consequence: cloud SMEs and startups find themselves shut out of the market, unable to qualify.
• As the 2022 presidential election approached, and to calm the controversy, budgets were finally set aside so that small companies that wanted to could fund a certification.
• Behind the scenes, everyone knows that backing SecNumCloud makes it easier to get public subsidies.
• Result: on LinkedIn, many entrepreneurs suddenly began professing their enthusiasm for SecNumCloud.

2. A risky extension to SaaS

• Originally, the label covered only infrastructure (IaaS, PaaS).
• Under pressure from certain SaaS players (notably Whaller), the scope was extended to those solutions. The idea was probably that this qualification would offer an edge in a less saturated market.

SecNumCloud: an opportunity for our technology companies

Mastering your information system, guaranteeing its sovereignty, starts with knowing how to secure it. Because the security of our information systems is not negotiable.

JDNThomas Fauré

• A poisoned chalice that still divides the ecosystem: some saw a competitive advantage, others an insurmountable complexity and de facto exclusion.
• In reality, if Bleu and S3NS secure SecNumCloud qualification, that market advantage vanishes instantly. Few said so publicly at the time.

3. Legislative neutralization of SREN

Problem: France has to transpose several major European regulations into French law:

• DSA (Digital Services Act), the regulation on digital services
• DMA (Digital Markets Act), the regulation on digital markets
• DGA (Data Governance Act), the regulation on data governance

Against this backdrop, the SREN law (Sécuriser et Réguler l'Espace Numérique, the law on securing and regulating the digital space) has to be passed. Many see it as an opportunity to reintroduce requirements that could block the choice of S3NS, Bleu and many startups working on health data (Doctolib, Alan…).

Initially, the SREN law included strict provisions requiring that the hosting of sensitive state and government data be reserved for SecNumCloud-certified European players, which, in theory, could have excluded, or at least severely limited, clouds operated on American technology.

In practice, the text was watered down over the course of parliamentary debate and joint committee discussions, under the influence of the state, of large corporate users and of the "trusted cloud" lobby. Several articles and amendments that could have barred S3NS and Bleu were withdrawn, stripped of their force or replaced with ambiguous wording.

The notion of "trusted cloud" was ultimately preferred to that of "sovereign cloud," opening the door to the integration of American technologies as long as a specific legal structure (French capital, local control, compliance commitments…) is respected.

Result: S3NS and Bleu can secure SecNumCloud certification despite the American technology underneath.

Objective achieved: maintain a legal gray area so as not to hinder the arrival of S3NS and Bleu, which can now present themselves as "sovereign" if you set aside the FISA risk.

A telling detail: many of those who had everything to lose in this game defended that ambiguity, letting the wolves S3NS and Bleu into the sheepfold of French digital players.

If their offerings turn out to be competitive, the French players will be in trouble.

But the story doesn't end there. Others chose to turn away from this segment and target public contracts that don't fall under the trusted cloud… only to discover a new competitor there.

DINUM and the state's intrapreneurs

DINUM occupies a singular position: at once the in-house operator of the state's digital solutions and an institutional player, it escapes the regulatory constraints imposed on the private sector.

It can deploy its own tools, hire outside the civil service rules (through contractors, notably via platforms like Malt), position itself as an open source software vendor… without ever having to submit to the heavy certifications demanded of the other players.

This asymmetry has given rise to a new figure: the state entrepreneur.

These "state entrepreneurs," often drawn from the administration or its immediate ecosystem, run their projects like startups, but without bearing either the risks or the constraints of the private sector.

They don't have to prove their economic viability (customers, P&L), which makes them a form of competition increasingly contested by startups, some of which have gone so far as to consider or initiate legal action against the state.

The operator state, a risky bet

This capture of sovereignty right under the sector's nose is, for now, a real success that the head of the DGE, now the main player at the controls, can boast about.

At the Nuit de la souveraineté (Sovereignty Night), with minister Clara Chappaz, they even managed to get the sovereignty ecosystem to come and sing their praises, despite everything we discussed above.

France tried, and failed, to pull off the same move at the European level.

• Europe launched EUCS (the EU Cloud Certification Scheme), a common cybersecurity label for the cloud, built by ENISA under the Cybersecurity Act.
• France tried to impose strict sovereignty criteria (data location, European control, Cloud Act/FISA immunity), modeled on SecNumCloud, but the other member states refused. The Netherlands, Sweden, Ireland and Germany, among others, rejected the exclusionary logic as too protectionist.
• Brussels removed the sovereignty requirements from the final texts: no "anti-Big Tech" lock, no automatic priority for French players.
• SecNumCloud therefore remains a national label.

Its future, and this carving-up of the trusted cloud market, is neither as rosy nor as simple as it looks. This strategy has several flaws and risks.

The rest is reserved for our subscribers.