ARCHANA RAMAMOORTHY: Thank you so
much for taking the time to join us
for this conversation about digital sovereignty
and how Google Cloud can help organizations worldwide
in supporting sovereignty requirements.
I'm Archana Ramamoorthy, a product manager focusing
on building compliance, trust, and privacy products
for our customers.
And I'm joined by my colleague and friend
Christopher Johnson, who goes by CJ.
CHRISTOPHER JOHNSON: Hi, I'm CJ.
And I lead the digital sovereignty product management
efforts at GCP.
It's so exciting to have this discussion with you today.
ARCHANA RAMAMOORTHY: Today, we'll
take a look at the global sovereign landscape, dive
a little deeper into how Google Cloud looks
at digital sovereignty and the various solutions
that we actually offer to solve some of those problems,
and discuss some best practices with you that you can leverage
as you think about your Cloud implementations for your most
critical workloads with sovereignty requirements.
CHRISTOPHER JOHNSON: All right, let's start
by looking at the evolving global sovereignty landscape.
Today, organizations around the world
are using Cloud Services to drive innovation.
The security, scale, sustainability, and innovation
offered by Cloud platforms is well-understood.
But customers often wonder how to balance these benefits
with their compliance and sovereignty needs.
So what is digital sovereignty?
It depends on who you ask.
There's no consensus definition.
But we can define it as the ability of a state or entity
to regulate or exert control over data technology operating
within its own jurisdiction.
The growing demand for digital sovereignty
is rooted in a number of concerns.
And these are not just about technology.
They include security and control.
What we're talking about here is the regulatory environment
related to Cloud.
It's very dynamic.
And we see an overall trend in the direction
of Global Strategic autonomy and digital sovereignty.
When we tune into locations like Europe,
there's a desire for stronger control over Cloud data
and software.
And we see this trend expanding globally.
We see regulations like GDPR, initiatives like Gaia-X,
and other efforts to define how Cloud companies operate,
and run their infrastructure, and host workloads
in the EU and beyond.
The other area that we're looking at is economic.
Building on top of number one, there's
a strong desire to see local players
getting involved in supporting some of these initiatives
in order to avoid lock-in, develop and strengthen
local economies, and to exert more
control over extraterritorial data access requests.
And finally, geopolitical-- policymakers, business leaders,
and technology leaders have vested interest
in defining the sovereign policies in their countries
as they see more data migrating from on-prem solutions
to the Cloud.
When bringing national critical infrastructure to the Cloud,
for example, there's always the question
of the degree to which they can trust foreign Cloud
providers with sensitive data, and therefore a strong
need to have guidelines, governance, and policies
to regulate how data is stored and managed.
More recently, the situation in Ukraine
has also resurfaced the importance
of having solutions that can survive the unexpected such as
disruptive events like conflicts or embargoes.
ARCHANA RAMAMOORTHY: So our goal is
to be able to align very, very closely with these local market
needs, and basically deliver solutions
that support these different kinds of demands
that CJ mentioned.
Our overall goal is to meet customers where they are.
And we want to do this while at the same time
sort of seeking to avoid issues of fragmentation and disruption
to existing infrastructure.
So for example, the development of railways in the 19th century
drove tremendous industrial progress and growth.
However, the creation of different rail
sizing standards in each country or region
sort of led to the break of gauge and these issues,
when trains reach national borders, these added
delays, cost inconveniences, and of course, you
know, a lot of cost for different countries.
We know that decisions that organizations and governments
make today will have a huge impact far into the future.
So they must be very thoughtfully and carefully
sort of considered.
So for example, we want to be able to support
local sovereignty without allowing digital fragmentation.
We want to provide organizations with an easy way
to expand their business globally, and all of this while
ensuring that the short-term pressure does not
lead to undesirable long-term implications.
CHRISTOPHER JOHNSON: All right, we
started our digital sovereignty journey
in one of the most mature markets that understands values
and sovereignty, the EU, back in 2019.
In the past few years, we've learned a lot
talking to customers, working with partners, policymakers,
and local governments, understanding
the key needs of this region and delivering
Cloud on Europe's terms--
a set of carefully tailored solutions
put together with local partners to truly bring
the value of Google Cloud in a format that's
acceptable for our global customers,
starting with Europe.
So really, what we're trying to do here
is give Cloud on your terms, from a sovereignty perspective.
Now we're expanding out further to deliver robust solutions
in other parts of the world, bringing Cloud on your terms
for your unique business needs and regulatory requirements.
ARCHANA RAMAMOORTHY: That's very exciting.
Now, as we mentioned, achieving digital sovereignty
can mean different things to different people.
One common theme that we hear a lot
is having control over your data.
Data is, of course, the most important asset
in the digital world.
And we believe that having strong controls
is fundamental to meeting sovereignty requirements.
In our mind, there are three fundamental control
objectives-- the state of residency, personal controls,
and encryption control.
But data controls are just one element
of a comprehensive approach to digital sovereignty.
At Google Cloud, we've therefore broken down digital sovereignty
into three distinct pillars.
Starts with data sovereignty-- this is giving customers
full control over core customer content.
And we want to provide the ability
to store and manage encryption keys outside
of the Cloud environment--
all of this, so that customers can protect their data
while enjoying the scale the security and innovation
quotient that you get with public Cloud.
The second is operational sovereignty.
This is going one step above data sovereignty
and gives customers or their trusted local partners
direct visibility and, if needed,
even control over Google Cloud's operations--
the ability to limit and control access
for support personnel based on predefined attributes--
and you can think of these as citizenship attributes
or a particular geographic location--
could be core to trusting Cloud providers with your most
sensitive data.
And last but not least, there's software sovereignty.
And this is often referred to as survivability
in a lot of cases.
And this means the protection against
unforeseen catastrophic events.
And we believe that software sovereignty and survivability
can only be accomplished with a modern, open Cloud
approach that's truly based on open source solutions.
And this is why Google has committed very, very strongly
to an open Cloud.
And we have based many of our core Cloud
Services in computing and data management
on open source solutions.
CHRISTOPHER JOHNSON: So how do we actually pull this off?
The simple answer is with the help of local partners.
We're really excited about this.
While we've built a global platform with many
of the controls and capabilities organizations
can use to meet their objectives for security control
and transparency, our goal is to be
able to deliver a localized portfolio
of digital sovereignty solutions by understanding
the local needs and requirements for various countries
by partnering very closely with local partners
to help bring these products to our customers.
So let's take a closer look at the types of solutions
that we can offer and how we have already
started on implementing these in many of the countries
that we're talking about.
Our solutions are built on a secure-by-design and
secure-by-default infrastructure foundation on Google Cloud.
On top of this foundation, our Cloud platform
offers a wealth of controls that every organization using it
can take advantage of, so for example,
data security using third party validated crypto.
We also offer confidential computing
to encrypt data and use for GCE, and GKE, and other services.
Next, security monitoring and operations-- these
include strong access, transparency,
and approval mechanisms.
Identity and access management, for example,
we based on zero trust principles
for today's parameter-less world.
ARCHANA RAMAMOORTHY: And building on top of these core
controls that CJ just talked about,
we offer a portfolio of sovereign solutions
to support the various sovereignty
needs of our customers depending on the type and sensitivity
of the data that they're actually looking
to bring into the Cloud.
So let's look at each of these options.
Our Sovereign Controls product allows
you to define the location of your core data, who
has access to your core data, and control of your encryption
keys.
And without all three technical controls,
you don't have data sovereignty.
You can also choose to apply GCP's core platform
controls to your data.
And these are controls such as DLP to de-identify data,
and confidential computing to encrypt data
while it is in use in various services.
The partner-managed sovereign controls product actually
adds the ability for a partner to monitor and control
Google access, all of this to data,
providing both visibility and control
over the operational elements that you care about.
Our Supervised Cloud offering when this becomes available
will be fully managed and operated
by a partner, supporting data and operational sovereignty
needs for specialized and highly sensitive data.
And lastly, for situations where there's a strong need
to have less reliance on a software provider,
our Hosted Cloud offering will support software sovereignty
and basically allow for air-gapped and disconnected
operations without provider software or support.
CHRISTOPHER JOHNSON: And we do this in conjunction
with well-trusted local partners.
For example, as part of our initiative
to deliver Cloud on Europe's terms,
we have worked with Sens in France and T Systems
in Germany to deliver sovereign solutions powered
by Google Cloud.
Let's dive into the details of our sovereign
controls by partners offered in the EU.
Sovereign controls allow you to keep your data
in a given geography.
This is where we allow for data residency
and this includes, as well as store and manage
your encryption keys outside of Google's infrastructure
and fully control access to them through external key management
with key access justifications.
And finally, our European Support feature
allows customers to ensure that only EU persons in the EU,
when you need help, are the ones that support you.
Together, these three products combine
to form a strong offering that is offered in conjunction
with our local partners to support the sovereignty
needs of our customers.
ARCHANA RAMAMOORTHY: And with Supervised Cloud,
our goal is to be able to combine
the strengths of the Google Cloud platform
with the operational capabilities of local partners
to support some of the strictest data
and operational sovereignty needs that we see.
And we're currently in the process
of designing and building this offering with local partners,
both in France and Germany.
While the controls that we've discussed so far
address the majority of the market needs,
we have also heard that there are some customers
and workloads that have a very strict requirement
to support air-gapped, disconnected operations.
For example, this may be the case
for some national government workloads.
For these workloads, we'll offer Hosted Cloud Services,
which are part of Google Cloud's Distributed Cloud offerings.
And hosted Cloud Services run on Anthos,
Google Cloud's managed application platform,
supporting containers and VMs on top
of a prescriptive, off-the-shelf hardware stack.
While the hosted Cloud provides a centralized control plane
for cluster management, networking, and config,
and policy management, the control plane
does not need to be connected to Google Cloud
to actually function.
Thus, it can support the specific needs for an air gap
solution.
And because running hosted Cloud Services requires
strong operational expertise, partners
will play a significant role in the delivery of this.
CHRISTOPHER JOHNSON: Let's now hear
from Oli, who represents our partner in Germany T
Systems on how they're able to support demands
of their local market with the spectrum of solutions
they're offering, tailored for Germany today.
OLIVER QUECK: Hi, my name is Oliver
and I'm leading the global Google Business at T Systems.
T Systems and Google Cloud are building and delivering
sovereign Cloud Services for European enterprises,
for the public and business sector.
Our common goal-- support all organizations
in migrating their workloads to the Cloud
through more innovation, flexibility, performance,
and security.
With Sovereign Controls by T Systems,
we have developed a Cloud solution
that allows you to securely host your sensitive data
and implement supplementary data protection measures that
help you to meet the requirements of European Data
Protection authorities without losing on scalability
nor elasticity.
In other words, you, as customer,
retain full control over your data, the software,
and operations, and still benefit
from all the advantages of Google Cloud, especially
the innovation power.
As every Cloud migration requires
continuous optimization, our partnership
additionally includes a commitment to core innovation.
Every day, dedicated teams of engineers
are collaborating on open source technology solutions
to stay ahead of the changing demand of digital markets
in Europe and beyond.
In doing so, you, as customers, always meet
the demand of data, operational, and software sovereignty
for your business.
CHRISTOPHER JOHNSON: Thanks, Oli.
Let's also hear from Cyprian, who
represents our partner, Sens, in France,
and how we're working together to help support
French regulatory requirements.
CYPRIAN: Hi, everyone.
I'm Cyprian, CEO of Sens, the joint venture
created recently between [INAUDIBLE] and Google Cloud.
Sens' mission is to help public and private organizations
benefit from the power of Google Cloud
while protecting their sensitive data in line
with the French-trusted Cloud requirements,
defining the second Cloud level by France's National
Information Systems Security Agency, NISA.
The creation of Sens, the definition and build
of our trusted Cloud offering, and the availability
of our first offer local controls with Sens,
this year are the results of many months
of collaboration between [INAUDIBLE] and Google Cloud
teams.
Our Local Controls offering is the first step this year
before we can offer a solution compliant
with all the French statistical criteria, which
we are working on in parallel.
Our objective is to be among the first to make
such an offering available for certification based
on hyperscale Cloud technology.
Local Control with Sens enables our customers
to start the journey to the Cloud
now and begin the digital transformation process.
ARCHANA RAMAMOORTHY: Now that we've directly
heard from our partners about how
these solutions work in real-life to solve customer
problems.
Let's take a look at some of the best practices
to keep in mind when navigating through your sovereign journey.
One thing to keep in mind is that one solution doesn't
fit all of the workload needs.
It's important to distinguish and understand
what is needed for your specific use case
your application and the kind of data
that you want to bring to the Cloud.
That will prepare you to make the right-trade offs
when it comes to choosing technology solutions.
Second, think about how hands on you
actually want to be in this process.
Understanding how you plan to manage operational complexity
is key to deciding how to handle sovereignty with your Cloud
provider, and whether it may make sense
to work with a trusted third party in this entire process.
And lastly, think about your business needs for the future.
This is important in order to understand
the right path for your digital transformation journey.
Thank you so much for joining us today
and enjoy the rest of the sessions at Next 2022.
[MUSIC PLAYING]