NATO Taps Google For Air-Gapped Sovereign Cloud

NATO has hired Google to provide "air-gapped" sovereign cloud services and AI in "completely disconnected, highly secure environments." From a report: The Chocolate Factory will support the military alliance's Joint Analysis, Training, and Education Centre (JATEC) in a move designed to improve its digital infrastructure and strengthen its data governance. NATO was formed in 1949 after Belgium, Canada, Denmark, France, Iceland, Italy, Luxembourg, the Netherlands, Norway, Portugal, the United Kingdom, and the United States signed the North Atlantic Treaty. Since then, 20 more European countries have joined, most recently Finland and Sweden. US President Donald Trump has criticized fellow members' financial contribution to the alliance and at times cast doubt over how likely the US is to defend its NATO allies.

In an announcement this week, Google Cloud said the "significant, multimillion-dollar contract" with the NATO Communication and Information Agency (NCIA) would offer highly secure, sovereign cloud capabilities. The agreement promises NATO "uncompromised data residency and operational controls, providing the highest degree of security and autonomy, regardless of scale or complexity," the statement said.

Oxymorons

[pjt33]

Air-gapped cloud? A sovereign cloud for an organisation with 32 member states? They've managed two oxymorons in a one-phrase requirement.

Re:

[sodul]

Air-gapped has been redefined by Cloud companies Marketing departments.

At the company I worked at it meant that the customer AWS data was managed by their accounts for their day to day work, and the copy of their data we managed was under different AWS accounts managed by us. Of course thanks to our APIs, their AWS accounts could have credentials to read/write the data of our services hosted in our AWS accounts, fully defeating even the concept of Virtual Air Gap.

The physical hardware can absolutely be the

Re:

[barcarolle]

That organization no longer really cares about the "32 member states."

Wow!

[oldgraybeard]

Wonder how all the foreign contractor admins working for the outsourced security vendors will remote in.

Re:Wow!

[ffkom]

Indeed, the thought that a US mega-corporation would perform a project of any substantial size without outsourcing work to the cheapest bidder on the planet is delusional. We have seen Microsoft having their "cloud" for the US defense department administrated by Chinese workers [propublica.org]. Anything but the same happening at Google would be a big surprise. Gotta increase that shareholder value, no matter the consequences.

Re:

[Cyberax]

In case of the CIA top-secret cloud, Amazon had an actual SCIF (Secure Compartmentalized Information Facility) where only people with an appropriate clearance could come in. It's probably be something similar for Google.

Re:

[oldgraybeard]

So a SCIF in a foreign country managed by remote admins in the US, who actually are remoting in from their counties of origin from their remote SCIF's which are managed remotely, etc, etc, etc. What could go wrong?

Re:

[UsRanger175]

Probably into a bastion server with DLP and then they SSH/Login to another server with a virtual desktop.

Over-Under on third party vendor security failure?

[Fly Swatter]

So how long do you think it will take a third party based in a cheap labor state to be social engineered and give away their login credentials?

My guess is 3 months? Then 6 years before it is discovered and 2 more years before it is disclosed.

Air-gapped cloud

[MpVpRb]

Joins military intelligence, and jumbo shrimp in the comedy routine

Oh cool, now they can use Gemini...

[kamakazi]

oh wait, maybe not cool.

Outsourced?

[bradley13]

Will the personnel be outsourced to India, Pakistan, et al?