Paris (AFP) – The role of Chinese e-commerce leader Alibaba Group as a “global partner” of the Paris 2024 Olympic Games has sparked a behind-the-scenes battle to prevent it from hosting and accessing sensitive data.
“There is a fight”, had declared earlier Guillaume Poupard, director general of the National Agency for the security of information systems (ANSSI), before adding that it was “complicated”.
“We fight and explain that for security reasons, including personal data, this is not possible,” he added, declining to give further details.
Alibaba, symbol of China’s success in the digital economy but now in the crosshairs of the Chinese authorities, is one of the IOC’s 13 “global partners”.
The partnership dates back to the PyeongChang Winter Olympics in 2018. The prospect of the company hosting several mission-critical applications in its cloud raises eyebrows in the secret world of French IT security, which is clinging to digital sovereignty as the standard.
What is the problem exactly?
An example cited by sources familiar with the matter suggests that the personal and contact details of tens of thousands of people accredited for the Games will be hosted in Alibaba’s cloud.
These would include data from authorities, such as the police, which is hard for the French Interior Ministry to swallow.
In mid-September, during a round table organized by the European Circle for Information Systems Security, the national security coordinator for the 2024 Olympic and Paralympic Games, Ziad Khoury, did not go into the subject in depth but mentioned “exchanges in the coming days”. “.
“It’s a pretty complicated subject,” said Khoury, responding to the Minister of the Interior.
“We will have to deepen very quickly with the Olympic world, to see a little how we can operate with all the constraints.”
There hasn’t been a word since. Nothing on these “exchanges”, nor on the extent of the “fight” of which Anssi speaks a month later.
“Yes there is an Alibaba problem,” admits a ministerial adviser, but the state is reluctant to say more.
The French Ministry of Digital is talking about a meeting of an interministerial delegation with the Olympics but does not want to talk about it for the moment.
The Paris 2024 organizing committee (COJO) told AFP that “concerning the collection, processing and hosting of accredited data, the work is still in progress and is the subject of specific discussions with the authorities. “.
Alibaba also hosts the nominations for the organizing committee, including its website, although this does not extend to the box office.
“The Games ticket office, for its part, will be operated by a European specialist who won the public tender,” said the organizing committee.
For Alain Bouille, CEO of Cesin, which brings together those responsible for IT security, “the authorities are more obsessed with the number of potential cyber-attacks than with the sponsorship of Alibaba”.
But he didn’t heed the warning and compared Alibaba to the Big Five US tech giants Google, Apple, Facebook, Amazon and Microsoft, collectively dubbed GAFAM.
“With the Americans and the GAFAM, we are able to do things but with the Chinese, there is no agreement,” he declared.
“If we give data to Alibaba, we know the Chinese government can access it.”
The organizing committee insists that all data will be protected by the EU’s General Data Protection Regulation (GDPR) and that “all data will be hosted in Europe”.
It has just appointed a data protection officer to ensure proper compliance with this regulation, and says it is “uncompromising” on the subject.
But will this be enough?
“GDPR does not guarantee data sovereignty,” Bouille said.
An expert suggested that the French group Atos, also a sponsor of the IOC, “can provide tools”, an idea supported by Bouille.
“One can imagine that anything strategic could be the responsibility of Atos,” he said.
This delicate subject with all its geopolitical ramifications is not yet resolved. The French Data Protection Agency told AFP it was not yet involved.
Alibaba declined to comment on AFP’s questions.
For the moment, it seems that the organizers of Paris 2024 have their hands tied.
“It’s very complicated for an organizing committee to fire an IOC partner,” said the committee’s deputy director of security, Thomas Collomb, in mid-September. “Unless there is very strong pressure from the state.”
© 2021 AFP