Posts
Part 0: Read This First | Part 1: Undersea Cable Empire | Part 2: Satellite Sovereignty | Part 3: DNS Dictatorship | Part 4: Payment Rails | PART 5: THE CLOUD IS SOMEONE'S COMPUTER | Part 6: Credential Wars
Part 5: The Cloud Is Someone's Computer
Where Your Data Lives Determines Who Controls It
You upload a photo to Google Photos. Store a document in Dropbox. Run your business on AWS. Stream a movie on Netflix. Train an AI model on Azure. All of this feels seamless, borderless, ethereal—like data floating in "the cloud," accessible from anywhere, existing nowhere specific. This is the greatest branding success in tech history. The cloud isn't a cloud. It's hundreds of massive data centers—warehouse-sized buildings filled with servers, consuming megawatts of electricity, connected by undersea cables, located in specific cities, in specific countries, under specific legal jurisdictions. Your Google Photos backup? It's on hard drives in Council Bluffs, Iowa or Hamina, Finland or Changhua County, Taiwan—depending on where you live and which Google data center region serves you. Your Dropbox files? Stored on AWS servers in Northern Virginia, Oregon, or Frankfurt. Your Netflix stream? Coming from an Open Connect Appliance in your ISP's data center, but the master copy lives in AWS US-East-1 (Virginia). Every byte of data you think is "in the cloud" exists on physical hardware, in a physical location, subject to the laws of that jurisdiction. And those laws determine who can access your data, compel its deletion, or seize it entirely. Where your data lives isn't a technical detail—it's a question of sovereignty, jurisdiction, and control. And right now, that question is fragmenting the cloud into incompatible national fortresses.
The Cloud Myth vs. Reality
The term "cloud computing" was brilliant marketing. It suggests something intangible, distributed, beyond physical constraints. The reality is far more concrete.
What "the cloud" actually is:
- Data centers: Massive facilities (100,000+ sq ft) filled with servers, storage, networking equipment
- Power consumption: 20-50 megawatts per large data center (equivalent to a small city)
- Cooling infrastructure: HVAC systems, water cooling, sometimes entire rivers diverted for cooling
- Network connectivity: Direct connections to undersea cables, fiber networks, internet exchanges
- Physical security: Fences, guards, biometric access, surveillance—because they're high-value targets
Where the major clouds actually are:
AWS (Amazon Web Services):
- 33 geographic regions (as of 2026)
- 105+ availability zones (clusters of data centers)
- Largest presence: US (8 regions including US-East-1 in Northern Virginia—the original and largest)
- Major international: EU (Frankfurt, Ireland, London, Paris), Asia-Pacific (Tokyo, Singapore, Sydney), China (separate regions, operated by Chinese partners)
Microsoft Azure:
- 60+ regions globally
- Heavy presence: US, Europe, Asia-Pacific
- Government clouds: Separate data centers for US DoD, US Gov, classified workloads
- China: Separate Azure China operated by 21Vianet (Chinese company)
Google Cloud:
- 40+ regions
- Major hubs: US (Iowa, Oregon, Virginia), Europe (Belgium, Netherlands, Finland), Asia (Taiwan, Singapore, Tokyo)
- No presence in China (Google services blocked since 2010)
Alibaba Cloud (China):
- 27+ regions, heavily concentrated in China and Asia-Pacific
- Dominant in China (40%+ market share)
- Expanding to Middle East, Southeast Asia (Belt & Road countries)
Tencent Cloud (China):
- 70+ availability zones globally
- Second-largest cloud in China
- Growing in Asia, less presence in US/EU
WORLDWIDE (excluding China):
• AWS: 32% ($95B annual revenue)
• Microsoft Azure: 23% ($70B)
• Google Cloud: 10% ($35B)
• Others (IBM, Oracle, etc.): 35%
CHINA (separate market):
• Alibaba Cloud: 38%
• Tencent Cloud: 18%
• Huawei Cloud: 15%
• Baidu Cloud: 8%
• Others: 21%
TOTAL MARKET: $600B+ annually (2026)
Projected to reach $1 trillion by 2028
KEY INSIGHT:
Cloud market has already fragmented:
Western companies dominate outside China.
Chinese companies dominate within China.
Almost no overlap—two parallel cloud ecosystems.
Data Localization: The National Fortress Strategy
Countries are increasingly demanding that data about their citizens stay within their borders. This isn't about privacy—it's about sovereignty and control.
EU: GDPR and Data Residency
General Data Protection Regulation (2018):
- Personal data of EU citizens must be protected to EU standards even when processed elsewhere
- Data transfers outside EU require "adequacy decisions" or other safeguards
- Schrems II decision (2020): Invalidated Privacy Shield, made US data transfers legally complex
- Result: US cloud providers built EU-specific regions (AWS eu-west, Azure West Europe, etc.) to keep EU data in EU
Why this matters: EU data staying in EU means it's not subject to US CLOUD Act (see below), reducing US surveillance access.
China: Total Data Localization
Cybersecurity Law (2017) + Data Security Law (2021):
- All "critical information infrastructure" operators must store data in China
- Personal information and "important data" cannot leave China without approval
- Foreign cloud providers must partner with Chinese companies (can't operate independently)
- Result: AWS China operated by Sinnet, Azure China by 21Vianet—Chinese entities that can be compelled by Chinese government
Why this matters: Chinese government has full access to all data stored in China, regardless of who "owns" the cloud service.
Russia: Sovereign Internet Data Storage
Data Localization Law (2015):
- Personal data of Russian citizens must be stored on servers physically located in Russia
- Foreign companies must establish Russian data centers or use Russian cloud providers
- Result: Many Western services either exited Russia or built Russian data centers (Apple, Microsoft built local infrastructure)
India, Brazil, Others Following Suit
- India: Proposed data localization for payment data, considering broader requirements
- Brazil: LGPD (data protection law similar to GDPR), considering localization
- Indonesia, Vietnam, Nigeria: Various data residency requirements
The trend is clear: Countries want data about their citizens stored domestically, under their jurisdiction, accessible to their law enforcement.
The CLOUD Act: US Claims Extraterritorial Access
While other countries demand data stay local, the US claims the right to access data stored anywhere in the world if held by a US company.
CLOUD Act (Clarifying Lawful Overseas Use of Data Act, 2018):
- US law enforcement can compel US companies (Microsoft, Google, Amazon) to produce data regardless of where it's stored
- If data is stored in AWS Frankfurt, but AWS is a US company, US warrant can compel production
- Creates conflict with foreign laws (e.g., EU privacy laws prohibit transfer, US law compels it)
Example conflict:
French company stores customer data in AWS eu-west-3 (Paris region) to comply with GDPR. US FBI issues warrant for that data (terrorism investigation). AWS (US company) must comply with US warrant. But transferring data violates EU law. AWS is stuck between conflicting legal requirements.
The result: Many non-US companies won't use US cloud providers for sensitive data, fearing US government access.
1. DATA CENTER LOCATIONS (Geographic Jurisdiction)
• Where servers physically sit = which laws apply
• US-East-1 (Virginia) hosts 30%+ of internet services
• Single region outage can cascade globally
• Government can raid data centers, seize servers
2. UNDERSEA CABLE LANDING POINTS
• Clouds connect via cables (see Part 1)
• Landing points = surveillance opportunity
• NSA reportedly taps cables at landing stations
• Cut cables = regions become isolated
3. POWER GRIDS
• Data centers consume massive electricity
• Grid failure = cloud outage
• Texas 2021 freeze: Some data centers went down
• Sabotage or attack on grid = cloud goes dark
4. DNS (See Part 3)
• Cloud services need DNS to be reachable
• aws.com, azure.com must resolve
• DNS disruption = cloud inaccessible
5. HYPERSCALE PROVIDER OLIGOPOLY
• 3 companies (AWS, Azure, Google) = 65% of market
• Single-point-of-failure risk
• Coordinated government pressure possible
• If AWS goes down, huge swath of internet fails
CONCLUSION:
The cloud is massively centralized despite "distributed" branding.
Physical infrastructure creates vulnerabilities at every layer.
Sovereign Cloud Initiatives: Taking Back Control
Countries uncomfortable with US/Chinese cloud dominance are building national alternatives.
EU: Gaia-X
Launched: 2020
Goal: Create European cloud infrastructure independent of US/China providers
Approach: Federation of European cloud providers with common standards
Reality (2026): Limited adoption, struggling to compete with AWS/Azure scale and pricing
Why it's hard: Cloud requires massive capital investment. AWS spent $50B+ over 15 years building infrastructure. European providers can't match that easily.
France: Cloud Souverain
France pushing for European cloud providers (OVHcloud, Scaleway) to handle sensitive government and critical infrastructure data. Mixed success—cost and capability gaps remain.
China: State Cloud Infrastructure
China doesn't need to "build alternatives"—they already have them. Alibaba Cloud and Tencent Cloud are effectively state-aligned (government can compel access). For sensitive data, government agencies use dedicated state-owned cloud infrastructure.
The Pattern
Every major power wants sovereign cloud capability. But building infrastructure at AWS/Azure scale requires:
- $tens of billions in capital
- 10-15 years of buildout
- Massive technical expertise
- Economies of scale to compete on price
Only US and China have achieved this. Everyone else is either dependent on them or building expensive, less capable alternatives.
WHERE YOUR DATA ACTUALLY LIVES:
AWS Region Checker:
If you use AWS, check which region your resources are in.
Login to AWS Console → Top right shows region (us-east-1, eu-west-1, etc.)
Each region is a specific geographic location with specific laws.
Google Takeout:
Google Takeout (takeout.google.com) lets you download all your Google data.
Metadata often shows which data center region stored your files.
Microsoft Azure Region Map:
azure.microsoft.com/en-us/explore/global-infrastructure/geographies/
Shows all Azure regions, their locations, compliance certifications.
EXPERIMENT:
Look up where major services store data:
• Gmail: Varies by user location, multi-region replication
• iCloud: Primary storage in US, EU users get EU storage option
• Dropbox: Uses AWS (multi-region, primarily US)
Understand: Your data isn't "in the cloud." It's in Virginia. Or Ireland. Or Singapore.
And that location determines who can access it.
AWS (AMAZON WEB SERVICES):
Revenue (2025): $95 billion
Operating income: $25 billion (26% margin)
Market dominance: 32% global share
Growth: 15-20% YoY
AWS is Amazon's profit engine. Retail operates at thin margins.
Cloud prints money.
MICROSOFT AZURE:
Revenue (2025): $70 billion (estimated)
Growing faster than AWS (20-25% YoY)
23% market share
GOOGLE CLOUD:
Revenue (2025): $35 billion
Still not profitable (heavy investment phase)
10% market share, growing 25%+ YoY
ALIBABA CLOUD:
Revenue (2025): $12 billion
Dominates China (38% share)
Expanding internationally
TOTAL CLOUD MARKET: $600B+ (2026)
Projected $1 trillion by 2028
CAPITAL EXPENDITURES (Building the Cloud):
AWS: $50B+ spent building infrastructure (2006-2026)
Azure: $40B+
Google Cloud: $30B+
THE ECONOMICS:
Cloud requires massive upfront investment.
Then operates at high margins (software + scale).
First movers (AWS, Azure, Google) have insurmountable lead.
Late entrants can't compete on price or capability.
Historical Parallel: Port Ownership and Trade Control
THE PATTERN:
British Empire controlled ports globally (Singapore, Hong Kong, Gibraltar, Suez Canal access).
Control of ports = control of trade routes = economic leverage.
HOW IT WORKED:
• Goods physically pass through ports
• Port owner can inspect, tax, delay, or deny shipments
• Countries dependent on British ports = subject to British pressure
THE PARALLEL TO CLOUD:
Data "passes through" cloud infrastructure.
Cloud owner (AWS, Azure, Alibaba) can access, delay, or deny data.
Companies dependent on US cloud = subject to US jurisdiction.
CHINA'S RESPONSE (Then and Now):
Historical: China was humiliated by foreign control of ports (Treaty Ports 1840s-1940s).
Modern: China builds its own ports (Belt & Road port infrastructure) AND its own cloud (Alibaba, Tencent).
Same strategic logic: Never depend on others for critical infrastructure.
THE LESSON:
Infrastructure creates dependency.
Dependency creates leverage.
Leverage gets weaponized during conflict.
Cloud is the digital equivalent of port control.
The Alternative Scenario: National Cloud Fortresses
TRIGGER:
Major US-China conflict. US expands CLOUD Act enforcement: all data from Chinese companies stored on US clouds must be accessible to US government. China retaliates: all data on Chinese clouds from Western companies must be accessible to Chinese government.
WEEK 1: THE IMPOSSIBLE CHOICE:
• Global companies face decision: store data in US cloud (accessible to US gov) OR China cloud (accessible to Chinese gov)
• Can't do both without exposing data to opposing governments
• Companies begin data segregation: "US data" on US clouds, "China data" on China clouds
MONTH 1: COMPLIANCE NIGHTMARES:
• EU enforces GDPR strictly: can't use US clouds (CLOUD Act conflict), can't use China clouds (surveillance risk)
• European companies forced onto EU cloud providers (Gaia-X, OVH)
• Capability and cost gaps emerge (EU clouds less capable, more expensive)
• Some companies build private clouds (massive cost)
MONTH 3: FRAGMENTATION CASCADES:
• Cloud regions become incompatible (data can't move between zones)
• Services fragment: Netflix US ≠ Netflix EU ≠ Netflix China
• AI models trained on segregated data (Western AI vs. Chinese AI, different training sets)
• Software development splits (can't use AWS tools in China, can't use Alibaba tools in US)
YEAR 1: SEPARATE CLOUDS:
• Three incompatible cloud ecosystems:
- US Cloud (AWS, Azure, Google)
- China Cloud (Alibaba, Tencent, Huawei)
- EU Cloud (Gaia-X, national providers)
• Data doesn't flow between zones (legal barriers)
• Companies operate separate infrastructure per region
• Costs skyrocket (lost economies of scale)
YEAR 5: DIGITAL BALKANIZATION:
• New startups launch in one zone only (too expensive to operate in all three)
• Innovation fragments (AI breakthroughs in one zone not accessible in others)
• The "global internet" is now regional fortresses
• Reunification impossible (too much infrastructure divergence)
THE LESSON:
Cloud fragmentation doesn't require technical barriers.
Just requires legal/political barriers making cross-border data flow impossible.
Those barriers are already being built.
Conclusion: Where Data Lives Is Who Controls It
The cloud reveals the ultimate truth about digital infrastructure: data has to exist somewhere physical, and that somewhere determines everything.
We've mapped five layers:
- Part 1 (Cables): Physical infrastructure vulnerable to cutting
- Part 2 (Satellites): Orbital infrastructure vulnerable to shooting
- Part 3 (DNS): Namespace infrastructure vulnerable to fragmentation
- Part 4 (Payment Rails): Financial infrastructure vulnerable to weaponization
- Part 5 (Cloud): Storage infrastructure vulnerable to jurisdiction
The cloud is the convergence point. It depends on all previous layers (cables for connectivity, satellites for edge cases, DNS for addressing, payment systems for transactions) but adds one critical dimension: physical location = legal jurisdiction = control.
Every country now understands this:
- China built Alibaba/Tencent Cloud (independent of Western infrastructure)
- EU building Gaia-X (struggling, but trying)
- Russia, India, Brazil imposing data localization (forcing local storage)
- US asserting CLOUD Act (claiming extraterritorial access)
The "global cloud" is fragmenting into national fortresses. The cloud isn't a cloud—it's buildings in countries under laws. And those laws are diverging.
Where your data lives determines who can access it, modify it, delete it, or weaponize it.
There is no cloud. There are just other people's computers in other people's countries.
Next: Part 6 - The Credential Wars (The final layer: who decides what's true, who's verified, who can participate?)
No comments:
Post a Comment