Chinese e-commerce giant Alibaba’s intervention in the 2024 Paris Olympics as the IOC’s “top” sponsor is the subject of a behind-the-scenes fight over it not being able to host and access the sensitive data.
“There is a fight“, acknowledged in mid-October Guillaume Poupard, director general of the National Agency for the Security of Information Systems (Anssi). “We fight and we explain that for security reasons, including personal data, it is not possible“, he added without wanting to go into more details.
Alibaba, symbol of China’s success in the digital economy but currently in the sights of the Chinese authorities, is part of the fifteen “top sponsors” of the International Olympic Committee (IOC). The partnership dates back to 2018, for the PyeongChang Winter Olympics in Korea. which brandishes digital sovereignty as a standard.The file of accredited persons, which includes tens of thousands of contact details, with data from the authorities, such as those of the police, for example, is an example of sensitive data.
In mid-September, during a round table organized by the European Circle of Information Systems Security, the coordinating prefect for the security of the 2024 Olympic and Paralympic Games, Ziad Khouri, did not expand on the subject. but had spoken”exchanges in the next few days“.”It’s a pretty complicated subject. We will have to deepen it very quickly with the Olympic world, to see a little how we are doing according to all the constraints“, added this prefect who depends on the Ministry of the Interior.
Since then, radio silence. Nothing filters out of these “exchanges”, nor of the extent of the “fight” mentioned a month later by Anssi. “Yes there is an Alibaba problem“, recognizes a ministerial adviser, but the State is reluctant to say more. The State Secretariat for Digital refers to the interministerial delegation to the Olympics which it does not want to talk about for the moment…
Asked by AFP, the Paris 2024 Olympic Games organizing committee modestly explained that “with regard to the collection, processing and hosting of accredited data, work is still in progress and is the subject of specific discussions with the authorities“. For the rest, Alibaba”hosts Cojo applications, including its website“.”The ticket office for the Games will be operated by a European specialist who won the public tender“, also indicated the Cojo.
For Alain Bouille, general delegate of Cesin, which brings together IT security managers, “the authorities are more obsessed with the number of potential cyberattacks than with the sponsorship of Alibaba“. But, he warns: “With the Americans and the ‘Gafam’, we manage to do things, but with the Chinese there is no agreement“, he notes. “If we give data to Alibaba, we know that the Chinese government can access it.“, he summarizes.
Certainly, the OCOG claims that all data will be protected by the GDPR (General Data Protection Regulation) and that “all data will be hosted in Europe“. He even just named a “Data Protection Officer (DPO)“to ensure proper compliance with these regulations, and says”uncompromising” on the subject. “GDPR does not guarantee data sovereignty“, nuance Alain Bouille.
The French group Atos, also sponsor of the IOC, can be a solution. “We can imagine that everything that will be strategic could be the responsibility of Atos“, abounds Alain Bouillé. This subject with geopolitical ramifications has not yet been decided. The National Commission for Computing and Freedoms (CNIL) has not been seized, she replied to AFP.
As Thomas Collomb, deputy security director of the Cojo, explained in mid-September: “It is very complicated for an organizing committee to dismiss an IOC partner“, “unless there is very strong state pressure“.