On Monday 6 March 2023, Luxembourg's Directorate of Defence confirmed that, on 23 February 2023, the Deputy Prime Minister and Minister of Defence, François Bausch, presented the bill concerning the Cyber Defence Cloud (LCDC) to the Committee on Internal Security and Defence of the Chamber of Deputies as well as to journalists.

The bill authorises the Directorate of Defence to finance the acquisition, operation, maintenance, operation, management of the system and related components and services of the LCDC. The total project budget, amounting to a maximum of €250,360,323, will be spread over a period of twelve years, from 2024 to 2035.

Luxembourg Cyber Defence Cloud

Cloud computing is the provision of on-demand computing resources and services through a network of remote servers. Computing resources are managed by a service provider and thus the user does not need to manage such computing resources themself and can concentrate on the services they want to host in the cloud.

The LCDC is to be hosted in secure data centres located in Luxembourg, with a standard of protection that meets the highest international standards, which will provide highly secure and available computing and storage capacity. Thus, the LCDC will be able to store unclassified information as well as classified data, via different cloud environments for the different classification levels. The LCDC will be a private cloud environment, therefore accessible only on a private network and not via the Internet.

It is planned to create segregated environments (multi-tenancy) for the different users of the LCDC, which will allow the beneficiaries to use the same cloud infrastructure for the storage and processing of their data, while guaranteeing that no other beneficiary can access their information.

The LCDC will provide a platform that is compatible and interoperable with different technology solutions from different vendors. This approach, called “multi-cloud”, aims to reduce dependence on a single provider.

“The LCDC will play a crucial role in the implementation of Luxembourg's future projects in the cyber domain and will thus contribute to our strategic objective which is to build one of the most cyber secure defences. By making this future cutting-edge capability available to reliable partners, Luxembourg will make a significant contribution to the common collective defence effort at EU and NATO level,” explained Minister Bausch.

Among the advantages of such an infrastructure of the cloud computing type are the following:

- Reduced costs and ecological footprint: cloud computing eliminates the need to invest in redundant hardware and software and saves energy consumption.
- Scalability: it is possible to adapt the allocated capacities according to the current needs of users.
- Reliability: Cloud computing simplifies data backup, disaster recovery and business continuity.
- Productivity: the management as well as the maintenance of the IT infrastructure will be part of the services provided within the framework of the LCDC and, thus, the IT teams of the users no longer need to take care of the maintenance of the IT infrastructure.
- Security: the LCDC will be installed in highly secure and accredited computing centres to host classified data.

In addition, the "Cyber Range" of the Luxembourg Defence, a training environment used for the continuous training of cyber experts presented in 2021, can be hosted on the new LCDC.

The role of the NATO Support and Procurement Agency (NSPA)

Considering the scope of the project and the complexity of the IT infrastructure as well as its management, the LCDC will be operated for the benefit of the Luxembourg Defence with the support of the NATO Support and Procurement Agency (NSPA) for the management of contracts with the various external contractors necessary for the implementation and operation of cloud environments. The NSPA had also been commissioned upstream by the Defence Directorate to carry out the proof of concept and to determine the budget necessary to carry out this project.

In addition, a dedicated part of the LCDC will be set up for the needs of NSPA. Indeed, the NSPA currently already operates a private cloud environment for its own needs, the latter being co-financed by Luxembourg. There are plans to migrate this private cloud environment to the LCDC.

Context

In February 2021, Defence published Luxembourg's cyber defence strategy. This document sets the framework for the evolution of the Luxembourg defence in the field of cyber-defence.

The long-term objective of this strategy is for Luxembourg to have one of the most cybersecure defences in NATO and the EU and to develop expertise and capabilities that can also be offered to Allies and to partners.

Luxembourg has one of the most modern and secure data centre parks in Europe with the highest performance and low latency connections to all major European Internet platforms.

"Today, highly secure IT resources, available and scalable according to needs, are essential to cope with the extensive digital transformation at the level of the Defenses of NATO and EU member countries", concluded Minister Bausch, and added: "With the LCDC, Luxembourg will have a capacity that it can make available to its Allies and national and international partners to respond to these challenges, the importance of which will continue to grow."