Blog: Independence & Open Source on Digital Independence

Sovereignty on Microsoft's servers

Tue, 09 Jun 2026 00:00:00 +0000

Yesterday you sent in a report. A small thing — a layout problem in a document, a few lines of description, two pictures. You signed it with your real name, because the project you were helping with — a European push for digital independence — felt like the kind of thing worth being public about.

This morning your credit card has stopped working.

That sequence is not, as of this writing, documented. It is the shape of a sequence the last eighteen months have made progressively plausible. On 5 May 2025, the Microsoft 365 account of Karim Khan, Chief Prosecutor of the International Criminal Court, stopped working after the Trump administration designated him personally under Executive Order 14203. In May 2026, Microsoft handed the personal data and communications of Dutch civil servants — regulators enforcing the EU Digital Services Act — to a US Congressional subpoena. In both cases the affected people had chosen a US-headquartered service provider years earlier, on the basis of reasonable institutional procurement. The political consequence was a property of the supply chain they had not audited.

Frontend vs backend sovereignty

Sat, 06 Jun 2026 00:00:00 +0000

You are the IT lead at a German Stadt or Landkreis whose digital-sovereignty roadmap includes changing the default search engine on managed devices. The European Parliament has just made Qwant the default on Microsoft Edge and Mozilla Firefox across 720 MEP offices and several thousand staff devices — the change went live on Thursday, 4 June 2026. Your CIO has forwarded the Politico story with two words: we too?

CADA before it lands

Fri, 05 Jun 2026 00:00:00 +0000

You are the IT director at a German health insurer subject to DORA and BaFin oversight. Your board has just forwarded the European Commission’s announcement of the Tech Sovereignty Package, adopted on Tuesday, 3 June 2026, with one sentence: what does this mean for our 2027 cloud procurement? The procurement runs to €18 million over five years. Your CIO wants a one-page note by Friday.

When voluntary is worse

Sun, 24 May 2026 00:00:00 +0000

You are a Dutch competition regulator. You correspond, by email, with the US platforms you supervise. You assume that correspondence is protected — by GDPR, by Dutch administrative law, by the fact that those platforms maintain European subsidiaries answerable to European courts. Last Friday afternoon you learned which of those assumptions was load-bearing.

The answer: none of them.

On Friday, 22 May 2026, the Dutch magazine Vrij Nederland published that Microsoft had handed your emails to a US Congressional subpoena. The recipient was the House Judiciary Select Subcommittee on the Weaponization of the Federal Government, chaired by Jim Jordan. The subpoenas had gone out the previous July — to ten tech companies, demanding internal communications with foreign governments about content moderation. Microsoft’s response, when Vrij Nederland verified it, included the unredacted names of civil servants at the Autoriteit Consument en Markt (ACM) and the Autoriteit Persoonsgegevens (AP) — the regulators enforcing the EU Digital Services Act in the Netherlands.

What the veto changes

Mon, 27 Apr 2026 00:00:00 +0000

You are the IT director at a German federal agency. On Wednesday morning, your inbox contains three things: a press summary of the Politico interview Karsten Wildberger gave around mid-April 2026, a memo from your procurement office about three projects in your 2026/27 roadmap that fall above €500,000 per year, and a note from your AI strategy lead asking whether the mandatory federal AI platform applies to the deployment you have been planning for Q3. The three documents are connected. The connection is the question this article exists to answer.

How to cite §58 VgV Nr. 4

Sat, 25 Apr 2026 00:00:00 +0000

You are the procurement lead at a German municipal IT department. On 1 July 2026, your next major tender — a €2.3 million citizen-portal replacement — will be the first one your office writes under the new §58 VgV Nummer 4. The clause is now law: Aspekte der digitalen Souveränität is an explicit award criterion in German public procurement. Your office’s tender-template library has not yet been updated. The legal department has asked you for a draft by Friday.

The vendor wrote the test

Wed, 22 Apr 2026 00:00:00 +0000

You are on a procurement committee at a German Landesbehörde, evaluating sovereign-cloud options for a 2,400-user migration off Microsoft 365. Last Friday, Schwarz Digits announced the European Sovereign Stack Standard (ES³) at Hannover Messe: a maturity model in four levels, more than a hundred criteria, independently verified by BDO AG. Your CIO forwarded the announcement with one sentence: can we use this in the next tender as a hard award criterion?

Europe, watch France

Tue, 14 Apr 2026 00:00:00 +0000

The convergence took six days.

On Monday 13 April 2026, at 13:25, Moritz Förster published “Europa, schau auf Frankreich” in heise’s opinion section. The same Monday, Steven J. Vaughan-Nichols filed “Digital sovereignty isn’t just a buzzword – it’s the future” at The Register. The Atlantic Council had a report ready with almost the same headline. Linuxiac, gHacks, TheNextWeb and a small army of newsletters echoed the framing through the week. By Friday, watch France had become the consensus reading of European sovereignty.

The file by autumn

Fri, 10 Apr 2026 00:00:00 +0000

You are a CIO at a French ministry. On Wednesday morning, 8 April 2026, your inbox contains a one-page directive from the Direction interministérielle du numérique signed jointly by DINUM, the DGE, ANSSI and the DAE. By autumn, you are to file a written plan reducing your ministry’s extra-European digital dependencies. Seven categories are mandatory: workstations, collaborative tools, antivirus, artificial intelligence, databases, virtualisation, network equipment. The signatures on the directive are Anne Le Hénanff’s and David Amiel’s. The deadline is non-negotiable.

Digital Sovereignty: Why Now

Thu, 26 Mar 2026 00:00:00 +0000

A mid-sized German manufacturer receives a routine audit request from a state agency. The request arrives as a .odf file. The manufacturer’s IT department cannot open it properly — their Microsoft Office installation renders the tables incorrectly. They send back a .xlsx. The agency returns it: wrong format, please resubmit.

This is not a story about file formats. It is a story about a shift that has already begun — one that is turning digital sovereignty from a policy debate into an IT planning factor for organisations of all sizes.

Germany Mandates Open Formats

Wed, 25 Mar 2026 00:00:00 +0000

Somewhere in a German federal ministry, a civil servant opens a spreadsheet. The file extension reads .xlsx. She has done this thousands of times — it is the default, the thing you never think about. But as of March 18, 2026, that default has an expiry date.

Germany’s IT-Planungsrat — the body where federal and state governments coordinate digital infrastructure — ruled that all German public institutions must switch to ODF for editable documents and PDF for final documents. Microsoft’s .docx, .xlsx, and .pptx are not on the list.

Technology as Geopolitical Leverage

Tue, 03 Mar 2026 00:00:00 +0000

Friday, 27 February 2026. Just before five.

In a negotiation room at the Pentagon, a compromise was on the table. AI company Anthropic had drawn two red lines: no autonomous weapons, no mass surveillance. The Pentagon had yielded on autonomous weapons — the phrase “as appropriate”, the loophole that would have permitted deployment of Anthropic’s AI model Claude in weapons systems, was to be removed. Anthropic had offered in return to work with the NSA on data collected under judicial oversight pursuant to the FISA Act.

The World Map of Digital Dependency

Tue, 03 Mar 2026 00:00:00 +0000

Five companies — Microsoft, Apple, Google, Amazon, Meta — form the digital foundation for most of the world. But not all of it. And the exceptions are as revealing as the rule.

In China, payments run on Alipay and WeChat Pay, not Visa. In India, UPI processes more transactions than Visa and Mastercard combined — on its own infrastructure. In Kenya, sending money requires not a bank account but a mobile phone with M-Pesa.

AI Safety Under Pressure

Thu, 26 Feb 2026 00:00:00 +0000

In September 2023, Anthropic published a document that was hailed as a landmark in the AI industry: the Responsible Scaling Policy (RSP). Its core promise was unusually clear: if an AI model exceeded certain capability thresholds, development would be paused — until safety could be demonstrably guaranteed. OpenAI and Google DeepMind adopted similar frameworks shortly after.

Digital Risk Audit

Thu, 26 Feb 2026 00:00:00 +0000

A French judge at the International Criminal Court tries to book a hotel room. He hands over his credit card. Declined. The second card. Declined. Both cards from European banks, both accounts funded — but payment processing runs through Visa and Mastercard. American networks. American rules.

Pentagon vs. Anthropic

Wed, 25 Feb 2026 00:00:00 +0000

In February 2026, the US Department of Defense issues an ultimatum to AI company Anthropic. The demand: unrestricted access to Anthropic’s AI models – including applications that Anthropic’s own terms of service explicitly prohibit. The threat: a war-production law dating from 1950.

Seven months earlier, the same company had signed a $200 million contract with the same Department of Defense. Anthropic has made responsible AI development a founding principle – and was, at the same time, the first AI company cleared for deployment on classified military networks.

Copilot Bypasses DLP, Leaks Emails

Sat, 21 Feb 2026 00:00:00 +0000

In January 2026, organisations using Microsoft 365 discovered that Copilot Chat was summarising emails marked as confidential — even when Data Loss Prevention (DLP) policies were explicitly configured to prevent it. The bug was reported by customers on 21 January. Microsoft acknowledged it in early February in a notice tracked as CW1226324.

What happened

Microsoft 365 uses sensitivity labels (e.g. “Confidential”, “Highly Confidential”) and DLP policies via Microsoft Purview to control how data flows within an organisation. The expectation: if an email is labelled confidential, AI tools should not process it.

Grist Joins France's Suite Numérique

Sat, 21 Feb 2026 00:00:00 +0000

France’s sovereign productivity suite — the Suite Numérique, formerly known as LaSuite — has added another component: Grist, an open-source tool that combines the accessibility of a spreadsheet with the structure of a relational database and a no-code app builder.

Sovereignty Washing Explained

Sat, 21 Feb 2026 00:00:00 +0000

Germany’s flagship sovereign technology platform, the Deutschland-Stack, is supposed to give the public sector a digital infrastructure it actually controls. The ambition is real: a national platform for federal, state, and municipal IT, built on open standards, reducing dependency on US hyperscalers.

But the Open Source Business Alliance (OSBA) warns that the current draft opens a dangerous loophole. The revised specification states that “solutions from European sovereign providers” may be used alongside open-source offerings. That sounds reasonable — until you consider what it means in practice.

AI Sovereignty: Who Owns the Models