From ECHELON to the CLOUD Act: Europes Digital Sovereignty Battle
Liam R. — Freelance Penetration Tester
[In English after some complaints]
When we last wrote about Microsoft's run of questionable decisions, we left readers with an open question rather than a conclusion. Switzerland's government had begun moving away from Microsoft towards Linux and open standards, and we wondered aloud whether that was an isolated act of frustration or the first visible move in a broader European realignment. We suggested it might be the start of a trend. We did not expect the next data point to arrive quite so quickly.
In April 2026, France supplied it.
(This is a follow-up to our earlier piece, Microsoft's Costly Mistakes... If you missed it, that article covers the Windows Recall saga, the layoffs, and the wider European mood that frames everything below. Link: https://www.linkedin.com/pulse/microsofts-costly-mistakes-what-europe-doing-them-liam-Liam R.-wwfie/ )
What France has actually committed to
This is not a vague aspiration or a single ministry experimenting at the margins. France's Interministerial Digital Directorate, DINUM, announced in early April that it would migrate its own workstations from Windows to Linux, and ordered every government ministry to draw up a formal plan to eliminate what it calls "extra-European digital dependencies" by the autumn of 2026.
The numbers involved are substantial. The plan ultimately covers around 2.5 million civil servant workstations (Est £600 million per year loss for Microsoft). The directive reaches well beyond the operating system itself, taking in collaboration tools, cloud infrastructure, antivirus software, databases and even the AI platforms departments rely on. The minister for public accounts, Daniel Amiel, framed the decision in terms of regaining control over the country's data and digital infrastructure, arguing that the state can no longer accept depending on foreign suppliers for systems that critical.
The likely destination is a homegrown option rather than a generic distribution. France already runs a hardened, Ubuntu-based system called GendBuntu, which the Gendarmerie has used since 2008 and which is well proven across more than 100,000 machines. It is not yet official, but it is the obvious candidate for a state that wants something it has already tested at scale.
None of this is cheap, and it is worth being honest about that. Analysts have put the total cost somewhere between €1.5 billion and €3 billion across a five to seven year rollout, once hardware, retraining and support are added up. Full deployment is not expected before 2030. This is a long, expensive, deliberate undertaking, which is rather the point. Governments do not commit to projects on that scale to make a passing gesture.
So, was it a trend?
It increasingly looks that way. France is the largest and most assertive example, but it is far from standing alone.
Within Europe, the clearest precedent is the German state of Schleswig-Holstein, which began moving tens of thousands of workstations to Linux and LibreOffice in 2024 and has worked through the bulk of the migration since - they spent €9 million on the roll out and saved €15 million on Microsoft licensing alone. Denmark is the other prominent case, though with an important qualification: its Ministry of Digitalisation is moving off Microsoft 365 to LibreOffice, but the government has since clarified that it is not abandoning Windows entirely, so the headline "Denmark dumps Windows" overstates what has actually been committed to. The Danish cities of Copenhagen and Aarhus are pursuing their own transitions. France's national move, meanwhile, sits on top of earlier regional ones: the city of Lyon and the Occitanie region, with a population of more than six million, had already begun abandoning Microsoft before the central government acted. The Netherlands and Austria are routinely named alongside these as having taken early steps.
It is not only governments. The International Criminal Court announced in late 2025 that it was dropping Microsoft Office for openDesk, an open-source suite built by a German publicly owned body specifically to give public institutions a sovereign alternative. That is a telling data point, because the ICC's motivation was almost entirely about control and security rather than cost, for reasons we will come to.
Look beyond Europe and the pattern is older, if more mixed. South Korea is the most instructive comparison: it has spent years moving government desktops onto home-grown Linux distributions, and while the rollout has been slower than first promised, it has survived multiple changes of administration rather than collapsing. China has deployed its own Kylin OS across government systems, India built an Ubuntu-based system called Maya OS for sensitive defence machines, and Russia, Turkey and Brazil have all developed state-backed distributions for parts of the public sector. The democratic cases are the more relevant ones for France, since a top-down mandate is easier to enforce in a centralised state than in a coalition government answerable to its ministries.
One quiet indicator sits underneath all of this. Linux's share of the global desktop market has reached a record high, somewhere around 4.5 per cent in early 2026, up from roughly 2.7 per cent three years earlier. It is still small, but the direction is unmistakable, and government migrations are part of what is driving it.
It is worth keeping some perspective. Government Linux migrations have a long and frequently disappointing history. Munich famously reversed its own switch years ago after compatibility headaches and user frustration, and Denmark has already trimmed its ambitions once. France may yet find the same mountain of practical problems waiting for it. What makes 2026 feel different from past false starts is not a technical breakthrough but the breadth of political backing and the sheer number of governments moving in parallel. A single city reversing course is a footnote. A cluster of national governments pulling in the same direction is a market signal.
Why they are leaving, and why security sits at the centre of it
The temptation is to read these moves as straightforward cost-cutting. Licensing fees matter, and the looming end of support for older Windows versions does concentrate minds by forcing expensive upgrades. The Occitanie region's decision, for instance, was triggered in part by rising Microsoft contract costs. But cost alone does not explain why a government would willingly take on a billion-euro, multi-year migration with a real risk of failure. The stronger motive is security, used in its broadest sense, and one episode did more to crystallise it than any sales pitch from the open-source world ever could.
In early 2025, after the US administration imposed sanctions on the International Criminal Court over one of its investigations, the email account of the court's chief prosecutor was suspended. Microsoft has firmly disputed the characterisation that it pulled a switch, with its president stating that the company never ceased or suspended its services to the court, and the precise sequence of events remains contested. But for European officials the distinction between "cut off" and "complied with a sanction that had that effect" was beside the point. A former diplomat described the incident as the proof that many Europeans had been waiting for. The lesson they drew was simple and alarming: critical communications running on American infrastructure can be disrupted by a decision taken in Washington, without a European court or government having any say in it.
That fear was then confirmed from an unlikely source. In mid-2025, Microsoft acknowledged in a French court that it could not guarantee the data it holds in Europe would be beyond the reach of US authorities, because the US CLOUD Act can compel an American company to hand over data under its control regardless of where in the world that data physically sits. It gave a similar answer to a policing body in Scotland. For a government weighing how much of its national infrastructure to entrust to a foreign supplier, an admission like that, made under oath, is far more persuasive than any marketing.
It helps to be precise about what "sovereignty" means here, because it is easy to confuse with a related problem Microsoft has already largely solved. The first issue is data residency, simply where the data physically sits. For years European customer data was routinely stored and processed partly outside the bloc, and Microsoft's answer was its "EU Data Boundary", a multi-year project completed in early 2025 that keeps customer data for its main cloud services within the EU and EFTA. Critics noted, fairly, that having to build such a boundary was itself an admission of how much data had been flowing out. But the deeper issue is data sovereignty, meaning who has legal control over that data, and residency does not deliver it. You can pin your files to a data centre in Frankfurt and the US CLOUD Act still reaches them, because it binds the American company that operates the centre, not the soil the servers stand on. That is the gap the Data Boundary cannot close, and it is the whole reason a government would tear out Windows rather than simply tick a box marked "store my data in the EU". Closing the residency gap only made the sovereignty gap easier to see.
So the reasons stack up roughly in this order. Sovereignty and the related security exposure sit at the top: the ability to inspect the code you run, host your own data, and not depend on a vendor that is ultimately bound by another country's laws. Cost and the avoidance of vendor lock-in come next. And underneath both runs a slow erosion of trust, the sense that the relationship had become one in which the supplier set the terms and the customer absorbed them.
This is not new
It would be a mistake to read all of this as a reaction to one US administration. The distrust has a lineage that runs back a quarter of a century, and the institution now driving digital sovereignty is the very same one that first put the problem on the record.
In 2000 the European Parliament convened a temporary committee to investigate ECHELON, the signals-intelligence network operated by the so-called Five Eyes alliance of the US, UK, Canada, Australia and New Zealand. Its 2001 report concluded that the system existed, that it was US-controlled with British involvement, and that it had been used for economic espionage, with American intelligence passing commercial information in ways that helped US companies win contracts. The two cases that came to symbolise the affair are still cited today: a 1994 deal in which the US reportedly intercepted evidence that Airbus agents were bribing a Saudi official, after which the contract went to Boeing and McDonnell Douglas, and a Brazilian radar contract that went to the American firm Raytheon rather than France's Thomson-CSF.
It needs to be noted that these claims were investigated rather than conclusively proven. Witnesses proved reluctant to testify, no court case was ever assembled, and the United States offered a pointed rebuttal: the former CIA director James Woolsey wrote openly that America did spy on European firms, but to catch bribery and sanctions-busting rather than to steal technology, adding dismissively that most European technology was not worth the trouble (A single digit response from which likely justifies the EU's negative view of the US government and US technology). Whether one finds that reassuring or not (not), the episode left a permanent mark on how European institutions think about American control of their communications. Edward Snowden's revelations in 2013 then reopened the wound, and the admissions of 2025 reopened it again. The thread connecting all three is a single, constant suspicion: that US state power can reach into commercial data and tilt the field towards American interests.
What has changed is the nature of the exposure, and the change runs against Europe rather than for it. ECHELON was about the covert interception of data in transit, and the natural defence was encryption: protect the pipe and you frustrate the eavesdropper. The cloud era has inverted that logic. Over the same two decades that Europe worried about being listened to, it voluntarily moved its administrative backbone, its email, its documents and its public-sector systems onto platforms operated by American companies. The exposure is no longer that someone might secretly intercept the data, but that a foreign provider now holds it, and that provider's home law openly reaches it. There is no encrypting your way out of that, because the company holds both the keys and the legal obligation. That is precisely why the response in 2026 is not better security but wholesale replacement. ECHELON could be defended against. Dependency can only be unwound.
Seen in that light, the France and Denmark migrations look less like a sudden flinch and more like the closing of a loop that opened in 2001. Europe spent twenty-five years worrying about American interception while simultaneously handing American firms custody of its digital life, and has finally noticed the contradiction.
Meanwhile, Britain is moving the other way
If the continent's direction of travel is away from American Big Tech dependency, the United Kingdom offers an instructive counter-example, and arguably a warning. While France rips Windows out of its ministries, Britain has spent the same period embedding a US data-analytics company deeper into the single most sensitive dataset the state holds: the medical records of the population.
In 2023, NHS England awarded a contract worth around £330 million to Palantir, the American firm co-founded by the Trump-aligned investor Peter Thiel, to build a Federated Data Platform that links the health service's fragmented datasets into one system. The procurement itself drew heavy criticism for being unusually short and opaque, and the contract was published only after pressure, with some two hundred pages blacked out, many of them in the sections dealing with personal-data protection. It survived two legal challenges. The deeper one cuts straight to the sovereignty theme of this piece: Palantir is a US company, and a US company holding British health data is exposed to exactly the CLOUD Act reach that is driving governments off Microsoft. This is not hypothetical squeamishness. The Swiss army is reported to have rejected Palantir over precisely the fear that US intelligence could gain access to its data, and Palantir's own corporate heritage lies in building surveillance tools for the American NSA and Britain's GCHQ.
Ironic that Brexit was all about sovereignty from foreign governments, while the British government now willingly hands over sovereignty of our private data to the US. For a party whose entire brand is "take back control," Reform (and other Brexiteers) have had remarkably little to say about a US firm taking control of the nation's personal health data.
The access question has since sharpened. In 2026 the Financial Times reported an internal briefing note warning that external contractors, including Palantir staff, were to be granted an administrative role giving broad access to identifiable patient records before they are pseudonymised. NHS England and Palantir insist that strict, role-based controls remain in place and that Palantir acts only as a data "processor", handling information solely as the NHS directs. But the episode fed an existing unease, compounded by reports in Parliament that patient opt-outs may not apply to the platform because of a legal direction that has never been published or scrutinised.
The result is that uptake has stalled. Fewer than half of NHS trusts have adopted the platform, some, such as Greater Manchester, have refused outright, and the government has begun to talk openly about whether to invoke a break clause before the contract's review date in early 2027. NHS England, for its part, points to measurable operational gains where the platform is in use. The wider point for this article is the irony of the contrast. At the very moment European governments are spending billions to claw their most sensitive systems back from foreign control, Britain has been paying a foreign company to take charge of data far more intimate than any office document, and is only now asking whether that was wise.
Reciprocal in name only
On paper, the arrangement governing all this is even-handed. The UK-USA Data Access Agreement, in force since October 2022 and the first of its kind signed under the CLOUD Act, is reciprocal: British authorities can request data from US providers, and American authorities from British ones, each working through its own courts and oversight. The UK side rests on the Investigatory Powers Act 2016, the older Regulation of Investigatory Powers Act 2000 and the Crime (Overseas Production Orders) Act 2019; the US side on its Stored Communications Act. It reads like a deal between equals.
It is not one. The asymmetry is structural, and it runs almost entirely in one direction. The companies that hold the world's data, Microsoft, Google, Amazon, Apple, Meta and, yes, Palantir, are overwhelmingly American, which means a "mutual" access regime mostly governs data already sitting in American hands and reachable under American law. The United States held compulsion over its own providers long before any treaty existed; the agreement largely just gave Britain a faster place in the queue. And on the occasions when the two governments actually want different things, the record is, to say the least, lopsided.
The clearest test came over encryption. At the end of 2024 the Home Office used the Investigatory Powers Act, Britain's flagship surveillance law, to serve Apple a secret Technical Capability Notice demanding access to encrypted iCloud data, and not merely for British users but for Apple's customers anywhere in the world. This was the UK asserting sovereign power over an American company in the most forceful way its law allows. Apple refused to build the backdoor, pulled its strongest encryption from the UK market in protest, and took the order to tribunal. Then Washington intervened. President Trump, Vice-President Vance and the Director of National Intelligence all weighed in, US lawmakers cast the order as a hostile act, and some openly threatened to remove Britain from the Five Eyes intelligence-sharing arrangement on which its own security depends. By August 2025 the UK had folded, withdrawing the demand as it applied to American citizens' data. What it kept was the narrower right to go on pressing for access to its own citizens' data, which it did, leaving British iCloud users without a protection still available almost everywhere else.
Read that sequence carefully, because it answers the question of who gets their way. Britain reached for the single most powerful legal instrument it possesses, aimed it squarely at an American firm, and the United States made it retreat on everything except the right to surveil its own population. If that is the outcome when London is the one giving the orders, the notion that a "reciprocal" data agreement shields British sovereignty against the CLOUD Act does not survive contact with the evidence. This is not a partnership of equals with a treaty on top; it is a hierarchy with a handshake on top. Whatever the paperwork says, when London and Washington want different things, Washington wins, and the data, sitting as it does on American platforms under American law, was always going to see to that. Britain took back control from Brussels and handed it to Washington.
What Microsoft could have done differently
It is worth being fair here, because not all of this was within Microsoft's gift. The CLOUD Act is US law. Microsoft did not write it and cannot repeal it, and any American cloud provider would have had to give a European court the same uncomfortable answer. To that extent, some of the sovereignty anxiety was always going to attach to any US supplier, and Microsoft is partly the victim of being the largest and most visible one. Obviously other US Big Tech such as Amazon and Google are also being affected.
But that is not the whole story, and the more damaging parts were avoidable - although the numbers seem large the switch to Linux so far is costing Microsoft an estimated 0.1% of turnover.
It could have built genuinely sovereign European infrastructure earlier, and meant it. Rather than scrambling to announce sovereign cloud commitments after governments had already started leaving, Microsoft could have got ahead of the CLOUD Act problem years ago by structuring European operations so that data really was beyond easy reach of a US legal order, and by being candid about the limits rather than letting the admission emerge under oath. The reactive sequence, reassurance first and concrete guarantees only once customers were walking, is exactly the pattern that erodes trust.
It could have handled the ICC situation with more visible spine. The fact that Microsoft later revised its internal policies, and reportedly did not cut off the accounts of several judges sanctioned a few months later, is the clearest possible evidence that it had more room for manoeuvre than its initial handling suggested. Establishing those protections before the first incident, rather than after, would have changed the story European leaders told themselves about what American providers can be made to do.
And it could have spent the past few years earning goodwill rather than testing it. The Recall saga we covered in the original piece, the forced upgrades, the features pushed onto users who did not ask for them: none of that caused the sovereignty migrations, but all of it lowered the cost of leaving. When a government is already uneasy about dependence, every reminder that the relationship is one-sided makes the alternative look more reasonable. A company that had spent that period being a careful, responsive custodian of its customers' trust would have found those same customers far more reluctant to endure the pain of switching.
The uncomfortable summary is that the structural problem was partly unavoidable, but the trust deficit that turned it into action was largely self-inflicted.
Why this might be good for everyone, Microsoft included
We argued in the original piece that this shift, uncomfortable as it is for Microsoft, may be a healthy development rather than a worrying one, and the France news only reinforces that view.
For the better part of two decades, the public-sector desktop has been a near-monopoly. When a supplier faces no credible alternative, the incentive to listen to its customers weakens. That is arguably how we ended up with features like Recall being pushed onto users who plainly did not want them. The most effective check on that kind of complacency is not a regulator's fine. It is a customer with somewhere else to go.
France, Germany and the others are, in effect, rebuilding that alternative. A viable open-source path for large organisations forces the incumbent to compete on quality, trust and respect for its users again, rather than relying on the sheer cost of leaving. That is good for the governments doing the switching, good for the open-source ecosystem that suddenly has serious institutional backing, and, in the longer run, probably good for Microsoft too. Competition has a way of sharpening companies that have grown comfortable.
The question we asked a few weeks ago was whether Switzerland's decision was the beginning of something. France has answered it. The more interesting question now is who moves next, and whether Microsoft, and other US Big Tech companies, treats this as a problem to lobby against (thereby eroding trust further) or a warning worth heeding.
2 reactions · 0 comments