What Happened
- A report published by the Brussels-based Future of Technology Institute (FOTI) on April 17, 2026 found that national security systems in 23 of 28 European countries studied appear to rely on US cloud computing technology.
- FOTI analysed public information from defence ministry websites, national media, and EU and UK public procurement records to identify major cloud contracts with US providers — Microsoft, Google, Amazon, and Oracle.
- 16 of the 28 countries studied are assessed to be at "high risk" from a potential US "kill switch" — the ability of US authorities to cut off cloud services under political pressure or legal compulsion; this group includes Germany, Poland, and the United Kingdom.
- The 16 high-risk countries identified are: Croatia, Czech Republic, Denmark, Estonia, Finland, Germany, Hungary, Ireland, Latvia, Lithuania, Poland, Portugal, Romania, Slovakia, Slovenia, and the United Kingdom.
- The concern is anchored in the US CLOUD Act, which allows US authorities to compel American tech companies to hand over data stored anywhere in the world, including in Europe.
- Early European responses include Italy's defence ministry shifting to open-source software, the German state of Schleswig-Holstein adopting open-source alternatives, and the Netherlands building a defence cloud with telecom firm KPN and France's Thales.
Static Topic Bridges
Digital Sovereignty and Cloud Sovereignty
Digital sovereignty refers to a state's ability to control the digital infrastructure, data, and technologies within its borders. Cloud sovereignty specifically addresses the ownership, storage, processing, and legal jurisdiction of data managed through cloud computing services. The European Union has increasingly framed digital sovereignty as a strategic imperative, distinct from trade or regulatory concerns.
- EU digital sovereignty frameworks: European Cloud Initiative, GAIA-X (European federated cloud project), and Cyber Solidarity Act
- GAIA-X launched 2019: aims to create a transparent, open European cloud infrastructure
- Cloud sovereignty concerns: data residency, access control, foreign law applicability, and supply chain dependence
- US CLOUD Act (2018): allows US law enforcement to compel US cloud providers to disclose data regardless of where it is stored
Connection to this news: The FOTI report quantifies what has been a policy debate: Europe's defence infrastructure is substantially hosted on US cloud platforms, making it subject to US legal jurisdiction and political leverage through the CLOUD Act.
India's Digital Infrastructure and Data Localization Context
India's Digital Personal Data Protection (DPDP) Act 2023 does not mandate blanket data localization — it presumes cross-border data flows are permissible unless the government specifically restricts transfers to particular countries. However, sector-specific rules (such as the Reserve Bank of India's payment data localization mandate) do require certain sensitive data to remain within India.
- DPDP Act 2023: no blanket data localization; government may blacklist certain countries for data transfers
- RBI payment data localization: all payment system data must be stored exclusively in India (2018 directive)
- Meity administers the DPDP Act; Data Protection Board of India is the enforcement authority
- India's cloud market is dominated by AWS, Microsoft Azure, and Google Cloud — a dynamic similar to Europe's dependency on US providers
Connection to this news: India faces a structurally analogous risk — its growing digital public infrastructure (DigiLocker, UMANG, CoWIN, etc.) and military systems increasingly depend on hyperscale cloud platforms headquartered in the US, raising similar sovereignty and access-control questions.
CLOUD Act and Extraterritoriality of US Law
The Clarifying Lawful Overseas Use of Data (CLOUD) Act, enacted by the United States in 2018, expanded US law enforcement's ability to compel US-headquartered technology companies to produce data stored on servers outside the United States. It also allows the US to enter "executive agreements" with other countries for mutual data access.
- CLOUD Act enacted: 2018 (US)
- Key provision: US government can demand data from US tech companies regardless of where that data is physically stored
- Contrast with GDPR: EU's General Data Protection Regulation restricts transfer of EU personal data outside the EU
- CLOUD Act vs. GDPR: creates a legal conflict for European subsidiaries of US tech companies
Connection to this news: The CLOUD Act is the specific legal mechanism that makes European dependence on US cloud providers a security risk — it gives the US government legal authority to access data stored on those platforms, potentially including sensitive national security information.
Key Facts & Data
- Report: Future of Technology Institute (FOTI), Brussels, published April 17, 2026
- 23 of 28 European countries studied rely on US cloud for national security systems
- 16 countries assessed at "high risk": includes Germany, Poland, UK, and 13 others
- US cloud providers named: Microsoft, Google, Amazon, Oracle
- US CLOUD Act: enacted 2018; allows US authorities to compel data access across borders
- European sovereign cloud initiatives: GAIA-X (launched 2019), Netherlands KPN-Thales defence cloud
- India's DPDP Act 2023: cross-border transfers presumed permissible unless restricted by government
- RBI payment data localization mandate: 2018; all payment system data must reside in India