When Governments Begin Reclaiming Their Digital Infrastructure

DIGITAL SOVEREIGNTY IS NOT SIMPLY ABOUT WHERE TECHNOLOGY IS BUILT. IT IS ABOUT WHO CONTROLS IT, WHO DEPENDS UPON IT, WHO CAN DISRUPT IT, AND WHO IS ACCOUNTABLE WHEN IT FAILS.

Every investigation in the WHO CONTROLS WHOM? series examines a different layer of the same structure. NVIDIA AND THE CONCENTRATION OF COMPUTATIONAL POWER examines who controls advanced computing capacity. WHO CONTROLS HYBRID WARFARE? examines how interconnected physical, digital, informational, and institutional systems can become instruments of conflict or coercion. THE ARCHITECTURE OF AI POWER examines who owns and finances the infrastructure of intelligence. This investigation examines what governments are doing about it — the concrete, documented attempts by European states to reclaim the digital systems on which their administrations run.

The European initiatives examined here are real, sourced, and consequential. They are also incomplete, contested, and in several cases largely aspirational. A sober investigation must hold both facts at once: the political will to reclaim digital infrastructure is strengthening across Europe, and the operational capacity to exercise that independence — in semiconductors, cloud infrastructure, advanced computing, and institutional maintenance — remains substantially concentrated elsewhere.

The investigation also recognizes a boundary that national programs alone cannot cross: domestic technology ownership does not automatically guarantee democratic oversight or individual liberty. A sovereign state does not automatically create a sovereign citizen.

In late January 2026, the French government announced its intended transition of the civil service away from United States videoconferencing platforms — Microsoft Teams, Zoom, Webex, and GoTo Meeting — toward Visio, a homegrown videoconference tool, with full deployment across ministries and state agencies targeted for 2027. The government's stated objective was, in its own words, "to put an end to the use of non-European solutions, to guarantee the security and confidentiality of public electronic communications by relying on a powerful and sovereign tool."

David Amiel, France's minister-delegate for the civil service and state reform, framed the decision in explicitly sovereign terms: "We cannot risk having our scientific exchanges, our sensitive data, and our strategic innovations exposed to non-European actors." The announcement came amid a documented European political realignment — tensions over Greenland, the precedent of a United States sanction that led Microsoft to disconnect the email of the International Criminal Court's top prosecutor in 2025, and years of transatlantic dispute over data transfers dating to the 2013 Snowden disclosures.

Microsoft, for its part, stated that it "continues to partner closely with the government in France" and respects "the importance of security, privacy, and digital trust for public institutions," pointing to its European data residency commitments. The company's statement — that data stays in Europe, under European law — is exactly the distinction this investigation examines: data residency and vendor jurisdiction are related but not identical properties, and neither is equivalent to independent operational control.

THE OCTOBER 2026 ACCOUNTABILITY QUESTION

Can a government declare technological independence before it possesses the operational capacity to exercise it?

REPORTED — THE COUR DES COMPTES REPORT HAS NOT BEEN INDEPENDENTLY REVIEWED BY DSC. DOCUMENTATION PENDING.

CAN A GOVERNMENT DECLARE TECHNOLOGICAL INDEPENDENCE BEFORE IT POSSESSES THE OPERATIONAL CAPACITY TO EXERCISE IT?

WHAT DOES IT MEAN FOR A GOVERNMENT TO OWN ITS COMMUNICATIONS INFRASTRUCTURE — AND WHAT DOES IT NOT YET MEAN?

WHICH OF THESE ARE ENACTED REQUIREMENTS, OPERATIONAL PROGRAMS, PROPOSED INITIATIVES, OR INSTITUTIONAL AMBITIONS — AND WHAT IS THE DIFFERENCE IN PRACTICE?

European digital sovereignty cannot be evaluated through productivity software and cloud hosting alone. A government can own its videoconference platform and remain structurally dependent for the layer beneath it: the infrastructure required to develop and operate advanced AI. The NVIDIA AND THE CONCENTRATION OF COMPUTATIONAL POWER investigation examines that layer in depth — the concentration of advanced computing capacity, the financial architecture that finances it, and the government relationships that surround it. This section does not reproduce that investigation; it states the structural connection.

The deeper question concerns the stack. Advanced GPUs and NVIDIA computing platforms; semiconductor fabrication; lithography and ASML equipment; advanced packaging; high-bandwidth memory; cloud computing; AI development frameworks; data centers and their electricity and cooling; capital investment at unprecedented scale; export restrictions that turn each layer into an instrument of statecraft; and international supply chains in which no single jurisdiction controls every stage. A European state that migrates its civil service to Visio has changed the software layer of that stack and nothing above it.

THE CENTRAL DISTINCTION: owning a sovereign software platform is not possessing independent capacity to operate the computational infrastructure beneath it. France controlling Visio's source code does not control the fabrication of the chips its servers run on, the cloud they are hosted on, or the models its transcription feature may eventually call.

CAN A GOVERNMENT EXERCISE COMPUTATIONAL SOVEREIGNTY WHILE DEPENDING ON A SMALL NUMBER OF FOREIGN CORPORATIONS FOR ADVANCED COMPUTING?

WHAT DOES NATIONAL DIGITAL SOVEREIGNTY MEAN IF ESSENTIAL INFRASTRUCTURE CAN BE DISRUPTED THROUGH SYSTEMS THAT A GOVERNMENT DOES NOT INDEPENDENTLY CONTROL OR UNDERSTAND?

1. Software supply-chain security — the integrity of every component a sovereign platform imports.
2. Vendor concentration — whether migration replaces one concentrated dependency with another.
3. Open-source security governance — who funds audits, responds to disclosures, and maintains the code a government now owns.
4. Sovereign cloud security — the operational security of domestically operated infrastructure, which is not superior by default.
5. Independent audits — who verifies the security claims of both foreign and domestic providers.
6. Government incident-response capacity — whether the state can detect, contain, and recover from compromise of its own systems.
7. Data residency versus data security — jurisdiction changes where data is subject to law; it does not change whether data is protected.
8. Infrastructure redundancy — whether the migration increased or decreased the number of independent failure domains.
9. Public procurement transparency — whether security requirements are visible and contestable in the purchasing process.
10. Human override and manual recovery — whether essential functions can operate when digital systems cannot.
11. Disaster recovery — whether tested continuity arrangements exist for sovereign platforms themselves.
12. Institutional accountability — who is answerable when a sovereign system fails, and to whom.

WHO SECURES A SOVEREIGN SYSTEM, WHO AUDITS THOSE PROTECTING IT, AND WHO IS ACCOUNTABLE WHEN THAT SYSTEM FAILS?

STATUS: the cybersecurity investigation (WHO CONTROLS OUR CYBERSECURITY?) is built and staged. The link above opens it. Both that investigation and this page remain unpublished pending founder authorization — the no-broken-link rule is preserved: the link points to a route that exists.

The findings of the NVIDIA investigation, TECHNO-STATE CAPTURE, THE ARCHITECTURE OF AI POWER, and this one converge on a reciprocal dependency. Governments depend upon private vendors for computational capacity, communications, cloud services, and cybersecurity. Corporations depend upon governments for procurement, export licensing, infrastructure approvals, industrial policy, and market access.

These relationships can support legitimate innovation and national security. They can also create conflicts of interest, procurement concentration, lobbying influence, and public accountability concerns. The distinction between legitimate cooperation and demonstrated misconduct is maintained case by case, on evidence, in each companion investigation — corporate political access does not establish corruption, and this page asserts no such equivalence.

WHEN PUBLIC AUTHORITY AND PRIVATE TECHNOLOGICAL CAPABILITY BECOME INTERDEPENDENT, WHO MAINTAINS INDEPENDENT OVERSIGHT?

A neutral, documented comparison between European and American digital infrastructure strategies must begin with the asymmetry: the United States possesses the world's largest domestic technology companies and advanced research capacity, while European governments are the customers — and increasingly the worried customers — of those companies. The relevant American questions are therefore not about building sovereign alternatives to foreign vendors, but about how a nation manages dependence on its own corporations.

American federal agencies rely extensively on private cloud providers and commercial communication platforms; federal procurement shapes — and is shaped by — the largest technology vendors; national security technology is deeply integrated with commercial industry; open-source procurement exists but is the exception rather than the rule; cybersecurity responsibilities are distributed across agencies and the private sector; and AI infrastructure is concentrating in a small number of domestic corporate ecosystems. The examination of how American agencies manage vendor lock-in, continuity, security, oversight, and supplier substitutability is a standing research question in this series, developed across TECHNO-STATE CAPTURE and THE ARCHITECTURE OF AI POWER.

On the day this update was staged, a widespread Microsoft service disruption affected Outlook, Teams, Copilot, and OneDrive for users globally. By early afternoon, outage-report volumes on Downdetector approached 83,000 for Outlook; Microsoft attributed the problem to servers being unexpectedly unavailable, stated it was restarting affected servers, and published incident identifiers EX1550543 and MO1550821. Reporting documented customers still unable to send or receive mail hours after an initial resolution notice (ZDNET, November 12, 2026; Associated Press, November 12, 2026).

CAN A NATION POSSESS THE WORLD'S MOST POWERFUL TECHNOLOGY CORPORATIONS WITHOUT POSSESSING INDEPENDENT PUBLIC CONTROL OVER THE TECHNOLOGICAL SYSTEMS ON WHICH ITS GOVERNMENT DEPENDS?

A SOVEREIGN STATE DOES NOT AUTOMATICALLY CREATE A SOVEREIGN CITIZEN.

WHO CONTROLS A NATION'S DIGITAL INFRASTRUCTURE — AND WHO PROTECTS THE PEOPLE WHEN GOVERNMENTS AND CORPORATIONS POSSESS THE CAPABILITY TO CONTROL IT?

1. Privacy-preserving civic AI — computation that serves participation without harvesting the participants.
2. Public-interest information verification — verification infrastructure owned by no platform.
3. Civic intelligence — knowledge systems designed for the common capacity of a community, not its monetization.
4. Independent oversight — technical capability for auditing powerful systems from outside them.
5. Computational self-determination — the individual's standing to govern their computational identity.
6. Citizen-controlled digital infrastructure — infrastructure whose governance includes the governed.
7. Accountable public services — public digital services answerable to due process.
8. Infrastructure resilience — civic capacity that survives the failure of any single system.
9. Human authority over consequential decisions — the non-negotiable center of the framework.

NATIONAL TECHNOLOGICAL INDEPENDENCE SHOULD CREATE THE CONDITIONS FOR GREATER DEMOCRATIC AND INDIVIDUAL AUTONOMY — NOT SIMPLY TRANSFER CONTROL FROM ONE CENTRALIZED AUTHORITY TO ANOTHER.

NO ORGANIZATION LISTED HERE IS A DSC PARTNER. NO PARTNERSHIP, ENDORSEMENT, COLLABORATION, OR INSTITUTIONAL RELATIONSHIP OF ANY KIND IS CLAIMED OR IMPLIED.

• The date of the underlying event is stated separately from the publication date of each report.
• Responses, corrections, and counterarguments are preserved: Microsoft's statement on France, the Ericsson chief executive's characterization of sovereignty discussions as "dangerous," and the documented advantages of mature commercial platforms all appear in this file.
• No evidence, quotation, institutional relationship, or finding is fabricated. Where a primary document has not been reviewed, the entry says so.
• Announced goals are distinguished from completed deployments throughout.

• International technology markets deliver scale, price, and maturity that national alternatives struggle to match; fragmentation carries real costs.
• Börje Ekholm, chief executive of Ericsson, stated at Davos in 2026 that European sovereignty discussions are "dangerous" and that building homegrown alternatives would lead to higher prices (ZDNET, January 30, 2026).
• Insufficient domestic maintenance capacity can turn a sovereignty program into a security liability; open-source does not maintain itself.
• Politically motivated procurement can substitute symbolic independence for operational effectiveness.
• Cross-border research cooperation and interoperable alliances are themselves forms of strength that autarky would forfeit.

This investigation must not become an isolated celebration of European technological independence. It exists to illuminate the structural relationships between concentrated computational power, government dependency, infrastructure security, democratic accountability, and individual autonomy.

A democracy cannot be fully technologically resilient if it cannot understand, govern, secure, or meaningfully replace the digital systems on which its institutions and people depend. But institutional resilience is not sufficient by itself. The constitutional rights, privacy, autonomy, and agency of individuals must remain central — in Europe, in the United States, and everywhere the same structure obtains.