Europe's defense vulnerable to US cloud providers

Most European countries rely on United States-based cloud services for national defense, creating the strategic risk of a "kill switch" that could disable systems, a new analysis concludes.

According to the Brussels-based think tank Future of Technology Institute, or FOTI, most European states depend on US technology companies for defense applications, either through direct partnerships or via European vendors that run on US cloud services.

This dependence exposes them to a "kill switch", which is the possibility that Washington could subpoena cloud-hosted data or impose sanctions on US cloud providers, reported Euronews.

Under legislation known as the CLOUD Act, or, in full, the Clarifying Lawful Overseas Use of Data Act, which was enacted during US President Donald Trump's first term, the US president has the authority to subpoena data.

Specifically, 16 European states face high exposure to a potential US kill switch: Croatia, the Czech Republic, Denmark, Estonia, Finland, Germany, Hungary, Ireland, Latvia, Lithuania, Poland, Portugal, Romania, Slovakia, Slovenia, and the United Kingdom.

Additionally, seven others are at medium risk due to indirect dependence on US cloud infrastructure via European contractors that built their systems: Belgium, France, Greece, Italy, Luxembourg, Spain, and the Netherlands.

According to FOTI's executive director, Cori Crider, the US employed such a kill switch in 2025, when Microsoft was reported to have suspended the accounts of the International Criminal Court's chief prosecutor, Karim Khan, after Trump imposed sanctions.

Another instance, reported by Ukrainian media, involved Maxar Technologies limiting Ukraine's access to satellite imagery following a US pause in intelligence sharing.

"A kind of kill switch risk from the United States is no longer some sort of theoretical discussion … this is a genuine, imminent risk that Europe doesn't have the luxury to ignore anymore," Crider said.

To conduct the analysis, FOTI reviewed procurement notices for government contracts valued and scanned national defense websites for mentions of "cloud", "Microsoft", "Google", "Amazon Web Services", and "Oracle".

According to the study, Microsoft is the leading cloud provider to European defense agencies, with deployments in 19 countries. Google and Oracle have also secured defense contracts.

At the top of the risk spectrum are countries relying directly on US cloud services that may not be "air gapped", meaning the systems are physically isolated from the broader global cloud infrastructure.

Because they depend on routine updates and maintenance from US service providers, these systems remain exposed and could be jeopardized if sanctions are imposed, the study noted.

Researchers said FOTI's findings represent a "conservative estimate" of cloud involvement, since many contracts are classified and it is difficult to identify every deal that implicates US technology.

jonathan@mail.chinadailyuk.com