F-Secure chief warns on US tech dependence

Imagine a hospital administrator arriving in for the early shift on a Monday. The building is standing. The cables are where they should be. The servers in the basement are humming away. But the login screen will not let her in. There has been no cyberattack, no power failure, no dramatic collapse. The American company that runs the hospital’s authentication system has changed the terms of access. The patient records are sitting a few metres away. She cannot open them.

That is what digital dependency looks like when it stops being an abstract policy phrase. It is not always a severed cable or a burning data centre. Sometimes it is the landlord changing the door code overnight. When Timo Laaksonen, chief executive of Finland’s F-Secure, warned this month that Europe relies heavily on US-controlled critical services, he was pointing to that quieter, more awkward vulnerability (Yle).

The Door Code Is Not in Europe

The weak point appears before the hospital worker even reaches her inbox.

She enters her credentials into a login system. Across Europe, many organisations use US-operated identity services, with Microsoft’s Entra ID the most common, to confirm that staff are who they say they are. If that provider fails, or access is withdrawn, every application sitting behind it can become unreachable at once (Hypergate). One locked door can close off a whole building.

Then comes the control panel for the cloud: the dashboard where IT teams create servers, manage databases and control the digital keys protecting sensitive information. A hospital’s patient records may physically sit in Frankfurt. But if the dashboard, billing account and encryption controls are managed by a US parent company, “hosted in Europe” does not necessarily mean controlled from Europe (JRC).

The same pattern runs through email, document storage, software updates and DNS, the internet’s address book that tells browsers where to find websites. German research found that about 96% of German companies depend on imported digital technologies, while US cloud providers hold more than 70% of the European market (egovernment.de).

When the Lock Actually Turned

This is no longer a theoretical argument for Brussels seminars.

Anthropic, the AI company, suspended access to its latest models for some users to comply with US export controls. Nothing was unplugged. A legal order simply made a digital capability vanish from certain screens (AP, Reuters).

In the Netherlands, a court blocked the US company Kyndryl from acquiring Solvinity, which hosts DigiD, the digital identity system Dutch citizens use for taxes and healthcare. The concern was legal control. Under US laws including the CLOUD Act and FISA, American-owned companies can be compelled to hand over data regardless of where that data is stored. A national identity system, the court found, could not sit comfortably under that umbrella (Ius Mentis).

In France, a National Assembly inquiry found that roughly 80% of public software purchases pass through US actors, worth about €1.5 billion a year. Ministries, energy operators and transport networks all rely on vendors that could, at least in theory, restrict access under political or legal pressure (Banque des Territoires, Clubic).

Fallbacks, Not Fantasies

Europe is not about to rebuild the American technology stack from the ground up. The economics of scale are against that, at least in the short term. The real question is more practical: how much stops working when a single access layer disappears?

France now requires cloud services certified for sensitive government use to be beyond the reach of foreign laws that could force a loss of control (CER). Germany is building openDesk, an open-source workplace suite. The European Commission’s Tech Sovereignty Package treats chips, AI, cloud and open source as parts of the same problem (European Commission).

Finnish cybersecurity researcher Mikko Hyppönen adds a point that is easy to miss: even defensive systems can become dependencies. A firewall installed in Helsinki, but relying on threat intelligence, virus signatures and software updates from abroad, still depends on uninterrupted access to a foreign service. Cut off that feed and the wall goes blind (YouTube / Hyppönen).

For any European hospital, council or department, the test is plain enough. If one vendor account, one identity provider or one update feed disappears tomorrow morning, can staff still log in, retrieve records and communicate? Institutions that can answer yes have some measure of sovereignty. Those that cannot are tenants who have not checked who holds the key.