F-Secure chief warns Europe depends on US-controlled digital services

Picture a hospital clerk arriving for a Monday morning shift. The building is fine, the network cables are intact, the servers in the basement hum along. But the login screen rejects her password. Not because of a hack or a power cut, but because the US company that manages the hospital's authentication system has changed the terms of access. Her patients' records are metres away. She cannot reach them.

This is what digital dependency looks like in practice. Not cables cut, not data centres burning. A landlord who changed the door code while you slept. When Finland's F-Secure CEO Timo Laaksonen warned this month that Europe is deeply dependent on US-controlled critical services, he was describing exactly this kind of quiet structural exposure (Yle).

The Door Code Is Not in Europe

To grasp where the vulnerability sits, follow what happens before that hospital clerk sees her inbox.

She types her credentials into a login system. Many European organisations rely on US-operated identity services (Microsoft's Entra ID is the most common) to verify who their staff are. If that provider goes down or pulls access, every application behind it becomes unreachable simultaneously (Hypergate). One locked door, dozens of rooms behind it.

Then there is what you might call the remote control for cloud infrastructure: the dashboard where IT teams create servers, manage databases and handle the digital locks that protect sensitive data. A hospital's patient records might physically sit on a server in Frankfurt. But if the dashboard, the billing account and those digital locks are all managed by a US parent company, "hosted in Europe" does not mean "controlled by Europe" (JRC).

The pattern repeats across email, document storage, software updates, and even the internet's address book (DNS) that tells browsers where to find websites. German research found that around 96% of German companies depend on imported digital technologies, with US cloud providers holding over 70% of the European market (egovernment.de).

When the Lock Actually Turned

Three recent cases show this is not speculation.

Anthropic, the AI company, suspended access to its latest models for some users to comply with US export controls. No server was unplugged. A legal order made a digital capability disappear from certain screens (AP, Reuters).

In the Netherlands, a court blocked the US company Kyndryl from acquiring Solvinity, the firm hosting DigiD, the digital identity system Dutch citizens use for taxes and healthcare. The reason: under US law (the CLOUD Act and FISA), American-owned companies can be compelled to hand over data regardless of where it sits. A national identity system cannot live under that legal umbrella (Ius Mentis).

In France, a National Assembly inquiry found that roughly 80% of public software purchases pass through US actors, worth about €1.5 billion annually. Ministries, energy operators and transport networks all depend on vendors who could, in theory, restrict access under political or legal pressure (Banque des Territoires, Clubic).

Fallbacks, Not Fantasies

Europe cannot rebuild the US technology stack from scratch. Scale economics make that unrealistic near-term. But reducing how much breaks when one access layer disappears is achievable.

France now requires that cloud services certified for sensitive government use cannot be compelled by foreign law to surrender control (CER). Germany is building openDesk, an open-source workplace suite. The European Commission's Tech Sovereignty Package frames the problem across chips, AI, cloud and open source together (European Commission).

Finnish cybersecurity researcher Mikko Hyppönen adds a twist often missed: even defensive tools become dependencies. A firewall installed in Helsinki but fed threat intelligence, virus signatures and software updates from abroad still relies on uninterrupted access to a foreign service. Cut that feed and the wall goes blind (YouTube / Hyppönen).

The practical test for any European hospital, municipality or ministry is straightforward: if one vendor account, one identity provider or one update feed disappears tomorrow morning, can staff still log in, retrieve records and communicate? The institutions that can answer yes have sovereignty. The ones that cannot are tenants who have not yet checked who holds the key.