F-Secure chief flags US digital dependence

Imagine a clerk at Mater Dei arriving for a Monday morning shift. The building is open, the network cables are in place, the servers are running. But the login screen refuses her password. Not because of a cyberattack or a power cut, but because the US company managing the hospital's authentication system has changed the terms of access. The patient files are only a few metres away. She cannot get to them.

That is what digital dependency looks like when it leaves the policy paper and enters daily life. No cables cut. No data centre on fire. Just a landlord changing the door code overnight. When Finland's F-Secure chief executive Timo Laaksonen warned this month that Europe is deeply dependent on US-controlled critical services, he was pointing to this quiet form of exposure (Yle).

The Door Code Is Not in Europe

The weak point appears before the hospital clerk even reaches her inbox.

She types her credentials into a login system. Many European organisations depend on US-operated identity services, with Microsoft's Entra ID the most common, to confirm who their staff are. If that provider fails or withdraws access, every application behind it can become unreachable at once (Hypergate). One locked door can seal off a whole corridor.

The same applies to the remote control of cloud infrastructure: the dashboard used by IT teams to create servers, manage databases and control the digital locks protecting sensitive data. Patient records may physically sit on a server in Frankfurt. But if the dashboard, the billing account and the encryption keys are managed by a US parent company, "hosted in Europe" does not necessarily mean "controlled by Europe" (JRC).

For Malta, this is not an abstract sovereignty debate. A small state has limited bargaining power when public services, banks, iGaming operators and government systems all rely on global vendors. The pattern runs through email, document storage, software updates and even DNS, the internet's address book that tells browsers where to find websites. German research found that around 96% of German companies depend on imported digital technologies, while US cloud providers hold more than 70% of the European market (egovernment.de).

When the Lock Actually Turned

Three recent cases show that this is not theoretical.

Anthropic, the AI company, suspended access to its latest models for some users to comply with US export controls. No server had to be unplugged. A legal order was enough to make a digital capability disappear from selected screens (AP, Reuters).

In the Netherlands, a court blocked the US company Kyndryl from acquiring Solvinity, the firm hosting DigiD, the digital identity system Dutch citizens use for taxes and healthcare. The reason was legal control. Under the CLOUD Act and FISA, American-owned companies can be compelled to hand over data regardless of where that data is stored. A national identity system could not be placed under that umbrella (Ius Mentis).

In France, a National Assembly inquiry found that roughly 80% of public software purchases pass through US actors, worth about €1.5 billion a year. Ministries, energy operators and transport networks all rely on vendors that could, at least in principle, restrict access under political or legal pressure (Banque des Territoires, Clubic).

Fallbacks, Not Fantasies

Europe is not going to rebuild the American technology stack from scratch in the near future. The economics of scale make that unrealistic. The more serious objective is narrower: reduce the damage when one access layer fails or is withdrawn.

France now requires cloud services certified for sensitive government use to be beyond compulsion by foreign law when it comes to surrendering control (CER). Germany is building openDesk, an open-source workplace suite. The European Commission's Tech Sovereignty Package treats chips, AI, cloud and open source as part of the same problem (European Commission).

Finnish cybersecurity researcher Mikko Hyppönen adds a point that matters for countries like Malta, where capacity is often bought rather than built. Even defensive tools can become dependencies. A firewall installed in Helsinki but fed with threat intelligence, virus signatures and software updates from abroad still relies on uninterrupted access to a foreign service. Cut that feed and the wall goes blind (YouTube / Hyppönen).

The practical test for any European hospital, kunsill lokali or ministry is simple. If one vendor account, one identity provider or one update feed disappears tomorrow morning, can staff still log in, retrieve records and communicate? The institutions that can answer yes have a measure of sovereignty. The ones that cannot are tenants who have not checked who holds the key.