Falk Steiner, Digital Policy Reporter at heise online: The Real Risk of European Sovereign Cloud Is Not Data Access, but Software Update Supply Cutoff
German Chancellor Friedrich Merz publicly stated his trust in the security of Google Cloud for intelligence agencies. Falk Steiner, digital policy reporter at heise online, argues this misses the point: the real threat is not forced data handover to authorities, but a potential cutoff of software stack maintenance by US providers. Without continuous updates, so-called sovereign clouds would face paralysis within months, as independent alternative infrastructure does not yet exist.
At the Berlin Digital Summit, German Chancellor Friedrich Merz was asked whether it sends a bad signal to domestic data center operators if German intelligence agencies rely on Google Cloud for their tasks. His answer was negative, noting that Google also invests in Europe. He expressed high confidence in Germany's intelligence services, stating that even when an American provider builds large cloud infrastructure, the data remains secure.
Falk Steiner, digital policy reporter at heise online, argues that this assessment fundamentally misidentifies the problem. In a commentary, he points out that the scenario requiring genuine concern is not Google handing over German data to US intelligence agencies under presidential directive—a situation that can indeed be prevented through technical and organizational measures within an air-gapped cloud architecture. The actual danger lies in a different scenario: a soft supply cutoff switch.
Steiner lists all current cloud products marketed as European sovereignty solutions—Amazon’s European Sovereign Cloud, the Microsoft Azure-based Delos Cloud, Google’s partnership S3NS in France, and the planned Thales Cloud in Germany. Technologically, they all depend on the maintainer of the cloud solution's software stack. The software stack is a core criterion for choosing or rejecting a cloud vendor, second only to cost.