The Kill SwitchHow one email cancellation exposed Europe's digital dependency

The Trump administration sanctioned ICC prosecutor Karim Khan in January 2026. Microsoft cancelled his email access. There was no hack, no data breach, no security incident. It was a policy decision made in Washington that instantly cut off a foreign official's communications. The prosecutor investigating war crimes lost his work email because a US company was told to comply with US sanctions. The ICC, based in The Hague and serving 124 member states, had built its communications on Microsoft's infrastructure. That infrastructure turned out to have an off switch controlled from another continent.

Governments have always known about surveillance risks. Edward Snowden made that clear in 2013 when he revealed the scope of NSA monitoring. But the ICC incident was not surveillance. It was a kill switch. Microsoft did not read Khan's emails. They deleted his ability to send them. It proved something that had been theoretical until that morning: US companies can unilaterally cut off service to anyone, anywhere, based on US government directives, regardless of where that person is located or what international body they serve. Surveillance is passive. This was active denial of service, carried out not by hackers but by a vendor following orders.

70% of French data sits on American cloud infrastructure. AWS, Azure, Google Cloud. Government pandemic loan applications for 530,000 companies ran through AWS. Health records for 67 million French citizens are stored on Microsoft Azure. EDF's nuclear facility maintenance records live on Amazon's servers. The most sensitive data a nation produces, from its citizens' medical histories to the maintenance logs of its nuclear reactors, is hosted by companies headquartered in Seattle and Mountain View.

80% of Europe's digital infrastructure relies on non-European providers. Operating systems, cloud platforms, identity providers, business software. Nearly all of it routes through Silicon Valley. When a French civil servant logs into their workstation, they boot Windows, authenticate through Azure Active Directory, open Outlook, join a Teams call, and save files to OneDrive. Every step in that workflow is controlled by a single American company.

95% of German businesses say they could not survive two years without US digital services, according to a Bitkom industry survey. France's numbers are not public but are likely similar. German manufacturers run their supply chains on SAP but host it on AWS. Hospitals schedule surgeries through American SaaS platforms. Law firms store case files on Dropbox. The dependency is not just deep. It is existential, woven into every layer of how European economies actually function day to day.

The US CLOUD Act of 2018 allows American authorities to compel US companies to hand over data regardless of where that data is physically stored. A French government ministry using Azure might have its data sitting in a data center in Frankfurt or Paris, but Microsoft is still a US company subject to US law. The physical location of the server is irrelevant. If the US government issues a warrant or a national security letter, Microsoft is legally obligated to comply, even if doing so violates EU data protection law. The CLOUD Act effectively means that any data stored with a US company is US-accessible data, no matter which country's soil the server sits on.

In a French Senate hearing, Microsoft France's president admitted the company could not guarantee that customer data would never be transferred to US authorities. This was not a leak. It was not a whistleblower. It was Microsoft's own executive, testifying under oath before a legislative body, stating plainly that the legal framework makes absolute data protection impossible. When pressed on whether French government data stored on Azure in Europe could be shielded from American law enforcement, the answer was no. The company that hosts health records for every French citizen publicly acknowledged it cannot promise those records stay out of Washington's reach.

France controls only 2.4% of the global digital infrastructure market, valued at roughly $5 trillion. This is a country that builds its own fighter jets, designs its own nuclear submarines, launches its own satellites, and maintains an independent nuclear deterrent. France has spent decades and billions ensuring it never depends on another nation for its defense. Then it outsourced something arguably more critical than any single weapons system: the digital infrastructure that runs its government, its hospitals, its energy grid, and its economy. The disconnect between France's defense sovereignty and its digital dependency became impossible to ignore.

This is no longer abstract policy debated in think tanks and academic conferences. After the ICC incident and the return of the Trump administration, the debate shifted from theoretical to existential across European capitals. European Commissioner Virkkunen created a new portfolio specifically for Tech Sovereignty. The word sovereignty moved from white papers to ministerial titles. France's digital minister began referencing the ICC email shutdown in press conferences. Germany's interior ministry opened a review of federal IT contracts with American vendors. The political class caught up to what technologists had been warning about for years: digital dependency is a national security problem.