Who Holds the Keys

Rob Kurver

3 hours ago

View from an airplane window at dusk over the Atlantic, with faint glowing network lines in the clouds below and a brass key on the tray table

If I’m an advocate for anything, it’s to move.
Anthony Bourdain, World Travel: An Irreverent Guide (compiled by Laurie Woolever)

I’m writing this somewhere over the Atlantic, on the Saturday flight from Amsterdam to Austin. Travel does something to your thinking. It takes you out of the feed and drops you into a seat with a window and a deadline, and the things you were half-ignoring sit down in front of you.

Almost forty years ago I lived in California for a couple of years, in the early days of Silicon Valley, when it still felt more like a workshop than a brand. I came back many times after that, travelling the world on silicon work, and I have never taken that luck for granted: seeing how technology gets built, and who gets to build it. Recently I was back in the Valley and stood outside Nvidia’s headquarters, the spaceship of a building. The ambition is still there. The sky is the limit, and most of the people building what comes next are doing it in good faith.

And yet here we are. Friday, 9 October. In Oslo, the Nobel Committee gave its Peace Prize to Navi Pillay, a former judge of the International Criminal Court, for her work on international law. Hours later, in Washington, the court itself went onto a sanctions list. Not a prosecutor. Not a handful of judges. The institution. The decision was reportedly taken before the Nobel announcement, so call it a coincidence. Novelists cut coincidences like that for being too neat. This one happened anyway.

I’m not going to litigate the court’s cases here. This piece is about the infrastructure we all run on: networks, satellites, payments, cloud and AI. Those systems were built as shared, global utilities. In a fortnight they have been treated as strategic assets, and that changes how everyone who depends on them has to think.

I get to do something most people in this industry only hear about secondhand. I travel, I speak, I record, I do the events, I sit with the people building telecoms, CX and AI, and I get to think about where it’s going without sitting through the corporate meetings that make the view smaller. That’s a privilege. It also means I have no excuse for not saying what I see, including about the parts of the industry I’m paid to help. And it matters because of who it is for. AI has to work for everybody, not a small group at the top.

So here is what I see. The question that matters is not where the data sits. It is who owns the company that holds it, and who can compel that company to hand something over or switch something off.

1. What actually happened

The US Treasury added the ICC itself to its Specially Designated Nationals list. That blocks any court property under US jurisdiction and bars US citizens, companies and banks from dealing with the court, its staff or its operations without a licence. This is not a sanction on a few individuals. It is a sanction on the plumbing.

The measures take full effect on 7 April 2027, after a 180-day delay. Reuters reports exemptions for telecoms, software, pensions and detainee-related transactions. Read the exemptions carefully. They are a dependency map: the services an institution like this cannot run without. The court’s registrar, Osvaldo Zavala Giler, put it more bluntly last week. The telecoms exemption, he said, “becomes a sort of Damocles sword on top of our head that could be revoked at any time.”

2. A gliding scale, not a switch

A few years ago, the standard answer from the large platforms was that a foreign government could never make them hand over customer data or cut off a customer. Then the answer became that it might happen in principle. In late 2024, Microsoft France told the French Senate it could not guarantee that EU data would never be handed over under a US CLOUD Act order. Then it began happening case by case.

Each step looked contained when it happened. Together they describe a slope. The sanctions on the court are the largest step so far, and not the last one on that slope.

3. Two levers: access to data, and access to services

An outside authority can hurt an organisation in two ways. The first is compelled access to its data. The second is restricted access to its services: an account closed, a card blocked, a bank relationship cut, a cloud tenant switched off.

The first lever now has a live European example. On 13 October, Amsterdam police seized a server in a data centre in the city’s eastern district, at the request of US authorities. The server belonged to Autistici/Inventati, an Italian provider of free hosting and email to activists and organisations. The US has designated the group; the designation is contested. Police are making a forensic copy for the US under the 1981 mutual legal assistance treaty between the Netherlands and the United States. The Public Prosecutor’s Office said there was no ground for refusal. Reports differ on whether the copy has already been delivered. Dutch cloud providers have said publicly that they are concerned, and on 16 October two sets of written questions went to the justice minister asking for the legal basis, whether Dutch authorities must comply automatically with US requests, and how many similar requests have been accepted or refused in the past two years.

Whatever you think of the group, the mechanics are the lesson. This was not a US court order served on a US company. It was a state-to-state treaty request, executed by a European police force on European soil. Location gave no protection, because the treaty works wherever the server sits. Privacy advocates called it a “terrifying precedent.” The prosecutor says the process was lawful. Both can be true, and that is the problem. The legal route exists, and whoever is asking sets the justification.

The second lever runs through ownership, not geography. A US parent’s cloud region in Amsterdam is still within reach of a US order. Gartner’s analysis of AWS’s European Sovereign Cloud makes the point directly: the German-registered entity is a wholly owned subsidiary of Amazon Inc. Location decides which law applies to the building. Ownership decides who can be compelled.

Ownership also runs upwards. A company can be fully European in its operations and still have US investors. If a US investor is restricted from doing business with you, or chooses to exert influence, what does that do to your roadmap, your partners and your customers? That question belongs in due diligence, and most boards have not asked it yet.

Mutual legal assistance treaties have existed for decades, built for cases everyone agreed on. What has changed is the thing that made those requests routine: the assumption that both sides work within shared rules. When a designation is contested, when a sanctioned court is the target, and when the request reaches a provider of activist hosting, the same paperwork reads differently. The issue is not one server. The shared assumption behind the process is in doubt, and that doubt does not reverse when one case is resolved.

4. Operational independence is not legal independence

The hyperscalers are responding with sovereign offers, and some of them are real. On 20 October Microsoft said its sovereign offer adds Data Guardian, EU-resident oversight of Microsoft engineers’ remote access, alongside national partner clouds such as Bleu in France and Delos in Germany. On Saturday 24 October, AWS cut its European Sovereign Cloud off from its global backbone for several hours, run by a team of EU residents from Brandenburg with a local copy of the source code, to show the region keeps running without infrastructure outside the EU.

These address a real question: can the service keep running inside the EU, and who can touch it day to day? That is operational independence, and it is worth testing. It is not the question this fortnight raised. Neither announcement changes who owns the parent company, and therefore who can be compelled under US law. One engineer’s reaction to the AWS test said it in a sentence: “You can’t solve legal problems with technical solutions.” Swisscom’s CEO has argued that sovereignty comes with trade-offs and that buyers should be selective. That is the right instinct. The mistake is to label a US-parented stack as sovereign because it runs in Europe.

5. Sovereignty is national security

In Washington, this conversation runs under the name national security. Everywhere else, most of us have called it sovereignty. Same question, different vocabulary. Subsea cables, satellites, spectrum, data centres and the services that run on them all fall into the same category, whichever side of the Atlantic you are on. Each is now treated as a question of resilience and control.

Networks, satellites, payments and cloud were sold for decades as neutral utilities that would connect us and keep us safe. The shared rules that made that plausible are being questioned in public, by governments and by companies. Until recently, sovereign AI was mostly a compliance story: GDPR, the EU AI Act, data residency. It is becoming a continuity story. Compliance gets a legal review. Continuity gets a board decision.

6. The switch is not only in banks

On 14 October, Ukrainian forces reported restrictions on their Starshield satellite service, the military version of Starlink, at a point when their air defence was under heavy pressure. Defense News, citing officials, reported that the order came from inside the White House. Reuters reported that Europe has no ready-made alternative.

Then came ten days of finger-pointing. Elon Musk said on 14 October that the US government owns and controls Starshield and that “any limits on speed or usage are decided by the US military and ultimately POTUS.” On 20 October the Defense Secretary said “we haven’t pulled anything back” and that Starlink “has the option to make those decisions.” On 21 October the Secretary of State said “the president doesn’t run that company and can’t direct that company to do anything.” On 22 October the president said the service was back at full speed and that “whether I called or whether somebody else called, doesn’t make any difference.” The next day he added: “it wasn’t me, and I don’t think it was Elon.” That same Friday, President Zelenskyy said the restrictions were still in place on parts of the front, and that he had been promised full restoration within 48 to 72 hours.

I don’t need to settle who gave the order, and this piece won’t try. The structure is the point, and the finger-pointing makes it sharper. A sovereign state at war depended on a network run by a company in another jurisdiction. The service was throttled. Ten days later, neither the company nor the government that contracts it would say it held the switch. For a customer, that is the worst answer of all. A switch you can see, you can negotiate over. A switch nobody admits to owning, you can only hope about. Satellite connectivity was a niche backup. It is now a national resource, and it is being treated like one.

Europe’s response is already visible. On 19 October, Deutsche Telekom, Orange, Telefónica and Vodafone signed a letter of intent for a joint bid on 2 GHz mobile satellite spectrum, to offer direct-to-device service to all operators on an open basis, with a satellite partner still to be chosen. The Commission wants to split the band three ways: European military, European commercial, and one block open to all bidders. The auction is due in 2027. The US ambassador to the EU, Andrew Puzder, warned of “devastating” retaliation in the US market and said European companies should be wary; he repeated the warning on 21 October. The proposal still has to pass the Parliament and the Council.

For telcos, the lesson is already clear. The access layer is now a negotiating position, and any layer you don’t own is a layer someone else can throttle.

7. The customer moves first

The hyperscalers may not be losing business. AI demand keeps them busy, and their revenue will show it. The movement that matters is on the customer side. Gartner forecasts European spending on sovereign cloud infrastructure will rise 83% this year, to $12.6 billion, and reach $23.1 billion in 2027. On 13 October, ABN AMRO, Achmea, ASN Bank, Deloitte, KPN and Rabobank announced MyCheck, a Dutch digital identity wallet built around the EU’s eIDAS 2.0 framework. The driver is regulation. But it is a telco and a set of banks building a consumer product in their own market, rather than renting one.

The court itself is the clearest case study, and it did the work before the sanctions landed. Its registrar said on 23 October that over twenty months the ICC made its payments independent of the dollar, moved staff to European bank accounts, converted contracts to euros, went from working with tens of banks to a few, and over the past six months replaced US technology providers with open-source software. “I cannot count on U.S. tech companies anymore,” he said. Whatever you think of the court, that is a migration plan, executed under pressure, by an organisation that found out exactly which levers could be pulled on it. Bourdain meant travel. The court took him literally.

In conversations with telcos across Europe, we are seeing the same pattern at smaller scale: operators pulling services back from hyperscalers, and enterprise customers asking them to host sensitive workloads in-country. These are first movers, organisations for whom jurisdiction matters most and that can afford to move. They set the direction before the market as a whole shifts. Price used to pull buyers towards hyperscale, because scale was the whole pitch. For a growing number of buyers, independence is now worth more than the last few points of unit cost. That shows up in procurement before it shows up in press releases. Nothing here requires a verdict on any government. It only requires customers to ask a question their providers used to answer with a shrug: who can compel you, and who can switch you off?

8. Capital is moving with it

European tech companies raised about €30 billion in the first half of 2026, up 46% on a year earlier, with deal count down 18%: fewer, larger rounds, mostly into AI and infrastructure. London took 38% of financings. Dutch startups attracted about €3.1 billion in the first nine months, already 25% above the whole of 2025. Dealroom’s European figures put H1 2026 at $44.5 billion against $63.8 billion for all of 2025.

Mistral AI is the clearest case. It raised €3 billion in September, led by Samsung, the EU-backed Scaleup Europe Fund and PSG, with anchor commitments from ASML, CMA CGM, Amadeus, Capgemini and Caisse des Dépôts. Its chips are still largely American. That is the honest caveat for any European sovereign AI story.

Those numbers show European capital growing. They do not show capital leaving the US for Europe, and I’m not going to claim that. What they show is where the market is looking. The sovereignty argument is now part of the investment case.

9. Follow the stack

Payments and banking come first, because that is where pressure lands. Card networks, correspondent banking and the dollar are chokepoints. ABN AMRO has been caught in the crossfire through its role in the ICC’s finances. The risk is not its European licence. It is the American exposure that comes with the business.

Then office software, where the court’s move to open source looks less like a quirk and more like foresight. Then the hyperscalers, who must navigate US and European law at the same time. Their European customers now have to ask a question that used to be theoretical: which law wins when a US order and a European privacy rule collide?

Then AI, the layer that matters most, because it is moving into everything. If your agents run on a US model, on a US cloud, orchestrated by a US platform, the same levers that can freeze a court’s payments can freeze your decision-making. AI does not sit next to the dependency problem. It compounds it. The hard part is no longer building the model. The hard part is deciding where it runs, and who can compel or stop it.

10. Why this favours telcos, if they move

Training stays centralised. Inference, where AI actually runs on sensitive data, can sit in national networks, close to users, under local jurisdiction. Telcos hold what is hard to copy: physical proximity, regulatory standing and decades as trusted national infrastructure. This is the second chance I keep writing about, and the market is now making the case for it. Deutsche Telekom is already selling T Cloud Public as a European alternative with legal as well as operational sovereignty; the test of that claim is the same one I apply to everyone else.

The uncomfortable part is that many telcos have signed hyperscaler partnerships that deepen the dependency their customers now want out of. A sovereignty label on a US-owned stack is sovereign-washing, and the evidence that it is already happening is in. A review by the think tank ECIPE of 8,725 cloud procurement contracts across nine EU countries found that every contract invoking “sovereignty” went to a domestic provider, and that many of those winners were prime contractors running on hyperscaler infrastructure underneath. The label attached to the operator’s nationality, not to the stack. ECIPE draws the conclusion that the EU’s proposed cloud rules mix security with industrial policy. The cloud association CISPE draws the opposite one: sovereignty should be defined by control and protection from extraterritorial law, not by having an EU address. Both agree on the finding. Buyers will see through the label fast, and they should.

There is an honest gap on the supply side too. European models and open-source software exist, but much of the silicon underneath is still American. Real sovereignty comes in degrees. The credible players will say which degree they offer, and what it costs.

11. The product

Strip away the speeches and ask the job-to-be-done question. Who buys? Governments, banks, healthcare, defence-adjacent bodies, critical infrastructure, and any organisation holding data a foreign authority might want. For what? AI and communications that keep running whatever happens elsewhere, and data that cannot be compelled out of reach. At what price? A premium, because it is insurance, and continuity has always been priced above commodity. That is a business model. “Sovereign” as a slogan is not.

12. What to do

Organisations. Map two kill switches for every critical system. First: who outside your jurisdiction can compel access to your data, through a national law or a treaty request? Second: who can disconnect the service, the account or the payment rail? Put both questions in every tender, and ask about your investors as well as your vendors. Then read the ICC’s twenty-month migration as a template, because it is one.

Governments. Use procurement as the lever. Anchor demand for European and regional providers is what turns sovereignty from a slide into a market. The Commission’s proposed Cloud and AI Development Act would make member states assess jurisdictional risk before signing digital contracts, with the most sensitive tier reserved for European providers or those that can prove legal ring-fencing. It is a proposal, and it is being fought over. The EU Blocking Statute is the other tool. On 20 October, Kaja Kallas told the European Parliament it is on the table but not decided, and asked companies not to suspend services to the court early: “If we use the Blocking Statute, we will only have one opportunity, a single opportunity, to do it right.” The court’s registrar replied, in effect, that dialogue should not become waiting, and asked for comfort letters in the meantime. The statute today covers measures against Cuba, Iran and Libya. Extending it needs a formal amendment, which has not happened.

Telcos, CX and AI vendors. Pick a lane and make your architecture portable. Own the layers you can, including the access and satellite layers where possible. If a customer cannot run you outside the reach of a foreign parent, you will be filtered out of the next tender.

Investors. Money follows continuity, not slogans. Sovereign infrastructure is becoming a category with its own economics.

Sovereignty was never a speech. It is the stack you run on, and who owns the company that runs it. On 9 October we found out who else holds the keys.

Austin is still a few hours away. I’ll land in Texas with a week of talks ahead, and the same question will come up in every room: who holds the keys? It is important work, and I feel lucky to be doing it. Make sure AI is for everybody, not a small group at the top.

Sources