service for the public sector • City councillor, Helsinki since 2013 • Co-initiator of the Digital Independence citizens' initiative • Full disclosure: I have skin in this game.
of Europe's digital products, services and infrastructure depend on non-EU providers ~70 % of the European cloud market is held by Amazon, Microsoft and Google Sources: European Commission, Tech Sovereignty Package 2026; Synergy Research Group
systems phone, laptop Identity & login sign-in, MFA, ID Business & public services HR, payroll, school, city e-services Every layer has a supplier, a jurisdiction and an off switch. Cloud platforms AWS, Azure, Google Cloud Which of yours do you actually control? Work tools email, documents, chat, calls Networks & cables Baltic subsea cables
Personal data may leave the EEA only with adequate protection US authorities can demand data held by US companies Even possible access counts as a transfer Wherever in the world it is stored EU–US transfer mechanisms combining the two Safe Harbor Privacy Shield Struck down 2015 Struck down 2020 Data Privacy Framework (2023) In force, but contested: a court appeal and new doubts after a US Supreme Court ruling in June 2026 Finland: Data Protection Ombudsman's remark on Azure and AWS use at Valtori and DVV, Oct 2025 Where the data sits ≠ who controls it!
clouds Cyberattacks surge Baltic cables cut US clouds leave Europe Unencrypted personal data can't go to clouds outside the EU. Even a name counts, so logins stop. Hostile states escalate attacks, helped by AI. All Baltic data cables are cut, repair time unknown. Only a weak link via northern Finland survives. Every US cloud provider withdraws from the European market, for example after a US government order. Already +35 % on Finnish firms in a year. 3 4
Commission's Tech Sovereignty Package CADA Chips Act 2.0 Cloud and AI Development Act: four cloud sovereignty levels, data centres, AI capacity. More European semiconductor capacity, one layer further down the stack. EU Open Source Strategy Open source as a tool for Europe's own capabilities. Still proposals: Parliament and Council have the final word.
supply chain; no third-country interference 3 Owned and controlled from the EU; personnel citizenship criteria 2 Independent of third countries; transparent software supply chain 1 Data processed and stored in EU-located infrastructure Source: Commission proposal, 3 June 2026 How it bites • Public bodies map their critical activities • Critical: level 2–4. Everything else: at least level 1 • Providers are audited and listed in a Commission register • US industry calls it protectionist
Spring 2026 Helsinki: council initiative on dependence on non-European systems Helsinki city board decides to reduce dependence step by step Government roadmap for digital sovereignty Spring–summer 2026 End of 2026 Next Parliament Initiatives spread: Espoo, Hämeenlinna, Kirkkonummi, Lahti and more Ministry of Finance guidance for public administration Citizen initiative “Digital Independence” on the floor Already in law: the Information Management Act requires critical systems to keep working in exceptional conditions.
up. The citizens' initiative proposes a law requiring public-sector digital services to be built with solutions from Finnish and European providers. Critical services and data in the EU/EEA, on European or open software, and still working in a crisis. digitaalinenitsenaisyys.fi
Switch operator without switching software. You can test your exit. 2 Right to continue If the authors leave or are blocked, anyone can fork the code and carry on. It has happened with Terraform (OpenTofu) and Redis (Valkey). 3 Local capability Money and skills stay local. €1 bn → €65–95 bn EU investment in open source (2018) and its GDP effect €1.2 bn: Finnish public Microsoft licence frameworks 2024–27 Not the only route, but the one that needs no one's promise. Needed: operator, skills, funding for maintainers. Sources: European Commission 2021; Hansel 2024
is Total independence is unrealistic. The goal is managed, more balanced interdependence. Data location is not control. Ownership and jurisdiction are. Not a label Not a one-off project “Sovereign cloud” is often a marketing claim. It should be verifiable. Contracts, vendors and teams change. Map your dependencies regularly.
where your logins live • Use open source and open standards • Map functions, systems, suppliers (SBOM) • Ask who can switch you off • Design for exit • Have a fallback • Make it self-hostable • Practise using it • Keep copies of what matters • Prefer open source and services you can leave • Put exit clauses in contracts • Add sovereignty and open source to procurement Visibility: you can't manage what you haven't mapped.
where leaving is cheapest. Pilot, then scale. “It will cost more.” → So does lock-in, and so does an outage. Count both. “This is protectionism.” → The goal is control and the ability to switch, not shutting anyone out. “Open source means no support.” → Open source as a service puts a contract and an operator behind the code.
most critical functions, and the systems, suppliers and jurisdictions behind them. 2 For each, ask: could we operate for two weeks without it? Do you have a contingency plan? 3 Take the answer to your board, council or management team.
said Frodo. "So do I," said Gandalf, "and so do all who live to see such times. But that is not for them to decide. All we have to decide is what to do with the time that is given us.” J.R.R. Tolkien, The Fellowship of the Ring Otso Kivekäs CEO, Haltu City councillor, Helsinki 044-333 6338 otso.kivekas@haltu.fi
mindtrekconference
gionn
taka_aki
kakehashi
yukiogawa
stomk
occhi
yamaguchitk333
.png){kind=avatar}
yamad
murachiakira
emiki
pfn
aleyda
kevinliebholz
tenderlove
cassininazir
danielanewman
soudai
jmmastey
.png){kind=avatar}
helenjbeal
mayunak
addyosmani
jeffersonlam
mayatellez
