7 ms·

I guess there are two types of "sovereignty" people talk about here. First is "data sovereignty", which is what the current (data) migrations are all about. As

I guess there are two types of "sovereignty" people talk about here. First is "data sovereignty", which is what the current (data) migrations are all about. As long as the data remains in place where it cannot be suddenly locked away by the US government, people don't care if the CPU was purchased from the US, as the government cannot suddenly disable those (as far as we know at least). Second is "hardware sovereignty", which is what this article talks about, about the geographical locations where the hardware is designed and built. This is obviously much harder, but also less important at this very moment. That's why you're not seeing people suddenly rushing to fund EU fabs for silicon, there are more important things to focus on right now, with real implications. The article kind of does everyone a disservice by mixing the two and not clearly separating which ones it's actually talking about. But to be fair, if they did that, then they've wouldn't have been able to publish this whole "Look how they aren't actually sovereign after all" article if they did so, here we are...

masfuerte 6mo ago
The actual risk is that US spooks can use these hardware features to infiltrate European clouds. It's not just a theoretical concern about hardware sovereignty.
- embedding-shape 6mo ago
  Is this an actual risk? If I buy a Intel/AMD CPU today and chuck it into this "European cloud" I'm running, how exactly will that be used to infiltrate this cloud? AFAIK, there is absolutely zero evidence either Intel or AMD CPUs are compromised, even less so that they're somehow remotely accessible by the US government...
  - tinychair 6mo ago
    The article does provide real world examples, as well as credible hypotheticals from academics. The 'compromise' is the built in features of the chips being discussed.
  - deleted 6mo ago
    [deleted]
  - akg_67 6mo ago
    > AFAIK, there is absolutely zero evidence either Intel or AMD CPUs are compromised, even less so that they're somehow remotely accessible by the US government... The concerns are similar to US supplied fighters having the kill switch or remotely damaging centrifuges in Iran using software virus. No one knows whether CPUs are compromised similar to no one knew beepers with explosives in Lebanon were compromised by Israel, allegedly during manufacturing. CPUs don't need to be accessed remotely, any compromised person locally will be enough. These are fascinating cases to show how far state actors will go and how long the compromise can stay dormant.
    - noir_lord 6mo ago
      > The concerns are similar to US supplied fighters. I doubt that they actually do, just cutting off software support substantially cripples the F-35 in multiple ways and without spares they aren't going to fly very long (on the timescales of fighter programs). The risk isn't worth the payoff because if anyone found that killswitch, US arms sales would crater. All that said I don't think my country should be buying US systems if European equivalents or near equivalents exist anyway for geopolitical reasons.
    - embedding-shape 6mo ago
      > The concerns are similar to US supplied fighters having the kill switch This is very different though, first they're huge, expensive machines, requiring infrastructure, maintenance and crew, there are huge surface areas to hide things like kill-switches. With CPU packages, not so much, and also fairly established how exactly you can clear the entire CPU, good luck doing that with the complexity-machines known as fighter jets. > No one knows whether CPUs are compromised Right, but what we do know, is that any US company (or any EU subsidiary with US owner, like "AWS European Sovereign Cloud") can and will be used to hold our data hostage when needed by the US government, as proven by recent actions. So, based on what we know and what we don't know, "data sovereignty" remains a priority, and until proven, "hardware sovereignty" remains less important, for now.
      - akg_67 6mo ago
        With the advent of LLMs, data sovereignty is being bypassed. All three Service, Data, and Hardware sovereignty are important and should be the focus. It is not about prioritizing one over the other.
  - mike_hearn 6mo ago
    The article talks about the management engines built into these chips. Parallel software stacks that can be reached over the network that can control the main OS.
- Spooky23 6mo ago
  That’s a risk, but for most cases likely not the most material up front risk - there’s a million ways for the spooks to enter the building. TBH, all of these entities are likely actively penetrated by US, Israeli and Russian human assets. You don’t need esoteric knowledge of CPU flaws or whatever if the dude holding the keys works for you.
  - spwa4 6mo ago
    You can prevent that by making sure these people have a lot to lose. Which means you start by paying them enough money. Wait, European you said? Never mind. Only politicians and the very rich deserve money is the law here. The owners of European clouds are people who were very, very wealthy before they ever started doing cloud (Xavier Niel, the Klaba Family in France, Hetzner (is also a German family name), Deutsche Telecom/Swisscom/A1 Telecom) and none of them have a reputation of decently paying anyone, whether we're talking software developers, system administrators, SREs, security guards, managers, ... and, of those, only Xavier Niel was not swimming in money when he was born (he was still very comfortable at a time when that was not at all common) As are most politicians. For example, Ursula von der Leyen is a member of a wealthy German family that was part of the aristocracy in Germany. Her family's money survived WW2 in Germany (everyone in Germany and North West Europe knows what that means, and it's nothing good). Her ancestors belonged to the nobility of the Free Imperial city of Bremen, allied to the Holy Roman Empire. Nobody in her family has ever lacked for money for 20 generations.
    - embedding-shape 6mo ago
      > Her ancestors belonged to the nobility of the Free Imperial city of Bremen, allied to the Holy Roman Empire. I've heard of people holding long grudges before but holy shit, that's quite a reach even for HN, that's over 200 years ago! :D
      - spwa4 6mo ago
        The point is that, like everyone else at the helm of the European commission, she and her family going back a LONG way, are part of the very, very rich. She has a coat of arms, for example. And she's not even the only one in the European commission. https://en.wikipedia.org/wiki/House_of_Leyen https://en.wikipedia.org/wiki/House_of_Leyen It's a commentary on social mobility. Oh, and actually her family has been rich for over 400 years for sure, and probably double that. One thing I always found a big positive on America is that a lot of the "American elite" was born, perhaps not poor, but also not rich, and they are never part of a dynasty that has been rich since the dark ages. Trump's grandfather was at best middle class. Biden's parents were broke when Joe Biden was little. Obama comes from what is probably a broken home. The contrast with Europe is enormous. By contrast, it often looks, in Europe, that the only possible way to become rich is to marry into a rich family.
- moses-palmer 6mo ago
  Well, to be fair, then it's precisely a theoretical concern about hardware sovereignty.
- traceroute66 6mo ago
  > The actual risk is that US spooks can use these hardware features to infiltrate European clouds. If your threat model is clandestine government actors then I think it would be a rather odd decision to host on ANY cloud ! The main risk for most people is being subject to US CLOUD Act, US PATRIOT Act etc. etc. Which, despite what the sales-droids will tell you, still applies in the fake-EU clouds operated by the US providers. If you are serious about EU data sovereignty then you absolutely want an EU OpCo that has nothing whatsoever to do with any US company. If OpCo has ties to a US company or IS a US company such as AWS or Microsoft, then you've lost the EU jurisdiction.
  - DiogenesKynikos 6mo ago
    The concern over "digital sovereignty" is motivated by the US wielding sanctions as a political tool against Europe. It's impossible to fully eliminate any exposure to US sanctions. If the EU wants to fully shield itself, it should aggressively counter-sanction American entities. If the US government knows that every time it sanctions some EU entity, an American entity will get sanctioned just as hard, it will think twice. For some reason, the EU has been unwilling to go down this obvious path.
    - graemep 6mo ago
      The problem is that European (in the EU and outside) countries do not have the same ability to sanction the US as the US has to sanction them. If the US imposed sanctions that blocked access to cloud services a lot of the government and the private sector would just shut down. Take what happened to the French ICC judge and imagine that happening across a whole country and far more pervasively (because a lot of people he deals with will not follow US sanctions, but would have their own services cut off if his country was sanctioned): https://www.euronews.com/my-europe/2026/02/18/us-sanctions-turn-international-criminal-court-judges-daily-life-into-a-nightmare https://www.euronews.com/my-europe/2026/02/18/us-sanctions-t...
      - embedding-shape 6mo ago
        > If the US imposed sanctions that blocked access to cloud services a lot of the government and the private sector would just shut down. You don't think they'd rather maybe find alternatives rather than shutting down? Sure, it'd be sucky probably for a long-time, but it's not like we don't have IT professionals who can stand up physical servers, email servers and what not, plenty of local municipalities do so already, so somewhere there is expertise already. People generally don't just give up and throw their hands in the air in the face of difficulties, even less so when the governance of their country depends on it.
- PaulHoule 6mo ago
  Or any other country. It is not like you can keep that genie inside the bottle.
- adjejmxbdjdn 6mo ago
  It’s not. It’s a real concern. But they are two different things. You can’t solve all problems at once. It’s reasonable to start by solving the problems which provide rrhe best improvement for the lowest effort and risk. Prioritizing data sovereignty as the OP has done well naming it, seems like a good trade off to me.
- brookst 6mo ago
  A risk, but not remotely the same risk or same severity of risk as hosting data in US clouds.
aaron695 6mo ago
[dead]
leonidasrup 6mo ago
"data sovereignty" for Europe should use the same technology as data protection from tech. giants for both US citizens and EU citizens. 1. Use open-source and Free as in Freedom software It's always easier to place and hide backdoor into closed source software than open source software. 2. Use decentralized and federated communications networks Even small organizations, groups should run own servers. Don't concentrate data at few cloud service providers.

masfuerte 6mo ago

The actual risk is that US spooks can use these hardware features to infiltrate European clouds. It's not just a theoretical concern about hardware sovereignty.

embedding-shape 6mo ago
Is this an actual risk? If I buy a Intel/AMD CPU today and chuck it into this "European cloud" I'm running, how exactly will that be used to infiltrate this cloud? AFAIK, there is absolutely zero evidence either Intel or AMD CPUs are compromised, even less so that they're somehow remotely accessible by the US government...
- tinychair 6mo ago
  The article does provide real world examples, as well as credible hypotheticals from academics. The 'compromise' is the built in features of the chips being discussed.
- deleted 6mo ago
  [deleted]
- akg_67 6mo ago
  > AFAIK, there is absolutely zero evidence either Intel or AMD CPUs are compromised, even less so that they're somehow remotely accessible by the US government... The concerns are similar to US supplied fighters having the kill switch or remotely damaging centrifuges in Iran using software virus. No one knows whether CPUs are compromised similar to no one knew beepers with explosives in Lebanon were compromised by Israel, allegedly during manufacturing. CPUs don't need to be accessed remotely, any compromised person locally will be enough. These are fascinating cases to show how far state actors will go and how long the compromise can stay dormant.
  - noir_lord 6mo ago
    > The concerns are similar to US supplied fighters. I doubt that they actually do, just cutting off software support substantially cripples the F-35 in multiple ways and without spares they aren't going to fly very long (on the timescales of fighter programs). The risk isn't worth the payoff because if anyone found that killswitch, US arms sales would crater. All that said I don't think my country should be buying US systems if European equivalents or near equivalents exist anyway for geopolitical reasons.
  - embedding-shape 6mo ago
    > The concerns are similar to US supplied fighters having the kill switch This is very different though, first they're huge, expensive machines, requiring infrastructure, maintenance and crew, there are huge surface areas to hide things like kill-switches. With CPU packages, not so much, and also fairly established how exactly you can clear the entire CPU, good luck doing that with the complexity-machines known as fighter jets. > No one knows whether CPUs are compromised Right, but what we do know, is that any US company (or any EU subsidiary with US owner, like "AWS European Sovereign Cloud") can and will be used to hold our data hostage when needed by the US government, as proven by recent actions. So, based on what we know and what we don't know, "data sovereignty" remains a priority, and until proven, "hardware sovereignty" remains less important, for now.
    - akg_67 6mo ago
      With the advent of LLMs, data sovereignty is being bypassed. All three Service, Data, and Hardware sovereignty are important and should be the focus. It is not about prioritizing one over the other.
- mike_hearn 6mo ago
  The article talks about the management engines built into these chips. Parallel software stacks that can be reached over the network that can control the main OS.
Spooky23 6mo ago
That’s a risk, but for most cases likely not the most material up front risk - there’s a million ways for the spooks to enter the building. TBH, all of these entities are likely actively penetrated by US, Israeli and Russian human assets. You don’t need esoteric knowledge of CPU flaws or whatever if the dude holding the keys works for you.
- spwa4 6mo ago
  You can prevent that by making sure these people have a lot to lose. Which means you start by paying them enough money. Wait, European you said? Never mind. Only politicians and the very rich deserve money is the law here. The owners of European clouds are people who were very, very wealthy before they ever started doing cloud (Xavier Niel, the Klaba Family in France, Hetzner (is also a German family name), Deutsche Telecom/Swisscom/A1 Telecom) and none of them have a reputation of decently paying anyone, whether we're talking software developers, system administrators, SREs, security guards, managers, ... and, of those, only Xavier Niel was not swimming in money when he was born (he was still very comfortable at a time when that was not at all common) As are most politicians. For example, Ursula von der Leyen is a member of a wealthy German family that was part of the aristocracy in Germany. Her family's money survived WW2 in Germany (everyone in Germany and North West Europe knows what that means, and it's nothing good). Her ancestors belonged to the nobility of the Free Imperial city of Bremen, allied to the Holy Roman Empire. Nobody in her family has ever lacked for money for 20 generations.
  - embedding-shape 6mo ago
    > Her ancestors belonged to the nobility of the Free Imperial city of Bremen, allied to the Holy Roman Empire. I've heard of people holding long grudges before but holy shit, that's quite a reach even for HN, that's over 200 years ago! :D
    - spwa4 6mo ago
      The point is that, like everyone else at the helm of the European commission, she and her family going back a LONG way, are part of the very, very rich. She has a coat of arms, for example. And she's not even the only one in the European commission. https://en.wikipedia.org/wiki/House_of_Leyen https://en.wikipedia.org/wiki/House_of_Leyen It's a commentary on social mobility. Oh, and actually her family has been rich for over 400 years for sure, and probably double that. One thing I always found a big positive on America is that a lot of the "American elite" was born, perhaps not poor, but also not rich, and they are never part of a dynasty that has been rich since the dark ages. Trump's grandfather was at best middle class. Biden's parents were broke when Joe Biden was little. Obama comes from what is probably a broken home. The contrast with Europe is enormous. By contrast, it often looks, in Europe, that the only possible way to become rich is to marry into a rich family.
moses-palmer 6mo ago
Well, to be fair, then it's precisely a theoretical concern about hardware sovereignty.
traceroute66 6mo ago
> The actual risk is that US spooks can use these hardware features to infiltrate European clouds. If your threat model is clandestine government actors then I think it would be a rather odd decision to host on ANY cloud ! The main risk for most people is being subject to US CLOUD Act, US PATRIOT Act etc. etc. Which, despite what the sales-droids will tell you, still applies in the fake-EU clouds operated by the US providers. If you are serious about EU data sovereignty then you absolutely want an EU OpCo that has nothing whatsoever to do with any US company. If OpCo has ties to a US company or IS a US company such as AWS or Microsoft, then you've lost the EU jurisdiction.
- DiogenesKynikos 6mo ago
  The concern over "digital sovereignty" is motivated by the US wielding sanctions as a political tool against Europe. It's impossible to fully eliminate any exposure to US sanctions. If the EU wants to fully shield itself, it should aggressively counter-sanction American entities. If the US government knows that every time it sanctions some EU entity, an American entity will get sanctioned just as hard, it will think twice. For some reason, the EU has been unwilling to go down this obvious path.
  - graemep 6mo ago
    The problem is that European (in the EU and outside) countries do not have the same ability to sanction the US as the US has to sanction them. If the US imposed sanctions that blocked access to cloud services a lot of the government and the private sector would just shut down. Take what happened to the French ICC judge and imagine that happening across a whole country and far more pervasively (because a lot of people he deals with will not follow US sanctions, but would have their own services cut off if his country was sanctioned): https://www.euronews.com/my-europe/2026/02/18/us-sanctions-turn-international-criminal-court-judges-daily-life-into-a-nightmare https://www.euronews.com/my-europe/2026/02/18/us-sanctions-t...
    - embedding-shape 6mo ago
      > If the US imposed sanctions that blocked access to cloud services a lot of the government and the private sector would just shut down. You don't think they'd rather maybe find alternatives rather than shutting down? Sure, it'd be sucky probably for a long-time, but it's not like we don't have IT professionals who can stand up physical servers, email servers and what not, plenty of local municipalities do so already, so somewhere there is expertise already. People generally don't just give up and throw their hands in the air in the face of difficulties, even less so when the governance of their country depends on it.
PaulHoule 6mo ago
Or any other country. It is not like you can keep that genie inside the bottle.
adjejmxbdjdn 6mo ago
It’s not. It’s a real concern. But they are two different things. You can’t solve all problems at once. It’s reasonable to start by solving the problems which provide rrhe best improvement for the lowest effort and risk. Prioritizing data sovereignty as the OP has done well naming it, seems like a good trade off to me.
brookst 6mo ago
A risk, but not remotely the same risk or same severity of risk as hosting data in US clouds.

aaron695 6mo ago

[dead]

leonidasrup 6mo ago

"data sovereignty" for Europe should use the same technology as data protection from tech. giants for both US citizens and EU citizens. 1. Use open-source and Free as in Freedom software It's always easier to place and hide backdoor into closed source software than open source software. 2. Use decentralized and federated communications networks Even small organizations, groups should run own servers. Don't concentrate data at few cloud service providers.