3 ms·

The actual risk is that US spooks can use these hardware features to infiltrate European clouds. It's not just a theoretical concern about hardware sovereignty

The actual risk is that US spooks can use these hardware features to infiltrate European clouds. It's not just a theoretical concern about hardware sovereignty.

embedding-shape 5mo ago
Is this an actual risk? If I buy a Intel/AMD CPU today and chuck it into this "European cloud" I'm running, how exactly will that be used to infiltrate this cloud? AFAIK, there is absolutely zero evidence either Intel or AMD CPUs are compromised, even less so that they're somehow remotely accessible by the US government...
- tinychair 5mo ago
  The article does provide real world examples, as well as credible hypotheticals from academics. The 'compromise' is the built in features of the chips being discussed.
- deleted 5mo ago
  [deleted]
- akg_67 5mo ago
  > AFAIK, there is absolutely zero evidence either Intel or AMD CPUs are compromised, even less so that they're somehow remotely accessible by the US government... The concerns are similar to US supplied fighters having the kill switch or remotely damaging centrifuges in Iran using software virus. No one knows whether CPUs are compromised similar to no one knew beepers with explosives in Lebanon were compromised by Israel, allegedly during manufacturing. CPUs don't need to be accessed remotely, any compromised person locally will be enough. These are fascinating cases to show how far state actors will go and how long the compromise can stay dormant.
  - noir_lord 5mo ago
    > The concerns are similar to US supplied fighters. I doubt that they actually do, just cutting off software support substantially cripples the F-35 in multiple ways and without spares they aren't going to fly very long (on the timescales of fighter programs). The risk isn't worth the payoff because if anyone found that killswitch, US arms sales would crater. All that said I don't think my country should be buying US systems if European equivalents or near equivalents exist anyway for geopolitical reasons.
  - embedding-shape 5mo ago
    > The concerns are similar to US supplied fighters having the kill switch This is very different though, first they're huge, expensive machines, requiring infrastructure, maintenance and crew, there are huge surface areas to hide things like kill-switches. With CPU packages, not so much, and also fairly established how exactly you can clear the entire CPU, good luck doing that with the complexity-machines known as fighter jets. > No one knows whether CPUs are compromised Right, but what we do know, is that any US company (or any EU subsidiary with US owner, like "AWS European Sovereign Cloud") can and will be used to hold our data hostage when needed by the US government, as proven by recent actions. So, based on what we know and what we don't know, "data sovereignty" remains a priority, and until proven, "hardware sovereignty" remains less important, for now.
    - akg_67 5mo ago
      With the advent of LLMs, data sovereignty is being bypassed. All three Service, Data, and Hardware sovereignty are important and should be the focus. It is not about prioritizing one over the other.
      - embedding-shape 5mo ago
        "Everything is highest priority" is the same as saying none of them are high priority. Considering one is a real issue we've already experienced, and others are theoretical ones we haven't, I feel like I agree with the current prioritization which is data migrations. Guess I'm too pragmatic to chase the ideal here, even though I'd want to eventually get to the ideal too of course.
- mike_hearn 5mo ago
  The article talks about the management engines built into these chips. Parallel software stacks that can be reached over the network that can control the main OS.
Spooky23 5mo ago
That’s a risk, but for most cases likely not the most material up front risk - there’s a million ways for the spooks to enter the building. TBH, all of these entities are likely actively penetrated by US, Israeli and Russian human assets. You don’t need esoteric knowledge of CPU flaws or whatever if the dude holding the keys works for you.
- spwa4 5mo ago
  You can prevent that by making sure these people have a lot to lose. Which means you start by paying them enough money. Wait, European you said? Never mind. Only politicians and the very rich deserve money is the law here. The owners of European clouds are people who were very, very wealthy before they ever started doing cloud (Xavier Niel, the Klaba Family in France, Hetzner (is also a German family name), Deutsche Telecom/Swisscom/A1 Telecom) and none of them have a reputation of decently paying anyone, whether we're talking software developers, system administrators, SREs, security guards, managers, ... and, of those, only Xavier Niel was not swimming in money when he was born (he was still very comfortable at a time when that was not at all common) As are most politicians. For example, Ursula von der Leyen is a member of a wealthy German family that was part of the aristocracy in Germany. Her family's money survived WW2 in Germany (everyone in Germany and North West Europe knows what that means, and it's nothing good). Her ancestors belonged to the nobility of the Free Imperial city of Bremen, allied to the Holy Roman Empire. Nobody in her family has ever lacked for money for 20 generations.
  - embedding-shape 5mo ago
    > Her ancestors belonged to the nobility of the Free Imperial city of Bremen, allied to the Holy Roman Empire. I've heard of people holding long grudges before but holy shit, that's quite a reach even for HN, that's over 200 years ago! :D
    - spwa4 5mo ago
      The point is that, like everyone else at the helm of the European commission, she and her family going back a LONG way, are part of the very, very rich. She has a coat of arms, for example. And she's not even the only one in the European commission. https://en.wikipedia.org/wiki/House_of_Leyen https://en.wikipedia.org/wiki/House_of_Leyen It's a commentary on social mobility. Oh, and actually her family has been rich for over 400 years for sure, and probably double that. One thing I always found a big positive on America is that a lot of the "American elite" was born, perhaps not poor, but also not rich, and they are never part of a dynasty that has been rich since the dark ages. Trump's grandfather was at best middle class. Biden's parents were broke when Joe Biden was little. Obama comes from what is probably a broken home. The contrast with Europe is enormous. By contrast, it often looks, in Europe, that the only possible way to become rich is to marry into a rich family.
moses-palmer 5mo ago
Well, to be fair, then it's precisely a theoretical concern about hardware sovereignty.
traceroute66 5mo ago
> The actual risk is that US spooks can use these hardware features to infiltrate European clouds. If your threat model is clandestine government actors then I think it would be a rather odd decision to host on ANY cloud ! The main risk for most people is being subject to US CLOUD Act, US PATRIOT Act etc. etc. Which, despite what the sales-droids will tell you, still applies in the fake-EU clouds operated by the US providers. If you are serious about EU data sovereignty then you absolutely want an EU OpCo that has nothing whatsoever to do with any US company. If OpCo has ties to a US company or IS a US company such as AWS or Microsoft, then you've lost the EU jurisdiction.
- DiogenesKynikos 5mo ago
  The concern over "digital sovereignty" is motivated by the US wielding sanctions as a political tool against Europe. It's impossible to fully eliminate any exposure to US sanctions. If the EU wants to fully shield itself, it should aggressively counter-sanction American entities. If the US government knows that every time it sanctions some EU entity, an American entity will get sanctioned just as hard, it will think twice. For some reason, the EU has been unwilling to go down this obvious path.
  - graemep 5mo ago
    The problem is that European (in the EU and outside) countries do not have the same ability to sanction the US as the US has to sanction them. If the US imposed sanctions that blocked access to cloud services a lot of the government and the private sector would just shut down. Take what happened to the French ICC judge and imagine that happening across a whole country and far more pervasively (because a lot of people he deals with will not follow US sanctions, but would have their own services cut off if his country was sanctioned): https://www.euronews.com/my-europe/2026/02/18/us-sanctions-turn-international-criminal-court-judges-daily-life-into-a-nightmare https://www.euronews.com/my-europe/2026/02/18/us-sanctions-t...
    - embedding-shape 5mo ago
      > If the US imposed sanctions that blocked access to cloud services a lot of the government and the private sector would just shut down. You don't think they'd rather maybe find alternatives rather than shutting down? Sure, it'd be sucky probably for a long-time, but it's not like we don't have IT professionals who can stand up physical servers, email servers and what not, plenty of local municipalities do so already, so somewhere there is expertise already. People generally don't just give up and throw their hands in the air in the face of difficulties, even less so when the governance of their country depends on it.
PaulHoule 5mo ago
Or any other country. It is not like you can keep that genie inside the bottle.
adjejmxbdjdn 5mo ago
It’s not. It’s a real concern. But they are two different things. You can’t solve all problems at once. It’s reasonable to start by solving the problems which provide rrhe best improvement for the lowest effort and risk. Prioritizing data sovereignty as the OP has done well naming it, seems like a good trade off to me.
brookst 5mo ago
A risk, but not remotely the same risk or same severity of risk as hosting data in US clouds.

The actual risk is that US spooks can use these hardware features to infiltrate European clouds. It's not just a theoretical concern about hardware sovereignty.

embedding-shape 5mo ago

Is this an actual risk? If I buy a Intel/AMD CPU today and chuck it into this "European cloud" I'm running, how exactly will that be used to infiltrate this cloud? AFAIK, there is absolutely zero evidence either Intel or AMD CPUs are compromised, even less so that they're somehow remotely accessible by the US government...

tinychair 5mo ago
The article does provide real world examples, as well as credible hypotheticals from academics. The 'compromise' is the built in features of the chips being discussed.
deleted 5mo ago
[deleted]
akg_67 5mo ago
> AFAIK, there is absolutely zero evidence either Intel or AMD CPUs are compromised, even less so that they're somehow remotely accessible by the US government... The concerns are similar to US supplied fighters having the kill switch or remotely damaging centrifuges in Iran using software virus. No one knows whether CPUs are compromised similar to no one knew beepers with explosives in Lebanon were compromised by Israel, allegedly during manufacturing. CPUs don't need to be accessed remotely, any compromised person locally will be enough. These are fascinating cases to show how far state actors will go and how long the compromise can stay dormant.
- noir_lord 5mo ago
  > The concerns are similar to US supplied fighters. I doubt that they actually do, just cutting off software support substantially cripples the F-35 in multiple ways and without spares they aren't going to fly very long (on the timescales of fighter programs). The risk isn't worth the payoff because if anyone found that killswitch, US arms sales would crater. All that said I don't think my country should be buying US systems if European equivalents or near equivalents exist anyway for geopolitical reasons.
- embedding-shape 5mo ago
  > The concerns are similar to US supplied fighters having the kill switch This is very different though, first they're huge, expensive machines, requiring infrastructure, maintenance and crew, there are huge surface areas to hide things like kill-switches. With CPU packages, not so much, and also fairly established how exactly you can clear the entire CPU, good luck doing that with the complexity-machines known as fighter jets. > No one knows whether CPUs are compromised Right, but what we do know, is that any US company (or any EU subsidiary with US owner, like "AWS European Sovereign Cloud") can and will be used to hold our data hostage when needed by the US government, as proven by recent actions. So, based on what we know and what we don't know, "data sovereignty" remains a priority, and until proven, "hardware sovereignty" remains less important, for now.
  - akg_67 5mo ago
    With the advent of LLMs, data sovereignty is being bypassed. All three Service, Data, and Hardware sovereignty are important and should be the focus. It is not about prioritizing one over the other.
    - embedding-shape 5mo ago
      "Everything is highest priority" is the same as saying none of them are high priority. Considering one is a real issue we've already experienced, and others are theoretical ones we haven't, I feel like I agree with the current prioritization which is data migrations. Guess I'm too pragmatic to chase the ideal here, even though I'd want to eventually get to the ideal too of course.
mike_hearn 5mo ago
The article talks about the management engines built into these chips. Parallel software stacks that can be reached over the network that can control the main OS.

Spooky23 5mo ago

That’s a risk, but for most cases likely not the most material up front risk - there’s a million ways for the spooks to enter the building. TBH, all of these entities are likely actively penetrated by US, Israeli and Russian human assets. You don’t need esoteric knowledge of CPU flaws or whatever if the dude holding the keys works for you.

spwa4 5mo ago
You can prevent that by making sure these people have a lot to lose. Which means you start by paying them enough money. Wait, European you said? Never mind. Only politicians and the very rich deserve money is the law here. The owners of European clouds are people who were very, very wealthy before they ever started doing cloud (Xavier Niel, the Klaba Family in France, Hetzner (is also a German family name), Deutsche Telecom/Swisscom/A1 Telecom) and none of them have a reputation of decently paying anyone, whether we're talking software developers, system administrators, SREs, security guards, managers, ... and, of those, only Xavier Niel was not swimming in money when he was born (he was still very comfortable at a time when that was not at all common) As are most politicians. For example, Ursula von der Leyen is a member of a wealthy German family that was part of the aristocracy in Germany. Her family's money survived WW2 in Germany (everyone in Germany and North West Europe knows what that means, and it's nothing good). Her ancestors belonged to the nobility of the Free Imperial city of Bremen, allied to the Holy Roman Empire. Nobody in her family has ever lacked for money for 20 generations.
- embedding-shape 5mo ago
  > Her ancestors belonged to the nobility of the Free Imperial city of Bremen, allied to the Holy Roman Empire. I've heard of people holding long grudges before but holy shit, that's quite a reach even for HN, that's over 200 years ago! :D
  - spwa4 5mo ago
    The point is that, like everyone else at the helm of the European commission, she and her family going back a LONG way, are part of the very, very rich. She has a coat of arms, for example. And she's not even the only one in the European commission. https://en.wikipedia.org/wiki/House_of_Leyen https://en.wikipedia.org/wiki/House_of_Leyen It's a commentary on social mobility. Oh, and actually her family has been rich for over 400 years for sure, and probably double that. One thing I always found a big positive on America is that a lot of the "American elite" was born, perhaps not poor, but also not rich, and they are never part of a dynasty that has been rich since the dark ages. Trump's grandfather was at best middle class. Biden's parents were broke when Joe Biden was little. Obama comes from what is probably a broken home. The contrast with Europe is enormous. By contrast, it often looks, in Europe, that the only possible way to become rich is to marry into a rich family.

moses-palmer 5mo ago

Well, to be fair, then it's precisely a theoretical concern about hardware sovereignty.

traceroute66 5mo ago

> The actual risk is that US spooks can use these hardware features to infiltrate European clouds. If your threat model is clandestine government actors then I think it would be a rather odd decision to host on ANY cloud ! The main risk for most people is being subject to US CLOUD Act, US PATRIOT Act etc. etc. Which, despite what the sales-droids will tell you, still applies in the fake-EU clouds operated by the US providers. If you are serious about EU data sovereignty then you absolutely want an EU OpCo that has nothing whatsoever to do with any US company. If OpCo has ties to a US company or IS a US company such as AWS or Microsoft, then you've lost the EU jurisdiction.

DiogenesKynikos 5mo ago
The concern over "digital sovereignty" is motivated by the US wielding sanctions as a political tool against Europe. It's impossible to fully eliminate any exposure to US sanctions. If the EU wants to fully shield itself, it should aggressively counter-sanction American entities. If the US government knows that every time it sanctions some EU entity, an American entity will get sanctioned just as hard, it will think twice. For some reason, the EU has been unwilling to go down this obvious path.
- graemep 5mo ago
  The problem is that European (in the EU and outside) countries do not have the same ability to sanction the US as the US has to sanction them. If the US imposed sanctions that blocked access to cloud services a lot of the government and the private sector would just shut down. Take what happened to the French ICC judge and imagine that happening across a whole country and far more pervasively (because a lot of people he deals with will not follow US sanctions, but would have their own services cut off if his country was sanctioned): https://www.euronews.com/my-europe/2026/02/18/us-sanctions-turn-international-criminal-court-judges-daily-life-into-a-nightmare https://www.euronews.com/my-europe/2026/02/18/us-sanctions-t...
  - embedding-shape 5mo ago
    > If the US imposed sanctions that blocked access to cloud services a lot of the government and the private sector would just shut down. You don't think they'd rather maybe find alternatives rather than shutting down? Sure, it'd be sucky probably for a long-time, but it's not like we don't have IT professionals who can stand up physical servers, email servers and what not, plenty of local municipalities do so already, so somewhere there is expertise already. People generally don't just give up and throw their hands in the air in the face of difficulties, even less so when the governance of their country depends on it.

PaulHoule 5mo ago

Or any other country. It is not like you can keep that genie inside the bottle.

adjejmxbdjdn 5mo ago

It’s not. It’s a real concern. But they are two different things. You can’t solve all problems at once. It’s reasonable to start by solving the problems which provide rrhe best improvement for the lowest effort and risk. Prioritizing data sovereignty as the OP has done well naming it, seems like a good trade off to me.

brookst 5mo ago

A risk, but not remotely the same risk or same severity of risk as hosting data in US clouds.