These are not great times for human rights. Or the European tech autonomy.
Karim Khan, Chief Prosecutor at the International Criminal Court (ICC) got his email blocked. Microsoft cited United States' sanctions over the court's investigation into Israel as the reason. The ICC is headquartered in The Hague and it is part of the European legal architecture.
Understandably, the incident became a political affair in the Netherlands in particular and Europe more broadly. Dutch officials called it a "red flag at all levels of government". The argument is that dependence on U.S. tech giants goes now beyond technical inconvenience and represents a strategic risk. The Dutch government has started a review of this dependency, contingency plans, and deployment of alternatives in public institutions.
A single product, a single jurisdiction, a single foreign policy can freeze a major public institution. This is a meaningful moment to understand "digital sovereignty", a reflection on the European dependency on foreign platforms. Hopefully, this is also a proper wake up call.
This is not just about Microsoft
Over the paper, this story looks like a dispute between Washington and Europe with Israel in the background with Microsoft playing a role. De facto, this exposes the very structural vulnerability we have been talking about: even if the data is stored in European data centres, the legal, technical, and commercial control remains in foreign companies, subject of the orders of a foreign power.
Experts and regulators warned in the past about highly centralized cloud and collaboration ecosystems as "single points of failure". The ICC gave that warning a high-profile and very concrete example. The EU's Digital Markets Act and other digital-sovereign initiatives are aimed to reduce this dependence on a few tech actors. It is not about ban, but to bring the necessary transparency, portability, resilience into the ecosystem so a single provider cannot block a critical institution.
What Europe is rethinking
The ICC blockade is a reframing of "digital sovereignty” from an abstract to a very concrete type of risk. Public officials now talk on the topic not just on terms of data privacy but as a matter of democratic resilience, geopolitical exposure, or just plain and simple operation continuity of public institutions.
The formal review in the Netherlands has triggered other EU member states to do their own reviews in order to diversify vendors, prioritized EU infrastructure for sensitive functions, and be more strict with data localization and auditability requirements. A few countries are experimenting with "hybrid" models where global cloud providers are used for non-sensitive data and workloads, while EU-controlled platforms are reserved for courts, law enforcement and politically sensitive institutions. A full decoupling seems unrealistic and unlikely in the short term, but a risk-resistant and resilient stack is very much possible.
There are, however, two major risks. One is the wide disinformation on what is really sovereign (often, driven by interested parties like Microsoft). The other is that the sanction against Mr. Khan seems to be another angle of what happened to former EU Commissioner Thierry Breton. Both experiences reinforce the idea that we cannot just assume immunity in the digital domain and that the EU must assume tech sovereignty as a continuous posture.
Beyond the emails
The email blockade is the tip of the iceberg of the broader digital stack. Tech giants build their business around wide ecosystems that include email, calendars, document sharing, user identity, etc. Migrating is a political and technical headache. Organization prefer to stick to a single ecosystem, and tech giants find the way to have a wider presence in the company.
This lock-in spreads to other layers: community forums, internal messaging, public consultation, advocacy, even hardware. This means that a change in policy, terms of service, or sanctions can cut completely or reshape how organizations interact with citizens, partners, and allies.
The ICC situation requires the governments, public organizations, and businesses to be more inquisitive about their tech procurement. It is not just about where the data is stored, but who controls protocols, APIs, identity, etc. The discussion now has evolved and includes new topics like who can turn things off, who can modify a service, who can read your messages, or who can block you from use.
Open source and open protocols
The most structural way to reduce risks is not to just switch vendors. It is about moving towards transparency thanks to open source and open protocols. When the code is auditable and the protocol is visible by anybody, no single company can unilaterally shut down access or change the rules without somebody noticing it.
Open protocols make interoperability and user portability possible: accounts, content, and relationships can move between applications, without being locked inside a proprietary ecosystem. Open‑source implementations allow public institutions to self‑host, inspect security, and align governance with EU law rather than outsourcing those decisions to a distant corporate board room.
European institutions are beginning to treat open protocols as a political tool for distributing power in the digital ecosystem. The challenge is to know if they understand properly if the underlying protocol is open and standardized, if the code can be audited and self-hosted, and how easy is to export the data and migrate to another provider. Their understanding of these topics will determine if the "sovereignty talk" becomes a practical architectural choice.
The opportunity in the vulnerability
The ICC email blockade is helping Europe to speed up the design of more resilient and sovereign digital infrastructure. Regulators, decision makers, and society are moving to concrete actions: diversify vendors, reinforce rules on data location and transparency, and exploring open-source and open-protocol alternatives.
The broad pattern of the ICC blockade and Mr. Breton's case shows that European actors cannot assume the neutrality or immunity of digital tools. Every organization is starting to believe that If there’s even a one percent chance of a risk on their digital dependencies, they have to take it as an absolute certainty and work in the contigencies.
The lesson is straightforward: the incident is not an isolated story, but a signal to revisit how systems are governed and how to drive European-centric tech autonomy. If the EU moves its pieces right, this moment of vulnerability can be turned into a long-term strategy for a more resilient digital infrastructure.
LeafPlaza is a European social platform built entirely on European infrastructure, owned and operated in the EU. Please consider to support us in our quest to build more European sovereign infrastructure.