My article Sovereignty is not ideology, it is security policy has been published in AG Connect 5 (2026). Using the US sanctions against the International Criminal Court as a case, it shows that digital dependency is a concrete information security risk.
A foreign government does not need to hack a server to bring an organisation’s IT to a halt; a sanctions decision can be enough. Karim Khan, Chief Prosecutor of the International Criminal Court, lost his Microsoft workplace, and the Dutch service provider ProcoliX informed the Court that it had to stop its services. That directly affects the three goals of information security: availability, integrity and confidentiality.
The article covers:
- how a sanction works as an attack vector, and why a small European provider cannot survive it;
- what the CLOUD Act, FISA 702 and the Crypto AG case mean for confidentiality and integrity;
- why procurement is decisive: 80% to 85% of the European cloud market, worth more than €61 billion, goes to providers under US law;
- how the European Cloud Sovereignty Framework and the SEAL levels make sovereignty testable, including as a requirement in a tender;
- a practical test with OciDeck and three processes with which organisations can start.
Read the article as a PDF (AG Connect 5 – 2026, pages 70–73, 1.5 MB).