A hyperscaler reportedly handed Dutch regulators' emails to Congress. Residency was never sovereignty.

A post on the CNCF blog reports that earlier this year a US hyperscaler was said to have handed the US Congress documents belonging to regulators at two Dutch authorities: emails, minutes and meeting invites ^[1]. The people whose records moved are the ones enforcing Europe's Digital Services Act against US technology companies, and according to the post the records were passed over with names left unredacted, in effect a ready-made list of the officials holding those firms to account ^[2][3].

Nothing here required a breach. The post identifies the mechanism as the US CLOUD Act, which can compel an American company to surrender data even when that data sits on European soil ^[4]. In sworn testimony to the French Senate, a provider's own counsel could not guarantee that French data held in European data centres was safe from quiet US access ^[5]. The post's summary is that "our servers are in Frankfurt" turns out to mean very little ^[6].

This is the distinction procurement keeps mislabelling. Residency is where the bytes physically sit; sovereignty is who has legal reach over them ^[7]. Frankfurt buys the first, the operator's jurisdiction decides the second, and jurisdiction travels with the operator rather than with the postcode ^[8].

The post declines to make it a vendor story. The provider in the headlines followed the law it is bound by, and substituting any other US hyperscaler produces the same answer, which makes the exposure structural rather than reputational ^[9][10]. Choosing a better-regarded operator inside the same jurisdiction leaves the risk exactly where it was ^[11].

The 1917 opening is doing real work rather than decoration. Germany's telegram offering Mexico the return of Texas, Arizona and New Mexico was sent in cipher ^[12]. With its own transatlantic cables cut, Germany routed the message down lines running through British territory, part of it on an American cable, on a link described as private both contractually and because the text was encoded ^[13][14]. Room 40, a group of codebreakers in the Admiralty, read the whole thing, and six weeks later it was on American front pages ^[15][16]. The encryption and the contract were both intact. The wire was not theirs.

The advice that follows is unglamorous, which is a point in its favour: work out which bills you have deferred and decide whether you are comfortable holding them ^[17]. Deferred dependencies are not felt at signature, the post argues, but on the day the terms change, the price jumps, the subpoena lands, or the supplier deprioritises your use case ^[18]. For data that would end careers, systems a regulator will ask about, or the layer the whole business runs through, ownership is worth the friction; for everything else, rent it ^[19][20].

On tooling, the post keeps the claim modest. Kubernetes offers a consistent deployment substrate across public clouds, private infrastructure and regional or sovereign providers, so a workload packaged once can run in any of them from the same manifests ^[21]. OpenTelemetry supplies open standards for traces, metrics and logs ^[22]. The post frames four questions for any critical system, starting with where it runs and who can observe it ^[23].

What to watch: whether any hyperscaler's counsel offers the guarantee that was withheld in Paris ^[5], and whether European buyers move from residency clauses to portability tests they actually exercise. A stack that cannot be redeployed elsewhere from the same manifests has no exit, whatever the contract says ^[21].