The Open Rights Group’s intervention ahead of the Cybersecurity and Resilience Bill’s second reading frames a blunt question for Westminster: can the UK afford to let its critical digital infrastructure remain overwhelmingly dependent on US hyperscalers and proprietary vendors, or does that dependence now count as a strategic vulnerability? The charity’s briefing argues for a stronger emphasis on digital sovereignty — pushing for open source, interoperability, and procurement rules that reduce vendor lock-in — and it arrives at a moment when high‑profile disruptions and geopolitical pressure have exposed the hard limits of outsourcing resilience to a small set of global providers.
The political test for MPs at the CSRB second reading is straightforward: will the government acknowledge that digital sovereignty is a public good, and act to reduce systemic dependence where it matters most, or will convenience and short‑term savings continue to determine the architecture of public services? The answer will shape not just procurement, but the UK’s operational independence in a world where digital control increasingly equals strategic power.
Source: theregister.com UK urged to cut out US Big Tech for sake of digi sovereignty
Background
What the Open Rights Group is saying
Open Rights Group (ORG) has urged MPs to use the Cybersecurity and Resilience Bill (CSRB) as an opportunity to enshrine a UK Digital Sovereignty strategy into law. The group wants the government to assess and mitigate risks created by reliance on foreign‑based hardware, software, cloud platforms, and analytics suppliers — naming Amazon, Microsoft, Google and Palantir as examples of vendors whose scale and legal jurisdictions create potential fragilities. ORG’s policy paper calls for stronger procurement rules favouring open source and interoperable systems to reduce the cost and difficulty of replacing suppliers if political pressure or legal constraints interrupt service.Where the bill stands
The CSRB, introduced in late 2025, reached its second reading in the House of Commons on 6 January 2026, the stage where Parliament debates the Bill’s general principles and can propose fundamental amendments. The government has paired the Bill with a wider Cyber Action Plan and a new Government Cyber Unit backed with roughly £210 million of funding to coordinate resilience across departments, signalling that cybersecurity is currently a high political priority.Recent cases that sharpen the argument
International Criminal Court: sanctions, email access and vendor dependency
ORG cites an episode where the International Criminal Court (ICC) found itself entangled in US sanctions policy: after US executive action in 2025 targeted ICC officials, the chief prosecutor, Karim Khan, reportedly lost access to his Microsoft email account and moved to other services — a development widely reported in international media and followed by the ICC taking steps to reduce dependence on US‑centric platforms. Multiple outlets documented service interruption claims, the sanctions’ legal reach, and the court’s contingency moves. Microsoft has publicly contested some versions of events, creating a factual dispute over exact corporate actions, but the episode illustrates how extraterritorial sanctions can cascade into operational disruption for organisations that rely on third‑party cloud services. This is an example where geopolitics, vendor control and operational continuity intersect.John Deere and remote disablement: convenience versus control
The experience of stolen Ukrainian farm machinery in 2022—where equipment equipped with GPS and remote locking was rendered unusable after being looted—demonstrates the dual nature of remote control features. The capability to disable vehicles is a defensive anti‑theft tool and a right‑to‑repair flashpoint, but it also shows how embedded remote control can be used (or repurposed) at distance, including in wartime or under political pressure. Reporting by major outlets described how dealers used remote immobilisation to stop stolen harvesters being run, underscoring that possession of control channels can be an operational lever.Huawei removal: how a dependency can flip into a political liability
The UK’s decision to ban Huawei equipment from 5G core elements in 2020 and order its removal by 2027 shows how quickly a supplier relationship can become a strategic liability once national policy shifts. The move — driven by national security assessments and allied pressure — required large and costly rip‑and‑replace programmes, and has caused real operational headaches and expense for UK telcos. The episode is often invoked by commentators and campaigners as evidence that long‑term reliance on foreign vendors carries geopolitical risk.Why this matters: the case for digital sovereignty
Digital infrastructure is now geopolitical infrastructure
Critical IT systems — identity platforms, citizen records, healthcare IT, emergency services communications, defence supply chains — are not merely operational assets. They are vectors of national capability and, in many cases, national security. When those services sit on software and infrastructure controlled by companies that answer to foreign legal regimes, they can be affected by extraterritorial orders, sanctions, commercial pressures, or unilateral policy shifts. ORG’s central claim is that digital sovereignty isn’t a nostalgia for national tech stacks; it’s a strategic hedge against the concentration of risk in a handful of global vendors.Vendor lock‑in erodes negotiating leverage and raises long‑term costs
Vendor lock‑in happens when bespoke use of provider‑specific platform features, poorly defined exit clauses, or one‑off customisations make migration costly or impractical. The Cabinet Office’s Central Digital and Data Office (CDDO) has warned the government that concentration in a few hyperscalers could reduce its ability to negotiate favourable commercial terms in the future — effectively surrendering leverage to providers that control the platforms departments depend on. Independent industry reporting has highlighted the risk and the practical pain local councils and public bodies face when custom systems leave them tied to suppliers. The consequence is not just higher bills; it is slower policy options and the inability to respond quickly if a vendor becomes a liability.Supply‑chain and sovereignty risks magnify for AI and data analytics
As government systems generate larger datasets and as AI models become integral to decision‑making, who controls the infrastructure and who can access the raw data becomes a policy decision. The more that core analytics and training happen on foreign‑run platforms, the more the UK buys into a model where critical insights and operational control may be out of reach during geopolitical stress. Companies like Palantir, and hyperscalers offering integrated AI stacks, are powerful enablers — but they also centralise capability. ORG argues that procurement policy should factor this concentration into risk assessments.Evaluating ORG’s proposals: realistic or romantic?
Strengths of the ORG argument
- ORG reframes procurement as a national resilience issue rather than a pure value‑for‑money exercise. That reframing is useful because short‑term price comparators often miss long‑term sovereignty and continuity costs.
- The call for open source and interoperable systems is practical: open standards reduce integration friction, increase auditability and make supplier substitution easier — important attributes in resilience planning.
- ORG highlights real precedents (ICC, John Deere, Huawei) showing that legal or political pressure can interrupt services, which strengthens the policy urgency in tangible ways.
Weaknesses and practical constraints
- Building, operating and maintaining sovereign alternatives is expensive and time consuming. Hyperscalers have spent a decade and tens of billions building global cloud footprints; replicating even a subset of that capability — particularly at the scale needed for big data, AI, and global resilience — requires sustained capital and market coordination. Airbus, for example, estimates only an 80/20 chance of finding a European provider able to host its most sensitive workloads today. That’s not just a procurement problem; it’s a market‑capacity problem.
- Open source is not a panacea. It reduces lock‑in risk, but wide adoption still requires staff with the right skills, long‑term maintenance commitments, and clear responsibility for security updates. A governmental push toward open source must be accompanied by funding models for ongoing maintenance and an appetite for long‑term stewardship.
- There are trade‑offs in resilience decisions. Multi‑vendor strategies can reduce concentration risk but increase operational complexity. Agencies often rely on managed services for speed of delivery and to leverage economies of scale; replacing those with bespoke or sovereign options may slow down modernization and raise costs.
National options: policy levers the CSRB and government can use
1) Procurement and contractual rules to reduce lock‑in
The government can require interoperability and clear exit pathways in public contracts. Contractual enforcement of data‑export guarantees, escrow for critical code and configuration, and mandated standards for APIs and data formats will make it easier to migrate workloads if a supplier becomes politically or operationally untenable. These are blunt but effective levers, and they can be targeted to the most sensitive systems first.2) A sovereign cloud marketplace and targeted investment
Rather than attempting to replicate hyperscale offerings across the board, the state could fund and aggregate sovereign cloud options for genuinely sensitive workloads: defence, certain national infrastructure, and uniquely sensitive datasets. The CDDO has discussed a Public Sector Cloud Marketplace concept to give departments ready‑built, well‑architected environments while preserving choice and standards. This approach acknowledges that not every workload needs a sovereign home, but some do.3) Open source stewardship and interoperability guidance
The government can underwrite the development and long‑term maintenance of open‑source building blocks that public bodies rely on, through grant funding, a national open‑source foundation, or guaranteed procurement pipelines. This creates a public good of shared, auditable components that reduce duplication and strengthen domestic capabilities.4) Legal and diplomatic work on extraterritorial access
Laws such as the US CLOUD Act and extraterritorial sanctions regimes create real legal exposure. The UK should pursue bilateral and multilateral frameworks that limit operational shocks — whether by negotiating mutual legal assistance protections for essential services or by working with European partners to build legal safeguards for critical infrastructure. These diplomatic routes won’t eliminate the risk, but they can narrow it.Technical and operational implications for IT teams
Design for portability from day one
Agencies should adopt cloud‑agnostic architectures where practicable: containerised workloads, IaC with provider‑agnostic tooling, and careful separation of platform‑specific managed services behind abstraction layers. This increases portability and reduces migration cost over time. While the cloud‑native world offers many shortcuts, an engineering culture that prizes portability will pay off in reduced vendor risk.Prioritise a workload classification regime
Not all systems are equal. Governments should classify workloads by sensitivity, recoverability, and strategic importance. High‑sensitivity workloads (classified defence designs, core identity systems, national security datasets) should be the priority for sovereign or highly constrained deployment patterns. Less sensitive services can remain on commercial public cloud to benefit from scale and speed. This triage approach is pragmatic and economically defensible.Invest in cloud exit and continuity playbooks
Every major contract should have a tested exit plan, including regular, automated export of data in open formats, and rehearsed cold‑standby migrations to alternative environments. Regular migration DR rehearsals — including full restores to alternative suppliers — convert procurement clauses from theoretical protections into operational readiness.Economic realities and industrial policy
Building a sovereign sector takes time and demand aggregation
Industrial policy can crowd in suppliers — France and Germany have invested in sovereign cloud initiatives and European initiatives such as Gaia‑X and various national cloud providers are attempting to fill the gap. But national players lack hyperscaler scale, and without long‑term, multi‑year public sector demand it will remain hard for them to reach equivalent capability and price. Airbus’s tender signals how major European corporates may be needed as anchor customers to create viable sovereign offers.The short‑term bill impact on vendors and costs
Mandating open standards and imposing sovereignty constraints will raise short‑term costs and slow procurement cycles. However, these costs must be weighed against the long‑term economic exposures from vendor lock‑in, potential service interruptions, and geopolitical leverage. A prudent staged approach — prioritize truly critical systems first — spreads cost while addressing the most dangerous dependencies.Risks and caveats
Unverifiable or disputed claims
Some high‑profile examples cited by campaigners — such as the precise sequence and responsibility for the ICC email interruption — include conflicting corporate statements and ongoing legal or diplomatic disputes. Microsoft and other vendors have disputed elements of media coverage at times. Where reporting disagrees, policymakers should seek primary evidence and, if necessary, independent audits to establish the facts before presuming vendor malfeasance. Readers should treat contested corporate causation as subject to verification rather than settled fact.Sovereign solutions can create new single points of failure
Building a UK or European sovereign cloud does not automatically solve resilience problems. If procurement funnels sensitive workloads to a small number of newly national or regional providers, concentration risk transfers rather than disappears. Sovereignty must be implemented alongside competition policy, supply‑chain diversification, and transparency to avoid new monocultures.Skills and operational overhead
Open source and sovereign stacks still require expert operators. The public sector will need to invest in skills, modern DevOps practices, and long‑term funding commitments to sustain alternative ecosystems — otherwise the state will still be dependent, only now on niche providers whose commercial viability may be fragile.Concrete steps MPs and civil servants can take now
- Require a national Digital Sovereignty risk assessment for any major contract above a defined threshold, with executive sign‑off.
- Mandate interoperable APIs and open data export formats in central government contracts to ensure data and workflows are portable.
- Pilot a UK Public Sector Sovereign Cloud Marketplace for a carefully selected set of high‑sensitivity workloads and measure cost, performance and risk reduction against current hyperscaler deployments.
- Establish an Open Source Maintenance Fund to support long‑term stewardship of critical public‑sector OSS components.
- Include legally enforceable exit and continuity playbooks in contracts and schedule annual migration rehearsals.
Conclusion
The Open Rights Group’s intervention is more than an ideological plea for open source — it is a challenge to conventional cost‑centric procurement logic that has underpinned a decade of cloud modernization. The UK’s reliance on a small number of large foreign vendors is now a cross‑cutting policy issue: legal exposure, geopolitical leverage, competition policy and operational resilience have collapsed into a single problem set that the Cybersecurity and Resilience Bill is uniquely positioned to address. The right course is not wholesale decoupling from hyperscalers — that would be impractical and costly — but a calibrated set of measures that protect the nation’s most sensitive systems, reduce supplier concentration, and make vendor substitution realistic when it is needed.The political test for MPs at the CSRB second reading is straightforward: will the government acknowledge that digital sovereignty is a public good, and act to reduce systemic dependence where it matters most, or will convenience and short‑term savings continue to determine the architecture of public services? The answer will shape not just procurement, but the UK’s operational independence in a world where digital control increasingly equals strategic power.
Source: theregister.com UK urged to cut out US Big Tech for sake of digi sovereignty
