German public sector tries to reduce reliance on US tech

ZenDis, the German Center for Digital Sovereignty, has created an alternative to US software for public sector agencies in Germany, which are increasingly vulnerable to blackmail under the 2018 US CLOUD act.

It's not just the German authorities have access to documents created by German government agencies, at state and federal level.

The US authorities potentially do too, since the German authorities currently predominantly use computer programs whose providers are based in the United States.

Data protection advocates in Germany argue that the country is dangerously dependent on the US through the US' Clarifying Lawful Overseas Use of Data Act, known as the CLOUD Act, which US President Donald Trump signed into law in 2018 during his first term.

The act allows the US government to access German data by decree or executive order if it is stored in a data facility in the US.

This also applies to data that is stored in other countries, if servers are owned by US companies or their subsidiaries.

ZenDis, the German Center for Digital Sovereignty in Public Administration, wants to reduce dependency on US tech companies such as Microsoft and is currently developing digital alternatives to US products.

"All data stored in US databases is potentially at risk," said Lutz Niemeyer, spokesperson for ZenDiS, which is a limited liability company wholly owned by the German government.

He added that the state had "a duty to ensure that crucial data entrusted to it by its citizens is kept secure."
The case of Nicolas Guillou, a French judge at the International Criminal Court in The Hague , illustrates what can happen if someone falls out of favor with the US government.

He and several other judges and prosecutors were placed on a US sanctions list after the court issued an arrest warrant for Israeli Prime Minister Benjamin Netanyahu citing allegations of war crimes and crimes against humanity in Gaza.

Guillou told media outlets that his accounts with US companies such as Amazon and PayPal had been closed.

He was also not able to make hotel reservations in Europe via the online travel agency Booking.com, which has a US-based parent company and thus also had to sever ties with all individuals subject to US government sanctions.

US tech companies could stop providing software updates
Niemeyer from ZenDis said that another means of exerting pressure that the US could resort to might be to instruct tech companies to stop providing updates, especially security updates, to software used by German government agencies.

"Then we would very quickly reach a point where we, as a state, would no longer be able to function," he predicted, saying this would apply across the board, from local governments all the way to the higher echelons of the German chancellery.

The solution ZenDis has developed to help Germany become less dependent on the US is called openDesk, a flexible all-in-one office suite for the public sector, whose source code is publicly available, with a focus on digital sovereignty, security, and collaboration.

ZenDiS did not develop openDesk itself.

Instead, a 40-strong team identified various products on the German and European markets and bundled them into a package that serves as an interface.

As ZenDis Managing Director Pamela Krosta-Hartl put it: "We connect the various individual solutions and integrate them."
ZenDiS was founded in 2022 with €16 million (ca.

$18.5 million) in seed funding from the federal government.

It has since sold 160,000 openDesk licenses.

Last year, its turnover totaled over €18 million, half of which came from license sales.

Private sector also interested in OpenDesk
It is not only the public sector that wants to reduce its dependence on the US.

Private companies are also interested, particularly in the financial services sector.

Niemeyer said that ZenDis was preparing a program for distribution partners "who can make our solutions available to the private sector," as the center itself, which belongs to the German government, can only generate 20% of its income from the private sector.

Niemeyer was reluctant to talk about ZenDis' clients but these consist of government agencies at both state and federal level, as is to be expected.

Krosta-Hartl said that there had been requests from many well-known companies in the past few months and that there had recently been a meeting with a Spanish telecommunications company.

"So our reach extends far beyond Germany's borders," she pointed out.

Given the ongoing efforts to achieve digital sovereignty in Germany, some digital protection campaigners have been surprised by a deal reached by Germany's largest electricity producer, RWE, with Amazon a few weeks ago.

That deal would enable Amazon to buy electricity from RWE, which would then store its data in the Amazon cloud and be able to use Amazon AI (Artificial Intelligence) products.

"As a general rule, we do not pass judgment when companies enter into partnerships with one another," Krosta-Hartl said, but she pointed out that there were significant risks associated with the use of US cloud services, including the risk of political blackmail.

"We can see today that this danger is very real.

Donald Trump is linking unrelated issues in an unprecedented way.

He is exploiting his close ties to the tech industry," said Krosta-Hartl.

Thus, she explained, the issue of digital sovereignty must always be taken into account when companies assess risks.

This article was originally published in German on March 18.

How one Amazon outage can break the internet
To view this video please enable JavaScript, and consider upgrading to a web browser that supports HTML5 video