A very serious failure by Microsoft on Friday prevented access to dozens of digital tools, including email or AI assistants, affecting millions of users, companies and public institutions in 74 countries around the world, including those in the EU, including Spain.
The massive interruption has raised alarm bells about the enormous dependence that European public institutions have on large private US technology companies, something that not only affects their performance, but also puts security in check.
Darío García de Viedma, an expert at the Elcano Royal Institute in digital geopolitics, especially in technological supply chains, assures that he has been "insisting for a long time on the risk that digital services are concentrated in a few providers for our institutions and for our societies. Because today it could be an update failure that affects 74 countries, but tomorrow it could be a cyberattack with malicious purposes," he says. "Before you needed an army of hackers, but now with AI a group with few resources can do a lot of damage."
A study by the European Commission recently revealed that 60% of the mail of public administrations in the 27 European countries is in the hands of companies located outside the EU. And 58% of office software is from Microsoft. Furthermore, in the case of data storage, it is even worse. Three large American technology companies host around 70% of the data of European institutions.
The EU's main companies contracted to host data in the cloud are, firstly, Amazon Web Services, secondly, Microsoft Azure and thirdly, Google Cloud, a dependency that aggravates the EU's vulnerability to failures, attacks or commercial decisions by US providers.
The origin of the dependence on US clouds lies in the fact that, although there are European alternatives, "at the moment they do not have the scale to house all our data," according to García de Viedma. "There are efforts, above all, and it makes a lot of sense, to prioritize the most sensitive data, for military use or confidentiality, which is not intended to be leaked or transferred to other countries for any reason," says the expert.
The most relevant European company in this field right now is the French company OVHcloud. However, its coverage percentage is very low (13%) compared to 70% of North American 'hyperscalers' - companies that offer computing, storage and networking infrastructure on a massive scale and with high operational efficiency.
More digital sovereignty
Experts recognize that the EU has been trying to promote digital sovereignty policies for years, but they consider that it is "more of a mantra than anything else," in the words of García de Viedma. The EU has an Executive Vice President for Technological Sovereignty, Security and Democracy, Henna Virkkunen. Furthermore, on Wednesday the Cloud and AI Development Act (CADA) was approved precisely, a law with which the EU wants to encourage the end of technological dependence on the US, creating a framework on which sectors stricter protectionism of digital data that no one outside Europe can access is needed.
However, experts consider that this political will in favor of greater digital sovereignty lacks the necessary economic investment. "The numbers don't add up," explains the expert in digital geopolitics from the Elcano Royal Institute. "The budget of the most ambitious plan that the European Union can have in seven years is equivalent to the budget that one of the three large American companies dedicates in one year to its investments in Europe. In a technology with such a high cost of access, especially if we are already starting to think about AI and not only in data storage, since the European budget does not add up," he maintains.
The latest and very serious failure of Microsoft had a global impact, as it spread across 74 countries, it did not affect data storage, but rather the provision of digital services, affecting the proper functioning of companies, educational institutions, public offices and hospitals.
Microsoft has a monopoly on public administration software suites, says García de Viedma. "It gives you everything you need to work. Because of that convenience we depend on them, public institutions are the ones that depend the most on Microsoft, because companies diversify a little more from other suppliers, but since Microsoft offers you the whole package and designs its proposal to the needs of the State in particular, we depend a lot on them," he explains. Hence, when, like on Friday, there is a problem in their servers, "although everything that is affected are very different services, since they are all on the same thread, if it breaks, everything goes down."
In Spain, according to what has emerged so far, there have been no serious effects reported. The interruption of the multinational's email service has been the main incident at both the state, regional and local levels. In the autonomous communities, the impact has been uneven, but almost all have reported incidents due to the Outlook email service. However, in the United Kingdom the emergency health service, the British 112, was down, making the work of such vital crews as ambulances difficult. The European Commission (EC), for its part, said this Friday that it was "aware" of the global drop in Microsoft services, but confirmed that the impact on the institution was "very limited" and did not "not affect" its operations.
Perhaps on this occasion everything has been an uncomfortable scare, but there is no doubt that the wound of vulnerability due to dependence and monopoly in the digital ecosystem has been reopened. For this reason, experts offer several reflections for the future. García de Viedma calls for starting to take digital supply chains seriously. "We take physical supply chains very seriously because we know that as soon as there is an error at one point, we stop having the products we need to live. However, we have made digital the backbone of our economies and our societies and we do not think that this also has a supply chain. It is very important that when we start using software, especially public institutions, we look at who produces each piece of that software and what risks it has," he requests.
Also remember that now a large part of digital products are programmed with artificial intelligence and programmers are dispensed with, which concentrates dependency even more. "You no longer depend on thousands of software programmers, but you depend on a company that controls the code and if that company goes down or makes its products very expensive or whatever, it will cost you much more to protect your digital supply chain," he warns.
