Twenty years later, the song has a new meaning. The reach is no longer cultural. It is legal.

Last week I wrote on LinkedIn about a server seized in Amsterdam at the request of US authorities. The response was bigger than anything I have posted before. The comments were sharper too, and they deserve a longer answer. This is it.

The detail most people missed

Several readers replied with the obvious fix. Avoid the American hyperscalers. Host with a European company and you are safe.

That was exactly what Autistici/Inventati had done. The Italian collective owned its own hardware. It used no US cloud provider. Its server stood in a Dutch data centre, and it was Dutch police who carried it out, under a mutual legal assistance treaty with the US. Before that, US sanctions had already cost the collective its domain, its PayPal account and its bank account at an Italian bank.

So the lesson is uncomfortable. Owning your servers did not help. Hosting in Europe did not help. The reach ran through every link in the chain.

And this is not an isolated case. In 2025, after the US sanctioned the International Criminal Court's chief prosecutor, his Microsoft email account was shut off. Microsoft insisted it never suspended services to the court itself. The court drew its own conclusion anyway: it is moving its staff off Microsoft Office to openDesk, an open source suite developed in Germany.

Mariëlle Wijermars, who researches internet governance at Maastricht University, put it bluntly in an interview with Studio Europa this week: "Since Trump's second presidency, we have to consider the US an authoritarian state." You may find that too strong. But her practical point is hard to argue with. She does not expect the US midterms in November to change American technology policy, and she expects the damage to trust to last.

That matters for anyone making IT decisions. Do not wait for an election to fix your architecture.

Sovereignty, and sovereignty claims

Every large US cloud provider now sells something with "sovereign" on the label. Microsoft talks about it more than most, so it is the fairest example to examine.

Here is what Microsoft promises, and what still stands in the way.

Microsoft's own transparency report makes the point without drama. In the second half of 2025, it disclosed customer content in 45 enterprise cases. Three involved non-US enterprise customers whose data was stored outside the US. One was in the EU.

Three is a small number. That is the point. The mechanism exists, and it works.

To be fair, tools like customer-held encryption keys and confidential computing are good security. They protect you against criminals and careless insiders. They do not change who Microsoft ultimately answers to. As long as the parent company sits in the US, a fully sovereign cloud inside its infrastructure remains a marketing claim. No contract can promise it.

So what do you actually do?

Two objections came up again and again in the comments, and both are fair.

The first: "So we should all write our own software and run it on a server under the desk?" No. There is no 100% solution. Every organisation depends on someone. The goal is to know where those dependencies sit, and to remove the ones you cannot afford to lose.

The second: "Going open source and self-hosting means taking on security, maintenance and cost yourself." Also true. Sovereignty has a price. Better to pay it on purpose than to discover the bill in the middle of a crisis.

Here is the approach I would suggest to any CIO.

Map the whole chain. Not just where your data is hosted. List your domain registrar, identity provider, payment providers, bank, cloud, application platform, source code and AI models. One reader pointed out that identity and access control are among the most overlooked switches. They are right. If you want a head start, our free Digital Sovereignty Scan scores your lock-in across code, contracts, AI models and cloud hosting in about four minutes.

Ask two questions for each link. How fast can my software run on a different setup? And how fast can I get my data there? If the answer is "we would have to rebuild," you have found a dependency you do not control.

Test the exit. Another reader made the best point in the thread. A backup is only useful if you have actually restored from it. The same goes for a migration plan. Run it. Time it. Train the people who would have to do it.

Prioritise. Not every application needs the same level of independence. Your internal lunch-ordering tool can live anywhere. Your citizen portal, patient records or core operations should not hinge on a decision made in another jurisdiction.

How we approach it at Betty Blocks

At Betty Blocks we had to answer these questions for ourselves first, because our customers ask them of us.

Applications built on Betty Blocks compile to standard React and WebAssembly. Both are open standards that nobody owns. You can export the code and run it on premise, in a private cloud, in a public cloud, or across a hybrid setup. If you decide to leave us, nothing needs to be rebuilt. AI models connect through MCP, so you can switch model providers without touching the application. And before any code is generated, IT reviews and approves the application model, so governance does not depend on trusting a black box.

None of this makes you immune. It does make the answer to "how fast could you move?" a matter of days rather than years. You can read more about how we approach digital sovereignty on our site.

Choosing is also policy

Europe needs to stand firmer behind the values it claims to protect. Governments will debate how. But a large part of Europe's digital future is decided somewhere else entirely: in procurement meetings, architecture reviews and renewal negotiations.

Every time a European organisation picks a platform it cannot leave, it makes the dependency a little deeper. Every time it chooses something portable, it gets a little of its independence back.

Rammstein sang about a world that drifted into Amerika without anyone deciding to. We still get to decide.

So ask yourself the question from my original post one more time. If a key provider had to cut you off tomorrow, how quickly could you move?