Despite warnings: Bavaria wants to become dependent on Microsoft

Sometime at the beginning of the year, Karim Khan could no longer access his emails. The account of the then chief prosecutor of the International Criminal Court in The Hague was no longer accessible. And this happened shortly after US President Donald Trump issued an executive order imposing harsh sanctions on the court.

What exactly happened that day remains unclear to this day. The Associated Press reported that the US tech giant Microsoft, on whose servers the account was stored, had blocked it. Microsoft denied this but offered no alternative explanation for the mysterious incident. And as opaque as the situation remained, the consequences were significant: the issue of digital sovereignty suddenly rose to the top of the agenda in Europe.

As early as spring , representatives of cloud companies told the RedaktionsNetzwerk Deutschland (RND) that customer demand for German and European solutions had risen sharply since Donald Trump took office. A key reason: the concern that the US could simply shut down certain services in the event of a conflict.

The International Criminal Court has also apparently learned from the case: According to a report in the "Handelsblatt", it intends to end its cooperation with Microsoft and instead rely on the German workplace software Open Desk in the future.

However, in one German state, concerns about US tech companies seem to be less shared: According to media reports, the Free State of Bavaria intends to conclude a contract with Microsoft for the Microsoft 365 cloud office package by the end of the year – much to the displeasure of the Bavarian IT industry.

According to a report in the computer magazine "c't", the responsible Ministry of Finance is planning to conclude "a new consolidated Enterprise Agreement (EA) for government agencies"—this was revealed in a ministry presentation. As a first step, ministries and agencies will reportedly use Microsoft's cloud services. A separate municipal agreement will also allow cities and towns to access the Microsoft 365 office suite.

The background to this is a project entitled "Future Commission #Digital Bavaria 5.0": The aim is to make the Bavarian administration "more efficient, standardized, and effective." Since each authority uses its own IT infrastructure, high costs are incurred. The goal is therefore to establish a central IT service provider for all Bavarian municipalities. And this service provider is now apparently to be Microsoft.

When contacted by RND, the ministry declined to comment further on the plans. A spokesperson stated only: "The Bavarian State Ministry of Finance and Regional Development's considerations regarding the use of Microsoft 365 are not based on a definitive target date. The core of these considerations is not the conclusion of a new major contract, but rather the further development of the existing contractual situation." No further details could be provided at this time.

Back in January, Microsoft founder Bill Gates praised the new US President Donald Trump. Now his company is trying to limit the damage. Because US services are increasingly perceived as risky, German IT providers in particular are enjoying a surge in business.

The plans are drawing criticism – for example, from the municipalities themselves. The city of Rosenheim, in its 2035 IT and digitalization strategy , criticizes the fact that there is a "counter-trend at the state level" regarding digital sovereignty. The use of Microsoft 365 is associated with risks. To counteract these, the city is planning its own measures to ensure that a later migration to a sovereign cloud environment across Germany or Europe remains possible.

The Center for Digital Sovereignty of Public Administration (ZenDiS) recently described the cloud efforts of large US corporations as "sovereignty washing," independent of the Bavarian case. In Bavaria, Microsoft services are reportedly operating with adjustments: the data centers are said to be located in Germany and separated from the global Microsoft cloud. However, it remains unclear how effective this would actually be in a crisis. According to a report by "Golem," even the Bavarian State Office for Information Security (LSI) is critical of Microsoft's use in light of various security-related incidents.

The loudest protest, however, is coming from the Bavarian IT sector. Representatives of regional IT and open-source companies have written an open letter stating: "With its planned billion-euro project, the Free State of Bavaria is taking a special path – and thus opposing the nationwide and Europe-wide trend towards digital sovereignty." The letter was signed by companies including Feliner IT, Hallo Welt GmbH, and the Heinlein Group.

In their letter, the stakeholders point to a whole range of potential problems. Besides the Khan case, they also mention the worldwide outage of Amazon's AWS service in October , which crippled a number of other service providers such as Signal and Snapchat, and highlighted the excessive dependence on US companies.

Another case: During a hearing in the summer, Anton Carniaux, Director of Public & Legal Affairs at Microsoft France, had to admit under oath that the company could not guarantee that no data from French citizens would flow to US authorities without the consent of French authorities.

In addition to data protection concerns, industry representatives also criticize the high costs. "Over a period of five years, nearly one billion euros in licensing fees are to flow to a US company – funds that will be taken away from the Bavarian economy, especially innovative software manufacturers in the state," the letter states. "This decision undermines the goals of regional economic development and digital independence, instead of building something ourselves for a fraction of that amount."

The reliability and trustworthiness of large US corporations has been a topic for years – however, since Donald Trump took office in January, the focus on data protection and digital sovereignty has intensified even further.

Microsoft reacted with an offensive, at the latest when the Khan case became public in the spring: Microsoft Vice President Brad Smith reassured European customers at a press conference and in a lengthy blog post, emphasizing that they would "maintain Europe's digital resilience, even in times of geopolitical volatility." To this end, they intended to build a European cloud and act as a "voice of reason." And should all of this fail, they would even be prepared to engage in a conflict with the US government if necessary.

However, digital sovereignty is not necessarily just about the potential shutdown of services. US laws such as the Patriot Act and the Cloud Act also pose risks. The latter, for example, allows US authorities to access cloud data from US companies, even if the company offers the services using servers in Europe.

Other German states have long been taking a different approach to digital sovereignty. Schleswig-Holstein, for example, has been gradually phasing out Microsoft software in its public authorities for several months now, relying instead on so-called open-source software.

The switchover was planned before Trump took office. Besides greater independence, the state also wants to save on the massive licensing costs incurred for Microsoft products.

The transition in Schleswig-Holstein is not going entirely smoothly, however: The "Kieler Nachrichten" newspaper has repeatedly reported problems with email communication in recent months , for example at courts and public prosecutor's offices. Furthermore, there is considerable frustration with the sometimes poor performance of the replacement software.