It is not just German officials who have access to documents created by German government agencies at the state and federal level. US officials also potentially do so, as German officials currently primarily use computer programs whose providers are based in the United States.
Data protection advocates in Germany argue that the country is dangerously dependent on the US through the US ‘Clarifying Lawful Overseas Uses of Data Act’, better known as the CLOUD Act, which US President Donald Trump signed into law in 2018 during his first term.
This act allows the US government to access German data by decree or executive order if it is stored in a data facility in the US. This also applies to data that is stored in other countries, if the servers are owned by US companies or their subsidiaries.
Zendis, the German center for digital sovereignty in public administration, wants to reduce dependence on American tech companies like Microsoft and is currently developing digital alternatives to American products.
“All data stored in US databases is potentially at risk,” said Lutz Niemeyer, a spokesman for Zendias, a limited liability company wholly owned by the German government. He said the state “has a duty to ensure that important data entrusted to it by its citizens is kept secure.”
US ban on ICC judge
The case of Nicolas Guillou, a French judge at the International Criminal Court in The Hague, shows what can happen if someone does not side with the US government. He and several other judges and prosecutors were placed on a US sanctions list after the court issued an arrest warrant for Israeli Prime Minister Benjamin Netanyahu, citing allegations of war crimes and crimes against humanity in Gaza.
Guillou told media outlets that his accounts with US companies such as Amazon and PayPal have been frozen. He was also not able to make hotel reservations in Europe through the online travel agency Booking.com, which has a US-based parent company, and thus had to sever ties with all individuals subject to US government sanctions.
American tech companies may stop providing software updates
Zendis’s Niemeyer said another method of applying pressure that the US could take could be to instruct tech companies to stop providing updates, especially security updates, to software used by German government agencies. “Then we will very quickly reach a point where we, as a state, will no longer be able to function,” he predicted, predicting that this would apply all the way from local governments to the higher echelons of the German Chancellery.
The solution that Zendis has developed to help Germany become less dependent on the US is called OpenDesk, a flexible all-in-one office suite for the public sector whose source code is publicly available with a focus on digital sovereignty, security and collaboration.
ZenDiS did not develop OpenDesk itself. Instead, the 40-strong team identified different products in the German and European markets and bundled them into a package that acts as an interface. As Pamela Crosta-Hartel, managing director of Zendis, said: “We connect different individual solutions and integrate them.”
ZenDiS was founded in 2022 with seed funding of €16 million (about $18.5 million) from the federal government. Since then it has sold 160,000 OpenDesk licenses. Last year, its turnover was more than €18 million, half of which came from license sales.
The private sector is also interested in OpenDesk
It is not just the public sector that wants to reduce its dependence on the US. Private companies are also interested, particularly in the financial services sector. Niemeyer said Zendis was preparing a program for distribution partners “who can make our solutions available to the private sector,” as the center, which belongs to the German government, can only generate 20% of its income from the private sector.
Niemeyer was reluctant to talk about Zendis’s customers, but they included government agencies at both the state and federal levels, as expected. Crosta-Hartel said there had been requests from several well-known companies over the past few months and a recent meeting with a Spanish telecommunications company. “So our reach extends far beyond Germany’s borders,” he said.
Given ongoing efforts to regain digital sovereignty in Germany, some digital security campaigners have been surprised by the deal struck with Amazon by Germany’s largest electricity producer, RWE, a few weeks ago. The deal will enable Amazon to purchase power from RWE, which will then store its data in the Amazon cloud and be able to use Amazon AI (Artificial Intelligence) products.
“As a general rule, we do not pass judgment when companies enter into partnerships with each other,” Crosta-Hartel said, but she pointed out that there were significant risks associated with the use of US cloud services, including the risk of political blackmail.
Crosta-Hartel said, “We can see today that this threat is very real. Donald Trump is connecting unrelated issues in an unprecedented way. He is taking advantage of his close ties to the tech industry.” Thus, he explained, the issue of digital sovereignty should always be taken into account when companies assess risks.
This article was originally published in German on March 18.