Two companies buy the same AI tool in the same quarter. Same vendor, same per-seat price, same glossy rollout email to staff. A year later one of them has quietly rebuilt a core process around it and can point to the hours it saves. The other is trying to remember the login.

The gap between them is not the software. They bought identical software. When MIT's NANDA initiative examined why most enterprise generative-AI pilots returned nothing, the cause was not the model. The pilots failed on how companies approached them, not on the quality of the tool. Gartner watched the same split from the outside and predicted that at least 30% of generative-AI projects would be abandoned after the proof-of-concept stage by the end of 2025. Same tools. Opposite outcomes.

So if the tool is identical, the difference lives somewhere else. It lives in whether the company around the tool was ready to use it.

Readiness has two axes, and a pile of licences moves only one of them. McKinsey counts only about 6% of firms as genuine AI high performers, and finds that only around 39% of organizations report any bottom-line impact from AI at all, most of it under 5%. BCG puts just 26% of companies past pilots into real value, which leaves 74% with nothing to show. The winners are not spending more on models. BCG's rule of thumb, drawn from studying them, is blunt: 70% of what makes AI work is people and process, 20% is technology and data, and only 10% is the algorithms.

This article takes readiness apart along its two axes, technology and organization. It borrows a ten-domain map so you can see where a business actually stands, explains why a Copilot licence is the last 10% rather than the first step, and ends with a self-scan you can run before lunch.

The uncomfortable headline is this: the part of readiness you can purchase is the part that matters least.

Two axes, not one dial

Most companies treat AI readiness as a single dial. Turn it up by spending more. Buy better tools, buy more seats, buy a bigger model, and readiness goes up. That mental model is why so much money produces so little.

Readiness is not one dial. It is two axes that have to move together.

The first axis is technology. Your data has to be reachable and reasonably clean. Your systems have to connect. There has to be somewhere sensible and secure for AI work to happen. This is the axis vendors talk about, because it is the axis they sell.

The second axis is organization. Someone has to pick a real process and redesign it around the new capability. People have to be trained to work differently. Results have to be measured, and the ones that fail have to be dropped. This is the axis nobody invoices you for, and it is the one that decides whether the first axis ever pays off.

Microsoft's own readiness research, drawn from its survey of a thousand organizations, shows how rarely the two move in step. Roughly 30% of organizations reach strong technology readiness, and a similar share reach organizational readiness, but only the firms that achieve both consistently deliver impact. That is a vendor's own data, so read it with a raised eyebrow, but it matches what the independent researchers keep finding. McKinsey reports that the high performers were far more likely to have fundamentally redesigned their workflows rather than sprinkled AI on top of the old ones. Redesigning a workflow is an organizational act, not a technical one.

Put the two axes on a grid and four kinds of company appear. Strong technology and a stalled organization gets you an expensive pilot that nobody adopts, the classic shelf of unused licences. A motivated organization sitting on chaotic data gets you enthusiasm that hits a wall the first time the tool returns confident nonsense. Weak on both is most of the market. Strong on both is the thin minority that shows up in every "AI leaders" statistic. The tools are the same across all four boxes. The position on the grid is what differs.

A map of ten domains, borrowed and de-branded

"Technology" and "organization" are the right two axes, but they are too coarse to act on. You cannot fix "organization." You can fix the specific things that make it up.

One of the more useful breakdowns comes from Microsoft's AI Readiness framework, which splits readiness into ten domains grouped under technology and organization. It is a vendor framework, and vendor frameworks tend to route you toward the vendor's products, so take the map and leave the sales pitch. Stripped of branding, the ten domains describe any business honestly, whether you run on Microsoft, on open-source models hosted in Europe, or on a mix.

On the technology axis, six domains:

• GenAI models. The models themselves, and whether the ones you use fit the job.
• GenAI applications. The actual apps and interfaces where people meet the AI.
• Cloud and hosting. Where the work runs, and whether that place is appropriate for your data and your rules.
• Data. Whether your information is organized, reachable, and clean enough to trust.
• Information security. Whether AI access widens your attack surface or is contained.
• Integration. Whether the tool can reach your other systems, or sits in a silo.

On the organization axis, four domains:

• Business strategy. Whether AI is aimed at a real business outcome or just adopted because everyone else is.
• Organization and culture. Whether people are willing and able to change how they work.
• AI strategy and experience. The skills, the literacy, the accumulated hands-on know-how.
• AI governance. Whether you can explain what the AI did, catch problems early, and stay inside the law.

Notice the balance. Six technical domains, four organizational, and yet BCG's evidence says the four organizational ones carry 70% of the weight. Fewer domains, more weight. That is the whole trap in one sentence: the axis with the most impact has the fewest boxes to tick and the least outside help for sale.

You do not need to score a perfect ten. You need to know which domains are weak, because a chain of ten breaks at the weakest link. A brilliant model pointed at disorganized data produces faster nonsense. A perfectly governed system nobody wants to use produces nothing. The map is not a shopping list. It is a diagnostic.

Why a stack of licences is not readiness

Here is the trap almost every company walks into, and it is an honest mistake. AI arrives as a product. A licence. A per-seat price. A logo in the corner of software you already own. So it gets bought like any other software: approve the budget, buy the seats, send the announcement, and wait for the productivity to appear.

It does not appear, because a licence only touches the technology axis, and only part of it. Buying seats does not organize your data, redesign a workflow, retrain a team, or set up a way to measure whether any of it worked. Those live on the axis no purchase order reaches.

The evidence on this is unusually consistent. The MIT researchers were clear that the failed pilots failed on approach, not on model quality. Gartner found that the organizations most satisfied with their AI results were the ones that spent roughly 30% more on data, governance, and talent, not on models. And the foundation underneath it all is data: Gartner reports that 63% of organizations either lack the data-management practices that AI needs or are not sure whether they have them. None of those gaps has a licence key.

The engineers who build these systems say the same thing in plainer language. A widely shared field guide on enterprise AI, "Foundations First," argues that the work that decides whether AI pays off happens before the model: standardized data, an architecture built to support AI rather than tolerate it, governance that can explain what happened and catch problems early, and teams that collaborate instead of throwing work over the wall. Get those in place and the model almost takes care of itself. Skip one and you feel it eventually.

For a small or medium business the licence trap has a particular shape, and it usually wears a Copilot badge. The offer is genuinely tempting: bolt a capable assistant onto the tools your team already uses, pay per head, done. And for an individual it does help. The problem is the leap from "a few people find it handy" to "the business is more productive." That leap is the organizational axis, and no per-seat renewal crosses it. The firms that got the leap right did not buy their way across. They picked one repetitive, document-heavy, rules-based process, rebuilt it around the tool, trained the handful of people involved, and measured the result. That is work, and the work is the point.

None of this argues against buying the tool. The tool is real and useful. It is just the last 10%, the finishing layer on top of the 90% that no vendor can sell you. Treating the licence as the strategy is like buying a treadmill and expecting to be fit because it is now in the house.

Run the scan before lunch

You can turn the ten-domain map into a rough self-assessment in about twenty minutes. It will not be precise, and it is not meant to be. It is meant to show you which axis is dragging, so your next euro goes where it is short.

Take two columns. On the left, the six technology domains. On the right, the four organization domains. Score each one from 0 to 3, and be honest, because the only person you fool with a generous score is yourself.

On the technology side, ask plainly. Can an AI tool reach our important data without a treasure hunt (data)? Is that data clean enough that we would trust an answer built on it (data again, it earns two questions)? Do our systems connect, or does everything live in its own silo (integration)? Does giving AI access to our information widen a security hole we have not thought about (information security)? Do we know where this actually runs and whether that is acceptable for our data and our rules (cloud and hosting)? Are the models and the apps we have chosen a fit for the job, or just what came bundled (models and applications)?

On the organization side, ask harder. Is our AI pointed at a specific business outcome, or are we doing it because everyone else is (business strategy)? Will our people actually change how they work, or will they nod and carry on (organization and culture)? Does anyone here have real hands-on AI skill, or are we guessing (AI strategy and experience)? Can we explain what the AI did, catch it when it goes wrong, and stay inside the rules (AI governance)?

Add up each column. The pattern matters more than the total. A high left and a low right is the shelf of unused licences, and your money should go to workflow redesign and skills, not more tools. A high right and a low left is enthusiasm about to hit a wall, and your effort should go to data and integration before you scale anything. Low on both, which is most businesses, means start small on one process and build both axes together rather than maxing out one.

The encouraging part, if you are small, is where the single biggest gap sits. Across Europe the most-cited barrier to AI is not budget and not technology. It is a lack of relevant expertise, named by 71% of enterprises. That is an organization-axis gap, and it is one a focused SMB can close without outspending anyone. It is also worth scoring governance honestly rather than treating it as paperwork, because in Europe it is already law: the EU AI Act has required every organization that uses AI to ensure a basic level of AI literacy among its staff since February 2025. Governance is a readiness domain, not a tax on one.

This scan is the pocket version. A fuller assessment, the kind that turns a score into a sequenced roadmap, is where this series lands in a later article. For now, the twenty-minute check is enough to stop you spending on the wrong axis.

Go back to the two companies that bought the same tool in the same quarter. The one that won did not find a better model hiding in the same licence. It moved both axes. It put its data in reach, then it picked one process, redesigned it, trained the people, and measured the result. The one that lost moved a single axis, waited for the other to move by itself, and it never did.

That is the whole lesson of the two-axis view. Readiness is not a product with a price. It is a balance you strike between the machine and the business around it, and the machine is the easy half. You can buy every licence on the market and still score zero on the axis that carries 70% of the value. Or you can spend almost nothing, fix one workflow, teach four people, and start compounding.

A pile of licences is not a strategy. It is one pan of the scale, sitting there waiting for you to load the other.

The next article turns to the domain most companies treat as a brake and the leaders treat as an accelerator: governance and trust. In Europe, with the AI Act now live and data sovereignty in play, getting trust right is not the thing that slows AI down. As the next piece shows, it is the thing that lets you scale it at all.

In August 2025, a research team at MIT published a number that should have stopped every boardroom AI project cold. After studying more than 300 enterprise deployments, the MIT NANDA initiative found that 95% of enterprise generative-AI pilots delivered no measurable return. Not a small return. No measurable return at all.

The finding landed quietly, then spread through finance departments like cold water. Here were companies that had bought the licenses, run the pilots, sat through the demos, and watched their investment produce nothing they could point to on a profit-and-loss statement.

If you run a small or medium business in Europe and you have felt that same quiet disappointment with AI, you are not behind. You are in the majority.

The numbers tell a brutal story. Independent of any vendor, McKinsey found that only around 39% of organizations report any bottom-line impact from AI, and for most of them the impact is under 5%. Boston Consulting Group put it more bluntly: 74% of companies show no tangible value from AI at all. Meanwhile a small group pulls away. An IDC study commissioned by Microsoft found that the leading firms earn a 2.84 times return on their AI investment, against just 0.84 times for the laggards.

This article is about that gap, and about the one thing the winners have that the rest do not. It is not a bigger budget. It is not a better model. It is readiness. And once you understand what readiness actually means, the gap stops looking like a wall and starts looking like an opening.

Because here is the part the hype merchants leave out: the reason most AI projects fail has almost nothing to do with the AI.

The gap is real, and it is widening

Start with adoption, because the story usually gets told backwards. AI is not rare. Across the EU, around 20% of enterprises used AI in 2025, up from 13.5% the year before. Denmark leads the entire union at 42%, nearly double its 2024 figure. Look at large companies alone and the numbers climb higher still. Globally, 88% of organizations now use AI in at least one function.

So access is not the problem. Almost everyone has touched AI. The problem shows up at the next step, when access is supposed to turn into value.

That is where the crowd thins out fast. Gartner predicted that at least 30% of generative-AI projects would be abandoned after the proof-of-concept stage by the end of 2025. McKinsey counts only about 6% of firms as genuine "AI high performers". BCG counts just 26% that have moved past pilots to real, scaled value.

Put those figures next to each other and a shape appears. A large majority experiments. A thin minority profits. The distance between them grows every year, because the firms that figure it out compound their advantage while everyone else restarts the same failed pilot with a newer model.

For European SMBs the shape is sharper still. The gap between large and small firms is enormous: 55% of big EU companies use AI, against 17% of small ones. The union has set itself a target of 75% of enterprises using AI, cloud, or big data by 2030, and on current trends AI is the piece dragging behind. That target will be won or lost in the small and medium businesses that make up most of the European economy.

Buying tools is not the same as being ready

Here is the trap almost every company walks into. AI arrives as a product. A licence. A per-seat price. A logo in the corner of software you already use. So it gets treated like any other software purchase: approve the budget, buy the seats, send an email announcing the rollout, and wait for the productivity to appear.

It does not appear. The licences sit mostly unused, the pilot quietly winds down, and a year later someone in finance asks what the return was.

The MIT researchers who found that 95% failure rate were clear about the cause. The pilots did not fail because the models were weak. They failed because of how companies tried to use them. Value showed up when firms rebuilt a specific workflow around the tool, and stayed absent when they simply bolted the tool onto how they already worked.

BCG reached the same conclusion from a different angle and turned it into a rule of thumb. In the companies that actually get value from AI, only about 10% of the effort goes into algorithms and models, 20% into technology and data, and a full 70% into people and process. The maths is uncomfortable for anyone hoping to buy their way to readiness. The part you can purchase is the small part. The part that decides whether it works is the part no vendor can sell you.

Gartner's data points the same direction. The organizations most satisfied with their AI results were the ones that spent roughly 30% more on data, governance, and talent, not on models. And 63% of organizations either lack the right data management practices for AI or are not sure whether they have them. A brilliant model pointed at disorganized data produces confident nonsense, faster.

None of this is a reason to avoid AI. It is a reason to stop treating a Copilot licence as a strategy. The tool is real and useful. It is just the last 10%, not the first step.

What the few actually do differently

So what separates the firms that get the 2.84 times return from the ones that get nothing? Strip away the vendor language and it comes down to two things working together, not one.

The first is technical. The winners have their data in order, their systems connected, and somewhere sensible for the work to happen. Not perfect, but organized enough that an AI tool can reach clean information and act on it.

The second is organizational, and this is the one almost everyone underweights. The winners changed how work gets done. They picked a real process, redesigned it around the new capability, retrained the people involved, and measured whether it actually helped. McKinsey found that the high performers were far more likely to fundamentally redesign workflows rather than sprinkle AI on top of the old ones.

Readiness is those two axes together. Strong technology and a stalled organization gets you an expensive pilot that nobody adopts. A motivated organization on top of chaotic data gets you enthusiasm that hits a wall. You need both, and most companies are unbalanced on one side or the other. That balance is important enough that it deserves its own article, which is where this series goes next.

The encouraging part, especially if you are small, is what this list does not include. It does not require a hyperscaler budget. It does not require a data-science team. The single most cited barrier to AI across Europe is not cost or technology. It is a lack of relevant expertise, named by 71% of enterprises. That is a skills-and-organization gap. Which means it is a gap an SMB can close with focus, without outspending anyone.

What this means if you are an SMB on a real budget

If you are a European small or medium business, the readiness gap is not bad news. It is the most level playing field AI will ever offer you, for three reasons.

First, the winning ingredients are mostly organizational, and small companies are better at organizational change than large ones. You do not need to align twelve departments and a global IT function. You need to fix one workflow and get a handful of people to work differently. That is a Tuesday for a well-run SMB and a two-year programme for an enterprise.

Second, you can start where the value is highest and the risk is lowest. The firms getting results did not begin with a moonshot. They took one repetitive, document-heavy, rules-based process, the kind every business has, and rebuilt it. Pick the task your team complains about most. Start there.

Third, doing it properly in Europe means doing it in a way that respects the rules from day one, and that is easier when you are small and starting fresh than when you are large and retrofitting. The EU AI Act already requires every organization that uses AI to ensure its staff have a basic level of AI literacy, a duty that has been in force since February 2025. Your data-protection obligations under GDPR do not pause because a tool is clever. Building with governance in mind from the start is not a tax on readiness. As this series will show, it is part of what makes the readiness real. That is the subject of a later article, on why trust is the accelerator rather than the brake.

The honest summary is this. AI will not transform your business because you bought it. It will transform your business if you change how your business works, in one place, on purpose, and then in another. The tool is the easy part. The readiness is the work. And the work is squarely within reach of a company your size.

The MIT number that opened this article, the 95% of pilots that returned nothing, was not a verdict on artificial intelligence. It was a verdict on how companies approached it. The 5% that worked were not using secret models. They were using the same tools as everyone else, wrapped around a business that had made itself ready to use them.

That is the whole game. Not the model. Not the licence. The readiness underneath. Most European companies still have it backwards, spending on the tool and skipping the work, then wondering why the return never comes.

The good news is that the recipe is not a mystery, and it is not reserved for the giants. It is two axes, balanced, applied to one process at a time. In the next article we take the first of those axes apart, and explain why readiness is something you build, not something you buy.

Del 3 af 3 i trilogien "1984 → 2048: Europas valg"

Danmarks justitsminister stod ved en talerstol i København og sagde den stille del højt:

Vi skal bryde med den helt fejlagtige opfattelse, at det er en borgerrettighed for alle at kommunikere på krypterede beskedtjenester.

Læs det igen. En siddende dansk minister, ikke kinesisk, ikke russisk, europæisk, erklærede, at privat kommunikation ikke er en grundlæggende rettighed.

Lige præcis her, er hvad den advarsel handlede om:

I 1984 er O'Brien det Indre Parti-medlem, der torturerer Winston til at elske Big Brother. Han skjuler ikke, hvad Partiet er. Han forklarer det: "We are not interested in the good of others; we are interested solely in power."

Peter Hummelgaard er Europas O'Brien. Og i modsætning til Orwells fiktion er han virkelig, han har magten, og han fortæller dig præcis, hvad han har til hensigt at gøre.

I Del 1 blev de tre digitale superstater kortlagt. I Del 2 blev det dokumenteret, hvordan Europa er under belejring. Nu kommer det spørgsmål, der virkelig betyder noget: Findes der en fjerde vej, eller vil Europa blive det, det hævder at bekæmpe?

Europa besidder noget, Winston Smith aldrig havde: fungerende demokratiske institutioner, reguleringsmagt der bider, og 450 millioner borgere der kan vælge. Spørgsmålet er ikke, om modstand er mulig. Spørgsmålet er, om Europa vil bruge, hvad det har. Eller om det selv vil bygge overvågningsstaten.

Klokken slår tretten, og klokkeslagene kommer indefra huset.

Europas modstand: det Winston ikke kunne have

I 1984 er der ingen modstand. Broderskabet viser sig at være en fiktion skabt af Partiet. Emmanuel Goldstein, Partiets officielle fjende nr. 1 og den angivelige leder af modstanden, eksisterer måske ikke — han kan være opfundet som lokkedue for at afsløre dissidenter. Prolerne holdes for uvidende og underholdte til at gøre oprør. Håb er en illusion, som Partiet fremstiller for at identificere dissidenter.

Demokratiske institutioner: ufuldkomne, men virkelige

Winston levede under en etpartistat, hvor valg var teater, og domstole var terrorinstrumenter. Europæere lever under demokratier, hvor regeringer kan stemmes ud. Hvor domstole kan underkende overvågningslove, som EU-Domstolen gjorde med Datalagringsdirektivet. Borgere kan sagsøge virksomheder og vinde, som Max Schrems gjorde mod Facebook, to gange. Tilsynsmyndigheder kan pålægge bøder i milliardklassen, som med Metas GDPR-bøde på 1,2 milliarder euro i 2023.

Disse institutioner er ufuldkomne og langsomme, nogle gange fanget af de interesser, de burde regulere. Men de eksisterer.

Reguleringsmagt: Effekten fra Bruxelles

Europa har noget, ingen anden blok besidder: magten til at sætte globale standarder gennem markedsadgang. "Brussels Effect" betyder, at virksomheder, der vil have adgang til 450 millioner forbrugere, skal overholde europæiske regler. Ofte anvender de disse regler globalt i stedet for at vedligeholde separate systemer.

Denne magt har allerede omformet den digitale verden. GDPR fra 2018 tvang globale privatlivspolitikker til at blive bedre. Californiens CCPA og Brasiliens LGPD følger dens model. Digital Services Act fra 2024 kræver, at platforme adresserer ulovligt indhold, algoritmisk gennemsigtighed og forskeres adgang. AI Act, også fra 2024, blev verdens første omfattende AI-regulering. Den forbyder social scoring, begrænser ansigtsgenkendelse og kræver gennemsigtighed for højrisikosystemer. Digital Markets Act tvinger Big Techs "gatekeepers" til at åbne deres platforme, tillade interoperabilitet og stoppe selvbegunstigelse.

Superstaterne kan lobbye mod disse reguleringer. De kan true med gengældelse. De kan forsinke overholdelse. Men de kan ikke ignorere et marked på 17 billioner euro.

450 millioner mennesker, 17 billioner euro i BNP

Europa er ikke alene, som Winston var.

Den Europæiske Union repræsenterer 450 millioner mennesker, flere end USA. Et marked stort nok til at sætte globale standarder, hvis det vælger at gøre det, med fælles regulering, fri bevægelighed og en fælles valuta for de fleste medlemmer.

Det her er ikke en lille nation, der kan tvinges til lydighed. Det er en blok, der kan, hvis den vælger det, bygge sin egen infrastruktur, sætte sine egne standarder og styre sin egen kurs. Spørgsmålet er ikke evne. Det er vilje.

Borgerne vågner op

I 1984 skriver Winston: "If there is hope, it lies in the proles." Men prolerne organiserer sig aldrig. Europæiske borgere har allerede gjort det.

Privatlivsbeskyttelse som værdi, ikke kun regulering

GDPR opstod ikke af et bureaukratisk tomrum. Den opstod af årtiers europæisk privatlivsaktivisme, af erindringen om overvågningsstater, både nazistiske og kommunistiske, af en kulturel forståelse af, at privatlivsbeskyttelse ikke handler om "at have noget at skjule". Det handler om retten til et selv, der ikke bliver observeret, målt og gjort til en handelsvare.

Nylige undersøgelser viser, at denne bevidsthed vokser. 45 % af europæiske organisationer øgede deres interesse for digital suverænitetsløsninger mellem 2024 og 2025. Nextcloud rapporterer en tredobling i forespørgsler om suveræne cloud-alternativer.

Open source som modstand

Partiet kontrollerede al teknologi. Europæere kan bygge deres egen.

Europæiske open source-projekter skaber alternativer til enhver stor amerikansk platform. Nextcloud i Tyskland tilbyder selvhostet cloud-lagring, samarbejde og kontorpakke. Det bruges nu af den tyske forbundsregering, det franske undervisningsministerium og tusindvis af europæiske organisationer. Matrix er en decentraliseret, krypteret beskedprotokol, der er blevet adopteret af den franske regering, det tyske forsvar og NATO til sikker kommunikation. PeerTube fra Frankrig tilbyder fødereret videohosting uden tracking, uden reklamer og uden algoritmisk manipulation. Mastodon, også tysk, er et decentraliseret socialt netværk, hvor fødererede servere betyder, at der ikke er noget enkelt punkt for kontrol eller nedbrud.

Det er produktionsklare alternativer, der bruges af regeringer og virksomheder. De beviser, at suverænitet er teknisk muligt.

Borgere kræver forandring

Partiet undertrykte al dissens. Det europæiske civilsamfund kæmper imod.

European Digital Rights (EDRi) koordinerer et netværk af 44 NGO'er, der forsvarer digitale rettigheder i hele Europa. La Quadrature du Net i Frankrig vandt en retssag og stoppede algoritmisk videoovervågning i Grenoble. noyb (None of Your Business), Max Schrems' organisation, har indgivet hundredvis af GDPR-klager og vundet skelsættende sager mod Facebook, Google og Amazon.

Europæiske borgere har allerede organiseret sig.

Klokken slår tretten

Åbningslinjen i 1984: "It was a bright cold day in April, and the clocks were striking thirteen."

Den umulige tid signalerer, at noget er grundlæggende galt. Verden ser normal ud (lys, kold, april), men klokkerne fortæller en sandhed, som bevidste sind har lært at ignorere.

I 2026 slår klokkerne tretten, og de fleste europæere bemærker det ikke.

Advarselstegn vi ignorerer

Ansigtsgenkendelse: forbudt i teorien, spredt i praksis

AI Act forbyder live-ansigtsgenkendelse på offentlige steder fra februar 2025. Men undtagelserne opsluger reglen: retshåndhævelse kan bruge det til ofre, terrorister og mistænkte for grov kriminalitet. Kritikere advarer om, at disse undtagelser er "meget vage." Diego Naranjo fra European Digital Rights kalder det "normaliseringen af masseovervågning."

"Intet at skjule" som accepteret sandhed

Partiets største sejr var at få borgerne til at overvåge sig selv. Den moderne ækvivalent: "Hvis du ikke har noget at skjule, har du intet at frygte."

Det vender uskyldsformodningen på hovedet. Det antager, at overvågning er neutral. At kun de skyldige har brug for privatlivsbeskyttelse. At overvågerne aldrig misbruger magt.

Historien skriger det modsatte. Stasi-arkiverne viste, hvordan "almindelig" overvågning ødelagde liv. NSA's LOVEINT-skandale afslørede analytikere, der spionerede på kæresteemner.

Chat Control: testsagen

Denne artikel åbnede med Hummelgaards erklæring. Overvej nu, hvad det betyder i praksis.

Chat Control-forslaget ville kræve scanning af al privat digital kommunikation, inklusive krypterede beskeder. Den tekniske mekanisme, "client-side scanning", ville kræve, at beskedapps som Signal, WhatsApp og Telegram scanner indhold før kryptering. Det ville reelt skabe en bagdør ind i enhver privat samtale.

Signal Foundation truede med at forlade EU-markedet frem for at overholde kravet. Efterretningstjenester advarede imod det. FN understregede, at underminering af kryptering ville krænke retten til privatliv.

Begrundelsen skifter, overvågningen er identisk.

Tyskland stemte i sidste ende imod. Offentligt pres tvang Danmark til at droppe obligatorisk scanning i slutningen af 2025. Men forslaget fortsætter mod de afsluttende forhandlinger med "frivillige" scanningskrav, som kritikere advarer om vil blive obligatoriske.

Den fjerde vej kan ikke bygges på overvågning. I det øjeblik Europa bryder kryptering "for børnenes skyld", mister det den moralske autoritet til at kritisere Amerika for at bryde den "for terrorisme" eller Kina for at bryde den "for stabilitet." Privatlivsbeskyttelse kan ikke deles op, og bagdøre er bagdøre. Når de først er bygget, vil de blive udnyttet.

Hvad sker der, hvis Europa fejler

Glem 2084. Hvordan ser 2030 ud, hvis Chat Control vedtages?

• Hvert foto, du sender, scannes før kryptering
• Hver besked analyseres af AI, der markerer "mistænkeligt" indhold
• Din krypterede samtale med din advokat? Ikke krypteret længere
• Signal forlader EU-markedet. Du bruger den kompromitterede app, der er tilbage
• Infrastrukturen eksisterer, og den næste regering, eller den efter den, vil finde nye grunde til at bruge den

Når overvågningsinfrastruktur først er bygget, bliver den ikke afmonteret. Den bliver udvidet. Den bliver normaliseret.

Den sidste linje i 1984: "He loved Big Brother."

Winston Smiths nederlag var totalt. Ikke fordi Partiet brækkede hans krop, men fordi det erobrede hans sind.

Orwell forestillede sig, at totalitarisme ville kræve tortur. Platformene opdagede, at det kun kræver dopamin.

"We needed to sort of give you a little dopamine hit every once in a while," indrømmede Sean Parker, Facebooks stiftende præsident. "It's a social validation feedback loop... exploiting a vulnerability in human psychology."

Partiet brugte smerte, platformene bruger nydelse. Algoritmen kaprer belønningskredsløb med variable belønninger. Den samme mekanisme, der gør spillemaskiner vanedannende. Hver notifikation er et træk i håndtaget.

Partiet var nødt til at bygge en overvågningsstat, vi crowdfundede vores gennem app-køb.

Big Brother har ikke brug for en teleskærm på din væg. Du købte en, puttede den i lommen og tjekker den 150 gange om dagen.

Superstaterne erobrer ikke Europas sind gennem invasion, men ét dopaminhit ad gangen.

Hvad du kan gøre

Winston Smith havde ingen muligheder. Du har.

Skift dine værktøjer

• E-mail: ProtonMail eller Tuta (europæisk, krypteret)
• Cloud-lagring: Nextcloud (europæisk, kan selvhostes)
• Beskeder: Signal (så længe det varer i Europa) eller Element/Matrix
• Søgning: Ecosia eller Qwant (europæiske alternativer)
• Browser: Firefox (nonprofit, privatlivsfokuseret)

Kræv handling

• Kontakt dit MEP om Chat Control: europarl.europa.eu/meps
• Støt digitale rettighedsorganisationer: EDRi, noyb, La Quadrature du Net
• Spørg din arbejdsgiver: Hvor opbevares vores virksomhedsdata? Hvem har adgang? Hvad er vores plan for digital suverænitet?

Hold dig informeret

• Følg Chat Control-forhandlingerne på chatcontrol.eu
• Læs EFF's dækning af overvågning
• Støt uafhængig europæisk tech-journalistik

I Orwells verden slog klokken tretten, og ingen bemærkede det.

I vores verden kan vi stadig høre klokkeslagene, hvis vi kan rive os selv væk fra vores skærme længe nok til at lytte.

Del 2 af 3 i trilogien "1984 → 2048: Europas valg"

"We are not interested in the good of others; we are interested solely in power." — O'Brien til Winston Smith, 1984

Brexit og Trump kom ikke ud af ingenting. De kom ud af en strategi.

Den samme kreds af aktører opererede på begge sider af Atlanten i 2016. Finansieret af de samme donorer, drevet af den samme ideologi, forbundet gennem det samme datafirma. Cambridge Analytica arbejdede for Leave.EU og for Trump-kampagnen. Steve Bannon sad i Cambridge Analyticas bestyrelse og drev Breitbart, før han blev Trumps kampagnechef. Robert Mercer finansierede det hele.

Parallelt kørte russiske trollefabrikker deres egne operationer på de samme platforme, rettet mod de samme splittelser. Om de to spor var koordinerede eller blot opportunistisk sammenfaldende, er stadig et åbent spørgsmål. Men resultatet var det samme: den angelsaksiske verden blev splittet, og det arsenal af teknikker, der virkede i 2016, er nu rettet mod det europæiske kontinent.

I Del 1 blev de tre digitale superstater og deres permanente krig kortlagt. Her vendes blikket mod deres primære slagmark: Europa.

Kampen om Europa bruger ikke kampvogne og missiler. Den bruger trollefabrikker og bankoverførsler, datadrevet vælgermanipulation og kaprede platforme. Rusland har brugt et årti på at dyrke højreekstreme bevægelser over hele kontinentet. Amerika har opbygget en overvågningsinfrastruktur, der behandler europæiske data som en ressource, der skal udvindes. Kina fremstiller den hardware, der muliggør begge dele.

Men Europas største sårbarhed er ikke superstaternes aggression. Det er Europas egen digitale naivitet. Kontinentet, der opfandt privatlivets fred som en menneskeret, har gjort sig fuldstændig afhængigt af udenlandske platforme, udenlandsk hardware og udenlandske cloudtjenester.

I Orwells 1984 eksisterer Europa ikke. Det er blevet opslugt: vest ind i Oceanien, øst ind i Eurasien. Den opsluging sker nu, i realtid, gennem mekanismer, Orwell aldrig forestillede sig.

To parallelle spor: Bannon-kredsen og Kreml

Sporet der startede indefra

2016 var ikke primært et russisk angreb på vestlige demokratier. Det var et indenlandsk projekt, der udnyttede de samme digitale sårbarheder, som Rusland senere forstærkede.

Personkredsen er dokumenteret: Robert Mercer, milliardær og hedgefond-forvalter, finansierede både Breitbart News og Cambridge Analytica. Steve Bannon sad i Cambridge Analyticas bestyrelse, drev Breitbart som redaktør, og lancerede Breitbart London i 2014 som en platform for den europæiske højrefløj. Samme Bannon blev Trumps kampagnechef i august 2016 og derefter chefstrateg i Det Hvide Hus.

Cambridge Analytica brugte psykografisk profilering baseret på data fra millioner af Facebook-brugere til at målrette politiske budskaber. Firmaet arbejdede for Leave.EU-kampagnen i Storbritannien og derefter for Trump-kampagnen i USA. Den samme personkreds, de samme teknikker, det samme mål: at mobilisere utilfredse vælgere mod det etablerede system.

Det er ikke en konspirationsteori. Det er en dokumenteret personkreds med en dokumenteret strategi. Breitbart, Cambridge Analytica, Leave.EU, Trump-kampagnen. Bundet sammen af de samme penge og de samme mennesker.

Det russiske spor

Parallelt med Bannon-kredsens indenlandske operationer kørte Rusland sin egen kampagne.

Den amerikanske efterretningsvurdering fra januar 2017 konkluderede med "høj tillid", at Ruslands præsident Vladimir Putin "beordrede en påvirkningskampagne" rettet mod det amerikanske valg i 2016. Mueller-rapporten dokumenterede "omfattende og systematisk" indblanding fra Internet Research Agency, som skabte falske amerikanske profiler på sociale medier og organiserede fysiske demonstrationer på begge sider af splittende emner.

Ruslands tilgang er en blanding af doktrin, opportunisme og institutionaliseret kapacitet. Russiske militærteoretikere har længe beskrevet, hvordan informationskrig, politisk undergravning og strategisk tvetydighed kan opnå mål, som konventionel militærmagt ikke kan. Ikke en detaljeret slagplan, men en tilgang, der udnytter muligheder, når de opstår. Målet er konsistent: at svække NATO og EU's sammenhængskraft.

Tidslinjen:

• 2014: Krim — Rusland annekterer Krim, mens Vesten reagerer med sanktioner, men ingen militær intervention. Budskabet: Vesten er splittet og vil ikke kæmpe.
• 2016: Brexit og Trump — Internet Research Agency kører samtidige påvirkningskampagner på tværs af vestlige demokratier, parallelt med Bannon-kredsens indenlandske operationer.
• 2022: Ukraine — Fuldskala invasion med væddemålet om, at et splittet Vesten ville gå i opløsning under økonomisk pres.

De to spor behøver ikke at have været koordinerede for at have været gensidigt forstærkende. Bannon-kredsen skabte splittelsen. Rusland forstærkede den. Platformene muliggjorde begge dele.

Den europæiske front: hvad der er dokumenteret

Trollefabrikkerne bliver kontinentale

Internet Research Agencys operationer var rettet mod både det amerikanske valg i 2016 og den britiske Brexit-afstemning samtidig. Den samme Sankt Petersborg-baserede trollefabrik kørte samtidige påvirkningskampagner på tværs af vestlige demokratier, skabte falske profiler, forstærkede splittende indhold og organiserede fysiske arrangementer på begge sider af Atlanten.

Følg pengene

Russisk finansiering af europæiske partier er dokumenteret af Europa-Parlamentets "Tip of the Iceberg"-rapport. Det franske Front National (nu RN) modtog 11 millioner euro i lån fra russiske banker i 2014. Østrigs FPO undertegnede en formel "venskabsaftale" med Putins parti Forenet Rusland i 2016. Pengesporet er dokumenteret.

Den tyske forbindelse

AfD-Kreml-forbindelserne omfatter dokumenterede møder mellem partifolk og russiske aktører. I 2024 blev MEP Maximilian Krah tilbageholdt og afhørt af FBI under mistanke om at have modtaget Kreml-midler gennem Voice of Europe-operationen. Tysk efterretningstjeneste fortsætter med at overvåge disse kontakter.

Fanget på kamera

Ibiza-skandalen i 2019 fangede Østrigs FPO-vicekansler på video, mens han diskuterede politiske donationer med en person, der hævdede at være niece til en russisk oligark. Optagelserne afslørede iveren efter Kreml-penge på de højeste niveauer i europæisk politik. Vicekansleren trak sig inden for få dage.

Hvad der forbliver ubevist

Den direkte forbindelse mellem Bannon/Mercer-kredsen og Kreml er ikke dokumenteret til en retslig standard. Cambridge Analyticas rolle i Brexit er stadig omstridt. Den britiske Information Commissioners undersøgelse fandt "ingen væsentlige brud" fra firmaet i forbindelse med Brexit-afstemningen. At de samme teknikker og den samme personkreds opererede på begge sider af Atlanten, er dokumenteret. At det var koordineret med Moskva, er det ikke.

Man bør være forsigtig med at se én stor sammensværgelse, hvor der kan være tale om flere uafhængige aktører, der udnytter de samme sårbarheder med de samme værktøjer. Det gør ikke truslen mindre reel. Det gør den sværere at forsvare sig mod.

Højredrejningen: hvad der fulgte

Siden 2020 har det samme mønster udspillet sig i Europas største demokratier.

Tyskland: det utænkelige vender tilbage

AfD vandt 20,8% ved forbundsdagsvalget i 2025, deres bedste resultat nogensinde. I september 2024 blev Thüringen stedet for den første højreekstreme sejr ved et delstatsvalg i Tyskland siden Anden Verdenskrig. Partileder Alice Weidel har eksplicit nævnt Brexit som model for "Dexit", Tysklands udtrædelse af EU. Samtidig advarer tysk efterretningstjeneste om fortsat russisk dyrkning af AfD-kontakter. Partiet, der engang virkede som en marginal protestbevægelse, former nu den nationale debat.

Frankrig: Le Pens lange march

Marine Le Pens Rassemblement National vandt 31,4% ved Europa-Parlamentsvalget i 2024, deres højeste andel siden 1984. Partiet har nu 125 pladser i Nationalforsamlingen efter lynvalget i juli 2024. Le Pen selv er i øjeblikket udelukket fra præsidentvalget i 2027 på grund af en dom for underslæb med EU-midler, men bevægelsen, hun byggede, har sluttet sig til Patriots for Europe-gruppen sammen med ungarske Fidesz og østrigske FPO og danner dermed en kontinental blok.

Østrig: gennem spejlet

FPO vandt 28,8% ved parlamentsvalget i 2024, deres bedste resultat i historien. Herbert Kickl er blevet bedt om at danne Østrigs første højreekstremt ledede regering siden Anden Verdenskrig. En tidligere efterretningschef advarede om, at FPO i regering ville være "et betydeligt sikkerhedsproblem" for internationale partnere. Partiet opretholder dokumenterede forbindelser til Rusland, selv om de hævder, at deres "venskabstraktat" med Putins Forenet Rusland er udløbet.

Mønstret: EU-kritisk, men ikke EU-exit

Det, der gør den nuværende drejning strategisk sofistikeret, er, at disse partier ikke længere eksplicit kræver EU-udtrædelse. De lærte af Brexits kaos. I stedet går de ind for et "Europa af suveræne nationer" frem for føderalisme og kræver "national fortrinsret" for egne borgere over EU-borgere. De presser på for undtagelser fra fælles politikker om asyl, klima og forsvar. De hævder national rets forrang over EU-ret trods traktatbrud. Og de arbejder for at blokere yderligere EU-integration og udvidelse ved enhver lejlighed.

Det er 1984-strategien tilpasset 2026: man behøver ikke fysisk at erobre territorium, hvis man kan udhule institutionerne indefra.

Kausalitet versus korrelation

Er den europæiske højredrejning forårsaget af udenlandsk indblanding, eller udnytter udenlandske aktører blot eksisterende utilfredshed? Det ærlige svar: begge dele, og forskellen betyder mindre, end man gerne vil tro.

Spørgsmålet "hvem startede det?" er måske det forkerte spørgsmål. Bannon-kredsen viste, at vestlige demokratier kunne flyttes med datadrevet manipulation og kulturkrig. Rusland viste, at udenlandske aktører kunne operere frit på de samme platforme. Begge udnyttede reel utilfredshed, som eksisterede uafhængigt af dem.

Det, der bør bekymre Europa, er ikke hvem der trak i snorene i 2016. Det er, at mekanismerne stadig fungerer. De partier, der er mest på linje med russiske interesser, vinder magt over hele kontinentet. De platforme, der muliggør manipulation, er stadig amerikanske. Og Europa har stadig ikke bygget alternativer.

I 1984 erobrede Big Brother med magt. I 2026 kan erobringen ske via stemmesedlen, og de fleste vælgere vil aldrig vide, hvem der formede de budskaber, der formede deres holdninger.

Den egentlige sårbarhed: europæisk digital naivitet

Her er det, europæere må se i øjnene: hverken Rusland eller Bannon-kredsen byggede de våben, de bruger mod os. Vi afleverede dem selv.

Trollefabrikker og datadrevet manipulation opererer på amerikanske platforme (Facebook, Twitter, YouTube), som Europa adopterede uden at bygge alternativer. Den desinformation, der splitter den europæiske enhed, flyder gennem infrastruktur, vi ikke kontrollerer, styret af algoritmer, vi ikke kan auditere, ejet af virksomheder, der svarer til udenlandske domstole.

Men hvorfor byggede Europa aldrig sine egne?

Svaret hedder tillid. Og det er en tragisk historie.

Europa og Amerika har en relation, der går dybere end de fleste forstår. Europa byggede Amerika. Oplysningstankerne, der formede den amerikanske forfatning, kom fra europæiske filosoffer. Millioner af europæere krydsede Atlanten og skabte nationen med deres hænder. Efter Anden Verdenskrig genopbyggede Marshallplanen Europa med amerikanske dollars, men det var europæisk kapital, europæisk viden og europæisk arbejdskraft, der havde bygget den amerikanske økonomi, som nu havde råd til at sende pengene den anden vej.

Det skabte en relation, der føltes som familie. NATO blev grundlagt i 1949. Amerikanerne stationerede tropper i Europa. Europa delegerede sin sikkerhed til Washington og koncentrerede sig om at bygge velfærdsstater, fællesmarkeder og fredsprojekter. Det var rationelt. Hvorfor bruge penge på forsvar, når din storebror har verdens største militær? Hvorfor bygge egne digitale platforme, når din nærmeste allierede leverer de bedste i verden?

Europa gav sin bedste ven nøglerne til huset. Adgangskoden til banken. Og alle sine hemmeligheder.

Det var ikke dumt. Det var tillid. Den slags tillid, man har til familie, hvor man ikke læser det med småt, fordi man ikke forestiller sig, at den anden part ville bruge det mod en.

Så begyndte vækningerne

2013: Snowden. Edward Snowden afslører, at NSA har aflyttet Angela Merkels mobiltelefon. Ikke en fjendtlig stats leder. Den tyske forbundskansler. Europas magtfuleste politiker. Aflyttet af sin nærmeste allierede. Europa var rystet. Men Europa gjorde... ingenting strukturelt. Ingen europæiske platforme blev bygget. Ingen cloudinfrastruktur blev omlagt. Tilliden var knækket, men vanerne var intakte. Og hvis Merkel blev aflyttet blev alle aflyttet.

2016: Trump. Pludselig sad der en mand i Det Hvide Hus, der kaldte EU en "fjende", behandlede NATO som en beskyttelsesforretning og åbenlyst beundrede Putin. Europa troede, det var en fejl i systemet. Fire år, og så ville den voksne vende tilbage.

2018: CLOUD Act. Washington vedtog en lov, der giver amerikanske myndigheder adgang til alle data lagret af amerikanske virksomheder, uanset hvor i verden serverne står. Med ét slag blev enhver europæisk virksomhed, der brugte Microsoft, Google eller Amazon, underlagt amerikansk jurisdiktion. Europa protesterede. Og fortsatte med at bruge de samme tjenester. Problemet med forandringer er at det kræver man forandrer sig.

2020: Schrems II. EU-Domstolen erklærede Privacy Shield ugyldigt, den aftale, der skulle beskytte europæiske data i amerikanske systemer. Domstolen konkluderede, at amerikansk overvågningslovgivning var uforenelig med europæiske grundrettigheder. Europas højeste ret sagde bogstaveligt: vi kan ikke stole på, at Amerika behandler vores data ordentligt. Men datastrømmene fortsatte.

2024-2025: Trump vender tilbage. Og denne gang er det ikke en fejl i systemet. Det er systemet. Toldmure mod europæiske varer. Trusler om at trække sig fra NATO. Åben fjendtlighed mod EU. Det dysfunktionelle familiemedlem, der brænder julepynten af, så snart det ikke får sin vilje.

Advarslerne var der. Europa valgte at overhøre dem.

Hvert skridt på vejen var der et øjeblik, hvor Europa kunne have handlet. Kunne have sagt: vi bygger vores egne platforme. Vi lægger vores data på europæiske servere. Vi investerer i europæisk teknologi. I stedet sagde Europa hver gang: det er nok bare et enkelt tilfælde. Alliancen holder. Vi behøver ikke bygge alternativer til vores bedste vens infrastruktur.

Andre regioner var ikke så tillidsfulde. Og de er bedre stillet i dag.

Sydkorea, et land med 51 millioner mennesker, byggede og vedligeholdt sit eget digitale økosystem. Naver dominerer søgning med 63% markedsandel (Google har kun 31%). KakaoTalk er den universelle beskedapp: stort set alle koreanere bruger den. Naver og Kakao kontrollerer tilsammen over 70% af Koreas digitale annoncemarked.

Japan byggede LINE med 186 millioner brugere. Rusland har VK og Telegram. Kinas økosystem (WeChat, Weibo, Douyin) er helt hjemligt. Selv Indien, med en endnu mere kaotisk tech-sektor end Europa, byggede UPI, et betalingssystem, der håndterer 12 milliarder transaktioner om måneden og ikke er afhængigt af Visa eller Mastercard.

Hvad har disse lande til fælles? De stolede ikke blindt på, at Washington ville handle i deres interesse. Sydkorea er en tæt amerikansk allieret, men det byggede Naver alligevel. Japan har amerikanske baser på sit territorium, men det byggede LINE alligevel. De forstod noget, Europa ikke ville se: at en alliance er et strategisk forhold, ikke et venskab. Og at man aldrig overlader sin infrastruktur til en anden magt, uanset hvor tæt relationen føles.

Europa med sine 450 millioner mennesker og 17 billioner euro i BNP havde markedskraften til at gøre det samme. Det valgte at stole i stedet.

Afhængighedsfælden: 450 millioner mennesker. Nul store platforme.

De tre drivkræfter bag europæisk svaghed

1. Sociale medie-kolonisering. Europa har ingen store sociale platforme. Facebook har 308 millioner europæiske brugere, TikTok 150 millioner. Når russiske trolde, kinesiske påvirkningsoperationer eller datadrevne politiske kampagner vil nå europæiske borgere, bruger de platforme, som europæiske myndigheder kan bøde, men ikke fundamentalt kontrollere. DSA er et plaster på et afskåret lem.

2. Hardwareafhængighed. Europa designer chips (ASMLs litografimaskiner er essentielle for enhver avanceret processor), men fremstiller næsten ingen. Kinesiske fabrikker bygger telefonerne i europæiske lommer. De overvågningsmuligheder, der er indbygget i hardware, hvad enten det er kinesiske bagdøre frygtet af vestlig efterretningstjeneste eller amerikanske afsløret af Snowden, eksisterer i enheder, Europa ikke kan inspicere i stor skala.

3. Cloudunderkastelse. Syv ud af ti bytes europæiske data ligger på amerikanske servere. Europæiske data er underlagt CLOUD Act, tilgængelige for amerikansk efterretningstjeneste, underlagt amerikansk lovgivning. Når Microsoft kan suspendere Den Internationale Straffedomstols e-mail, og AWS kan deplatforme enhver kunde inden for 24 timer, afsløres europæisk digital suverænitet som en høflig fiktion.

Superstaterne konkurrerer om Europa, og Europa er sårbart over for dem alle

Det er ikke en koordineret opdeling. Det er tre uafhængige aktører, der hver udnytter den samme europæiske sårbarhed: afhængighed af infrastruktur, Europa ikke kontrollerer. Spørgsmålet er ikke, om Rusland, Amerika eller Kina udgør den største trussel. Spørgsmålet er, hvorfor Europa byggede en digital civilisation på fundamenter, det ikke kontrollerer.

Rusland våbengør europæiske sårbarheder. Amerika kommercialiserer dem. Kina producerer den hardware, der muliggør begge dele. Resultatet ligner en belejring, men mekanismen er opportunisme snarere end sammensværgelse, og det gør den sværere at forsvare sig mod.

Europas 1984-mareridt

I Orwells verden eksisterer Europa ikke

Det er ikke en metafor. Slå 1984 op og se på det kort, Orwell tegnede.

Oceanien omfatter Nord- og Sydamerika, De Britiske Øer, Australasien og det sydlige Afrika. Eurasien strækker sig over hele den eurasiske landmasse fra Portugal til Beringstrædet. Østasien dækker Kina, Japan og Sydøstasien.

Hvor er Europa?

Vesteuropa (Frankrig, Tyskland, Benelux, Skandinavien) er en permanent krigszone. Bekriget, men aldrig rigtigt holdt. I romanens baggrundshistorie blev Storbritannien opslugt af Oceanien (den amerikanske sfære) i 1950erne. Kontinentaleuropa faldt til Eurasien (den russiske sfære). Den europæiske civilisation, der gav verden Oplysningstiden, menneskerettighederne og demokratisk styreform, ophørte ganske enkelt med at eksistere som en selvstændig enhed.

Orwell skrev det i 1948, med fremskrivning til 1984. Han beskrev logikken i supermagtskonkurrence: små og mellemstore magter bliver opslugt eller ødelagt. Der er ikke plads til en tredje vej.

Testen af, om Orwell tog fejl, udspiller sig lige nu.

Den nuværende kurs: digital opsluging i gang

Den opsluging, Orwell forestillede sig gennem militær erobring, sker gennem digital afhængighed:

• Europæiske data ligger på amerikanske servere, underlagt amerikansk lovgivning
• Energiafhængigheden var russisk indtil 2022, og rørledningerne kan ikke afmonteres fra den ene dag til den anden
• Telefonen i din lomme er samlet i Kina, af chips designet i Amerika, med software der rapporterer til begge
• Dine politiske holdninger formes af amerikanske algoritmer, forstærkes af russiske operationer og målrettes af datadrevne kampagner, hvis ophav du aldrig ser

Europa i 2026: fanget mellem tre imperier, sårbart over for dem alle, afhængigt af dem alle.

Den "pæne version" af 1984

Orwell tog fejl på ét punkt: han antog, at totalitarisme ville være grimt.

I 1984 hersker Partiet gennem afsavn, frygt og vold. Teleskærmene er obligatoriske. To Minutters Had er tvungent. Værelse 101 bryder kroppen for at erobre sindet. Støvlen tramper på et menneskeansigt, for evigt.

Men historien lærer os noget andet: imperier bygget på vold falder til sidst. Imperier bygget på begær består.

Romerne vidste det allerede for 2.000 år siden. Den romerske digter Juvenal beskrev, hvordan det romerske folk, der engang havde kæmpet for politisk indflydelse, stemt om love og holdt magthaverne ansvarlige, var blevet reduceret til at ønske sig to ting: panem et circenses, brød og cirkus. Giv dem gratis korn og gladiatorkampe, og de glemmer, at de har mistet deres frihed. Mens Colosseum underholdt masserne, kunne kejserne gøre, hvad de ville. Historien fortæller os, at ethvert samfund der bliver undertrykt med vold, ender til sidst med at gøre oprør. Men et samfund, der bliver underholdt til passivitet? Det gør aldrig oprør. Det har for travlt med at scrolle.

Sovjetunionen faldt, fordi den kun kunne tilbyde støvlen: afsavn, frygt og køer. Den kunne ikke levere det, folk ønskede: forbrugsvarer, frihed, muligheder. Det amerikanske kulturimperium spredte sig gennem cowboybukser, Coca-Cola og Hollywood. Ting, folk selv valgte at omfavne. Man kan ikke opretholde et imperium, der kun tager. De imperier, der varer, er dem, der giver folk, hvad de begærer, og derefter udvinder værdi fra den afhængighed, de skaber.

Juvenal beskrev Rom. Orwell beskrev Oceanien. Begge tog fejl om formen, men mekanismen er den samme. I 2026 bærer kontrollen et venligere ansigt:

Begge billeder viser kontrol. Kun det ene ansigt ved det.

Partiet forstod, at mennesker kan brydes af smerte. Silicon Valley opdagede, at de kan fanges af nydelse. Resultatet er det samme: en befolkning, der ikke kan tænke klart og ikke kan handle kollektivt.

Vi tortureres ikke til lydighed. Vi underholdes ind i den.

Doublethink i den digitale tidsalder

I 1984 betyder "doublethink" at holde to modstridende overbevisninger samtidig og acceptere begge som sande. War is Peace. Freedom is Slavery. Ignorance is Strength.

Hver supermagt praktiserer sin egen version:

Amerika erklærer privatlivets fred for en grundlæggende rettighed, mens det driver PRISM, aflytter Angela Merkels telefon og vedtager CLOUD Act for at nå alle data lagret af amerikanske virksomheder, overalt i verden. Regelbaseret international orden, undtagen når amerikanske interesser siger andet.

Kina kræver ikke-indblanding i sine interne anliggender, mens det eksporterer overvågningssystemer til 80+ lande. Kameraerne, der overvåger uighurer i Xinjiang, overvåger nu dissidenter i Zimbabwe. Belt and Road lover "win-win-samarbejde". Indtil Sri Lanka mister en havn, og Zambia tilbyder sit elnet som sikkerhed.

Rusland hævder, at NATO-udvidelse truer dets sikkerhed, mens det invaderer Georgien, annekterer Krim og indleder fuldskala krig mod Ukraine. Det retfærdiggør invasionen som "afnazificering", mens det anvender Wagner-gruppen, hvis grundlægger bar nazisymboler. Det kræver informationssuverænitet, mens det driver trollefabrikker, der oversvømmer vestlige sociale medier med desinformation.

For europæere er udfordringen ikke at vælge den "gode" side. Der er ingen god side. Det er måske den sværeste erkendelse af alle: god og ond er ikke kategorier, der eksisterer i geopolitik. Der findes kun interesser.

Europa er vokset op med en fortælling om, at der findes gode og onde magter, at Vesten er den gode side, at demokrati og markedsøkonomi automatisk producerer retfærdighed. Den fortælling var altid en forenkling, men den fungerede, så længe den amerikanske storebror opførte sig nogenlunde anstændigt.

Nu er fortællingen brudt sammen. Ikke fordi Amerika pludselig blev "ondt", men fordi sløret er faldet. Supermagter handler ikke ud fra værdier. De handler ud fra afkast. Amerikanske techgiganter overvåger europæere, fordi det er profitabelt. Rusland destabiliserer Europa, fordi et svagt Europa er i Ruslands interesse. Kina eksporterer overvågningsteknologi, fordi der er kunder.

Der er ingen skurke i denne historie. Kun aktører, der maksimerer deres eget afkast. Og Europa, der troede det handlede om venskab.

Det er den egentlige doublethink: ikke at 2 + 2 = 5, men at alliance = venskab, at partnerskab = tillid, at fælles værdier = fælles interesser. Europa har accepteret alle tre som sande. Ingen af dem er det.

Winston Smith blev tvunget til at tro, at 2 + 2 = 5. Europæere har selv valgt at tro, at overvågning er privatlivets fred, at afhængighed er partnerskab, at opsluging er alliance.

Svaret må være: Nej. Vi kan regne. Og regnestykket viser, at ingen passer vores interesser undtagen os selv.

Kampen om Europa er reel. Murene er gennembrudt.

Bannon-kredsen viste, at vestlige demokratier kan manipuleres indefra. Rusland dyrker politikere, der vil udhule EU. Amerika udvinder data gennem platforme, vi ikke kontrollerer. Kina fremstiller de enheder, vi ikke kan inspicere. Og Europa har gjort sig afhængigt af dem alle.

I Orwells 1984 spørger Winston Smith O'Brien, hvordan fremtiden ser ud. Svaret: "A boot stamping on a human face, forever."

Men det var den grimme version. Den version, der avler modstand.

2026-versionen er anderledes. Støvlen er en behagelig sneaker. Trampet er en blid massage. Menneskeansigtet scroller, altid scroller, for underholdt til at bemærke, hvad det har opgivet.

Men Europa er ikke Oceanien. Endnu ikke.

Del 1 af 3 i trilogien "1984 -> 2048: Europas valg"

Du læser dette på en teleskærm.

Den kender din placering. Den ved, hvem du skrev til i morges. Den ved, hvad du søgte efter i nat, da du ikke kunne sove. Den har fotograferet dit ansigt snesevis af gange i dag og sendt dataene til servere, du aldrig vil se, i lande, hvis love ikke beskytter dig.

Du betalte godt for den. Du føler dig nøgen uden den.

George Orwell forestillede sig teleskærmen som et mareridt påtvunget af staten. Han forestillede sig aldrig, at vi frivilligt ville købe dem, bære dem overalt og blive urolige, når de ikke er inden for rækkevidde.

"The world is divided into three great super-states: Oceania, Eurasia, and Eastasia. They are perpetually at war with each other in shifting alliances. The war is not meant to be won—it is meant to be continuous." — George Orwell, *1984* (1949)

Tre supermagter kæmper om kontrol over den digitale verden. Europa er det territorium, de deler mellem sig. Amerika tager dine data gennem platforme, du bruger dagligt. Kina fremstiller enhederne i din lomme. Rusland forgifter dit informationsmiljø. Alle tre behandler dig som en ressource, der skal udvindes, ikke som en borger, der skal beskyttes.

Europa kunne gøre modstand. Med 450 millioner mennesker og en økonomi på 17 billioner euro. I stedet bliver der scrollet videre.

Dette er den første af tre artikler, der undersøger Europas digitale situation gennem Orwells linse. Denne artikel kortlægger supermagterne. Del 2 undersøger, hvordan Europa er målet. Del 3 udforsker, om en fjerde vej eksisterer.

De tre digitale supermagter

Oceania 2.0: den amerikanske overvågningsmodel

I 1984 er Oceanias ideologi "Ingsoc" (English Socialism), et regime, der lover frihed og leverer total kontrol. Partiets slogan, "Freedom is Slavery," indfanger modsætningen i hjertet af dets magt.

I 2026 har Amerikas ideologi et andet navn: overvågningskapitalisme.

Harvardprofessor Shoshana Zuboff definerer det som "the unilateral claiming of private human experience as free raw material for translation into behavioral data." Disse data pakkes derefter som forudsigelsesprodukter og sælges til annoncører, politiske kampagner og enhver, der vil betale for indsigt i, hvad du vil gøre næste gang.

Forretningsmodellen er enkel i sin udvinding: brugere genererer data, virksomheder indsamler dem, algoritmer behandler dem, og prædiktive modeller sælger dem til tredjeparter. Google, Facebook, Amazon, Apple. De platforme, amerikanere bruger dagligt, kører på denne logik. Tjenesten er "gratis." Du er produktet.

NSA-forbindelsen

Men overvågningskapitalisme er kun halvdelen af den amerikanske model. Den anden halvdel bærer et regeringsskilt.

PRISM-programmet, afsløret af Edward Snowden i 2013, viste, at NSA fik elektronisk kommunikation i realtid fra internetudbydere, herunder Microsoft, Yahoo, Google, Facebook, Skype, YouTube og Apple. Den føderale overvågningsdomstol (Foreign Intelligence Surveillance Court) fastslog, at PRISM står for 91 % af de cirka 250 millioner internetkommunikationer, der indsamles hvert år under Section 702.

Programmet stoppede ikke med Snowdens afsløringer. Antallet af personer under PRISM-overvågning er vokset støt: fra 89.138 overvågede mål i 2013 til 291.824 i 2024. Mål er lig med faktiske mennesker der er under komplet digital overvågning. I 2024, bare to dage efter Kongressen fornyede og udvidede Section 702, sendte FBI's vicedirektør en e-mail, der opfordrede agenter til at "bruge" overvågningsbeføjelsen.

Dette er Oceania-modellen opdateret til den digitale tidsalder: virksomhedsudvinding plus statslig adgang. Silicon Valley bygger infrastrukturen. NSA tapper den. CLOUD Act sikrer, at amerikansk lov rækker til alle data lagret af amerikanske virksomheder, uanset hvor i verden.

Partiet i 1984 overvågede gennem teleskærme. Amerika overvåger gennem platforme, du frivilligt downloadede, og hardware, du købte for dine egne penge. Oceanias slogan var "Freedom is Slavery." 2026-versionen: "Convenience is Surveillance."

Eurasia 2.0: den russisk-kinesiske akse

I 1984 strækker Eurasien sig over den eurasiske landmasse fra Portugal til Beringstrædet: en autoritær blok, hvor staten kontrollerer alt.

I 2026 er denne blok ved at dannes igen. Den 4. februar 2022, blot få uger, før Rusland invaderede Ukraine, annoncerede Xi Jinping og Vladimir Putin et partnerskab uden grænser og uden "forbudte samarbejdsområder."

Partnerskabet "uden grænser"

Det var ikke diplomatisk teater. I maj 2025 uddybede Kina og Rusland deres partnerskab yderligere og underskrev aftaler inden for investering, handel, energi, rumfart og kultur. Præsidenterne Xi og Putin afviste offentligt den USA-ledede verdensorden og formulerede en ny vision med Beijing og Moskva i centrum.

Partnerskabet er asymmetrisk (Kina er den overordnede partner), men funktionelt integreret:

• Teknologioverførsel: Kinesiske forsvarsuniversiteter har markant øget forskningspartnerskaber med russiske institutioner siden 2019 og giver Moskva adgang til strategiske teknologier afskåret af vestlige sanktioner, især inden for luftfart og droneteknologi.
• Omgåelse af sanktioner: Kina forsyner Rusland med dual-use industrielle komponenter, herunder mikroelektronik, militær optik, dronemotorer og satellitteknologi. Næsten 90 % af russisk-kinesiske transaktioner afregnes nu i yuan og rubler.
• Militær koordinering: Fælles øvelser, delte ubådsteknologier og samarbejde om AI og kvantecomputerforskning skaber en integreret forsvarsprofil.

Kinas overvågningsindustrielle kompleks

Men partnerskabet rækker ud over militær hardware. Kina har opbygget, hvad Stanford-forskere kalder et "overvågningsindustrielt kompleks". Og det er beregnet til eksport.

Gennem virksomheder som Huawei, Hikvision, Dahua og CloudWalk har Kina eksporteret sine "smart city"-overvågningsprodukter til over 80 lande. Mange er deltagere i Belt and Road Initiative. Teknologien omfatter ansigtsgenkendelse, videoanalyse, mobilsporing og datafusionsmuligheder.

• Huawei har bygget cirka 70 % af Afrikas 4G-netværk
• 266 kinesiske teknologiinitiativer opererer på tværs af Afrika, fra datacentre til smart cities til overvågningsnetværk
• Forskning på tværs af 90 lande fandt, at kinesiske virksomheder eksporterer AI-overvågning til mindst 54

I autokratier faciliterer Huawei-teknologi digital undertrykkelse. CloudWalks ansigtsgenkendelsesdatabase i Zimbabwe bruges angiveligt til at overvåge regeringskritikere. Huawei-teknikere er blevet afsløret i politisk spionage i Uganda og Zambia.

Ruslands informationskrigsmaskineri

Rusland bidrager med en anden kapacitet til partnerskabet: informationskrig i stor skala. Mens Kina eksporterer overvågningshardware, eksporterer Rusland kaos.

Internet Research Agency, de desinformationskampagner, der er dokumenteret i Mueller-rapporten, operationerne rettet mod Brexit og europæiske valg: dette er ikke afvigelser. Det er doktrin. Gerasimov-doktrinen beskriver eksplicit, hvordan informationskrig kan opnå mål, som konventionel militær magt ikke kan.

I Orwells roman er Eurasien og Østasien sommetider allierede, sommetider fjender, men funktionelt identiske i deres totalitarisme. I 2026 repræsenterer Rusland og Kina forskellige varianter af den samme kontrolmodel: overvågningshardware fra Beijing, informationskrig fra Moskva, smeltet sammen til en enkelt autoritær teknologistak.

Hvorfor Kina + Rusland = én digital fraktion

Orwell sammensmeltede Eurasien og Østasien til udskiftelige fjender, fordi deres systemer var funktionelt identiske. Trods kulturelle og historiske forskelle tjente begge det samme formål: total statskontrol over deres befolkninger.

Den samme logik gælder i dag. Trods spændinger og asymmetrier er Kina og Rusland konvergeret mod en fælles digital model:

Erklæringen om "ingen grænser" fra februar 2022 var ikke begyndelsen på denne konvergens. Den var dens offentlige anerkendelse. Partnerskabet går forud for invasionen af Ukraine, vil overleve den og tjener begge regimers kerneinteresse: at demonstrere, at autoritarisme kan sameksistere med teknologisk modernitet.

Dette er Eurasien i 2026: ikke en enkelt monolitisk stat, men en koalition af autoritære digitale modeller forenet mod det liberale demokrati.

Den evige digitale krig

"Vi har altid været i cyberkrig med..."

En af Orwells skarpeste indsigter: krigen mellem supermagterne er ikke beregnet til at blive vundet. Den er beregnet til at være permanent.

"The war is waged by each ruling group against its own subjects, and the object of the war is not to make or prevent conquests of territory, but to keep the structure of society intact."

Supermagterne skifter periodisk alliancer (Oceanien var altid i krig med Østasien; Oceanien var altid i krig med Eurasien), men selve krigen slutter aldrig. Dens formål er ikke sejr, men videreførelse.

Den digitale krig har ingen våbenstilstand

Cyberkonflikter følger den samme logik. Der er ingen fredstraktat at underskrive, intet territorium at udveksle, intet øjeblik hvor krigen slutter.

SolarWinds var ikke et hack. Det var en besættelse. Russisk efterretningstjeneste levede inde i 18.000 organisationer i måneder, læste deres e-mails, overvågede deres beslutninger, kopierede deres hemmeligheder. Det amerikanske finansministerium, handelsministerium, ministeriet for indre sikkerhed: alle kompromitteret. Indtrængerne forsvandt, da de valgte det. Ikke da de blev opdaget.

Microsoft Exchange (2021): Kinesiske hackere udnyttede sårbarheder i hundredtusindvis af e-mailservere verden over. Din virksomhed kørte sandsynligvis Exchange. Colonial Pipeline (2021): Russisk ransomware lukkede brændstofforsyningen til USA's østkyst. Europa-Parlamentet (2022): Angrebet under en debat om russisk statsterrorisme. En besked leveret i realtid. Den tyske regering (2023, 2024, 2025): Gentagne indtrængen, tilskrevet russiske og kinesiske aktører, som Berlin kan dokumentere, men ikke stoppe.

Angrebene er kontinuerlige. Tilskrivningen er uklar. Reaktionerne er utilstrækkelige. Det er systemet.

Den virkelige fjende: deres egne borgere

Orwell forstod, at ekstern krig tjener intern kontrol. Partiet har brug for Eurasien og Østasien som fjender. Ikke for at besejre dem, men for at retfærdiggøre overvågningen af sin egen befolkning.

Amerikas sikkerhedsskrue

Efter 9/11 byggede USA et overvågningsapparat retfærdiggjort af krigen mod terror. Patriot Act. PRISM. Section 702. Hver krise udvidede statsmagten. Ingen indskrænkede den, da krisen var overstået.

NSA indsamler 250 millioner internetkommunikationer årligt under Section 702: kommunikation fra udlændinge, ja, men også amerikanere fanget i nettet. Begrundelsen er altid den samme: vi har brug for denne magt for at holde dig sikker mod ydre trusler.

Kinas sociale kontrol

Kina gør forbindelsen eksplicit. Social credit-systemet, de 200 millioner overvågningskameraer, Great Firewall: alt retfærdiggjort som nødvendigt for stabilitet og sikkerhed. Ydre trusler (amerikansk inddæmning, taiwanesisk uafhængighed, uighurisk terrorisme) leverer begrundelsen for intern kontrol.

Ruslands suveræne internet

Ruslands RuNet-projekt sigter mod at skabe et fuldt kontrollerbart indenlandsk internet, der kan afkobles fra det globale netværk. Begrundelsen: forsvar mod vestlige cyberangreb. Effekten: total kontrol over den information, der er tilgængelig for russiske borgere.

Et fælles mønster

Hver supermagt fortæller sine borgere: Vi er nødt til at overvåge dig for at beskytte dig mod dem. Den ydre fjende retfærdiggør den interne overvågning. Krigen, uanset om den er mod terrorisme, vestlig indflydelse eller østlig autoritarisme, er undskyldningen for teleskærmen.

I 1984 overvågede teleskærmene alle, altid. I 2026 gør smartphonen det samme. Og vi betaler for privilegiet.

Supermagterne har mere brug for hinanden som fjender, end de har brug for at besejre hinanden. Amerikansk overvågning kræver russiske hackere som begrundelse. Kinesisk kontrol kræver amerikansk inddæmning som undskyldning. Russisk undertrykkelse kræver NATO-udvidelse som rationale. Den evige krig holder alle tre systemer intakte.

Tre digitale supermagter, der hver overvåger deres borgere, der hver peger på de andre som begrundelse.

Men kig igen på Orwells kort. Læg mærke til, hvad der mangler.

I Orwells geopolitiske vision eksisterer Europa ikke. Storbritannien er opslugt af Oceanien. Det europæiske kontinent er slugt af Eurasien. Den civilisation, der gav verden Oplysningstiden, menneskerettighederne og demokratisk styring, er udslettet. Delt mellem rivaliserende imperier.

Det er den kurs, vi er på.

I Del 2: Europa under belejring undersøges det, hvordan supermagterne allerede arbejder på at absorbere Europa: gennem trollfarme og bankoverførsler, gennem kompromitterede politikere og erobrede platforme. Belejringen er ikke på vej. Den er begyndt.

450 millioner mennesker og 17 billioner euro i BNP, et marked stort nok til at sætte globale standarder, alt sammen afhængigt af amerikanske platforme, kinesisk hardware og sårbart over for russisk informationskrig.

Klokken slår tretten.

Microsoft bygger stort i Danmark. I december 2020 annoncerede selskabet sin første danske datacenterregion – "Denmark East" – med faciliteter i Hovedstadsregionen og på Sjælland. Efter fem års byggeri er regionen planlagt til lancering i første halvår af 2026. Så, i december 2025, annoncerede Microsoft en anden region: "West Denmark" med tre nye faciliteter i Varde og Esbjerg kommuner, beskrevet som selskabets største enkeltinvestering i dets 36-årige danske historie. Alene mellem 2023 og 2027 investerer Microsoft 3 milliarder dollars i datacenterkapacitet på dansk grund – og West Denmark-udvidelsen vil skubbe det tal endnu højere.

For europæiske IT-ledere ser narrativet ud som en gevinst. Microsoft-tjenester der kører på dansk grund. Lokale arbejdspladser. CO2-fri energi. Et skridt tættere på at holde europæiske data i Europa.

Så, den 7. januar 2026, skete der noget andet – og de fleste organisationer gik fuldstændig glip af det.

Den stille ændring i Copilot

På den dato aktiverede Microsoft Anthropics Claude AI-modeller som underdatabehandler på tværs af Microsoft 365 Copilot. For kommercielle tenants uden for EU var knappen sat til TIL som standard. Ingen handling krævet. Ingen notifikation til slutbrugere. Bare en ny AI-model der behandler deres data ved siden af OpenAIs GPT.

De funktioner der drives af Anthropics Claude inkluderer Microsoft 365 Copilot på web, desktop og mobil, Researcher-agenten, Copilot Studio, Power Platform, Agent Mode i Excel samt Word-, Excel- og PowerPoint-agenterne. Det er ikke marginale funktioner – det er kerneprodukter som millioner af vidensarbejdere bruger dagligt.

Her er den kritiske detalje: Anthropic-modeller er eksplicit udelukket fra Microsofts EU Data Boundary. Microsofts egen dokumentation siger det ligeud: "Anthropic models deployed in Microsoft offerings are currently excluded from the EU Data Boundary, and when applicable, in-country processing commitments."

For EU/EFTA- og UK-tenants satte Microsoft knappen til FRA som standard. En ansvarlig beslutning. Men knappen eksisterer. Og der skal kun en enkelt Global Administrator til for at slå den til. Måske under pres for at give brugerne adgang til de nyeste Copilot-funktioner. Måske uden fuldt ud at forstå konsekvenserne for dataopbevaring.

Hvad der sker når indstillingen bliver aktiveret

Når en M365-administrator aktiverer Anthropic som Microsoft-underdatabehandler, fravælger organisationen eksplicit EU Data Boundary-beskyttelsen for data der behandles af disse modeller. Data behøver ikke længere at forblive inden for EU/EØS-infrastruktur. Anthropic behandler data på tværs af amerikansk, europæisk, asiatisk og australsk infrastruktur, med lagring i amerikanske datacentre.

Det er ikke en fejl. Microsoft har været transparent omkring det – informationen er tilgængelig i admin-centeret og i Microsofts dokumentation. Men "transparent" og "bredt forstået" er ikke det samme. Hvor mange IT-administratorer i danske SMV'er har gennemgået Microsofts underdatabehandlerdokumentation? Hvor mange DPO'er er blevet konsulteret før indstillingen blev ændret?

Risikoen forstærkes af, at brugerne ikke kan se hvilken AI-model der behandler deres forespørgsel i de fleste Copilot-oplevelser. En medarbejder der bruger Copilot i Word ved ikke – og kan ikke nemt afgøre – om deres dokumentindhold behandles af OpenAI (inden for EU Data Boundary) eller af Anthropic (uden for). Administratoren traf en enkelt beslutning i et indstillingspanel. Brugeren er uvidende.

Selv uden Anthropic: Datacenter-illusionen

Selv med Anthropic-knappen sikkert i FRA-positionen er der et dybere strukturelt problem som Microsofts danske datacentre ikke løser.

Microsoft er et amerikansk selskab. Dets danske datterselskaber – de enheder der vil drive faciliteterne i Esbjerg, Varde og Hovedstadsregionen – er kontrolleret af et amerikansk moderselskab. To amerikanske love gør forskellen mellem hvor dataene befinder sig og hvor selskabet er registreret kritisk vigtig:

FISA Section 702 giver amerikanske efterretningstjenester ret til at pålægge amerikanske selskaber at udlevere adgang til kommunikationsdata fra ikke-amerikanske personer. Den gælder selskabet, ikke serveren. Et Microsoft-datacenter i Danmark er lige så tilgængeligt under FISA 702 som et i Virginia.

CLOUD Act (2018) gør det eksplicit: Amerikanske myndigheder kan pålægge amerikanske selskaber at udlevere data der er lagret på servere uden for USA. Dataene behøver ikke være i USA. Det skal selskabet.

EU-US Data Privacy Framework (DPF), vedtaget i 2023, udgør det nuværende retsgrundlag for denne behandling. Men dets to forgængere – Safe Harbor (ugyldiggjort 2015, Schrems I) og Privacy Shield (ugyldiggjort 2020, Schrems II) – blev underkendt af EU-Domstolen af præcis samme grundlæggende årsag: Amerikansk overvågningslovgivning giver utilstrækkelig beskyttelse for europæiske borgere. DPF hviler på en eksekutiv ordre der kan ændres af enhver fremtidig amerikansk præsident. En juridisk udfordring – almindeligvis omtalt som Schrems III – er bredt forventet.

Intet af dette gør Microsoft ulovligt eller ubrugeligt. DPF er i kraft. Microsofts EU Data Boundary er en reel teknisk indsats. For de fleste europæiske organisationer er Microsoft 365 det praktiske og lovlige valg.

Men EU-datacenter er ikke lig med EU-datasuverænitet. Og din governance bør afspejle det.

Den multi-model fremtid

Det der gør Anthropic-integrationen særligt vigtig, er at den signalerer en retning, ikke bare en hændelse. Microsofts Business and Industry Copilot-præsident Charles Lamanna formulerede det som at give kunder "fleksibiliteten til også at bruge Anthropic-modeller." Copilot er ved at blive en multi-model-orkestrator – der dirigerer forskellige opgaver til forskellige AI-udbydere baseret på kapabilitet, ikke geografi.

I dag er det Anthropic. I morgen kan det være en anden udbyder. Mønsteret er klart: den AI-tjeneste som brugere interagerer med, er ikke længere en enkelt model fra en enkelt udbyder med et enkelt sæt dataopbevaringsforpligtelser. Det er en platform der dirigerer opgaver bag kulisserne, og hver rute kan have forskellige jurisdiktionsmæssige karakteristika.

Hvor går data egentlig hen? AI-leverandøroversigt

For at forstå det reelle billede er det vigtigt at vide, hvor hver større AI-udbyder behandler data – og helt afgørende, hvor den udbyder er registreret.

Grøn = EU-baseret udbyder. Gul = EU-opbevaring tilgængelig eller betinget. Rød = ingen EU-dataopbevaring.

Tabellen afslører et mønster: EU-dataopbevaring fra et amerikansk selskab er teknisk reel, men juridisk skrøbelig. EU-dataopbevaring fra et EU-selskab er strukturelt solid. Og selvhostede modeller giver mest kontrol – men kræver den største investering.

Hvad du bør gøre nu

1. Tjek knappen. Log ind på Microsoft 365 admin center → Copilot → Settings → Data access → AI providers operating as Microsoft subprocessors. Verificér at Anthropic er deaktiveret, hvis organisationen kræver EU Data Boundary-overholdelse. Kun en Global Administrator kan ændre denne indstilling.

2. Dokumentér beslutningen. Uanset om Anthropic holdes fra eller slås til, dokumentér begrundelsen. DPO'en bør være involveret. Hvis det aktiveres, registrér at organisationen bevidst accepterer databehandling uden for EU Data Boundary og opdatér ROPA i overensstemmelse hermed.

3. Klassificér data. Ikke alle data bærer den samme risiko. Offentligt markedsføringsindhold behandlet af Anthropic uden for EU er en helt anden situation end interne HR-dokumenter eller klientkontraktdetaljer. En ordentlig dataklassificering – hvad der må behandles af AI, under hvilke betingelser og gennem hvilke udbydere – er fundamentet for governance i en multi-model-verden.

4. Overvåg underdatabehandlerlisten. Microsoft kan tilføje nye AI-underdatabehandlere. Gennemgå tenantens underdatabehandlerindstillinger kvartalsvist. Sæt en kalenderpåmindelse. Antag ikke at dagens konfiguration er permanent.

5. Hav en beredskabsplan. Hvis EU-US Data Privacy Framework bliver ugyldiggjort, vil enhver europæisk organisation der bruger Microsoft, OpenAI, Google eller enhver anden amerikansk cloududbyder, være nødt til at revurdere. Vid hvilke workloads der kan flyttes til EU-baserede udbydere. Begynd at evaluere alternativer nu – ikke når EU-Domstolens afgørelse falder.

Den ubehagelige sandhed

At Microsoft investerer milliarder i dansk infrastruktur er godt for Danmark. Flere lokale datacentre betyder lavere latenstid, lokale arbejdspladser og bedre disaster recovery. Ingen foreslår at europæiske organisationer skal holde op med at bruge Microsoft.

Men europæiske IT-ledere skal forstå, hvad de faktisk køber. Et datacenter i Danmark giver nærhed. Det giver ydeevne. Det giver et flag på et kort der ser betryggende ud i bestyrelseslokalet.

Det giver ikke suverænitet. Suverænitet kræver at dataene er uden for den juridiske rækkevidde af en fremmed regering. Så længe selskabet der driver datacenteret er registreret i USA, er det ikke tilfældet.

Organisationer der forstår dette i dag, klassificerer deres data, konfigurerer deres admin-knapper bevidst og bygger beredskabsplaner. De kommer til at stå langt bedre, når det næste regulatoriske skift rammer.

Overview

What you'll learn: How to monitor multiple SharePoint lists across multiple sites using just two flows instead of dozens.

Time required: 60-90 minutes

Prerequisites:

• Power Automate Premium license OR Azure Logic Apps access
• SharePoint site collection administrator permissions
• A SharePoint site for storing configuration lists

What you'll build:

• Two SharePoint lists for configuration
• One flow to manage webhook subscriptions
• One flow to handle change notifications

The Problem

If you need to monitor 50 SharePoint lists for changes, the obvious approach requires 50 separate flows. This creates a management nightmare with 50 flows to maintain and update.

The solution: Use SharePoint webhooks. Instead of 50 flows, you need exactly two:

1. Subscription Flow – Creates and renews webhook subscriptions (runs monthly)
2. Handler Flow – Receives notifications and processes changes (triggered automatically)

Architecture Overview

The Subscription Flow runs once per month. It loops through all your sites, finds lists matching your criteria, and creates webhook subscriptions pointing to the Handler Flow.

When something changes on any monitored list, SharePoint sends a notification to the Handler Flow. The Handler Flow then queries the list to find what changed and executes your business logic.

Licensing Note

This solution requires Power Automate Premium because the Handler Flow uses the "When a HTTP request is received" trigger (a premium connector).

Alternative: Use Azure Logic Apps with consumption-based pricing. This is often more cost-effective for low-volume scenarios and doesn't require a premium license.

The instructions below work for both Power Automate and Logic Apps.

Part 1: Create the Configuration Lists

Before building the flows, you need two SharePoint lists to store configuration data.

Step 1.1: Create the Sites List

This list stores the SharePoint sites you want to monitor.

Step 1.1.1: Navigate to Your Management Site

1. Open your browser and go to the SharePoint site where you want to store the configuration
2. This could be any site, for example: https://yourtenant.sharepoint.com/sites/management

Step 1.1.2: Create a New List

1. Click + New in the top left
2. Click List
3. Select Blank list
4. Enter the name: Sites
5. Click Create

Step 1.1.3: Add the URL Column

The list already has a Title column. You need to add one more column.

1. Click + Add column
2. Select Single line of text
3. Enter the name: URL
4. Click Save

Step 1.1.4: Add Your Sites

Add one row for each site you want to monitor. For example, your first entry might have the Title Sales Site with the URL https://yourtenant.sharepoint.com/sites/sales. Add additional rows for each site, such as HR Site pointing to https://yourtenant.sharepoint.com/sites/hr and Projects Site pointing to https://yourtenant.sharepoint.com/sites/projects.

Step 1.2: Create the Timestamps List

This list tracks when each monitored list was last processed.

Step 1.2.1: Create the List

1. Click + New in the top left
2. Click List
3. Select Blank list
4. Enter the name: Timestamps
5. Click Create

Step 1.2.2: Add the Required Columns

Add three columns:

Column 1: listGUID

1. Click + Add column
2. Select Single line of text
3. Enter the name: listGUID
4. Click Save

Column 2: SiteURL

1. Click + Add column
2. Select Single line of text
3. Enter the name: SiteURL
4. Click Save

Column 3: LastModificationDateTime

1. Click + Add column
2. Select Date and time
3. Enter the name: LastModificationDateTime
4. Click Save

You'll populate this list later when the Subscription Flow runs.

Part 2: Create the Handler Flow

You must create the Handler Flow first because you need its URL for the Subscription Flow.

Step 2.1: Create a New Flow

Step 2.1.1: Open Power Automate

1. Go to https://make.powerautomate.com
2. Sign in with your Microsoft 365 account

Step 2.1.2: Create the Flow

1. Click + Create in the left menu
2. Click Instant cloud flow
3. Enter the flow name: Webhook Handler
4. Scroll down and select When a HTTP request is received
5. Click Create

Step 2.2: Configure the HTTP Trigger

Step 2.2.1: Get the HTTP URL

After creating the flow, you'll see the trigger action open.

1. Leave Request Body JSON Schema empty for now
2. Click Save in the top right
3. After saving, the HTTP POST URL field will show a long URL
4. Click the copy icon next to the URL
5. Save this URL somewhere – you'll need it for the Subscription Flow

The URL looks like this:

https://prod-XX.westeurope.logic.azure.com:443/workflows/abc123.../triggers/manual/paths/invoke?api-version=...

Step 2.3: Add the Response Action

SharePoint expects a response within 5 seconds. You must respond immediately.

Step 2.3.1: Add the Response

1. Click + New step
2. Search for Response
3. Select Response (under "Request")
4. Set Status Code to: 200
5. Leave Body empty

Step 2.4: Add Variables

You need to initialize variables to store data during processing.

Step 2.4.1: Add Variable for Headers

1. Click + New step
2. Search for Initialize variable
3. Select Initialize variable
4. Configure:
5. Name: header_nometa
6. Type: Select Object
7. Value:

Step 2.4.2: Add Variable for List GUID

1. Click + New step
2. Search for Initialize variable
3. Select Initialize variable
4. Configure:
5. Name: ListGUID
6. Type: Select String
7. Value: Leave empty

Step 2.4.3: Add Variable for Site URL

1. Click + New step
2. Search for Initialize variable
3. Select Initialize variable
4. Configure:
5. Name: listSiteURL
6. Type: Select String
7. Value: Leave empty

Step 2.4.4: Add Variable for Timestamp

1. Click + New step
2. Search for Initialize variable
3. Select Initialize variable
4. Configure:
5. Name: lastModifiedTime
6. Type: Select String
7. Value: Leave empty

Step 2.5: Handle Validation Requests

When creating a subscription, SharePoint sends a validation request first. You must detect and handle this.

Step 2.5.1: Add a Condition

1. Click + New step
2. Search for Condition
3. Select Condition (under "Control")

Step 2.5.2: Configure the Condition

In the condition, you'll check if the Content-Length header is 0 (meaning it's a validation request).

1. In the first field (left side), click in the box
2. Click Expression tab
3. Enter: int(triggerOutputs()?['headers']?['Content-Length'])
4. Click OK
5. In the middle dropdown, select is equal to
6. In the right field, enter: 0

Step 2.6: Configure the "If Yes" Branch (Validation)

When Content-Length is 0, it's a validation request. You must return the validation token.

Step 2.6.1: Add Response in "If Yes"

1. Click inside the If yes branch
2. Click Add an action
3. Search for Response
4. Select Response
5. Configure:
6. Status Code: 200
7. Click Show advanced options
8. Under Headers, click + Add new item
9. Key: Content-Type
10. Value: text/plain
11. Body: Click in the box, then click Expression and enter:
12. Click OK

Step 2.6.2: Add Terminate Action

1. Click Add an action (still in "If yes" branch)
2. Search for Terminate
3. Select Terminate (under "Control")
4. Set Status to: Succeeded

Step 2.7: Configure the "If No" Branch (Change Notification)

When Content-Length is not 0, it's an actual change notification.

Step 2.7.1: Set the ListGUID Variable

1. Click inside the If no branch
2. Click Add an action
3. Search for Set variable
4. Select Set variable
5. Configure:
6. Name: Select ListGUID
7. Value: Click Expression and enter:
8. Click OK

Step 2.7.2: Set the listSiteURL Variable

1. Click Add an action
2. Search for Set variable
3. Select Set variable
4. Configure:
5. Name: Select listSiteURL
6. Value: Click Expression and enter:
7. Click OK
8. Important: Replace yourtenant with your actual tenant name

Step 2.7.3: Get the Last Processed Timestamp

1. Click Add an action
2. Search for Send an HTTP request to SharePoint
3. Select Send an HTTP request to SharePoint
4. Configure:
5. Site Address: Enter your management site URL (e.g., https://yourtenant.sharepoint.com/sites/management)
6. Method: Select GET
7. Uri:
8. Headers: Click + Add new item
9. Key: Accept
10. Value: application/json; odata=nometadata

Step 2.7.4: Set the lastModifiedTime Variable

1. Click Add an action
2. Search for Set variable
3. Select Set variable
4. Configure:
5. Name: Select lastModifiedTime
6. Value: Click Expression and enter:
7. Click OK

Step 2.7.5: Update the Timestamp

Update the timestamp before processing to prevent duplicate processing.

1. Click Add an action
2. Search for Send an HTTP request to SharePoint
3. Select Send an HTTP request to SharePoint
4. Configure:
5. Site Address: Your management site URL
6. Method: Select POST
7. Uri: Click Expression and enter:
8. Headers: Click Switch to text mode (if available) or add these items:
9. Accept: application/json;odata=nometadata
10. Content-Type: application/json;odata=nometadata
11. IF-MATCH: *
12. X-HTTP-Method: MERGE
13. Body:

Step 2.7.6: Get Modified Items

1. Click Add an action
2. Search for Get items
3. Select Get items (SharePoint)
4. Configure:
5. Site Address: Click in the box, then select Enter custom value, then select listSiteURL from Dynamic content
6. List Name: Click in the box, then select Enter custom value, then select ListGUID from Dynamic content
7. Click Show advanced options
8. Filter Query:

Step 2.7.7: Process Each Modified Item

1. Click Add an action
2. Search for Apply to each
3. Select Apply to each (under "Control")
4. In Select an output from previous steps, select value from the "Get items" action

Inside this loop, add your business logic (send emails, update records, etc.).

Step 2.8: Save the Flow

1. Click Save in the top right corner
2. Verify the flow saves without errors

Part 3: Create the Subscription Flow

This flow creates and renews webhook subscriptions for all your lists.

Step 3.1: Create a New Flow

Step 3.1.1: Create the Flow

1. In Power Automate, click + Create
2. Click Scheduled cloud flow
3. Configure:
4. Flow name: Webhook Subscription Manager
5. Starting: Select today's date
6. Repeat every: 1 Month
7. Click Create

Step 3.2: Initialize Variables

You need several variables for this flow.

Step 3.2.1: Add Variable for Headers

1. Click + New step
2. Search for Initialize variable
3. Select Initialize variable
4. Configure:
5. Name: header_nometa
6. Type: Select Object
7. Value:

Step 3.2.2: Add Variable for Flow Name

1. Click + New step
2. Search for Initialize variable
3. Select Initialize variable
4. Configure:
5. Name: flowName
6. Type: Select String
7. Value: Click Expression and enter:
8. Click OK

Step 3.2.3: Add Variable for Notification URL

1. Click + New step
2. Search for Initialize variable
3. Select Initialize variable
4. Configure:
5. Name: notificationURL
6. Type: Select String
7. Value: Paste the HTTP POST URL you copied from the Handler Flow

Step 3.2.4: Add Variable for Expiration Date

1. Click + New step
2. Search for Initialize variable
3. Select Initialize variable
4. Configure:
5. Name: expirationDateTime
6. Type: Select String
7. Value: Click Expression and enter:
8. Click OK

Step 3.2.5: Add Variable for Subscription ID

1. Click + New step
2. Search for Initialize variable
3. Select Initialize variable
4. Configure:
5. Name: SubscriptionID
6. Type: Select String
7. Value: Leave empty

Step 3.3: Get the Sites to Monitor

Step 3.3.1: Get Items from Sites List

1. Click + New step
2. Search for Get items
3. Select Get items (SharePoint)
4. Configure:
5. Site Address: Your management site URL
6. List Name: Select Sites

Step 3.4: Loop Through Each Site

Step 3.4.1: Add Apply to Each

1. Click + New step
2. Search for Apply to each
3. Select Apply to each
4. In Select an output from previous steps, select value from "Get items"

Step 3.5: Get Lists from Each Site

Inside the "Apply to each" loop:

Step 3.5.1: Query Lists Matching Your Criteria

1. Click Add an action
2. Search for Send an HTTP request to SharePoint
3. Select Send an HTTP request to SharePoint
4. Configure:
5. Site Address: Click in the box, click Dynamic content, select URL from the Sites list
6. Method: Select GET
7. Uri:
8. Headers:
9. Key: Accept
10. Value: application/json; odata=nometadata

Customize the filter: Change startswith(Title, 'contracts-') to match your list naming pattern.

Step 3.6: Extract List IDs

Step 3.6.1: Add Select Action

1. Click Add an action
2. Search for Select
3. Select Select (under "Data Operations")
4. Configure:
5. From: Click Expression and enter:
6. Click OK
7. Click Switch to text mode (the icon with a "T")
8. Map: Click Expression and enter:
9. Click OK

Step 3.7: Build Subscription URIs

Step 3.7.1: Add Another Select Action

1. Click Add an action
2. Search for Select
3. Select Select
4. Configure:
5. From: Select Output from the previous Select action
6. Click Switch to text mode
7. Map: Enter exactly (including quotes):

Note: If Power Automate removes the quotes when you save, add them back manually.

Step 3.8: Loop Through Each Subscription URI

Step 3.8.1: Add Nested Apply to Each

1. Click Add an action
2. Search for Apply to each
3. Select Apply to each
4. In Select an output from previous steps, select Output from the second Select action

Step 3.9: Check for Existing Subscriptions

Inside the nested loop:

Step 3.9.1: Get Existing Subscriptions

1. Click Add an action
2. Search for Send an HTTP request to SharePoint
3. Select Send an HTTP request to SharePoint
4. Configure:
5. Site Address: Select URL from Dynamic content (from the Sites list)
6. Method: Select GET
7. Uri: Select Current item from Dynamic content (this is the subscription URI)
8. Headers:
9. Key: Accept
10. Value: application/json; odata=nometadata

Step 3.9.2: Filter to This Flow's Subscriptions

1. Click Add an action
2. Search for Filter array
3. Select Filter array (under "Data Operations")
4. Configure:
5. From: Click Expression and enter:

(Note: The action name may have a number like _2 or _3 – check your actual action name)

• Click OK
• In the condition:
• Left field: Click Expression and enter: item()?['clientState']
• Middle: Select is equal to
• Right field: Select flowName variable

Step 3.9.3: Set the SubscriptionID Variable

1. Click Add an action
2. Search for Set variable
3. Select Set variable
4. Configure:
5. Name: Select SubscriptionID
6. Value: Click Expression and enter:

Step 3.9.4: Extract the List GUID

1. Click Add an action
2. Search for Compose
3. Select Compose (under "Data Operations")
4. Rename it to Get_resource_id (click the three dots, then "Rename")
5. Inputs: Click Expression and enter:

(Note: Check your actual loop name – it might be Apply_to_each_2 or similar)

Step 3.10: Create or Update the Subscription

Step 3.10.1: Add a Condition

1. Click Add an action
2. Search for Condition
3. Select Condition
4. Configure:
5. Left field: Click Expression and enter: length(body('Filter_array'))
6. Middle: Select is greater than
7. Right field: Enter 0

Step 3.11: Configure "If Yes" (Update Existing Subscription)

Step 3.11.1: Update the Subscription

1. Click inside If yes
2. Click Add an action
3. Search for Send an HTTP request to SharePoint
4. Select Send an HTTP request to SharePoint
5. Configure:
6. Site Address: Select URL from the Sites list
7. Method: Select PATCH
8. Uri: Click Expression and enter:
9. Headers:
10. Accept: application/json; odata=nometadata
11. Content-Type: application/json; odata=nometadata
12. Body:

Step 3.12: Configure "If No" (Create New Subscription)

Step 3.12.1: Create the Subscription

1. Click inside If no
2. Click Add an action
3. Search for Send an HTTP request to SharePoint
4. Select Send an HTTP request to SharePoint
5. Configure:
6. Site Address: Select URL from the Sites list
7. Method: Select POST
8. Uri: Select Current item from Dynamic content (the subscription URI)
9. Headers:
10. Accept: application/json; odata=nometadata
11. Content-Type: application/json; odata=nometadata
12. Body:

Step 3.13: Save the Flow

1. Click Save in the top right corner
2. Verify the flow saves without errors

Part 4: Initialize the Timestamps List

Before running the Subscription Flow, you need to add entries to the Timestamps list for each list you want to monitor.

Step 4.1: Get List GUIDs

For each list you want to monitor:

1. Navigate to the list in SharePoint
2. Click the gear icon (Settings) in the top right
3. Click List settings
4. Look at the URL in your browser – find the part that says List=%7B...%7D
5. The GUID is between %7B and %7D (these are encoded { and })

Step 4.2: Add Entries to Timestamps List

For each monitored list, add a row with the following values:

• Title: A descriptive name, e.g. Contracts-Sales
• listGUID: The GUID you copied in the previous step, e.g. abc12345-...
• SiteURL: The full URL of the site where the list lives, e.g. https://yourtenant.sharepoint.com/sites/sales
• LastModificationDateTime: Set this to today's date

Repeat for every list you want to monitor. For instance, add a second row for Contracts-HR with its GUID and the HR site URL.

Part 5: Test the Solution

Step 5.1: Test the Handler Flow

1. Open the Handler Flow
2. Click Test in the top right
3. Select Manually
4. Click Test
5. The flow will wait for a trigger

Step 5.2: Run the Subscription Flow

1. Open the Subscription Flow
2. Click Test in the top right
3. Select Manually
4. Click Test
5. Click Run flow

If successful, the Subscription Flow will create webhook subscriptions, which will trigger the Handler Flow's validation.

Step 5.3: Verify Subscriptions Were Created

1. Check the Subscription Flow run history – all actions should show green checkmarks
2. Check the Handler Flow run history – you should see validation runs (these are normal)

Step 5.4: Test a Real Change

1. Go to one of your monitored SharePoint lists
2. Create or modify an item
3. Within a few minutes, the Handler Flow should trigger
4. Check the Handler Flow run history to verify it processed the change

Troubleshooting

"Failed to validate notification URL" — This means the Handler Flow is not responding to SharePoint's validation request. Make sure the Handler Flow is saved and enabled before running the Subscription Flow.

Subscription Flow fails on the "Select" action — Power Automate has a known quirk where it strips the quotation marks from the mapping field when you save. Open the action, re-add the quotes manually, and save again.

Handler Flow never triggers after setup — The webhook subscription has likely expired or was not created correctly. Open the Subscription Flow and run it manually to renew all subscriptions.

No items returned in the Handler Flow — Check that the Timestamps list has correct entries for the list in question. If the LastModificationDateTime value is in the future or the listGUID doesn't match, the filter query will return no results.

"Action name not found" errors in expressions — Power Automate auto-generates action names based on the action title, and appends numbers like _2 or _3 when there are duplicates. Open the action that precedes the failing expression and check its actual generated name, then update the expression to match.

Microsoft's Denmark East region launches in the first half of 2026. Denmark West, covering new facilities in Esbjerg and Varde, was announced in December 2025. Between 2023 and 2027, Microsoft is investing $3 billion in datacenter capacity on Danish soil. Brad Smith called it an investment that would "strengthen Europe's digital sovereignty."

The performance, residency, and sustainability benefits are real. For many Danish organisations, this is genuinely good news. But the sovereignty framing deserves scrutiny, because residency and sovereignty mean very different things.

Residency vs. Sovereignty

Data residency is about geography. Where does data physically sit? When Denmark East goes live, tenants who select that region will store data at rest in Denmark. Real capability, no asterisks.

Data sovereignty is about jurisdiction. Who can legally compel access to that data? Every authoritative definition, including Microsoft's own documentation, says the same thing: data sovereignty means data is subject to the laws of the nation where it resides, and that nation holds authority over access and disclosure.

One partner whitepaper recently redefined data sovereignty as "responsibility" and "making informed decisions you can stand behind in front of your board, citizens, customers, and authorities." That is good governance. It is not data sovereignty. When a vendor redefines sovereignty as accountability rather than jurisdictional control, they are sidestepping the one question that actually matters: which government can legally compel access to your data, and can you stop them?

The Jurisdictional Reality

Microsoft is a US corporation. Two pieces of US legislation follow that fact regardless of where the servers sit. The CLOUD Act (2018) authorises US authorities to compel US companies to produce data stored anywhere in the world. FISA Section 702 authorises surveillance of non-US persons through US companies, irrespective of server location. Its scope was expanded in April 2024 with a broader definition of "electronic communication service provider."

On June 10, 2025, Microsoft France's legal director Anton Carniaux testified under oath before the French Senate. Asked whether he could guarantee that EU-stored data would not be disclosed to US authorities, he answered: "Non, je ne peux pas le garantir". No, I cannot guarantee that.

The EU and US have tried three times to create a stable legal basis for transatlantic data transfers. Safe Harbor fell in 2015. Privacy Shield in 2020. The current Data Privacy Framework rests on an executive order that any president can modify. In January 2025, the Trump administration removed three of five Privacy and Civil Liberties Oversight Board members, breaking a key DPF safeguard mechanism.

None of this makes Microsoft illegal or unusable. The DPF is in force. The EU Data Boundary is genuine engineering. For many organisations, Microsoft 365 remains a practical and lawful choice. But an EU datacenter does not equal EU data sovereignty.

Who should celebrate, and who should be cautious

The value of Danish datacenters depends entirely on your regulatory context and data sensitivity.

The problem is not the datacenters. The problem is when marketing leads highly regulated organisations to believe that residency solves sovereignty. It does not. The consequences of that misunderstanding land on the organisation, not the vendor.

The Danish Contradiction

In June 2025, Denmark's Minister for Digitalisation Caroline Stage Olsen announced the Ministry would migrate from Microsoft Office 365 to LibreOffice, citing sovereignty concerns. Copenhagen and Aarhus are pursuing similar paths. Six months later, Microsoft announced its largest-ever Danish investment.

The Danish government understands that physical presence does not resolve jurisdictional control. They are diversifying away from Microsoft for sensitive workloads while welcoming the infrastructure investment. That posture, adopt the datacenters but reject the sovereignty narrative, is exactly right.

What would real sovereignty require?

Microsoft is not ignoring the problem. The EU Data Boundary, confidential computing, and customer-managed encryption keys represent genuine effort to reduce practical risk. None of them resolve the structural issue.

Customer-managed keys sound definitive. If you hold the keys, Microsoft cannot read the data. But anyone who has set up BitLocker with a Microsoft account has seen their recovery key silently uploaded to Microsoft's cloud. That is key escrow, not customer-managed encryption. Even with keys in external hardware security modules, the platform operator processes decrypted data in memory during use. A CLOUD Act order does not ask for your encryption keys. It compels Microsoft, as the infrastructure operator, to cooperate in producing data. If Microsoft has administrative access to the environment, that obligation can be fulfilled regardless of where your keys sit.

Confidential computing with trusted execution environments is designed to close that last gap. But you still trust the silicon vendor, the attestation chain, and the operator's implementation. These are meaningful mitigations. They are not sovereignty.

The only path to genuine sovereignty using Microsoft technology is to separate the operating entity from the US corporate parent. France understood this. In 2021, Orange and Capgemini created Bleu, a legally independent French company, majority-owned by French entities, operating datacenters physically isolated from Microsoft's global infrastructure, staffed entirely by French employees. Bleu licenses Microsoft technology but is not a Microsoft subsidiary. It is not subject to the CLOUD Act because it is not a US company.

For Microsoft to deliver real sovereignty in Europe, it would need to let go. Help establish legally independent EU entities that license its technology but operate without a US parent in the chain of command. Microsoft could retain minority ownership, but the operating entity must be European-owned, European-governed, and European-operated. The jurisdictional chain must be severed, not mitigated.

No US hyperscaler has done this at scale. The Bleu model comes with real tradeoffs: narrower services, slower feature rollout, higher cost. But it is the only model that addresses the actual problem. That, or get rid of the US CLOUD Act.

What to do now

If you are evaluating Microsoft's Danish datacenters, start here. Distinguish residency from sovereignty in your DPIA. Explicitly address CLOUD Act and FISA 702 exposure, even if the risk is acceptable for your data classification. Classify data by sensitivity: general business data on Danish infrastructure is a straightforward win, but patient records, classified data, or core banking systems require a harder conversation. And watch the DPF. If Schrems III materialises, the legal basis for US cloud providers processing EU data could be invalidated for the third time.

The Danish datacenters are a genuine improvement. For most organisations, they are worth adopting. They are not a sovereignty solution. And until someone builds a Danish Bleu, a legally independent, EU-governed entity operating Microsoft technology without a US parent in the chain, they never will be.

Europe's largest retailer just broke ground on a €11 billion data center. Not to sell groceries online or optimize supply chains. To become Europe's first homegrown hyperscaler and challenge AWS, Azure, and Google Cloud on their own turf.

The Schwarz Group, the parent company behind Lidl and Kaufland, is building a 200MW, 100,000-GPU data center campus in Lübbenau, Germany, on the site of a decommissioned coal power plant south of Berlin. The first phase is scheduled for completion by the end of 2027. It is backed by €175 billion in annual retail revenue, strategic partnerships with SAP, Google, and German AI company Aleph Alpha, and an explicitly stated mission to end Europe's dependence on American cloud infrastructure.

For European companies currently evaluating their Microsoft 365 dependency, considering open-source alternatives like Nextcloud or Alfresco, or simply wondering whether a credible European IaaS/PaaS provider will ever exist, this changes the conversation.

From supermarket aisles to server racks

Running 14,200 stores across 32 countries generates enormous volumes of sensitive data. When the Schwarz Group evaluated where to host it all, it concluded that no existing European cloud provider could meet its security and sovereignty requirements. And using AWS or Azure meant accepting the US CLOUD Act.

So they built their own. What started as an internal cloud platform in 2018 became STACKIT GmbH in 2023, then part of Schwarz Digits, a dedicated IT division employing around 7,500 people and generating €1.9 billion in annual revenue. The division also includes XM Cyber (cybersecurity), an investment in Aleph Alpha (AI), and partnerships with Wire (secure communications) and SAP.

The Lübbenau data center scales this internal capability into a genuine European hyperscaler serving external customers.

What STACKIT offers today

STACKIT provides a solid IaaS and PaaS foundation: virtual machines, block and object storage, networking, managed Kubernetes (SKE), Cloud Foundry, and managed databases (PostgreSQL, MongoDB, OpenSearch). For organizations running workloads on Azure VMs or AWS EC2, this is directly comparable. For teams using Azure Kubernetes Service or AWS EKS, SKE is a credible alternative.

The critical gap is SaaS. STACKIT does not offer its own productivity suite. It is the infrastructure layer, not a drop-in replacement for Microsoft 365 or Google Workspace. The service catalog has perhaps 20-30 services compared to Azure's 200+, and the global presence is limited to Germany and Austria.

What makes the strategy interesting is that STACKIT is building a sovereign application ecosystem through partnerships.

The sovereign workplace ecosystem

Rather than building an M365 competitor from scratch, Schwarz Digits has assembled a portfolio of partnerships:

Google Workspace on STACKIT is hosted on STACKIT infrastructure with client-side encryption. The Schwarz Group is migrating its own 575,000 employees to this instance. It is a pragmatic improvement over American-controlled infrastructure, but it is not true digital sovereignty. Google remains a US company subject to the CLOUD Act and FISA Section 702. The keys to the data may be European; the keys to the software are not. For organizations pursuing genuine sovereignty, this is a stepping stone, not a destination.

Wire is a Swiss-German end-to-end encrypted messaging platform using the MLS protocol. Already used by the Schwarz Group for board-level communications. Purpose-built for high-assurance scenarios and federated cross-organization communication.

openDesk is the German government-backed open-source workplace suite (Nextcloud, Collabora Online, Element, OpenProject) available as SaaS on STACKIT. Primarily targeted at the public sector.

SAP on STACKIT lets organizations run S/4HANA on STACKIT infrastructure within European jurisdiction through the RISE with SAP program.

PhariaAI is Aleph Alpha's sovereign AI suite running natively on STACKIT, enabling organizations to train and deploy AI models without proprietary knowledge leaking into external training data.

Can an M365 company migrate to STACKIT?

Yes, but it requires honest planning, not wishful thinking. Microsoft 365 is an integrated ecosystem where SharePoint, Teams, Exchange, OneDrive, Power Platform, Entra ID, and Purview are deeply intertwined. You cannot simply lift it and drop it onto STACKIT. You need to decompose it and find sovereign replacements for each capability.

Document management and file storage is the most mature replacement path. Nextcloud Hub or Alfresco on STACKIT (VMs, Kubernetes, managed PostgreSQL backends) can replace SharePoint and OneDrive. Your files, metadata, and database all reside on GDPR-compliant infrastructure with no CLOUD Act exposure. STACKIT does not offer these as managed SaaS, so you deploy and manage the application yourself or use a partner.

Email is the single biggest gap. Exchange Online is where Microsoft shines brightest, and STACKIT offers no managed email service. Self-hosting email (Open-Xchange, Zimbra) on STACKIT VMs means owning the entire operational burden: spam filtering, deliverability, backup, high availability, security patching, 24/7 monitoring. The savings from leaving Microsoft get consumed by the engineers needed to run it. For most organizations, email should be the last workload to migrate, not the first.

Team communication depends on what you are already doing. If you are migrating to Nextcloud, start with Nextcloud Talk. It is included at no additional cost, supports encrypted video/audio calls, chat, screen sharing, and integrates natively with Nextcloud files, calendar, and tasks. For most internal communication, Talk is more than sufficient. Consider Wire as an additional layer only if you need high-assurance communications: board-level discussions, cross-organization federation, or regulatory scenarios where MLS protocol guarantees matter. Some organizations run both.

Identity and access management catches organizations off guard. Those deeply integrated with Entra ID will need Keycloak or Univention Corporate Server on STACKIT. This is often the hidden blocker.

Compliance and governance has no single open-source equivalent to Microsoft Purview. Retention policies, classification, eDiscovery, and audit trails need to be reconstructed using Nextcloud's or Alfresco's built-in capabilities, potentially supplemented by dedicated GRC tooling.

The realistic migration path

The realistic path is a phased sovereignty transition over 12-24 months:

1. Assess and classify — Map your M365 and Azure estate. Classify every workload by sovereignty sensitivity.
2. Migrate infrastructure — Move Azure VM and container workloads, databases, and networking to STACKIT.
3. Migrate documents — Extract documents, metadata, permissions, and version history from SharePoint Online to Nextcloud or Alfresco on STACKIT. This is the hardest phase.
4. Transition the productivity stack — Enable Nextcloud Talk, replace OneDrive with Nextcloud file sync, add Wire only if needed.
5. Rebuild compliance — Reconstruct retention policies, classification schemes, and audit trails.
6. Email (when ready) — Keep Exchange Online until a managed sovereign email service emerges.

Why the €11 billion matters

The single biggest risk with European cloud alternatives has always been sustainability. Companies fear investing in a migration to a provider that might fail or stop growing. The Schwarz Group's commitment, backed by €175 billion in annual retail revenue, changes that calculus. This is not a venture-funded startup. The €8.5 billion allocated to IT infrastructure (primarily GPUs) positions STACKIT not just as an alternative hosting provider, but as a platform for AI training and inference at European scale. That matters increasingly as the EU AI Act requires demonstrable control over training data and model behavior.

What this means for European companies

For regulated industries (pharma, finance, healthcare, defense): The combination of STACKIT + SAP + sovereign Google Workspace + Wire + PhariaAI creates a complete sovereign technology stack that can meet GDPR, NIS2, DORA, and industry-specific compliance requirements without US cloud dependency. That did not exist two years ago.

For companies running SharePoint and M365: STACKIT is not a platform you migrate SharePoint to directly. But it is the infrastructure that makes a migration to Nextcloud or Alfresco genuinely viable at enterprise scale, with the security and compliance backing large organizations require.

For any European company worried about the CLOUD Act or unpredictable US policy changes: STACKIT offers an insurance policy. Even if you do not migrate today, a credible European hyperscaler means you have a realistic exit path.

Planning the information architecture is the real work

The technology choice is only half the migration. The other half is information architecture: deciding where every document type, metadata schema, permission model, and retention policy lands on the target platform before you move a single file.

This is where migrations go wrong. Organizations arrive at the target platform without a clear plan for how their information should be structured. The result is a disorganized pile of files that technically migrated but practically broke every governance workflow the business depended on.

For regulated industries, this is not just an inconvenience. It is a compliance failure. GxP-regulated documents must maintain chain of custody. Retention policies must survive the transition. Sensitive and controlled documents must arrive in the correct location with the correct access controls, or the migration itself becomes a regulatory event.

The caveats

Scale and maturity. STACKIT generated €1.9 billion in 2024, compared to AWS's $100+ billion. The service catalog is lean and the partner ecosystem is young.

Vendor concentration risk. Moving from Microsoft dependency to Schwarz Group dependency is a dependency shift, not elimination. The use of open-source technologies (OpenStack, Kubernetes) at STACKIT's core mitigates this, since your workloads should be portable.

Migration complexity is real. Leaving M365 requires organizational commitment, budget, change management, and patience. Companies should not underestimate the effort, but they should also not let complexity become a reason for inaction.

The European cloud just got real

"European digital sovereignty" has been a policy aspiration more than a practical reality for years. Gaia-X generated more PowerPoint decks than usable infrastructure. European cloud providers remained regional players with limited scale.

The Schwarz Group's €11 billion entry changes this. Not because STACKIT is ready to replace Azure today (it is not), but because there is now a European actor with the financial muscle and strategic commitment to build hyperscaler-grade infrastructure within European jurisdiction.

If you are running M365 or Azure workloads, now is the time to map your estate, classify your data by sovereignty sensitivity, and evaluate STACKIT alongside other European providers. The question is no longer whether European companies can leave Big Tech. It is whether they will start planning before circumstance forces their hand.

If you're running Hyprland on Wayland and need to connect to a Fortinet SSL VPN with SAML/SSO, you're in for a rough ride. FortiClient on Linux has several undocumented issues on Wayland compositors, and the official documentation is essentially silent on the topic.

This guide covers every pitfall I've hit and how to solve them — from choosing the right package to getting the SAML login popup to actually appear.

Choosing the Right Package

On Arch Linux (and derivatives like CachyOS), there are three options in the AUR:

The correct choice is forticlient-vpn. Here's why the others fail:

• openfortivpn doesn't support SAML/SSO authentication natively. You'd need to extract an SVPNCOOKIE from a browser session manually — fragile and tedious.
• forticlient (the ZTNA edition) includes endpoint compliance features that require registration with a FortiClient EMS server. Without EMS, the VPN feature is locked with the error: SSLVPN is disabled while registered to EMS. If your organization doesn't provide an EMS endpoint, this package is a dead end.

Install the VPN-only edition:

paru -S forticlient-vpn

Start and enable the service:

sudo systemctl enable --now forticlient.service

The Secrets Service Requirement

FortiClient stores VPN credentials through the org.freedesktop.secrets D-Bus interface. Without a secrets service running, you cannot save VPN profiles — the GUI save button simply does nothing, with no error message.

If you're on a KDE-based setup, you might have kwallet installed but not necessarily exposing the freedesktop secrets interface. The most reliable option is gnome-keyring:

sudo pacman -S gnome-keyring

Start the secrets component:

gnome-keyring-daemon --start --components=secrets

Verify it's registered on D-Bus:

dbus-send --session --print-reply \
  --dest=org.freedesktop.DBus \
  /org/freedesktop/DBus \
  org.freedesktop.DBus.ListNames 2>&1 | grep secrets

You should see org.freedesktop.secrets in the output.

Making It Persistent

To ensure gnome-keyring starts automatically on login, add it to your PAM configuration. The gnome-keyring package typically installs PAM hooks automatically, but if your session doesn't go through a standard display manager (common with Hyprland), you may need to start it in your Hyprland config:

# ~/.config/hypr/hyprland.conf
exec-once = gnome-keyring-daemon --start --components=secrets

After setting up the secrets service, restart FortiClient:

sudo systemctl restart forticlient.service

You should now be able to save VPN profiles in the GUI.

The Wayland Problem: Buttons Don't Work

Here's where it gets truly frustrating. You've installed the right package, set up the secrets service, saved your VPN profile — and when you click Connect, nothing happens. No SAML popup. No error. The GUI shows "Connecting" and sits there forever.

The SSL VPN log at /var/log/forticlient/sslvpn.log reveals the issue:

[sslvpn:INFO] main:1781 State: Logging in
[sslvpn:DEBG] main:1689 Message to UI: 8
[sslvpn:DEBG] main:1707 90 bytes sent.

The VPN backend sends a message to the GUI (the SAML login window request), but the Electron-based GUI running natively on Wayland fails to open the popup. The buttons themselves may also not register clicks properly.

The Fix: Force XWayland

FortiClient's Electron GUI doesn't work correctly as a native Wayland client on Hyprland. The solution is to force it to run under XWayland using the --ozone-platform=x11 flag:

WAYLAND_DISPLAY="" DISPLAY=:1 \
  /opt/forticlient/gui/FortiClient --ozone-platform=x11

You can verify it's running under XWayland by checking:

hyprctl clients | grep -A15 "FortiClient"

Look for xwayland: 1 in the output. If it says xwayland: 0, it's running as a native Wayland client and will have the input/popup issues.

Permanent Wrapper Script

Create a wrapper script so you don't have to remember the flags:

#!/usr/bin/env bash
# ~/.local/bin/forticlient-vpn
# Force FortiClient to run under XWayland on Hyprland
export WAYLAND_DISPLAY=""
export DISPLAY="${DISPLAY:-:1}"
exec /opt/forticlient/gui/FortiClient --ozone-platform=x11 "$@"

Make it executable:

chmod +x ~/.local/bin/forticlient-vpn

You can also create a desktop entry to override the default launcher:

[Desktop Entry]
Type=Application
Name=FortiClient VPN
Exec=env WAYLAND_DISPLAY="" DISPLAY=:1 /opt/forticlient/gui/FortiClient --ozone-platform=x11
Icon=FortiClient
Terminal=false
Categories=Network;VPN;

Summary Checklist

If you're setting up FortiClient VPN on Hyprland from scratch, here's the complete sequence:

1. Install forticlient-vpn (not forticlient ZTNA edition)
2. Install gnome-keyring and ensure org.freedesktop.secrets is on D-Bus
3. Start the FortiClient service: sudo systemctl enable --now forticlient.service
4. Launch FortiClient with --ozone-platform=x11 to force XWayland
5. Add your VPN profile in the GUI (server, port, SAML authentication)
6. Click Connect — the SAML login popup should now appear

Troubleshooting

sudo systemctl stop forticlient

sudo sqlite3 /var/lib/forticlient/config.db \
  "UPDATE vpn SET value='0' WHERE config='sslvpn.options.warn_invalid_server_certificate';"

sudo sqlite3 /opt/forticlient/.config.db.init \
  "UPDATE vpn SET value='0' WHERE config='sslvpn.options.warn_invalid_server_certificate';"

sudo systemctl start forticlient

If you use Hyprland as your Wayland compositor, you’ve probably adopted hyprlock as your lock screen and hypridle as your idle daemon. It’s a clean, well-integrated setup — until one morning you wake up to find hyprlock has crashed overnight and your session is wide open.

This guide walks through why hyprlock crashes happen and how to build a three-layer defense that keeps your session protected no matter what.

The Problem

Here’s a typical lock-and-sleep workflow on Hyprland:

1. You lock your screen (Super+Ctrl+L or a dedicated lock key)
2. After a few minutes of inactivity, monitors turn off (DPMS)
3. After 30 minutes, the system suspends
4. Hours later, something wakes the system (Bluetooth event, USB device, scheduled wake)
5. hyprlock should show the lock screen — but it has crashed

The crash typically happens during the suspend/resume cycle. AMD GPUs (especially integrated Radeon graphics) are particularly prone to this: the GPU resources hyprlock holds become invalid when the display hardware powers down and back up.

When hyprlock crashes, you’re left with an unlocked desktop. If you’re away from your machine, that’s a security problem.

The Solution: Three Layers of Protection

Rather than hoping for a bug fix, we can build resilience into the system. Each layer catches failures the previous one might miss.

Layer 1: Hyprlock Watchdog Script

The most important piece. Instead of running hyprlock directly, we wrap it in a script that monitors its exit code and restarts it on crash.

Create ~/.config/hypr/scripts/hyprlock-watchdog.sh:

#!/usr/bin/env bash
# -----------------------------------------------
# Hyprlock Watchdog
# Wraps hyprlock and restarts it if it crashes.
# If it keeps crashing, suspends the system as a
# safety measure to protect the unlocked session.
# -----------------------------------------------

MAX_RESTARTS=5
RESTART_DELAY=1
CRASH_WINDOW=60  # Reset crash counter if stable for this many seconds

# Don't start if hyprlock is already running
if pidof hyprlock > /dev/null 2>&1; then
    exit 0
fi

crash_count=0

while [ $crash_count -lt $MAX_RESTARTS ]; do
    start_time=$(date +%s)

    hyprlock
    exit_code=$?

    # Exit code 0 = normal unlock by user
    if [ $exit_code -eq 0 ]; then
        exit 0
    fi

    end_time=$(date +%s)
    runtime=$((end_time - start_time))

    # If hyprlock ran for a while before crashing, reset the counter
    # (it was stable, this is likely a new/different issue)
    if [ $runtime -ge $CRASH_WINDOW ]; then
        crash_count=1
    else
        crash_count=$((crash_count + 1))
    fi

    logger -t hyprlock-watchdog "hyprlock crashed with exit code $exit_code after ${runtime}s (crash $crash_count/$MAX_RESTARTS)"
    notify-send -u critical "Lock Screen" "hyprlock crashed (exit $exit_code). Restarting... ($crash_count/$MAX_RESTARTS)"

    sleep $RESTART_DELAY
done

# Exhausted restart attempts — suspend to protect the session
logger -t hyprlock-watchdog "hyprlock crashed $MAX_RESTARTS times in rapid succession. Suspending system."
notify-send -u critical "Lock Screen" "hyprlock keeps crashing. Suspending system for safety."
sleep 2
systemctl suspend

Make it executable:

chmod +x ~/.config/hypr/scripts/hyprlock-watchdog.sh

How it works:

• When hyprlock exits with code 0 (user unlocked successfully), the watchdog exits too
• When hyprlock crashes (non-zero exit), the watchdog restarts it immediately
• If hyprlock ran for over 60 seconds before crashing, the crash counter resets (it was a one-off, not a crash loop)
• If hyprlock crashes 5 times in rapid succession, the watchdog gives up and suspends the system — better to suspend than leave the session exposed
• Every crash is logged via logger (check with journalctl -t hyprlock-watchdog) and shown as a notification

Layer 2: Systemd-Managed Hypridle

By default, most Hyprland setups start hypridle via exec-once in the Hyprland config. This is fire-and-forget: if hypridle crashes, it’s gone and your idle/lock/suspend chain is broken.

Hyprland ships a systemd user service at /usr/lib/systemd/user/hypridle.service with Restart=on-failure. If we use this instead, systemd will automatically restart hypridle when it crashes.

Step 1: Comment out the exec-once line in your autostart config (~/.config/hypr/conf/autostart.conf):

# hypridle is now managed by systemd (systemctl --user enable --now hypridle.service)
# exec-once = hypridle

Step 2: Enable and start the systemd service:

# Enable it (starts automatically on future logins)
systemctl --user enable hypridle.service

# Start it now (for the current session)
systemctl --user start hypridle.service

# Kill the old exec-once instance if it's still running
# Check PIDs first:
pgrep -a hypridle
# Kill the one that ISN'T the systemd-managed one (lower PID, usually)
kill <old-pid>

Step 3: Verify:

systemctl --user status hypridle.service

You should see Active: active (running) and Restart: on-failure.

Layer 3: Resume Guard in Hypridle

The final layer addresses the most dangerous moment: waking up from suspend. This is when hyprlock is most likely to crash (GPU resources are reinitialized, display state changes).

Update your ~/.config/hypr/hypridle.conf general section:

general {
    lock_cmd = pidof hyprlock || ~/.config/hypr/scripts/hyprlock-watchdog.sh
    before_sleep_cmd = loginctl lock-session
    after_sleep_cmd = hyprctl dispatch dpms on && (pidof hyprlock > /dev/null || loginctl lock-session)
}

The key changes:

• lock_cmd now uses the watchdog wrapper instead of plain hyprlock
• after_sleep_cmd now does two things: turns on the display AND checks if hyprlock is still alive. If hyprlock crashed during resume, it triggers loginctl lock-session, which fires the lock_cmd again (launching the watchdog with a fresh hyprlock)

Bonus: Consistent Keybindings

If your keybindings call hyprlock directly, they bypass the watchdog. Update them to use loginctl lock-session instead, which goes through hypridle’s lock_cmd:

In ~/.config/hypr/conf/keybindings/default.conf:

# Before (bypasses watchdog):
# bind = $mainMod CTRL, L, exec, hyprlock
# bind = , XF86Lock, exec, hyprlock

# After (goes through hypridle's lock_cmd → watchdog):
bind = $mainMod CTRL, L, exec, loginctl lock-session
bind = , XF86Lock, exec, loginctl lock-session

If you have a power.sh script that calls hyprlock directly for its lock action, you can update that too — or just rebind the key to skip the script entirely.

The Complete Flow

Here’s what happens now when you lock your PC and go to bed:

1. You press Super+Ctrl+L → loginctl lock-session fires
2. Hypridle catches it → runs lock_cmd → starts watchdog → starts hyprlock
3. 8 minutes idle → brightness dims to 10%
4. 10 minutes idle → (already locked, no-op)
5. 11 minutes idle → monitors turn off (DPMS)
6. 30 minutes idle → system suspends (before_sleep_cmd locks session again for safety)
7. Morning: something wakes the PC → after_sleep_cmd runs:
8. Turns on DPMS
9. Checks if hyprlock is alive
10. If not → loginctl lock-session → watchdog → fresh hyprlock
11. If hyprlock crashes during resume → watchdog catches it, restarts immediately
12. If hyprlock keeps crashing → system suspends as a safety net

At every point, something is watching something else. There’s no single point of failure.

Verifying Your Setup

After making all the changes:

# Reload Hyprland config
hyprctl reload

# Verify hypridle is running via systemd
systemctl --user status hypridle.service

# Test locking
loginctl lock-session

# Check watchdog logs after a lock/unlock cycle
journalctl -t hyprlock-watchdog --no-pager

# Monitor in real-time (in a separate terminal before locking)
journalctl -t hyprlock-watchdog -f

Troubleshooting

Hypridle won’t start via systemd: Check that WAYLAND_DISPLAY is set in your environment. The service requires it (ConditionEnvironment=WAYLAND_DISPLAY). If you’re having issues, run systemctl --user show-environment | grep WAYLAND.

Two hypridle processes running: You probably forgot to kill the old exec-once instance or forgot to comment it out. Run pgrep -a hypridle and kill the one not managed by systemd.

Lock screen never appears after resume: Check journalctl --user -u hypridle.service for errors. Make sure the after_sleep_cmd syntax is correct (the pidof check needs /dev/null redirection).

Watchdog suspends immediately: If hyprlock keeps crashing in a loop (5 times), the watchdog suspends for safety. Check journalctl -t hyprlock-watchdog for the exit codes. Common causes: GPU driver issues (try updating mesa/amdgpu), or Wayland protocol mismatches (update hyprlock).

Summary

The system went from “one crash = exposed session” to “multiple independent safety nets.” Your lock screen might still crash — but now something is always watching, ready to restart it or suspend the machine before your session is left unprotected.

Microsoft is building big in Denmark. In December 2020, the company announced its first Danish datacenter region, "Denmark East," covering sites in the Capital Region and Zealand. After five years of construction, that region is set to launch in the first half of 2026. Then, in December 2025, Microsoft announced a second region: "West Denmark," with three new facilities across Varde and Esbjerg municipalities, described as the company's largest single investment in its 36-year Danish history. Between 2023 and 2027 alone, Microsoft is committing $3 billion to datacenter capacity on Danish soil, and the West Denmark expansion will push that figure higher still.

For European IT leaders, the narrative looks like a win. Microsoft services running on Danish soil. Local jobs. Carbon-free energy. One step closer to keeping European data in Europe.

Then, on January 7, 2026, something else happened. And most organisations missed it entirely.

The quiet change inside Copilot

On that date, Microsoft enabled Anthropic's Claude AI models as a subprocessor across Microsoft 365 Copilot. For commercial tenants outside the EU, the toggle was set to ON by default. No action required. No notification to end users. Just a new AI model processing their data alongside OpenAI's GPT.

The features powered by Anthropic's Claude include Microsoft 365 Copilot in web, desktop, and mobile, the Researcher agent, Copilot Studio, Power Platform, Agent Mode in Excel, and the Word, Excel, and PowerPoint agents. These are not marginal features. They are core productivity tools that millions of knowledge workers use daily.

Here is the critical detail: Anthropic models are explicitly excluded from Microsoft's EU Data Boundary. Microsoft's own documentation states it plainly: "Anthropic models deployed in Microsoft offerings are currently excluded from the EU Data Boundary, and when applicable, in-country processing commitments."

For EU/EFTA and UK tenants, Microsoft set the toggle to OFF by default. A responsible decision. But the toggle exists. And it only takes one Global Administrator, perhaps under pressure to give users access to the latest Copilot features, perhaps without fully understanding the data residency implications, to flip it on.

What happens when the toggle gets flipped

When an EU tenant administrator enables Anthropic as a Microsoft subprocessor, the organisation is explicitly opting out of EU Data Boundary protections for data processed by those models. The data no longer needs to stay within EU/EEA infrastructure. Anthropic processes data across US, European, Asian, and Australian infrastructure, with storage in US data centres.

This is not a bug. Microsoft has been transparent about it. The information is available in the admin centre and in their documentation. But "transparent" and "widely understood" are not the same thing. How many IT administrators in Danish SMBs have reviewed Microsoft's subprocessor documentation? How many DPOs have been consulted before the toggle decision?

The risk is compounded by the fact that users see no indication of which AI model is processing their prompt in most Copilot experiences. An employee using Copilot in Word does not know, and cannot easily determine, whether their document content is being processed by OpenAI (within the EU Data Boundary) or by Anthropic (outside it). The admin made a single decision in a settings panel. The user is unaware.

Even without Anthropic: the datacenter illusion

Even with the Anthropic toggle safely in the OFF position, there is a deeper structural issue that Microsoft's Danish datacenters do not resolve.

Microsoft is a US corporation. Its Danish subsidiaries, the entities that will operate those Esbjerg, Varde, and Capital Region facilities, are controlled by a US parent company. Two pieces of US legislation make this distinction between where the data sits and where the company is incorporated critically important:

FISA Section 702 authorises US intelligence agencies to compel US companies to provide access to communications data of non-US persons. It applies to the company, not to the server. A Microsoft datacenter in Denmark is as reachable under FISA 702 as one in Virginia.

The CLOUD Act (2018) makes this explicit: US law enforcement can compel US companies to disclose data stored on servers outside the United States. The data does not need to be in the US. The company does.

The EU-US Data Privacy Framework (DPF), adopted in 2023, provides the current legal basis for this processing. But its two predecessors, Safe Harbor (invalidated 2015, Schrems I) and Privacy Shield (invalidated 2020, Schrems II), were struck down by the Court of Justice of the European Union for the same fundamental reason: US surveillance law provides inadequate protection for EU data subjects. The DPF rests on an executive order that can be modified by any future US president. A legal challenge, commonly referred to as Schrems III, is widely expected.

None of this makes Microsoft illegal or unusable. The DPF is in force. Microsoft's EU Data Boundary is a genuine engineering effort. For most European organisations, Microsoft 365 is the practical and lawful choice.

But EU datacenter does not equal EU data sovereignty. And your governance should reflect that.

The multi-model future

What makes the Anthropic integration particularly important is that it signals a direction, not just an incident. Microsoft's Business and Industry Copilot President Charles Lamanna framed it as giving customers "the flexibility to use Anthropic models too." Copilot is becoming a multi-model orchestrator, routing different tasks to different AI providers based on capability, not geography.

Today it is Anthropic. Tomorrow it could be another provider. The AI service your users interact with is no longer a single model from a single provider with a single set of data residency commitments. It is a platform that routes tasks behind the scenes, and each route may have different jurisdictional characteristics.

Where does your data actually go? AI vendor overview

To understand the real picture, you need to know where each major AI provider processes data, and where that provider is incorporated.

Green = EU-headquartered provider. Yellow = EU residency available or conditional. Red = no EU data residency.

The pattern here is clear: EU data residency from a US company is technically real but legally fragile. EU data residency from an EU company is structurally sound. Self-hosted models give you the most control but require the most investment.

What you should do now

1. Check the toggle. Log into the Microsoft 365 admin centre, go to Copilot, then Settings, Data access, AI providers operating as Microsoft subprocessors. Verify that Anthropic is disabled if your organisation requires EU Data Boundary compliance. Only a Global Administrator can change this setting.

2. Document the decision. Whether you keep Anthropic off or turn it on, document the rationale. Your DPO should be involved. If you enable it, record that you are consciously accepting data processing outside the EU Data Boundary and update your ROPA accordingly.

3. Classify your data. Not all data carries the same risk. Public marketing content processed by Anthropic outside the EU is a very different situation from internal HR documents or client contract details. A proper data classification, covering what can be processed by AI, under what conditions, and through which providers, is the foundation of governance in a multi-model world.

4. Monitor the subprocessor list. Microsoft can add new AI subprocessors. Review your tenant's subprocessor settings quarterly. Set a calendar reminder. Do not assume today's configuration is permanent.

5. Have a contingency plan. If the EU-US Data Privacy Framework is invalidated, every European organisation using Microsoft, OpenAI, Google, or any other US-headquartered cloud provider will need to reassess. Know which workloads can move to EU-headquartered providers. Start evaluating alternatives now, not when the CJEU ruling drops.

The uncomfortable truth

Microsoft investing billions in Danish infrastructure is genuinely good for Denmark. More local datacenters mean lower latency, local jobs, and better disaster recovery. Nobody is suggesting that European organisations should stop using Microsoft.

But European IT leaders need to understand what they are actually buying. A datacenter in Denmark gives you proximity. It gives you performance. It gives you a flag on a map that looks reassuring in a board presentation.

It does not give you sovereignty. Sovereignty requires that the data is beyond the legal reach of a foreign government, and as long as the company operating the datacenter is incorporated in the United States, that is not the case.

The organisations that understand this today, that classify their data, configure their admin toggles deliberately, and build contingency plans, will be the ones that navigate what comes next without scrambling.

On February 5, 2026, Anthropic released Claude Opus 4.6. It is a major update to their flagship AI model, and it brings capabilities that matter directly to anyone working with enterprise document management.

Not a paradigm shift. A solid step forward in what AI agents can practically do with documents, spreadsheets, and enterprise content. For organizations running SharePoint, Nextcloud, Documentum, or other DMS platforms, the update opens real efficiency gains if you know how to apply them.

What Opus 4.6 brings to the table

One million token context window

Previous Opus models processed 200,000 tokens, roughly 500 pages of text. Opus 4.6 extends this to one million tokens in beta, approximately 750,000 words.

For document management, this is the most relevant upgrade. A model with this context window can hold an entire migration scope: all source metadata, target mappings, and exception rules in a single working session. No chunking, no summarization loss, no context switching between batches. You describe the full picture, and the model reasons across it.

On the MRCR v2 benchmark, which tests retrieval accuracy in large contexts, Opus 4.6 scored 76% compared to 18.5% for Sonnet 4.5. That is the difference between a model that accepts large inputs and one that actually finds what you need inside them.

Agent teams

Claude can now split a task across multiple parallel agents, each handling a piece and coordinating with the others. Combined with Cowork, the desktop agent Anthropic launched in January 2026, this means non-technical users can describe an outcome ("audit these three SharePoint sites for retention policy compliance") and let multiple agents work on it simultaneously.

For document-heavy operations, parallel execution is practical. An agent team can review a document library, flag exceptions, draft a summary report, and prepare remediation steps concurrently rather than sequentially.

128,000 token output

Previous output limits forced the model to break large deliverables into multiple requests. Opus 4.6 can generate up to 128,000 tokens in a single response, roughly 96,000 words. A complete migration plan, a full compliance report, or a complete set of metadata mapping documentation can be produced in one pass.

Adaptive effort controls

The model now adjusts its reasoning depth based on task complexity, and developers can set explicit effort levels. A simple document classification task does not need the same computational investment as a regulatory compliance analysis. Organizations can optimize for cost without sacrificing quality where it matters.

Context compaction

A beta feature that lets the model summarize its own older context during long-running tasks. For multi-hour operations like processing an entire document library or conducting cross-reference analysis across thousands of files, compaction prevents the model from losing track of earlier work.

The office integration layer

Opus 4.6 arrives alongside expanded integrations that make Claude a practical participant in daily document work.

Claude in PowerPoint launches in research preview, integrating directly into PowerPoint as a side panel. The model reads existing layouts and fonts to match corporate templates, useful for generating stakeholder presentations from migration data or compliance findings.

Claude in Excel receives substantial upgrades for working with spreadsheet data, formulas, and analysis directly within Excel. For metadata inventories, permission matrices, and content type mappings, this turns Excel from a manual tool into a collaborative workspace.

Combined with Cowork for file system operations and Claude in Chrome for browser-based research, Anthropic is building a complete workspace agent. For document management professionals, this means the AI does not replace your tools. It operates alongside them, handling the repetitive parts while you focus on the decisions that require judgment.

What this means for document management

This is where the practical value lives. Opus 4.6 does not change what document management is. It changes how efficiently you can do it, if you bring the right expertise.

Migration planning and execution

Every data migration starts with the same problem: understanding what you have, where it needs to go, and what will break along the way. Source inventories. Metadata mappings. Content type transformations. Permission structures that need to be rebuilt. Exception rules for edge cases.

Traditionally, this analysis happens in stages. You inventory one site collection, map its metadata, document exceptions, then move to the next. With a million-token context window, a model can hold the entire scope simultaneously. Upload the complete source inventory, the target information architecture, and the migration rules, and the model can identify conflicts, flag unmapped content types, and draft transformation rules across the full dataset.

This does not eliminate the need for a migration specialist. It means the specialist spends less time on inventory and mapping mechanics and more time on the decisions that actually matter: which content structures to preserve, which to consolidate, and how to handle the hundreds of small exceptions that break automated migrations.

At Strator, we have run data migrations for some of Denmark's largest organizations across pharmaceuticals, finance, and healthcare. The pattern is always the same: 80% of the work is systematic and repeatable, 20% requires human judgment shaped by years of experience with specific platforms, regulatory requirements, and organizational politics. AI agents handle the 80% faster. The 20% is where consultants earn their value.

Compliance and governance

Regulated industries (pharmaceuticals under GxP and EMA requirements, finance under DORA and MiFID II, healthcare under patient data regulations) need continuous verification that their document management meets requirements. Retention policies, sensitivity labels, access permissions, and audit trails all require regular review.

Agent teams that work in parallel can scan document libraries, verify retention labels against policy, flag permission anomalies, and generate exception reports. Tasks that take a compliance team days to perform manually can be drafted in hours.

But the AI generates findings. A qualified professional validates them. In regulated environments, the signature on a compliance report carries legal weight. The AI cannot sign. A GxP-trained document management specialist can, because they understand not just what the label says but why it was applied, what regulatory context drove that decision, and what consequences follow from changing it.

This is where the human knowledge layer becomes essential. An AI agent can tell you that 47 documents in a validation folder have incorrect retention labels. It takes a regulatory specialist to determine whether those documents are superseded validation protocols that should have been archived, active records that were mislabeled during migration, or legacy content that predates the current retention policy entirely. Each scenario requires a different remediation path, and choosing wrong has audit consequences.

Daily operations and content processing

Beyond large projects, Opus 4.6 improves day-to-day document operations. The combination of large context and substantial output means practical tasks become faster.

Summarizing meeting series into decision logs. Extracting action items from project correspondence. Classifying incoming documents against an information architecture. Generating metadata suggestions for content that was uploaded without proper tagging. Drafting standard operating procedures from existing process descriptions.

None of these tasks are new. Document management professionals do them every week. The difference is that an AI agent can handle the first draft, and a professional can review, adjust, and approve it. The review takes minutes instead of the hours the drafting would have taken.

The collaboration model

The most productive way to think about Opus 4.6 is not as a replacement for expertise but as an amplifier. A junior consultant with AI assistance can produce first-draft deliverables at a speed that previously required senior-level efficiency. A senior consultant can focus their time on the judgment calls, client relationships, and strategic decisions that AI cannot replicate.

At Strator, we see this in practice. Our consultants carry deep knowledge of SharePoint, regulated industries, and enterprise information management built over years of implementation work. That knowledge does not become less valuable when AI gets better. It becomes more valuable, because the bottleneck shifts from "can we process this data fast enough" to "do we understand what this data means in context."

AI provides speed. Human expertise provides direction. The combination is where real efficiency gains happen.

The digital sovereignty dimension

There is one important consideration that European organizations should keep in mind.

Opus 4.6 introduces US data residency as an option, at a 10% price premium. European data residency is not currently available. Every prompt, every document processed by Claude, every agent team coordinating across your files is processed on US infrastructure.

For most document management tasks (working with public content, internal process documents, or non-sensitive operational data) this is perfectly workable. But for organizations subject to GDPR, NIS2, or DORA processing personal data, health records, or regulated content, the data residency question needs a clear answer before deployment.

Practical recommendations

Classify before you connect. Before granting any AI agent access to document libraries, classify the content by sensitivity. Public and internal-use documents are generally fine. Confidential, personal, or regulated data requires assessment, and may require on-premises or EU-hosted alternatives.

Understand what EU hosting solves and what it does not. Anthropic may eventually offer European data residency. For many organizations, that could be sufficient, provided they classify their content carefully and manage what the AI is allowed to access. If your data is not subject to strict regulatory controls, EU-hosted infrastructure combined with proper access governance is a reasonable path forward.

For regulated industries where data must never leave the organization's domain, tenant, or control (pharmaceuticals under GxP, finance under DORA, healthcare under patient data regulations) the issue is not where the servers are. As long as Anthropic is a US-incorporated, US-controlled company, it remains subject to US legal frameworks including FISA Section 702, the CLOUD Act, and related provisions. These grant US authorities the ability to compel access to data regardless of where it is physically stored. EU hosting on US-controlled infrastructure does not resolve this. The capability is impressive. The jurisdictional reality makes it incompatible with European regulatory obligations for controlled data.

Consider a DPIA regardless. Even for non-sensitive use cases, deploying Cowork or API-based agent teams for document processing likely triggers a Data Protection Impact Assessment under GDPR Article 35. Conduct it proactively. It will force the right conversations about what data goes where, and that clarity benefits the organization whether or not AI agents are involved.

If you need help assessing your document management strategy, particularly in regulated environments where compliance and data sovereignty matter, Strator has the experience to guide that conversation. We work with Denmark's largest organizations across pharmaceuticals, finance, and healthcare, and we understand both the technology and the regulatory landscape.

Get in touch

Pricing

Opus 4.6 maintains the same API pricing as its predecessor: $5 per million input tokens and $25 per million output tokens. Processing the full one-million-token context window costs $5. Generating a full 128K token output costs approximately $3.20.

For consumer access through claude.ai, Opus 4.6 is available on Pro ($20/month), Max ($100-200/month), Team, and Enterprise plans. Cowork is available on all paid plans.

In May 2025, Signal did something remarkable. The encrypted messaging app, trusted by journalists, activists, and security professionals worldwide, rolled out a feature called "Screen security" for its Windows desktop application. The purpose: to block Microsoft Recall from capturing Signal conversations.

Signal's engineering team explicitly stated they do not trust Microsoft's safeguards to be effective. When the maker of one of the world's most secure messaging apps builds defenses specifically against your AI feature, that says something.

Two months later, Brave browser and AdGuard followed suit. The same month, Penn's Office of Information Security issued a warning to its community: "Recall introduces substantial and unacceptable security, legality, and privacy challenges."

The pattern is now undeniable. Microsoft Recall, the AI feature that takes screenshots of everything you do on your computer every few seconds, has returned. After being pulled in June 2024 following public backlash, it reappeared in the Windows 11 24H2 update in April-May 2025.

Microsoft insists Recall is opt-in. But security researchers have identified troubling reactivation pathways: once enabled even once, Recall can be reactivated by anyone who knows the device PIN, no biometric authentication required. And Windows updates have a documented history of resetting privacy settings without warning.

The question is no longer whether Recall poses a privacy risk. The question is why Microsoft keeps pushing it.

What Recall actually does

Microsoft Recall continuously captures screenshots of your screen activity every few seconds. It then uses AI and optical character recognition to make everything searchable, creating a complete timeline of your digital life.

Every email you read. Every document you work on. Every website you visit. Every private conversation in Teams or WhatsApp. Every password you type. Every bank statement you view.

All of it. Captured. Stored. Indexed.

Microsoft positions this as a productivity feature, allowing you to "retrace your steps." But the implications extend far beyond convenience.

The security failures

Independent testing by TechTarget and Kaspersky has revealed that Recall's "Filter sensitive information" feature still misses critical data:

• Credit card numbers
• Bank account balances
• Social Security numbers
• Passwords

According to Ars Technica, some users have reported instances of credit card numbers, cheques, and emails with personal data being captured despite the filter. The sensitive information filter is not reliable. Users who trust it are exposed.

The third-party problem

Recall does not just capture your data. It captures other people's information too. WhatsApp conversations with contacts. Client documents under NDA. Confidential emails from colleagues.

The third parties whose data is captured never consented to being recorded. In enterprise environments, this creates significant legal exposure under GDPR, HIPAA, and PCI DSS.

Even worse: if a self-destructing WhatsApp or Signal chat is open on screen, Recall will save it anyway, despite the chat's privacy policies. Photos and videos intended for one-time viewing will be stored if just one person in the conversation uses Recall.

The troubled history

The story of Microsoft Recall is one of repeated controversy, withdrawal, and return. For the complete timeline with detailed coverage of each event, see our Microsoft Recall Timeline.

June 2024: Microsoft announced Recall with screenshots stored unencrypted in plaintext, enabled by default, impossible to remove. The UK ICO launched inquiries. Days later, Microsoft pulled the feature entirely.

September 2024: Microsoft announced a security overhaul: encryption, biometric authentication, and opt-in activation.

April 2025: Recall returned for Windows Insiders with security updates in place.

May 2025: Public rollout to all Copilot+ PC users. Signal immediately released its "Screen security" countermeasure.

July 2025: Brave and AdGuard announced they would block Recall by default. The same week, Microsoft introduced Copilot Vision, sending screenshots to Microsoft's cloud servers, deliberately excluded from the EU.

October 2025: Gaming Copilot controversy: users discovered screenshot capture without clear consent, installed automatically through Xbox Game Bar.

The "opt-in" problem

Microsoft's official documentation states clearly: "Snapshots are not taken or saved unless you choose to use Recall."

But security researchers have identified significant gaps in this "opt-in" promise.

Reactivation without biometrics

Kaspersky's analysis found that once Recall has been enabled even once, it can be reactivated by anyone who knows the device PIN, no biometric authentication required. A family member, coworker, or anyone with temporary access to your unlocked computer can turn Recall back on.

Settings reset after updates

Proton's research warns: "Windows updates have a history of reversing privacy settings without warning." Users who disabled Recall may find it quietly reactivated after the next update cycle. There is no way to monitor if Recall gets turned back on automatically.

Low bar for reactivation

Windows Forum analysis notes that Microsoft made this feature "opt-in during installation, but with a low security bar for reactivation if it's ever been enabled. After initial consent, it becomes much easier to re-enable with minimal user interaction."

Workplace pressure

In enterprise environments, IT administrators can enable Recall at the system level. While Microsoft requires end users to activate it on their individual computers, the reality of workplace dynamics means consent may not be truly voluntary. Employees can feel pressured to enable features pushed by their employer.

This raises fundamental questions about informed versus coerced consent.

Institutional and industry response

Penn's security office

Penn's Office of Information Security reviewed Recall in April 2025 and issued an unambiguous conclusion:

"Recall introduces substantial and unacceptable security, legality, and privacy challenges."

Penn is not a small organization with limited IT resources. It is a major research university with extensive security expertise. When institutions of this caliber reject a feature as "unacceptable," it carries weight.

Signal's active defense (May 2025)

Signal's response was more than a warning. It was a technical countermeasure.

In May 2025, Signal announced "Screen security" for its Windows desktop application. The feature uses DRM techniques to render screen capture attempts as black rectangles. It is enabled by default for all Windows 11 users running Signal desktop.

Signal explicitly stated they do not trust that Microsoft's safeguards can be universally effective now or in the future. The trade-off: Signal's approach also blocks legitimate screenshots, including those needed by accessibility software like screen readers.

Brave and AdGuard join the resistance (July 2025)

Two months after Signal, both Brave browser and AdGuard announced they would block Recall by default.

Brave's approach is more surgical than Signal's. The browser marks every tab as "private" to the operating system, preventing Recall capture while maintaining normal screenshot functionality for accessibility tools. As Brave noted: "We think it's vital that your browsing activity on Brave does not accidentally end up in a persistent database, which is especially ripe for abuse in highly-privacy-sensitive cases such as intimate partner violence."

AdGuard's implementation goes further: it blocks Recall system-wide across all applications, not just within one app.

When three of the most privacy-focused software makers in the industry (Signal, Brave, and AdGuard) all build countermeasures against the same Microsoft feature, the message is clear.

Regulatory scrutiny

The UK Information Commissioner's Office launched inquiries in May 2024. EU regulators are watching. GDPR compliance remains in question, particularly around:

• Consent mechanisms for third-party data capture
• The "legitimate interest" basis for continuous surveillance
• Data minimization requirements

For organizations operating in regulated industries, Recall may create compliance exposure that no productivity benefit can justify.

Protecting yourself

Check if Recall is running

Open Task Manager (Ctrl+Shift+Esc) and look for "Recall" in the processes list. If you see "Recall (preview)" running and you never enabled it, investigate immediately.

Disable Recall (basic)

1. Press Windows+i to open Settings
2. Click "Privacy & security" in the left sidebar
3. Navigate to "Recall & snapshots"
4. Turn it off

Disable Recall (permanent)

For a more permanent solution, according to Proton's guide:

1. Search "Turn Windows features on or off" in the taskbar
2. Uncheck "Recall"
3. Restart your computer

This removes Recall from the system entirely, rather than just disabling it.

Enterprise: use Group Policy

IT administrators can disable Recall via Group Policy:

1. Disable Group Policy: "Allow Recall to be enabled"
2. Restart PCs
3. This completely removes the Recall toggle and related components

Use privacy-focused software

Consider switching to browsers and apps that block Recall:

• Brave browser (v1.81+): Blocks Recall by default while preserving normal screenshot functionality
• Signal desktop: Blocks all screenshots including Recall
• AdGuard: System-wide Recall blocking

Check after every update

This is the most important step: verify Recall is still off after each Windows Update. Microsoft's update process has a documented history of resetting privacy settings without warning.

The bigger picture

Recall represents a fundamental shift in how Microsoft views your computer. It is no longer just a tool you use. It is a platform that Microsoft believes should record everything you do "for your convenience."

The pattern continues

In July 2025, Microsoft introduced Copilot Vision, an extension of Recall that takes data collection even further. While Recall processes screenshots locally, Copilot Vision sends them to Microsoft's cloud servers for analysis. Microsoft deliberately excluded Copilot Vision from the European Union, a tacit acknowledgment that its cloud-based model cannot comply with GDPR.

In October 2025, Gaming Copilot sparked another privacy controversy when users discovered it was capturing gameplay screenshots and sending data to Microsoft servers by default, installed automatically through Xbox Game Bar without clear consent.

When you combine these developments:

• Recall's continuous local screenshots
• Copilot Vision's cloud-based screen analysis
• Gaming Copilot's default-on screenshot capture
• Windows 11's mandatory telemetry

A pattern emerges. Microsoft wants your data. All of it. And they are making it increasingly difficult to say no.

Signal, Brave, and AdGuard didn't build Recall countermeasures as a marketing stunt. They built them because their security teams concluded that Microsoft Recall poses a genuine risk to user privacy, and that Microsoft's safeguards cannot be fully trusted.

Penn's Office of Information Security reviewed Recall and found it "unacceptable." The UK Information Commissioner's Office is investigating. Independent testing shows the sensitive information filter fails to catch passwords and financial data. Security researchers have documented reactivation pathways that undermine the "opt-in" promise.

Yet Microsoft continues to expand its screen-capture ecosystem. Recall locally. Copilot Vision in the cloud. Gaming Copilot by default.

The market has spoken: Copilot+ PCs made up less than 2% of Windows laptops sold in early 2025. Users are not embracing Microsoft's vision of an AI that watches everything they do.

Check your Task Manager. Disable Recall if you find it. Switch to privacy-respecting browsers. Keep checking after every update. Because in 2025, your Windows PC may be watching everything you do, and the "opt-in" promise may be thinner than Microsoft suggests.

Timeline

• Microsoft Recall Timeline - DocuPoint

Part 3 of 3 in the "1984 → 2048: Europe's Choice" trilogy

Denmark's Justice Minister stood at a podium in Copenhagen and said the quiet part out loud:

"We must break with the totally erroneous perception that it is everyone's civil liberty to communicate on encrypted messaging services."

Read that again. A sitting European minister, not Chinese, not Russian, European, declared that private communication is not a fundamental right.

This is not the warning. This is the event the warning was about.

In 1984, O'Brien is the Inner Party member who tortures Winston into loving Big Brother. He doesn't hide what the Party is. He explains it: "We are not interested in the good of others; we are interested solely in power."

Peter Hummelgaard is Europe's O'Brien. And unlike Orwell's fiction, he's real, he's in power, and he's telling you exactly what he intends to do.

In Part 1, we mapped the three digital superstates. In Part 2, we documented how Europe is being besieged. Now comes the question that matters: Is there a fourth way, or will Europe become the thing it claims to oppose?

Europe possesses something Winston Smith never had: democratic institutions that still function, regulatory power that still bites, and 450 million citizens who can still choose. The question is not whether resistance is possible. The question is whether Europe will use what it has, or whether it will build the surveillance state itself.

The clock is striking thirteen. The hour is not yet lost. But the chimes are coming from inside the house.

Europe's resistance: what Winston couldn't have

In 1984, there is no resistance. The Brotherhood turns out to be a Party fiction. Emmanuel Goldstein may not exist. The proles are kept too ignorant and entertained to revolt. Hope is an illusion the Party manufactures to identify dissidents.

Europe in 2026 is not Oceania. Not yet.

What Winston Smith couldn't have

Winston had nothing. Europe has everything it needs, if it chooses to use it.

Democratic institutions: flawed but real

Winston lived under a one-party state where elections were theater and courts were instruments of terror. Europeans live under democracies where governments can be voted out, where courts can strike down surveillance laws as the ECJ did with the Data Retention Directive. Citizens can sue corporations and win, as Max Schrems did against Facebook, twice. Regulators can impose billion-euro fines, as with Meta's €1.2 billion GDPR penalty in 2023.

These institutions are imperfect. They are slow. They are sometimes captured by the interests they should regulate. But they exist, and that existence is the difference between 1984 and 2026.

Regulatory power: the Brussels Effect

Europe has something no other bloc possesses: the power to set global standards through market access. The "Brussels Effect" means that companies wanting access to 450 million consumers must comply with European rules, and often apply those rules globally rather than maintain separate systems.

This power has already reshaped the digital world. The GDPR of 2018 forced global privacy policies to improve; California's CCPA and Brazil's LGPD follow its model. The Digital Services Act of 2024 requires platforms to address illegal content, algorithmic transparency, and researcher access. The AI Act, also 2024, became the world's first comprehensive AI regulation, banning social scoring, restricting facial recognition, and requiring transparency for high-risk systems. The Digital Markets Act forces Big Tech "gatekeepers" to open their platforms, allow interoperability, and stop self-preferencing.

The superstates can lobby against these regulations. They can threaten retaliation. They can delay compliance. But they cannot ignore a €17 trillion market. Europe's regulatory power is sovereignty in action.

450 million people, €17 trillion economy

Winston was alone. Europe is not.

The European Union represents 450 million people, larger than the United States. Its €17 trillion GDP makes it the world's third-largest economy. A market large enough to set global standards, if it chooses to, with unified regulations, free movement, and a shared currency for most members.

This is not a small nation that can be bullied into compliance. This is a bloc that can, if it chooses, build its own infrastructure, set its own standards, and chart its own course. The question is not capability. It is will.

Citizens are waking up

In 1984, Winston writes: "If there is hope, it lies in the proles." But the proles never organize. European citizens already have.

Privacy as a value, not just regulation

GDPR did not emerge from bureaucratic void. It emerged from decades of European privacy activism, from the memory of surveillance states both Nazi and Communist, from a cultural understanding that privacy is not "having something to hide" but having the right to a self that is not observed, measured, and monetized.

Recent surveys show this consciousness growing. 45% of European organizations increased their interest in digital sovereignty solutions between 2024 and 2025. Nextcloud reports a threefold increase in requests for sovereign cloud alternatives.

Open source as resistance

The Party controlled all technology. Europeans can build their own.

European open source projects are creating alternatives to every major American platform. Nextcloud in Germany offers self-hosted cloud storage, collaboration, and office suite capabilities, now used by the German federal government, French ministry of education, and thousands of European organizations. Matrix provides a decentralized, encrypted messaging protocol adopted by the French government, German armed forces, and NATO for secure communications. PeerTube from France offers federated video hosting with no tracking, no ads, and no algorithmic manipulation. Mastodon, also German, provides a decentralized social network where federated servers mean no single point of control or failure.

These are not toys. They are production-ready alternatives used by governments and enterprises. They prove that sovereignty is technically possible. The only question is adoption.

Citizens demanding change

The Party suppressed all dissent. European civil society fights back.

European Digital Rights (EDRi) coordinates a network of 44 NGOs defending digital rights across Europe. La Quadrature du Net in France successfully sued to stop algorithmic video surveillance in Grenoble. noyb (None of Your Business), Max Schrems' organization, has filed hundreds of GDPR complaints, winning landmark cases against Facebook, Google, and Amazon.

The proles in 1984 never organized. European citizens already have.

The clock strikes thirteen

The opening line of 1984: "It was a bright cold day in April, and the clocks were striking thirteen."

The impossible time signals that something is fundamentally wrong. The world looks normal (bright, cold, April) but the clocks tell a truth that conscious minds have learned to ignore.

In 2026, the clocks are striking thirteen. Most Europeans don't notice.

Warning signs we're ignoring

Facial recognition: banned in theory, spreading in practice

The AI Act prohibits live facial recognition in public spaces from February 2025. But the exceptions swallow the rule: law enforcement can use it for victims, terrorists, and serious crime suspects. Critics warn these exceptions are "very vague." Diego Naranjo of European Digital Rights calls it "the normalisation of mass surveillance."

"Nothing to hide" as accepted truth

The Party's greatest victory was making citizens police themselves. The modern equivalent: "If you have nothing to hide, you have nothing to fear."

This inverts the presumption of innocence. It assumes surveillance is neutral, that only the guilty need privacy, that watchers never abuse power.

History screams otherwise. The Stasi files showed how "ordinary" surveillance destroyed lives. The NSA's LOVEINT scandal revealed analysts spying on love interests.

Chat Control: the test case

We opened this article with Hummelgaard's declaration. Now consider what it means in practice.

The Chat Control proposal would mandate scanning of all private digital communications, including encrypted messages. The technical mechanism, "client-side scanning," would require messaging apps like Signal, WhatsApp, and Telegram to scan content before encryption, effectively creating a backdoor into every private conversation.

The Signal Foundation threatened to leave the EU market rather than comply. Intelligence agencies warned against it. The UN emphasized that undermining encryption would breach privacy rights.

The justification changes. The surveillance is identical.

Germany ultimately voted against. Public pressure forced Denmark to drop mandatory scanning in late 2025. But the proposal continues toward final negotiations with "voluntary" scanning requirements that critics warn will become mandatory.

The fourth way cannot be built on surveillance. The moment Europe breaks encryption "for the children," it loses the moral authority to criticize America for breaking it "for terrorism" or China for breaking it "for stability." Privacy is not divisible. Backdoors are backdoors. Once built, they will be exploited.

What happens if Europe fails

Forget 2084. What does 2030 look like if Chat Control passes?

• Every photo you send is scanned before encryption
• Every message is analyzed by AI that flags "suspicious" content
• Your encrypted conversation with your lawyer? Not encrypted anymore
• Signal leaves the EU market; you use whatever compromised app remains
• The infrastructure exists, and the next government, or the one after that, will find new reasons to use it

Once built, surveillance infrastructure doesn't get dismantled. It gets expanded. It gets normalized.

The path to absorption runs through the next five years.

The final line of 1984: "He loved Big Brother."

Winston Smith's defeat was total, not because the Party broke his body, but because it conquered his mind.

Orwell imagined totalitarianism would require torture. The platforms discovered it only requires dopamine.

"We needed to sort of give you a little dopamine hit every once in a while," confessed Sean Parker, Facebook's founding president. "It's a social validation feedback loop... exploiting a vulnerability in human psychology."

The Party used pain. The platforms use pleasure. The algorithm hijacks reward circuits with variable rewards, the same mechanism that makes slot machines addictive. Every notification is a pull of the lever.

The Party had to build a surveillance state. We crowdfunded ours through app purchases.

Big Brother doesn't need a telescreen on your wall. You bought one, put it in your pocket, and check it 150 times a day.

The superstates didn't conquer Europe's minds through invasion. They're doing it one dopamine hit at a time.

What you can do

Winston Smith had no options. You do.

Switch your tools:

• Email: ProtonMail or Tuta (European, encrypted)
• Cloud storage: Nextcloud (European, self-hostable)
• Messaging: Signal (while it lasts in Europe) or Element/Matrix
• Search: Ecosia or Qwant (European alternatives)
• Browser: Firefox (nonprofit, privacy-focused)

Demand action:

• Contact your MEP about Chat Control: europarl.europa.eu/meps
• Support digital rights organizations: EDRi, noyb, La Quadrature du Net
• Ask your employer: Where is our company data stored? Who can access it? What's our plan for digital sovereignty?

Stay informed:

• Follow the Chat Control negotiations at chatcontrol.eu
• Read the EFF's surveillance coverage
• Support independent European tech journalism

The superstates are forming. The perpetual war is already underway, fought not with bombs but with algorithms, not for territory but for attention, not for bodies but for minds.

The question is whether Europe will be a player or a province. A civilization or a colony. A fourth way or a footnote.

In Orwell's world, the clock struck thirteen and nobody noticed.

In our world, we can still hear the chimes, if we can tear ourselves away from our screens long enough to listen.

The clock is striking. Will you keep scrolling?

Series context

Position: Part 3 of 3 in "1984 → 2048: Europe's Choice" trilogy
Previous: 1984 → 2048: Europe Under Siege (Part 2)
Next: —

This concludes the "1984 → 2048: Europe's Choice" trilogy.

Part 2 of 3 in the "1984 → 2048: Europe's Choice" trilogy

"We are not interested in the good of others; we are interested solely in power."
— O'Brien to Winston Smith, 1984

Brexit and Trump weren't the attack. They were the rehearsal.

In 2016, Russian intelligence tested its weapons on the Anglosphere, and both targets fell. The troll farms worked. The funding pipelines worked. The division algorithms worked. Now the arsenal is aimed at the continent those operations were designed to isolate.

Europe is the real target. The siege has already begun.

In Part 1, we mapped the three digital superstates and their perpetual war. Now we turn to their primary battlefield: Europe.

The siege of Europe doesn't use tanks and missiles. It uses troll farms and bank transfers, compromised politicians and captured platforms. Russia has spent a decade cultivating far-right movements across the continent. America has built a surveillance infrastructure that treats European data as a resource to be extracted. China manufactures the hardware that enables both.

But Europe's greatest vulnerability isn't the superstates' aggression, it's Europe's own digital naivety. The continent that invented privacy as a human right has made itself utterly dependent on foreign platforms, foreign hardware, and foreign clouds.

In Orwell's 1984, Europe doesn't exist. It has been absorbed: the west into Oceania, the east into Eurasia. That absorption is happening now, in real time, through mechanisms Orwell never imagined.

The long game: from Crimea to Cambridge to Kyiv

The documented strategy: divide and conquer

Russia's strategy to weaken Western unity is not speculation. It is doctrine. The "Gerasimov Doctrine" (named after Russian Chief of General Staff Valery Gerasimov) explicitly describes how information warfare, political subversion, and strategic ambiguity can achieve objectives that conventional military force cannot. The goal: fracture NATO and the EU before any shot is fired.

The timeline tells the story:

• 2014: Crimea - Russia annexes Crimea while the West responds with sanctions but no military intervention. The message: the West is divided and will not fight.
• 2016: Brexit & Trump - Both campaigns saw documented Russian interference. The U.S. Mueller Report confirmed the Internet Research Agency (IRA) operated "troll farms" targeting American voters. UK intelligence identified the same Russian actors attempting to influence the Brexit referendum.
• 2022: Ukraine - Full-scale invasion, betting that a divided West would fragment under economic pressure. The bet nearly worked.

This is not a conspiracy theory. The U.S. Intelligence Community's January 2017 assessment concluded with "high confidence" that Russian President Vladimir Putin "ordered an influence campaign" targeting the 2016 U.S. election. The Mueller Report documented "sweeping and systematic" interference by the IRA, which created fake American personas on social media and organized real-world rallies on both sides of divisive issues.

The European front: what we know

The troll farms go continental

The Internet Research Agency's operations targeted both the U.S. 2016 election and UK Brexit referendum simultaneously. The same St. Petersburg-based troll farm ran concurrent influence campaigns across Western democracies, creating fake personas, amplifying divisive content, and organizing real-world events on both sides of the Atlantic.

Following the money

Russian funding to European parties has been documented by the European Parliament's "Tip of the Iceberg" report. The French National Front (now RN) received €11 million in loans from Russian banks in 2014. Austria's FPÖ signed a formal "friendship agreement" with Putin's United Russia party in 2016. The money trail is not speculation; it is documented.

The German connection

AfD-Kremlin connections include documented meetings between party officials and Russian actors. In 2024, MEP Maximilian Krah was detained and questioned by the FBI over suspicions of receiving Kremlin funds through the Voice of Europe operation. German intelligence continues to monitor these contacts.

Caught on camera

The Ibiza Scandal of 2019 captured Austria's FPÖ vice-chancellor on video discussing political donations from someone claiming to be a Russian oligarch's niece. The footage exposed the eagerness for Kremlin money at the highest levels of European politics. The vice-chancellor resigned within days.

What remains unproven

Cambridge Analytica's role in Brexit remains contested. While documentaries have presented compelling narratives linking the data firm's Brexit work to its later Trump campaign involvement, the UK Information Commissioner's investigation found "no significant breaches" by the firm in the Brexit referendum context. The connection is plausible but not proven to the same standard as Internet Research Agency operations.

Direct coordination between Brexit, Trump campaigns, and the Kremlin has not been established with the same evidentiary standard as Russian interference itself. The operations may have been parallel rather than coordinated. We should be careful not to see conspiracy where opportunism may suffice as explanation.

The rightward shift: coincidence or consequence?

Since 2020, the same pattern has played out across Europe's largest democracies.

Germany: the unthinkable returns

The AfD won 20.8% in the 2025 federal election, their best result ever. In September 2024, Thuringia became the site of the first far-right state election victory in Germany since World War II. Party leader Alice Weidel has explicitly cited Brexit as a model for "Dexit", Germany's exit from the European Union. Meanwhile, German intelligence warns of ongoing Russian cultivation of AfD contacts. The party that once seemed a fringe protest movement now shapes the national conversation.

France: Le Pen's long march

Marine Le Pen's Rassemblement National won 31.4% in the 2024 European Parliament elections, their highest share since 1984. The party now holds 125 seats in the National Assembly after the July 2024 snap elections—a historic breakthrough that would have been unimaginable a decade ago. Le Pen herself is currently barred from the 2027 presidential run due to an EU fund embezzlement conviction, but the movement she built has joined the Patriots for Europe group alongside Hungarian Fidesz and Austrian FPÖ, forming a continental bloc.

Austria: through the looking glass

The FPÖ won 28.8% in the 2024 parliamentary elections, their best result in history. Herbert Kickl has been tasked with forming Austria's first far-right-led government since World War II. A former intelligence chief warned that FPÖ in government would be "a considerable security problem" for international partners. The party maintains documented ties to Russia despite claiming its "friendship treaty" with Putin's United Russia has expired.

The pattern: EU-critical but not EU-exit

What makes the current shift strategically sophisticated is that these parties no longer explicitly call for EU exit. They learned from Brexit's chaos. Instead, they advocate for a "Europe of sovereign nations" rather than federalism, demanding "national priority" for citizens over EU residents. They push for opt-outs from common policies on asylum, climate, and defense. They assert the primacy of national law over EU law, despite treaty violations. And they work to block further EU integration and enlargement at every turn.

This is the 1984 strategy adapted for 2026: You don't need to physically conquer territory if you can hollow out the institutions from within.

Critical assessment: causation vs. correlation

Is the European rightward shift caused by Russian interference, or is Russia simply exploiting existing discontent? The honest answer: both, and the distinction matters less than we'd like.

What we know

Russian state actors have systematically funded, promoted, and coordinated with European far-right parties. These parties promote policies aligned with Russian strategic interests: weaken NATO, fragment the EU, end Ukraine support. The timing of Russian interference correlates with major electoral disruptions, from Brexit to Trump in 2016. Security services across Europe have issued warnings about far-right parties' Russian connections.

What we cannot prove

We cannot definitively prove that Brexit or Trump would not have happened without Russian interference. We cannot prove that Cambridge Analytica's techniques were developed on Brexit and then deployed for Trump. We cannot prove that there is a single coordinated "master plan" rather than opportunistic exploitation. Correlation is not causation, and intellectual honesty requires acknowledging the limits of our evidence.

The conclusion that matters

Whether or not Russia "caused" Europe's rightward shift, it has demonstrably amplified and exploited it. The parties most aligned with Russian interests are gaining power across the continent. The policies they promote would achieve Orwell's Eurasia outcome, European absorption into the Russian sphere, through democratic means rather than military conquest.

In 1984, Big Brother conquered through force. In 2026, the conquest can come through the ballot box.

The real vulnerability: European digital naivety

Here's what Europeans must confront: Russia didn't build the weapons it uses against us. We handed them over.

Russia's Internet Research Agency troll farms operated on American platforms (Facebook, Twitter, YouTube) that Europe adopted wholesale without building alternatives. The disinformation that fractures European unity flows through infrastructure we don't control, governed by algorithms we can't audit, owned by companies that answer to foreign courts.

This wasn't inevitable. Other regions made different choices.

South Korea, a country of 51 million people, built and maintained its own digital ecosystem. Naver dominates search with 63% market share (Google has just 31%). KakaoTalk is the universal messaging app: virtually every Korean uses it. Naver and Kakao together control over 70% of Korea's digital advertising market, forming what analysts call a "walled garden" that limits American platform dominance.

Japan built LINE with 186 million users across Asia, dominating messaging in Japan, Taiwan, and Thailand. Russia has VK (72 million users) and Telegram. China's ecosystem (WeChat with 1.28 billion users, Weibo, Douyin) is entirely domestic.

Europe could resist. With 450 million people and a €17 trillion economy, it had the market power to demand alternatives or build its own. It chose dependency.

Russia is merely the most aggressive exploiter of a vulnerability that all three superstates recognize:

The three enablers of European weakness

1. Social Media Colonization - Europe has no major social platforms. Facebook has 308 million European users, TikTok 150 million. When Russian trolls, Chinese influence operations, or American political campaigns want to reach European citizens, they use American platforms that European regulators can fine but not fundamentally control. The DSA is a bandage on a severed limb.

2. Hardware Dependency - Europe designs chips (ASML's lithography machines are essential to every advanced processor), but manufactures almost none. Chinese factories build the phones in European pockets. The surveillance capabilities baked into hardware, whether Chinese backdoors feared by Western intelligence or American ones revealed by Snowden, exist in devices Europe cannot inspect at scale.

3. Cloud Subjugation - Seven out of every ten bytes of European data live on American servers. When Washington sneezes, Berlin's email goes down. When Amazon has a bad quarter, European startups lose their infrastructure. European data is subject to the CLOUD Act, accessible to American intelligence, governed by American law. When Microsoft can suspend the International Criminal Court's email, and AWS can deplatform any customer within 24 hours as it did with Parler, European sovereignty is revealed as a polite fiction.

The Superstates Don't Compete for Europe, they share it

The question isn't whether Russia, America, or China poses the greater threat. The question is why Europe built a digital civilization on foundations it doesn't control.

Russia weaponizes European vulnerabilities. America monetizes them. China manufactures the hardware that enables both.

Europe's 1984 nightmare isn't being conquered by one superstate. It's being colonized by all three simultaneously, each taking the piece that serves its interests.

Europe's 1984 nightmare

In Orwell's world, Europe doesn't exist

This is not metaphor. Open 1984 and look at the map Orwell drew.

Oceania comprises the Americas, the British Isles, Australasia, and southern Africa. Eurasia spans the entire Eurasian landmass from Portugal to the Bering Strait. Eastasia covers China, Japan, and Southeast Asia.

Where is Europe?

Western Europe—France, Germany, the Low Countries, Scandinavia—is a perpetual warzone, fought over but never truly held. In the novel's backstory, Britain was absorbed into Oceania (the American sphere) in the 1950s. Continental Europe fell to Eurasia (the Russian sphere). The European civilization that gave the world the Enlightenment, human rights, and democratic governance simply... ceased to exist as an independent entity.

Orwell wrote this in 1948, projecting forward to 1984. He was describing the logic of superpower competition: small and medium powers get absorbed or destroyed. There is no room for a third way.

We are now living the test of whether Orwell was wrong.

The current trajectory: digital absorption in progress

The absorption Orwell imagined through military conquest is happening through digital dependency:

• Seven of every ten bytes of EU data live on American servers
• Energy dependence was Russian until 2022, and the pipelines can't be unbuilt overnight
• The phone in your pocket was assembled in China, from chips designed in America, running software that reports to both
• Your political opinions are shaped by American algorithms and disrupted by Russian operations

Europe in 2026: a digital colony caught between empires, each taking what it needs.

The "Pretty Version" of 1984

Orwell got one thing wrong: he assumed totalitarianism would be ugly.

In 1984, the Party rules through deprivation, fear, and violence. The telescreens are mandatory. The Two Minutes Hate is compulsory. Room 101 breaks the body to conquer the mind. The boot stamps on a human face, forever.

But history teaches a different lesson: empires built on violence eventually fall. Empires built on desire endure.

The Soviet Union fell because it could not provide what people wanted—consumer goods, freedom, opportunity. The American cultural empire spread through blue jeans, Coca-Cola, and Hollywood, things people chose to embrace. You cannot sustain an empire that only takes. The empires that last are the ones that give people what they desire, then extract value from the dependency they create.

In 2026, control wears a friendlier face:

The Party understood that humans can be broken by pain. Silicon Valley discovered they can be captured by pleasure. The result is the same: a population that cannot think clearly, cannot act collectively, cannot resist effectively.

We are not tortured into compliance. We are entertained into it.

Doublethink in the digital age

In 1984, "doublethink" means holding two contradictory beliefs simultaneously and accepting both as true. War is Peace. Freedom is Slavery. Ignorance is Strength.

Each superstate practices its own version:

America declares privacy a fundamental right while operating PRISM, tapping Angela Merkel's phone, and passing the CLOUD Act to reach any data stored by American companies, anywhere in the world. Rules-based international order, except when American interests say otherwise.

China demands non-interference in its internal affairs while exporting surveillance systems to 80+ countries. The cameras that watch Uyghurs in Xinjiang now watch dissidents in Zimbabwe. Belt and Road promises "win-win cooperation", until Sri Lanka loses a port and Zambia offers its electrical grid as collateral.

Russia claims NATO expansion threatens its security while invading Georgia, annexing Crimea, and launching full-scale war against Ukraine. It justifies the invasion as "denazification" while employing the Wagner Group, whose founder displayed Nazi insignia. It demands information sovereignty while operating troll farms that flood Western social media with disinformation.

For Europeans, the challenge is not choosing the "good" side. There is no good side. Each superstate speaks of values while practicing power. Both surveil. Both extract. Both subordinate European interests to their own.

Winston Smith was taught to accept that 2 + 2 = 5 if the Party said so. Europeans are being asked to accept that surveillance is privacy, that dependency is partnership, that absorption is alliance.

The answer must be: No. We can count.

The siege is real. The walls are breached.

Russia cultivates politicians who would dismantle the EU from within. America extracts data through platforms we cannot control. China manufactures the devices we cannot inspect. And Europe—450 million people, €17 trillion in GDP—has made itself dependent on all three.

In Orwell's 1984, Winston Smith asks O'Brien what the future looks like. The answer: "A boot stamping on a human face, forever."

But that was the ugly version. The version that breeds resistance.

The 2026 version is different. The boot is a comfortable sneaker. The stamping is a gentle massage. The human face is scrolling, always scrolling, too entertained to notice what it has surrendered.

But Europe is not Oceania. Not yet.

In Part 3: The Fourth Way, we examine what Europe still possesses that Winston Smith never had: democratic institutions, regulatory power, 450 million citizens who can still choose.

Series context

Position: Part 2 of 3 in "1984 → 2048: Europe's Choice" trilogy
Previous: 1984 → 2048: The Three Digital Superstates (Part 1)
Next: 1984 → 2048: The Fourth Way (Part 3)

For 25 years, answering "What can this user access?" in SharePoint required PowerShell scripts or third-party tools. That changed in late 2025 when Microsoft added user-centric permission snapshot reports to the SharePoint Admin Center.

The feature is genuinely useful, and has clear limitations. Here's what administrators need to know.

What Microsoft now offers

The Data Access Governance reports in SharePoint Admin Center include three snapshot report types:

Site permissions for your organization provides a tenant-wide view of permission structures, total users per site, guest access, "Everyone except external users" exposure, and sharing link counts.

Site permissions for users answers the user-centric question: given a specific person, which sites can they access? The report distinguishes between site-level and item-level access, showing whether permissions were granted directly or through groups.

Sensitivity labels for files identifies sites containing files with specific sensitivity labels.

Licensing requirements

These reports require SharePoint Advanced Management (SAM) licensing at $3 per user per month, licensed for every user in the tenant. For a 150-person organization, that's $5,400/year.

Organizations with at least one Microsoft 365 Copilot license ($30/user/month) automatically receive SAM features for all administrators—Microsoft positioned these tools as Copilot readiness features for auditing permissions before AI can surface sensitive content.

Key limitations

Even with SAM licensed, these reports have constraints:

• 30-day refresh cycle — reports can only be regenerated monthly
• 48-hour data latency — reports capture data from up to 48 hours before generation
• Maximum 5 concurrent reports — you cannot generate unlimited user reports
• No change tracking — snapshot reports show current state, not who changed permissions or when
• CSV export only — no native Power BI integration, alerting, or automated workflows

Third-party alternatives

For organizations needing more than monthly snapshots, several established tools fill the gaps:

• Syskit Point offers comprehensive permission management with automated access reviews, lifecycle management, and detailed audit trails. Strong integration with Microsoft 365 governance workflows.
• DeliverPoint runs as an SPFx solution entirely within your tenant, no data export required. Provides real-time reporting, permission snapshots with point-in-time recovery, and site owner self-service.
• ShareGate combines migration capabilities with permission reporting. The Permissions Matrix Report provides cross-site visibility without PowerShell.
• Cognillo SharePoint Essentials Toolkit offers a free community edition with permission reports at site, list, and item level—accessible for smaller organizations evaluating their needs.
• SolarWinds Access Rights Manager provides enterprise-grade access governance across multiple platforms, with automated compliance reporting and scheduled audit delivery.
• ManageEngine SharePoint Manager Plus supports hybrid environments (SharePoint Online plus on-premises 2013-SE), with scheduled reporting and secure delegation to technicians.

Quick comparison

When to use what

Microsoft's native reports are sufficient when you:

• Already have Copilot licenses (SAM included)
• Need quarterly or monthly permission audits
• Focus primarily on Copilot readiness assessments
• Have straightforward permission structures without frequent changes

Third-party tools are essential when you:

• Require daily or real-time permission visibility
• Need permission change auditing with historical tracking
• Want site owners to self-manage permission hygiene
• Operate hybrid SharePoint environments
• Have compliance requirements demanding continuous monitoring
• Need automated alerting on permission changes

Practical recommendation

Microsoft's native reports fill a 25-year gap and provide genuine value for periodic organizational assessments and Copilot preparation. For basic quarterly audits, they're now sufficient.

Organizations with mature governance requirements, daily auditing, change tracking, automated compliance workflows, or hybrid environments—will find the native capabilities too constrained.

The most practical approach may be hybrid: use Microsoft's native reports for periodic tenant-wide assessments while deploying a specialized tool for continuous governance in high-sensitivity areas.

After 25 years, we finally have native user permission reports. They won't solve everything, but they're a solid foundation.

Sources:

• Microsoft Learn: Site permissions for users report
• Microsoft Learn: Data access governance reports
• Microsoft Learn: SAM Licensing