Cloud Lock-In Is a Geopolitical Risk

Europe relies on AWS, Azure, and Google Cloud for 70% of cloud, creating non-zero risk of denial if tensions escalate. Trump’s ICC sanctions caused Microsoft to cut a prosecutor's email; drone strikes on AWS data centers underscore digital infrastructure as a weapon. The risk includes full lockout because US law overrides EU data rules.

The proposed answer is commoditization: de facto standards like S3-compatible storage, Kubernetes, and Postgres wire protocol make cloud services interchangeable. Multi-cloud and local-first architectures reduce lock-in and enable switching, but they demand higher operational complexity, duplicate storage and egress costs, and force reliance on least-common-denominator features.

AT Protocol (BlueSky’s foundation) and local-first software illustrate commoditization in social media and collaboration. AT Protocol allows users to migrate identity, data, and social graph for credible exit. Local-first keeps primary data on users’ machines, making cloud sync services swappable. Both show decentralization shifts power without sacrificing user experience.

For engineering leaders, cloud dependency is now a geopolitical vulnerability, not merely a cost lever. Action steps—investing in portable architectures, standards-based tooling, and local-first for file-editing workloads—require careful trade-off analysis. The risk is real but probabilistic; panic is unwarranted, yet resilience planning is essential.