Taking back control of our data

When American law reigns over European data, the only response is to rebuild a culture of digital sovereignty, piece by piece, NAS by NAS, one step at a time.

The European “sovereign cloud,” a legal illusion

In December 2025, a legal analysis commissioned by the German Federal Ministry of the Interior confirmed that American authorities can access data stored on European servers. The physical location of data offers no protection whatsoever against American surveillance. The finding is unequivocal. The Cloud Act of 2018, combined with the Stored Communications Act and Section 702 of FISA, allows American authorities to demand data from cloud providers, regardless of where that data is physically hosted. What matters is the control exercised over the company processing the data. If the parent company is American, or if the company has significant commercial ties with the United States, the data can be claimed. The European subsidiaries of Microsoft, Google, and Amazon are therefore directly affected.

In June 2025, Anton Carniaux, head of legal affairs at Microsoft France, testified under oath before the French Senate. He acknowledged that he could not guarantee that French data would not be seized by American authorities. Even data encryption does not provide sufficient protection: American law can require providers to retain data in unencrypted form so it can be handed over on demand. AWS (Amazon Web Services) claims it has never transmitted data from companies stored outside the United States, but only commits to contesting excessive requests, with no guarantee of success.

The “sovereign cloud” offerings from American hyperscalers increasingly resemble what some call “sovereign washing”: a marketing veneer that changes nothing about the legal reality. The only way to escape the Cloud Act would be to use exclusively European providers with no capital ties to the United States. Yet AWS (Amazon), Azure (Microsoft), and Google Cloud (Alphabet) together account for more than 65% of the global market. As mathematician David Monniaux noted in Le Monde on 23 October 2025: “What would happen if Trump ordered Big Tech to stop providing cloud services to our government, our public services, our armed forces?” This is simply the application of the American Cloud Act, which compels any American company to obey its own country’s laws first, regardless of European legislation.

Some will respond that this hypothesis amounts to alarmist speculation. But Monniaux insists: the American government, which has already expressed its desire to take over Greenland, clearly could not care less about law, let alone international or foreign law. Just because something has not happened yet does not mean it cannot happen. And this kind of event is unfortunately all too predictable. The question is no longer whether it will happen, but when, in what context, and with what consequences.

What we have already lost: delegation as abdication

This legal analysis only confirms a deep trend I have been observing and documenting for years: we have collectively accepted a massive transfer of responsibility. Our most personal documents no longer reside in our carefully organized binders on our bedroom shelves, nor in the physical archives of our institutions. They now inhabit an abstract space, managed by private companies to which we pay a subscription — the freemium model giving us just enough free storage to get us hooked before charging us and locking us into dependency.

This massive migration to the cloud, which began some fifteen years ago, represents an anthropological rupture that Sherry Turkle analyzes in Reclaiming Conversation: we become “connected but alone,” dependent on infrastructures we no longer control. We no longer manage our own data — we have abdicated that fundamental responsibility. Digital writing, as Kenneth Goldsmith proposes in Uncreative Writing (2006), now encompasses data, texts, sounds, images, and videos; it is our entire heritage that has been made fragile, because it is now almost entirely digital.

The philosopher Hartmut Rosa speaks of “alienation” to describe our relationship to a technical world we no longer master. And the consequences are already concrete: the attack on the National Museum of Natural History in Paris in 2025, the brutal shutdown of Megaupload by the FBI in 2012 where millions of legitimate users lost their data overnight, the OVH fire in Strasbourg in 2021 that permanently took down over 400,000 websites, and more recently still, the fire at a government data center in South Korea in September 2025, where 750,000 civil servants lost all their work files (nearly 900 terabytes of state data vanished in an instant, with no possibility of recovery).

But the risk is not only that of accidental loss. It is the risk of losing sovereignty. State documents stored under foreign jurisdiction potentially violate national sovereignty laws and principles. And if an authoritarian drift were to occur in the country hosting our data, blackmail would become terrifyingly effective — immediate and total.

The issue is not technical, it is cultural

I want to stress this point, because it is the heart of my argument: the problem is not primarily technical. All the tools exist. What is missing is the culture. It is an attitude of abdicated responsibility, a chosen infantilization when it comes to digital matters, a voluntary dependency we place ourselves in, and which we need to shift culturally.

I experience this myself. For years, I have wanted to host my own calendar instead of using Google Calendar. And I still haven’t done it. Not because the technical side is beyond me, but because I haven’t taken the trouble to find a community of knowledgeable people around me who could help me set it up. Today, AI can produce an easy-to-follow tutorial. But I still haven’t taken the plunge. So it really is a question of culture, of social fabric — not of IT skills. The same goes for our email: we use Google’s mail servers, we can’t magically leave them overnight, but we can decide to start down that path.

Think twice: wanting our digital data storage to require zero effort and to be entirely delegated to someone else reveals our acceptance of dependency. Consider the analogy with a physical library: we buy or build shelves, we install them, we carry our books in boxes, we organize them. We physically take on that responsibility. Why should digital exempt us from all effort? This absence of effort signals our state of dependency: someone else does the work for us, making us dependent on their decisions. The old shoeboxes people used to keep in their attics, where they stored family photos and documents — we now need to replace them with computing capacities we can integrate ourselves, and which really are not that complicated.

And what is striking is that even turning to a “free” or “ethical” social network does not solve the problem. A free social network, even a European one, remains a third-party service: we have no control over it. That network can shut down overnight, and we can lose our data. Even on an “ethical” social network, it is not us. We are outsourcing to other people — we saw this with the OVH fire in Strasbourg. The question runs deeper than simply choosing a platform: it concerns our very ability to own our data.

The NAS: our new digital shoebox

Reclaiming our digital sovereignty begins with a concrete, material, simple act: setting up a NAS at home or within one’s organization. A NAS (Network Attached Storage) is a hard drive with special capabilities, permanently switched on in your office and plugged into your Internet router. It is accessible remotely from a computer or phone, and provides shared office documents, file sharing, calendars, contacts, music, video, applications... NAS devices provide roughly the same services as commercial cloud services — and often better ones. The fundamental difference is that it happens under your own control and responsibility. For basic use, NAS devices can be configured by non-technical people.

I recently convinced a French intellectual friend of mine, deeply committed to left-wing politics, who nonetheless had all his data with Google and the like, to buy a NAS. He did, and he is happy with it. This small victory seems significant to me, because it shows that the barrier is not technical: it is a matter of relearning sovereignty over one’s own data, of organization, of backup. Here was a person who, out of political conviction, knew perfectly well that concentrating his data with American tech giants was problematic, but who had not taken the step because he lacked the cultural push, the example, the community to support him.

Entrusting your data to Google means accepting that an American multinational holds considerable power over your digital life. Conversely, hosting your data at home restores a responsibility similar to the one we had with our paper documents. The difference between the two is in fact enormous. And this autonomy does not preclude complementarity: you can duplicate your data to an external service for security, using an encrypted external backup to which the provider does not hold the key. You thus benefit from the infrastructure of major corporations while avoiding dependency. The reverse approach also works: continuing to use Google Cloud out of habit while setting up a local duplication strategy to preserve your sovereignty. These solutions, seemingly complex, are becoming increasingly accessible.

Learning to back up as we learn to tidy our homes

Incremental backup is the heart of this new culture. In simple terms, it means ensuring that every change to your files is automatically copied to a second storage medium, ideally located somewhere else. Digital data must be duplicated on two separate media, kept in two different locations. This protects against hardware failure, water damage, burglary, and accidental deletion. For the future, it is recommended to copy these media onto new ones every four to five years, ensuring compatibility with newer interfaces. Yes, it is work. Yes, it requires follow-through. It is the responsibility of our heritage — part of our contemporary reality.

Are we not responsible for maintaining our homes? The same applies to digital data. Care for your digital data and its storage media as you would care for your precious books, because your digital data is no less material than your books. It has the advantage of being duplicable without loss, but the disadvantage of lacking the durability of a book, which you only need to place on a shelf to preserve over time.

And in this area, the question of organization is key. Before backing up, you need to know where your data is. How many of us know precisely where our family photos, administrative documents, and personal writings are? Scattered across personal hard drives, cloud services, email inboxes — this data is our heritage, and we often do not even have a map of it.

What schools should teach: building a server, not using Word

In schools, instead of teaching and using Word — which is completely absurd — children should be made aware of these sovereignty issues, because they are political questions. Imagine a classroom exercise where middle-school students assemble a NAS server from a Raspberry Pi and a USB drive plugged into it, on which they can store data and set up automatic backup systems to other NAS devices. In a few hours, these students would have understood in material terms what data storage is, where files are physically located, and why it matters to know who controls them. What is more, they would have learned many skills — especially cooperation skills — and would have grasped the concepts on their own.

The material cost of such an exercise is negligible: a Raspberry Pi costs between 40 and 80 euros, a USB drive a few euros more. And the educational benefit would be immense: learning that there is nothing magical about digital technology, that it does not exist in the clouds, that our data is always physically stored somewhere. As Mark Alizart points out in Informatique Céleste (2017), the divine symbolism of digital technology is a trap: if we do not concern ourselves with where our data is saved and how durable that storage is, no “almighty God” is going to do it for us.

This education should not be limited to the technical side. It should explain why using LibreOffice rather than Word is a political choice: free software is co-developed by a community for the common good, while proprietary software makes us dependent on private industries to access our own documents. 95% of the Internet’s infrastructure and data centers run on Linux, a remarkably mature piece of free software. The multinationals themselves rely on this free software to deliver their services, acknowledging that no proprietary software can match its reliability for critical applications.

In local government: breaking free from the comfort of dependency

Local authorities, small and large, are unfortunately — with rare exceptions — engaged in a massive movement of outsourcing to the major American cloud corporations, because it achieves economies of scale. The apparent advantages are numerous: it seems cheaper, responsibility for backups is transferred, users already know these dominant tools. We think we are saving time, money, efficiency. But what we lose is our sovereignty: the ability to know where our data is, who owns it, and to govern it under our own law. This dependency exposes businesses and public administrations to concrete risks: rising costs over the long term, service interruptions, exposure to American extraterritorial laws, and an irreversible loss of heritage in the medium term — the loss of our history, our written records.

But inspiring examples do exist. The French national gendarmerie replaced its Microsoft office suite with a free one, then moved nearly all its Windows workstations to its own Linux distribution, GendBuntu. It is one of the rare public bodies to have developed a long-term strategy against this dependency. Denmark, under the leadership of its digital minister Caroline Stage Olsen, announced a bold decision: her ministry, gradually followed by others, will stop using Microsoft tools. Out with the Office 365 cloud, out with Word and Excel, replaced by LibreOffice. As she aptly puts it: “We will never move toward our goal if we don’t start somewhere.”

The city of Lyon recently chose to manage all its IT with free software, leaving Microsoft behind. This means more work — that is undeniable. But a city that manages its own systems remains entirely under the scope of French law and can perfectly well use external services for encrypted backups, where the provider has no access to the content. In that case, the external service is used for security; it is not an alienation. The French state itself has built a nominally sovereign digital service for public use, La Suite numérique, which works rather well.

Imagine the potential of the contributive approach: if every municipality adopting Linux and LibreOffice created a team dedicated to improving the tools — benefiting its own staff and citizens, but also the global community through shared improvements — the individual effort would remain modest while the collective improvement reached unprecedented levels. These tools would quickly become superior to commercial solutions. But this requires an initial political commitment to invest in the collective. The effort must be carried by local authorities more than by individuals — that is precisely their political role.

Micro-politics of reclaiming sovereignty: concrete steps

How do we actually do it? Here is a gradual path toward autonomy that everyone can follow at their own pace.

• First step: become aware of where your data is. Take inventory: where are my photos, my documents, my emails, my calendars, my contacts? With whom? Under which jurisdiction? It is a simple but revealing exercise. Most of us will discover that virtually all of our digital heritage is in the hands of two or three American companies.
• Second step: acquire a NAS. Brands like Synology, QNAP, or now Ugreen offer devices whose basic configuration is accessible to non-technical users. You install your documents, photos, calendar, music, and applications on it, and access it from your phone just as you would Google Drive. The cost: between 200 and 500 euros for a device that will last years, compared to monthly cloud subscriptions that never end, and through which we become tenants of our data (just as with music — we used to own our records, and now we lose access to everything if we stop paying the monthly subscription).
• Third step: set up automatic backup of the NAS. To a second drive stored elsewhere — at a friend’s place, at the office — or to a European backup service like Infomaniak in Switzerland, with encryption. This is not creating dependency: it is securing data that you still own, and to which the provider does not hold the decryption key.
• Fourth step: gradually migrate your services. Start with the simplest: replace Google Photos with your NAS’s photo gallery, replace Dropbox with your NAS’s file sharing. Then, when you feel comfortable, migrate your calendar, your contacts, even your email to a trusted European host. You cannot change everything overnight, and that is fine. What matters is starting.
• Fifth step: talk about it. Share your experience, help someone close to you take the step, build around yourself the mutual support community that is so sorely lacking. Because that is exactly where the problem lies: the technology exists, but not yet the culture. And culture is born only through sharing.

The time of sovereignty is a political time

How do we regain our sovereignty? The answer lies in a cooperative approach: discussing, drawing inspiration from successful experiences, staying informed, agreeing to devote attention to it. The time dedicated to digital sovereignty, to backing up our data, to being aware of where it is stored, must be formalized. It is not useless, tedious technical time — it is political time in the noblest sense.

If we see this time as political time, as time for emancipation and autonomy, we will radically shift our perspective. As the popular saying goes, “a problem well stated is half solved.” If we avoid asking ourselves the right questions about our digital autonomy, we will inevitably suffer the consequences one day. Lawrence Lessig warned us in 1999: “Code is law” — code acts as a form of law, it regulates our actions, limits our freedoms or opens new ones, often invisibly and immediately. Without all becoming specialists, we must discuss and share our digital practices. It is a political act as concrete as sorting our waste or choosing how we get around.

The point is not for everyone to become a geek. That is not it at all. But for people to realize that it is worth thinking about, and that they can, if they choose, participate through their choices in a real societal project — one that rests on acts that may seem trivial. That it is not complicated, not boring to be responsible for your own data, and that you can be fully supported and encouraged within cooperative systems that make it constructive and even fun.

This awareness is particularly crucial for elected officials and local government staff, funded by our taxes. Their digital choices commit our collective future. The mass adoption of Microsoft tools and the hosting of public data with this American giant may be practical choices for IT departments, but they are politically reckless. The political and societal cost of this dependency will far exceed the investment needed to build sovereign systems.

Building the culture we lack

How do we change the culture on these issues? That is the whole challenge. I deeply believe that this change will not come from the top. It will come slowly, from the micro-politics of groups, from communities of practice, from mutual aid workshops, from awareness-raising moments within organizations. These moments must be part of a democratic process, avoiding expert discourse that claims to hold superior knowledge. In a genuinely democratic society, every person makes an essential contribution from their own position. No contribution is minor.

The spirit of the Linux world’s “install parties” — those convivial gatherings where volunteers help newcomers install Linux on their computers — is a model of what this culture could become. You learn by doing, you exchange, you demystify. This approach should be extended to setting up NAS devices, configuring backups, migrating to sovereign services. “NAS parties,” so to speak, where you would show up with your brand-new hard drive and leave with your personal server configured and running.

Communities already exist around free software, from Framasoft to the GULLs (Free Software User Groups), to the Chatons (Collective of Alternative, Transparent, Open, Neutral, and Supportive Hosting Providers). These initiatives, still on the margins, carry within them the seeds of a profound cultural transformation. But they need to move beyond the circle of insiders to reach the general public, teachers, elected officials, families.

It is this political culture of tools that we need to pass on. Through this path of personal sovereignty politics, of thinking about ourselves projected into the future and the long term, we can escape the dictatorship of the present — that sort of hybrid between the dystopias of Orwell and Huxley. Digital sovereignty goes beyond mere technology choices. It engages cultures, ways of thinking, of dialogue, of exchange. Its construction therefore benefits from the contribution of every person, whatever their technical skill. It is in this diversity that our collective strength lies.

It is through this awareness and this gradual reappropriation that we will regain our grip, our footing, and our power over our future, our democracy, and our personal freedom. Digital sovereignty is not a matter for technology enthusiasts: it is one of the conditions of our personal and collective political autonomy.