The Last Colony.

AHistory has a well-documented fondness for irony, and it has rarely been more tidily arranged than in the simultaneous movements of two continents in early 2026. While Denmark was methodically testing its escape from Microsoft's embrace, and France was ordering its quarter-million public servants onto a homegrown platform by 2027, Australia was doing something rather different. It was signing another five-year deal.

The agreement, known in the language of procurement as VSA6, the sixth iteration, in case anyone was counting, commits the Commonwealth's agencies to Microsoft's full enterprise stack: Azure, Microsoft 365, Dynamics 365, Copilot, and the attendant security and identity services that now constitute the digital nervous system of the federal government. It commences July 2026. It is, the Digital Transformation Agency assured anyone who asked, a very good deal. Strong protections. Stable pricing. Capped increases. A $1.55 million training fund for ethical AI use, which works out to roughly the cost of a modest Sydney apartment.

One is not obliged to be uncharitable. The deal does, on its own terms, deliver what it promises: consolidated purchasing power, discounts the DTA estimates at $1.6 billion between 2019 and 2024, and reduced administrative friction for smaller agencies. These are genuine efficiencies. They are also, it should be noted, precisely the kind of efficiencies that make it very comfortable to stay exactly where you are.

Across the other side of the planet, Europeans were reaching different conclusions about comfort, and about what, precisely, they were comfortable with.

The Danish calculus, when examined closely, is not especially exotic. Copenhagen's municipal Microsoft licensing bill had risen by 72 percent in five years. The government's 2026–2029 strategy allocated 80 million kroner to test alternatives, not to abandon Microsoft overnight, but to run pilots, prove reversibility, and loosen the grip. France was less tentative. Its January 2026 order to phase out Microsoft Teams, Zoom, Google Meet and Cisco Webex from all government departments came with a ready replacement: Vizio, a platform built by the government's own digital unit and hosted on French infrastructure under French law. Germany's Schleswig-Holstein has been migrating its 30,000 government workers to open-source software for years, with budgets and timelines rather than slogans.

These are not acts of ideology. They are acts of self-interest, driven by a question that Europeans have found increasingly difficult to set aside: who actually controls the infrastructure their societies run on?

The legal mechanism at issue is the US CLOUD Act, which grants American authorities the power to demand data from American technology companies regardless of where that data physically resides. A server in Sydney, Frankfurt, or Dublin is no protection. The company holding the keys remains subject to American jurisdiction. Microsoft said as much in a French parliamentary hearing, it could not guarantee data would not be transmitted to US authorities if legally required. This was not a confession. It was a description of how American law works, delivered in a room full of people who had apparently been waiting for someone to say it aloud.

None of this occurs in a vacuum. The same period that produced VSA6 also produced an American administration that threatened to annex a NATO ally's territory, imposed tariffs on countries it formally considers friends, and conducted its diplomacy toward Europe and the Pacific with a bluntness that older alliances were not, perhaps, designed to absorb. One does not need to catastrophise to notice that the assumption underpinning arrangements like VSA6, that Washington's interests and Canberra's interests are, in all foreseeable circumstances, aligned is doing more work than it used to. Alliances have terms and conditions too. They are simply less often written down.

Australia has heard all of this. The Privacy Act has been under review. Digital sovereignty has made occasional appearances in policy documents. There are IRAP assessments and whole-of-government cloud computing policies and references, in the VSA6 documentation, to "enhanced data residency commitments." The architecture of reassurance is elaborate and, within its own logic, coherent. What it does not address is the jurisdictional problem, which is not a technical problem. No data residency commitment, however enhanced, alters the nationality of the company holding the contract. Microsoft is an American company. A warrant served in Washington can reach a server in Sydney. This is not a criticism of Microsoft. It is a description of how law works, and it is precisely the description that France, Denmark, and Germany have decided they can no longer politely ignore.

Australia is a country that has, with some justification, devoted considerable cultural energy to examining the dynamics of dependency, who controlled the land, who wrote the laws, whose interests the institutions served. That examination has been serious, often uncomfortable, and genuinely unfinished. It is therefore a little striking that when the same question arrives in a different register, not land but data, not settlement but software, not the nineteenth century but the twenty-first, the answer is: different situation entirely, nothing to see here, have you seen the discount on Azure?

Because the situations are not, in the ways that matter, entirely different. To have the infrastructure of your civic life, your government's communications, your citizens' records, your institutions' internal deliberations, running through systems that are legally answerable to another country's courts is a form of dependency with a reasonably long history. The only notable innovation is that this time, we are paying for the privilege, and calling it a saving.

The Europeans are not being romantic about this. They are being, in the unglamorous tradition of northern pragmatism, careful. They have read the CLOUD Act. They have watched the last few years of American foreign policy. They have done the arithmetic on licensing costs. And they have concluded, without drama, that the sensible thing is to hold the keys yourself.

It is a conclusion that tends to follow, eventually, from taking sovereignty seriously. Australia will get there. The question is whether it takes another five years, or another five iterations of the same deal.

Perhaps VSA7 will be different.

If you know someone who’d appreciate this, they probably will. Please share. Sharing's nice.
...
If you enjoyed this article and would like to see more, 'Buy the Goose a Coffee →'.
...
The views expressed are those of the correspondent. Factual claims draw on publicly available sources.