Microsoft admits error in UK Parliament testimony over ICC sanctions

Microsoft has admitted to providing inaccurate testimony to the UK Parliament regarding its handling of US sanctions against the International Criminal Court's chief prosecutor, Karim Khan. The software giant has formally apologized to the Business and Trade Committee and requested corrections to the parliamentary record after senior director Hugh Milward's testimony last week contained factual errors about the company's role in suspending Khan's email services.

During the parliamentary hearing, Milward told MPs that the ICC, "not Microsoft," had made the decision to terminate email services to the sanctioned prosecutor. He stated that Microsoft had "worked with the ICC throughout the whole period" and that it was the ICC's decision to respond to the US sanctions, not Microsoft's.

However, Microsoft has now acknowledged this account was incorrect. In a statement to The Register, a Microsoft spokesperson said: "We have apologized to the Business and Trade Committee for the inaccuracy and asked for the record of the hearing to be corrected. We were in touch with the ICC throughout the process that resulted in the disconnection of its sanctioned official from Microsoft services. At no point did Microsoft cease or suspend its services to the ICC."

The controversy stems from Khan's sanctioning by the Trump administration over the ICC's investigation into alleged war crimes and crimes against humanity, including efforts to prosecute Israeli officials. The suspension of Khan's Microsoft email access has become a flashpoint in the broader debate about digital sovereignty in Europe, with Gartner estimating that investment in sovereign cloud services will more than triple from 2025 to 2027.

The original reporting that contradicted Microsoft's parliamentary testimony came from technology activist Bert Hubert, a former regulator of Dutch intelligence services. Hubert confirmed to The Register that Dutch press reports accurately described the situation: Microsoft had informed the ICC that US sanctions required denying Khan access to its services, and that if the ICC did not suspend the prosecutor's access, Microsoft would terminate email services for the entire organization.

The ICC ultimately decided to suspend Khan's email services based on this ultimatum. This sequence of events directly contradicts Milward's testimony that the ICC independently made the decision without pressure from Microsoft.

Microsoft's error in parliamentary testimony is particularly significant given the heightened sensitivity around digital sovereignty in Europe since Trump's return to power. European organizations are increasingly questioning their reliance on US-based technology providers amid growing geopolitical tensions. The incident has contributed to a broader trend of European entities seeking alternatives to American cloud services.

The ICC itself has moved away from Microsoft's ecosystem, adopting OpenDesk, an open-source office and collaboration suite provided by the German Centre for Digital Sovereignty (ZenDiS). This shift reflects a growing European preference for domestically controlled digital infrastructure.

Microsoft has attempted to address European concerns through initiatives like its European Digital Resilience Commitment, announced in April last year. The company pledged to make certain commitments legally binding across all its European contracts. However, these assurances have been undermined by admissions in French court proceedings that Microsoft cannot guarantee digital sovereignty if US authorities invoke the Cloud Act to demand access to data stored on foreign servers.

The Business and Trade Committee has published a transcript of the hearing that records Milward's evidence as originally spoken, without additional corrections or footnotes. According to parliamentary practice guidelines, witnesses can submit proposed alterations "confined to the correction of inaccuracies in the reporting of the evidence, or to the correction of matters of fact which do not materially alter the sense of the answer."

This incident highlights the complex position of US technology companies operating in Europe during a period of strained transatlantic relations. Major providers like AWS, Microsoft, and Google are attempting to launch "digital sovereign cloud solutions" to reassure European customers, but skepticism remains high. Airbus's recent tender for a European sovereign cloud to handle sensitive workloads underscores the growing demand for alternatives to US-based infrastructure.

The episode also raises questions about corporate accountability when testifying before legislative bodies and the importance of accurate information in policy discussions about technology regulation and digital sovereignty. As European organizations continue to reassess their technology dependencies, incidents like this may further accelerate the shift toward domestically controlled digital infrastructure and services.