OpenInfra GM Warns of 'Kill Switches' as Sovereignty Threatens Cloud Infrastructure

At last week's Kubecon, amidst the AI hype, a more sobering topic emerged: digital sovereignty and the threat of government-mandated "kill switches" on critical infrastructure. Thierry Carrez, General Manager of the OpenInfra Foundation, raised concerns that tech companies might be forced by their governments to deploy mechanisms that could shut down services for geopolitical leverage.

Carrez frames this as "the survival problem" - a core component of what he sees as true digital sovereignty. "A lot of people are just talking about digital sovereignty as like a catchphrase for a bunch of things," he explains. "The way I look at it is what are we meaning? It's all about building a resilience against something, right? But what are we exactly talking about? What are the scenarios we are actually trying to address?"

He identifies multiple layers of sovereignty concerns: legal jurisdiction over data storage and processing, supply chain dependencies (both software and hardware), and the looming threat of kill switches that could disable critical infrastructure.

Unlike many hypothetical threats, Carrez believes the kill switch scenario is increasingly plausible. "It's something we need to build resilience against," he says. "I think that the threat is going to be leveraged more in negotiations... just like 'Agree to this, or something bad might happen to your critical infrastructure.'"

By "negotiations," Carrez means geopolitical discussions where the mere threat of infrastructure shutdown could yield significant leverage. "Some governments already have the capability to force their companies to not collaborate with overseas organizations," he notes. "It's more the potential of the threat that we need to address than necessarily surviving the action."

Hardware dependencies present another long-term sovereignty challenge. Carrez points to the concentration of chip manufacturing in Taiwan and the potential for supply chain disruptions. "It's all about having alternatives," he explains. "The leverage is there if there is only one provider, and sometimes just having the ability to switch from one to another is enough."

He suggests exploring alternatives like China-based chip vendors or building domestic manufacturing capacity. "It's not that we don't have the knowledge on how to make them. It's just like it was more convenient to use Taiwan and others to build them."

Regulation will play a crucial role in driving sovereignty adoption, according to Carrez. "Regulation is going to be key because you will have to accept some difference," he says. "I'm not necessarily saying it's a downgrade, but it's going to be sufficiently different to have a cost in switching. And so, if that cost is not covered, companies are going to continue using what they've always been using, and the vulnerability will still be there."

He cites extreme examples like nuclear plant maintenance systems running on major cloud providers as scenarios where regulation should mandate local alternatives. "For certain types of workloads, there is going to have to be some mandate from at Europe level or national level that, like, it's not reasonable to run your nuclear plant maintenance systems on Amazon, you know?"

Carrez also warns against open source single-vendor products, which remain vulnerable to acquisition and consolidation. "It's vulnerable to acquisition," he said, "and so you still keep that vulnerability because you put all your eggs into one basket."

Instead, he advocates for open source combined with open-governed ecosystems like CNCF or OpenInfra, which "guarantees you some independence against a single actor."

The path forward requires immediate action, Carrez emphasizes. "It's going to take a while," he acknowledges, "but they should start. They should at least audit their level of reliability. Where are they running? Where are their workloads running? Which ones are critical, which ones they can't really afford to be taken hostage in some kind of geopolitical negotiation, and start moving that, thanks to some public cloud that's built here."

While acknowledging the costs of switching from hyperscaler ecosystems, Carrez stresses the importance of understanding vulnerabilities now rather than waiting for regulation to force action. "They should be already looking at it," he concludes.