Posted on August 20, 2026 by James Hirst and Budhaditya Bhattacharya, Tyk It went to Mexico. The offer: join the war against the United States, and you can have Texas, Arizona and New Mexico back. The Germans were careful, and they put it in a cipherin cipher. Their own transatlantic cables had been cut, so they sent it the only convenient way left, down lines that ran through British territory, part of it on an American cable. The cable was described as private. Contractually, and because they had encoded the message. Except Britain was quietly tapping those wires.
A room of codebreakers in the Admiralty, Room 40, read the whole thing. Six weeks later, it was on the front page of every American newspaper. Not long after, the United States was at war. It doesn't matter whose message it is. If it runs on infrastructure you don't control, whoever controls it can read it. That century-old lesson is having a very modern moment. Earlier this year, a US hyperscaler was reported to have handed the US Congress documents belonging to regulators at two Dutch authorities: emails, minutes, meeting invites. The people whose job is enforcing Europe's Digital Services Act against US tech.
The records were reportedly handed over with names left unredacted , in effect a ready-made list of the people holding US giants to account. Whatever the specifics, it shifts the data sovereignty picture in a way worth sitting with. The mechanism is the US CLOUD Act . It can compel an American company to surrender data even when that data sits on European soil. In sworn testimony to the French Senate, a provider's own counsel could not guarantee that French data held in European data centers was safe from quiet US access. So "our servers are in Frankfurt" turns out to mean very little.
This is the distinction the cloud native community keeps coming back to: data residency is not data sovereignty . Residency is where the bytes physically sit. Sovereignty is who has legal reach over them. Frankfurt gives you the first. The operator's jurisdiction decides the second, and jurisdiction travels with the operator, not the postcode. It's tempting to make this a story about a single company. The provider in the headlines followed the law it's bound by. Swap in any US hyperscaler and the answer is the same. That's the point: the risk is structural, not reputational.