As the Cyber and Resilience Bill undergoes its second reading in the House of Commons, the Open Rights Group (ORG) is calling on the UK to use the new legislation as an opportunity to further the UK’s digital sovereignty and curb its reliance on US tech companies.

The rights group is calling on MPs to implement a digital sovereignty strategy into the bill in an effort to reduce the UK’s reliance on US tech companies like Amazon, Google, Microsoft, and Palantir, for its digital infrastructure.

“Just as relying on one country for the UK’s energy needs would be risky and irresponsible, so is overreliance on US companies to supply the bulk of our digital infrastructure,” James Baker, the ORG’s Platform Power programme manager said.

“Now more than ever, the UK needs to build and protect sovereignty over its digital infrastructure, and not leave itself vulnerable to the policies and actions of foreign powers such as the US and China.

“Although the US is a historical ally, it’s assertion that it will use hard power to achieve its political, economic and military goals, should raise concerns among parliamentarians in the UK. The Cybersecurity and Resilience Bill is an opportunity to improve the UK’s control over its infrastructure.”

The ORG is calling for the bill to include certain sovereignty stipulations that could prove integral to resilience, one that considers supplier withdrawals, foreign law restrictions to data access, the impact of sanctions, trade disputes and political pressures on systems, and meaningful alternatives should relations with foreign states change.

The ORG’s intervention points out that technically secure infrastructure can remain fragile if they depend on a small number of foreign suppliers, if systems cannot be easily replaces, and if cloud and data services are governed entirely by foreign law.

The rights group pointed to three instances in the past few years that have seen digital infrastructure compromised by foreign powers.

Microsoft reportedly blocked the email account of an International Criminal Court (ICC) chief prosecutor following sanctions from the US on the court. While Microsoft denied this allegation, the ICC switched providers and stopped using Microsoft software in 2025.

Recommended reading

• Can Europe ‘Trump-Proof’ Its Cloud Services?
• UK&I SMEs Are Concerned About Data Sovereignty
• UK IT Leaders Shift Cloud Strategy Over Data Sovereignty Concerns
• Security, Compliance, AI Concerns Driving Private Cloud Adoption

In the UK, a parliamentary inquiry in 2020 found “clear evidence of collusion” between Hauwei and the Chinese government, leading to the company being phased out of 5G networks in Britain.

Further, tractor company John Deere disabled stolen tractors in 2022. While the move was celebrated at the time as the tractors were stolen in Ukraine by Russia, the move indicated that John Deere could apply a kill switch to any of its vehicles given political pressure.

These sobering realities show some of the consequences of a highly connected world, often controlled by who owns said connections.

ORG’s calls echo concerns from UK and European businesses seeking home-owned alternatives to major tech giants and woes over data sovereignty become more widespread amid rising political tensions