Europe built sovereign clouds to escape US control. Then forgot about the processors
Europe has invested over €2 billion in sovereign cloud initiatives to reduce reliance on US-controlled infrastructure and avoid extraterritorial legal reach, such as under the US RISAA 2024 law. However, most data centers still depend on American-made Intel and AMD processors that contain embedded management systems operating beyond host-level security controls. These subsystems, like Intel's Management Engine and AMD's Platform Security Processor, run at a privileged level invisible to operating systems and are not assessed by European certification frameworks.
- ▪Europe's sovereign cloud programs, including the EU's IPCEI-CIS and France's SecNumCloud, aim to protect data from US legal jurisdiction but do not evaluate the security of underlying processor firmware.
- ▪Intel's Management Engine and AMD's Platform Security Processor operate at Ring -3, a privilege level below the operating system, with independent memory, network access, and persistent operation even when devices appear powered off.
- ▪Under the US RISAA 2024 law, hardware manufacturers are considered communication providers and can be subject to secret government data access orders.
- ▪The ME and PSP enable remote management features like Intel's Active Management Technology, which opens network ports and enables functions such as keyboard-video-mouse redirection, creating potential covert channels for data exfiltration.
- ▪Microsoft documented that the nation-state group PLATINUM used Intel's Serial-over-LAN feature, enabled by the Management Engine, to exfiltrate data without detection by host firewalls or endpoint security tools.
Opening excerpt (first ~120 words) tap to expand
(function() { let windowUrl = window.location.href; windowUrl = windowUrl.substring(windowUrl.indexOf('?') + 1); let messageElement = document.querySelector('.shareableMessage'); if (windowUrl && windowUrl.includes('code') && windowUrl.includes('expires')) { messageElement.style.display = 'block'; } })(); Systems Europe built sovereign clouds to escape US control. Then forgot about the processors Intel ME and AMD PSP: The silicon layer nobody certifies Kim Loohuis Kim Loohuis Published sat 16 May 2026 // 11:30 UTC FEATURE Can digital sovereignty exist on American silicon? Europe is pouring more than €2 billion into sovereign cloud initiatives designed to reduce exposure to US legal reach. The EU's IPCEI-CIS program funds infrastructure development.
…
Excerpt limited to ~120 words for fair-use compliance. The full article is at The Register.
Discussion
0 commentsMore from The Register
