Sweden's Government Offices will block ChatGPT and Claude on staff computers from Monday, steering civil servants to Microsoft Copilot as the only AI that passed its security review.
I had an interesting discussion with my manager about the thinking about this…
We work for a company outside the government so we don’t have nay insight into the actual decision making.
What he said was “you either trust Microsoft completely or not at all”.
We don’t have the option to be selective about what parts of MS you want to trust, you can decide to not trust them at all, that is fine, but you can’t say that you trust Windows, Office and OneDrive, but not Copilot.
And sadly, at this point the government can’t really afford to not trust Microsoft, since everything they are running comes from Microsoft, and changing that will take decades and cost billions of SEK, which we can’t afford.
Microsoft for software that runs on your local systems and can be airgapped = probably fine.
Microsoft as SaaS (Azure and co) = probably fine as well
Microsoft’s AI department = read the damn privacy policy. If I needed frontier model support for a large organisation, I’d sooner trust a Bedrock or similar hosted Anthropic model than a Microsoft service…
Microsoft as SaaS (Azure and co) = probably fine as well
When access to a service can be shut off in an instant by an order of the U.S. government—as has been demonstrated with the ICC—there is a national security risk in relying on it.
Even without losing access to it, the U.S. CLOUD Act lets the federal government access the data on servers of U.S. companies hosted in other countries.
That’s why even ‘sovereign’ hosting solutions offered by U.S. companies are not a safeguard from overreach by the U.S. federal government.
I had an interesting discussion with my manager about the thinking about this…
We work for a company outside the government so we don’t have nay insight into the actual decision making.
What he said was “you either trust Microsoft completely or not at all”.
We don’t have the option to be selective about what parts of MS you want to trust, you can decide to not trust them at all, that is fine, but you can’t say that you trust Windows, Office and OneDrive, but not Copilot.
And sadly, at this point the government can’t really afford to not trust Microsoft, since everything they are running comes from Microsoft, and changing that will take decades and cost billions of SEK, which we can’t afford.
Except there ARE degrees of trust.
Microsoft for software that runs on your local systems and can be airgapped = probably fine.
Microsoft as SaaS (Azure and co) = probably fine as well
Microsoft’s AI department = read the damn privacy policy. If I needed frontier model support for a large organisation, I’d sooner trust a Bedrock or similar hosted Anthropic model than a Microsoft service…
When access to a service can be shut off in an instant by an order of the U.S. government—as has been demonstrated with the ICC—there is a national security risk in relying on it.
Ah, you’re right. My primary aspect here was MS accessing your data, not restricting your access to it.
Even without losing access to it, the U.S. CLOUD Act lets the federal government access the data on servers of U.S. companies hosted in other countries.
That’s why even ‘sovereign’ hosting solutions offered by U.S. companies are not a safeguard from overreach by the U.S. federal government.