Everyone is talking about the US government's inability to secure its own employees. That is the wrong conversation.
Yesterday, a hacktivist group extracted the complete organisational directory of the Department of Homeland Security through Okta, its commercial single sign-on provider. 41,000 personnel records. Undercover agents mapped to Cellebrite and Palantir surveillance tools. Reporting chains spanning ICE, CBP, and Homeland Security Investigations. An organisational X-ray, pulled through a vendor's authentication layer.
That is bad. It is also the minor part of this story.
The breach disrupted one government temporarily. What should concern every other government is that the United States can do this to them permanently, deliberately, and on command.
Australia and the United Kingdom run their governments on Microsoft 365. Australia's own secure-cloud blueprint, published by its signals intelligence agency, builds government identity on Microsoft Entra ID. Email, messaging, conferencing, documents, calendar, contacts, and authentication all sit behind one identity layer operated by a single US vendor. If that layer is revoked, a government cannot send an email, hold a meeting, check a schedule, or look up a colleague's phone number. It loses its means to function. Not over weeks. In minutes.
This is not theoretical. In September 2025, Microsoft's Brad Smith revoked Azure and AI access for Israel's Unit 8200 after a terms-of-service review. No court order. No sanctions. One corporate executive decided, and an allied nation's intelligence unit lost access to 8,000 terabytes of surveillance data hosted in the Netherlands.
The US CLOUD Act compels any US-headquartered vendor to surrender data regardless of where it sits. Executive orders can go further and restrict the service entirely. One signature, and a sovereign government goes dark.
You can manage your dependency on cloud hosting. You can migrate workloads over months. Identity is different. Identity is the single gate to everything behind it. There is no gradual migration from a revoked identity layer. There is no fallback. It is binary: you control it or you do not.
Mature, self-hosted identity platforms like Keycloak, an open-source project maintained for over a decade, have existed all along. Every government running on Microsoft Entra ID or Okta evaluated the cost of operating its own identity infrastructure and chose to hand a foreign corporation the kill switch to its entire ability to govern.
That is not a strategic risk. It is negligence, chosen for convenience, by the institutions responsible for national security, critical infrastructure, and the services their citizens depend on.