Drones today, business software tomorrow?

The restrictions imposed on satellite communications used by Ukraine are a reminder that a private provider remains subject to the decisions of its state. The subject also concerns companies: their messaging, their CRM or their cloud infrastructures may depend on political authorizations that no commercial commitment is sufficient to guarantee.

A drone is available, as is its operator, but when the connection necessary for its mission disappears, part of its capacity becomes unusable. On the night of October 13 to 14, Ukrainian forces discovered restrictions affecting the satellite terminals on board some of their aircraft. According to Ukrainian officials cited by the Wall Street Journal, missions were disrupted or canceled, particularly for medium-range strike drones and interceptors.

The reported limitation concerned the movement speed of the terminals, around 160 km/h, and not the Internet speed. The service was announced as restored on October 15 by Ukrainian Defense Ministry sources. This recovery leaves unanswered the question revealed by the incident: who decides the conditions under which an essential capacity can be used?

The answer also concerns companies that entrust their daily operations to foreign software. A private supplier remains subject to the laws and public decisions imposed on it, including when these upset its relationship with a client.

The commercial contract is part of a power relationship

In this case, Elon Musk refers the setting of Starshield limits to the American military authorities and, ultimately, to the President of the United States. On October 15, Reuters reported, citing American and Western officials, that the restriction order came from the White House.

Starshield falls under a specific military and contractual framework. It would therefore be inaccurate to directly transpose its control conditions to those of management software. But the episode recalls a more general principle: the desire to serve a customer does not guarantee that a supplier will retain the right to do so.

A sanction can prohibit certain services, an export control can subject a use to authorization, a public contract can reserve the definition of the conditions of employment to the authority which finances it. These mechanisms are different, but they all require us to look beyond the service provider’s commitments.

The private status of a company does not place it outside public power.

Civil restrictions already have precedents

The transition from military to civilian already has a history. On June 12, 2024, the U.S. Treasury announced restrictions on the provision of certain computer and software services to persons located in Russia, effective September 12. The system notably concerned support and cloud services associated with business management, design and manufacturing software.

The categories specified by OFAC, the US financial sanctions agency, include CRM, ERP, supply chain management and project management tools. Ordinary corporate functions can therefore fall within the scope of a foreign policy decision.

GitHub provides another example. The platform explains that it restricted certain access for Iranian developers in 2019 in order to respect American sanctions. In January 2021, it announced that it had obtained a license from the US government allowing it to reinstate all of its services in the country. Commercial willingness and public authorization were two separate conditions.

These precedents concern specific sanction contexts. They do not prejudge a comparable measure against European companies. However, they establish that access to a civilian digital service may be subject to a government decision. The mechanism exists, its extension to other situations is a matter of risk analysis.

SaaS makes daily dependency

For a company, the question translates into very concrete operations. If your CRM becomes inaccessible, how can you find discussions with a prospect, follow a quote or organize follow-ups? If your messaging is suspended, how can you continue conversations with your customers and suppliers? If its authentication service is unavailable, how many applications simultaneously become difficult to access?

These are business continuity scenarios, the realization of which would depend on the scope of a possible restriction. Their interest consists in making visible the place of the services concerned in daily work.

With software delivered as a service, the business depends on the continued operation of systems operated by its provider. It may hold its data and still encounter great difficulty in using it elsewhere. An export of the customer file does not reconstruct histories, automations, authorizations and connections to other software.

A partial restriction is also worth examining: removal of a function, interruption of support or limitation of certain uses. In the Ukrainian case, maintaining numerous connections did not prevent the degradation of certain missions. For a company, criticality is also measured by the function affected.

A server in Europe does not solve the whole question

Data localization remains an element of the evaluation. It must be completed by examining the contracting entity, the laws to which it is subject and the technical organization which allows the service to be operated.

Three questions need to be asked separately: who can access the data, who can maintain or restrict the service, and how to change provider? They concern confidentiality, availability and reversibility respectively.

An offer operated under separate control may present guarantees different from those of simple local distribution. These situations must be examined concretely. The presence of a data center or subsidiary in a country alone is not sufficient to describe all dependencies.

The French debates on the digital sovereignty of the State find an operational translation here: protecting information and maintaining the capacity to work are two complementary requirements.

The price of a fallback solution must be included in the calculation

A general management cannot treat each software as a strategic infrastructure. On the other hand, it can identify the few services whose interruption would prevent selling, invoicing, producing or communicating.

For these services, the evaluation must integrate the time required for a recovery, the skills available and the cost of a transition. The contractual possibility of exporting data is a start. A restoration or migration exercise allows you to verify what this possibility is worth in practice.

Multiplying suppliers only provides protection if their dependencies are actually different. Multiple applications may rely on the same cloud or identity system, and thus present a common point of vulnerability.

The economic calculation must therefore bring together the cost of the subscription, that of preparing a fallback solution and that of an interruption. The absence of immediate migration can be a rational choice, provided that the consequences and the time frame of a possible exit are known.

Sovereignty is also built in purchases

Europe has suppliers and projects capable of meeting part of these needs. Alternatives to dominant collaboration suites and infrastructure solutions must, however, be evaluated on their functionality, security, deployment capacity and their own dependencies.

Public and private purchases help finance these capacities. A sustainable replacement solution requires customers, trained integrators and available skills. Preparing for continuity thus joins the construction of an industrial offer.

The Ukraine incident provides further reason to examine these dependencies before a crisis occurs. The leader who renews his CRM does not need to imagine an imminent diplomatic rupture. He must be able to identify external decisions likely to affect his access, and know how to continue his activity if they arise. The next rule which will modify the use of its software may be decided elsewhere than by its supplier.