When the Foreign Vendor Controls the Switch: Building Dependency-Proof Archives

A dependency risk is the vulnerability that exists when critical infrastructure is owned and operated by someone else, and that owner can restrict, alter or withdraw access on its own decision, not an attacker's. In October 2026, Ukrainian forces got a live demonstration of exactly that, when SpaceX introduced an overnight restriction on military Starlink terminals with no warning given. The episode is a sharp, specific example of a much broader and more ordinary problem: institutions of every kind now keep their most important records on infrastructure they do not own, cannot inspect, and cannot guarantee access to tomorrow.

What happened: Starlink, Ukraine, and the switch nobody else controls

On 14 October 2026, Serhiy Beskrestnov, an adviser to President Zelenskyy on military technology, reported that SpaceX had introduced a speed-based restriction on Starlink terminals used by Ukrainian forces overnight, with connectivity cut once a terminal moves faster than roughly 160 km/h. Writing on Telegram, he said Ukrainian defence forces "did not receive a warning about this limitation and this led to the disruption of several missions." The restriction appears to affect Starshield, the military-grade tier of the service. No reason has been publicly given by SpaceX, and reporting on the episode has found no independent evidence tying the change to any government directive — the cause, as of this writing, remains unconfirmed.

What is not in dispute is the structural fact underneath the story: a foreign, privately owned company controls a communications layer that a sovereign nation's armed forces had come to depend on, and that company changed the terms of access unilaterally, without notice, for reasons it has not explained. Whatever the eventual explanation, the capability to do that is itself the vulnerability — it exists whether or not it is ever used again.

This isn't only a wartime problem: the dependency risk in peacetime

The same structural risk shows up away from any battlefield. The UK-based Open Rights Group's 2026 report, Tech Giants and Giant Slayers, argues that reliance on a small number of foreign technology firms has left the UK government exposed to risks it did not sign up for. ORG executive director Jim Killock called the overreliance "an urgent national security issue as well as an economic threat." The report cites several concrete mechanisms:

• Legal compulsion: the US CLOUD Act and China's National Intelligence Law can both require a company headquartered in that country to hand over data or system access, regardless of where the data is physically stored or who it belongs to.
• Sanctions enforcement reaching into services: the report describes US sanctions imposed on the International Criminal Court over its actions against named individuals as having led, by its account, to Microsoft suspending email and banking-related services tied to those affected — presented in the report as an example of a technology provider's sanction-enforcement power, not an attack.
• Concentrated public-sector contracts: the report flags growing UK government reliance on firms such as Palantir, alongside a Competition and Markets Authority finding that the UK overspends by at least £500 million a year on cloud services it has limited ability to shop around for.

None of this requires a war, a hack, or any wrongdoing by the vendor. It is simply what dependency looks like once the infrastructure a government or institution relies on sits inside someone else's legal and corporate jurisdiction.

Three kinds of control an institution can lose

The Starlink and ORG cases point to the same underlying pattern, which is worth separating into three distinct risks, since each needs a different answer:

• Access control. The vendor can throttle, restrict or cut off the service itself — the Starlink terminal restriction is a clean example. This affects live communications and operational systems most directly, but also any cloud-hosted archive reachable only through that vendor's platform.
• Legal control. A foreign government can compel the vendor to hand over data or access, under its own laws, regardless of what the customer's contract says. The CLOUD Act and China's National Intelligence Law are the two most frequently cited mechanisms, and they apply to data at rest, not just live services.
• Decision control. A newer and less visible version of the same risk: if AI agents or automated systems operated by a foreign vendor decide what gets retained, indexed, surfaced or flagged as redundant, an institution can lose effective command of its own archive even while every file technically still exists. Micrographics Data has written separately about this risk in When AI Agents Delete Your History and AI Ground Truth Archiving — the sovereignty angle here is the same control problem wearing a newer face.

Physical destruction and cyberattack are different problems again, already covered in The Day the Cloud Went Dark and Ransomware-Proof Archival Storage. Dependency is distinct from both: nobody has to attack anything. The vendor relationship itself is the exposure.

What "dependency-proof" actually requires

A record is dependency-proof only if losing the vendor — its goodwill, its home government's policy, its continued existence, or simply its product roadmap — changes nothing about whether the record can still be read. Archival microfilm meets that bar in a specific, narrow way: a roll of film made to ISO 18901, processed to ISO 18917 and stored to ISO 18911 carries an LE-500 rating — a 500-year life expectancy — and needs nothing beyond light and a lens to read. There is no subscription to lapse, no account to be suspended, no foreign-hosted platform to restrict, and no software version to fall out of support. See what an LE-500 rating actually means for the full standard.

This is not an argument against digital systems, which remain the right tool for daily access, search and collaboration. It is an argument for a specific preservation layer underneath them, for the subset of records an institution genuinely cannot afford to lose control of. Digital files can be written directly to film through a computer output microfilm (COM) system such as Micrographics Data's MD AW3 Digital Archive Writer, or converted through Micrographics Data's own microfilming and digital-to-microfilm services in Singapore, using film and processing chemistry supplied from the microfilm supplies collection. For a fuller economic treatment of this trade-off, see Geopolitical Risk Cost Analysis: Microfilm vs. Digital Storage.

Frequently asked questions

What happened with Starlink and Ukraine in October 2026?

Ukrainian officials reported that SpaceX introduced an overnight speed-based restriction on military Starlink/Starshield terminals without warning, disrupting several operations. SpaceX has not publicly stated a reason, and no independent evidence has confirmed who ordered the change.

Is this only a risk for countries at war?

No. The UK-based Open Rights Group's 2026 report "Tech Giants and Giant Slayers" documents the same structural risk in peacetime, citing the US CLOUD Act, China's National Intelligence Law, and a case where Microsoft reportedly suspended services tied to US sanctions against the International Criminal Court.

What is the difference between a cyberattack risk and a dependency risk?

A cyberattack is an outside actor breaking in. A dependency risk is different: the vendor who legitimately operates your infrastructure can restrict, alter or withdraw access on its own decision, under legal compulsion from its home government, or under commercial or political pressure, with no attack required.

Can AI agents create the same kind of dependency risk?

Yes, in a newer form. If AI agents operated by a foreign vendor decide what records are retained, indexed or surfaced, an institution can lose effective control of its own archive even while the underlying files still exist.

Does microfilm solve every part of this problem?

Microfilm removes the vendor-control layer entirely for the records placed on it: no subscription, no network connection, no foreign-hosted account, and no software to be deprecated. It does not replace the working digital systems an institution uses day to day; it is the preservation layer that keeps functioning when those systems don't.

What standards govern archival microfilm's independence from any vendor?

Film manufactured to ISO 18901, processed to ISO 18917 and stored to ISO 18911 carries an LE-500 rating: a 500-year life expectancy that depends only on the physical film and controlled storage conditions, not on any company remaining in business or any license remaining valid.

Build the layer no vendor can switch off

Whatever the Starlink dispute's eventual explanation, the underlying lesson holds regardless: records that only exist inside someone else's infrastructure are only as permanent as that relationship. Micrographics Data supplies the film, chemistry and archive-writing equipment to put the most critical layer of an institution's records genuinely beyond any vendor's reach. Request a quote or review the microfilm supplies collection to start.

Sources: Euronews, "Starlink terminals operations restricted in Ukraine overnight, adviser to Zelenskyy says" (14 October 2026); Open Rights Group, "Tech Giants and Giant Slayers" (2026), as reported by The Register, "UK's reliance on big tech is a national security risk, report warns" (15 April 2026).