"I cannot guarantee it": under oath, Microsoft admits it cannot rule out that data entrusted to its cloud is handed to the US government (CLOUD Act). Hearing, French Senate committee — Jun 2025 ›
National Observatory
Digital Sovereignty
News 5 Ottobre 2026

The Observatory at RomHack Camp 2026

On 2 October 2026 the Observatory was presented at RomHack Camp 2026, the cybersecurity conference organised by Cyber Saiyan, in a talk by Fabio Pietrosanti (naif).

MXMap Italia: National Observatory for Digital Sovereignty Lightning talk · STAGE 2 (Ghost in the Shellcode) · 2 October, 15:10 · 20 minutes Track: Journalism, society, hacker culture

Language

The talk and all materials are in English, as listed in the conference programme.

From the official programme

From the abstract published on the RomHack schedule:

«MXMap Italia has been established as national observatory of the status of digital Sovereignty of italian public agencies, by analyzing DNS records on the basis of the MXMap software.»

The talk presented the results of the measurement — 22,987 public bodies analysed, of which 46% run their email on providers under non-EU jurisdiction and 0% on European providers based outside Italy — together with the methodology, its origin in upstream research, and a call to contribute to the project.

What was covered

  • The method, and where it comes from: MXMap began with David Huser’s work on mxmap.ch and grew into the SecAssure 2026 paper, covering around 15,300 municipalities in Germany, Austria and Switzerland. MXMap Italia is its Italian adaptation.
  • Why jurisdiction beats geography: the CLOUD Act and FISA 702, and why keeping data in Italy does not change who can be compelled to hand it over.
  • Sovereignty washing: a critical reading, measure by measure, of how data residency, key management, confidential computing, operator access controls, local partners and separate European entities are offered as answers to a question that is legal, not technical.
  • The national cloud programme: why consolidating the public sector’s scattered datacentres — necessary, and genuinely achieved — is not the same as making them sovereign.
  • What is still missing: the measurement of public spending on cloud services, year by year, which is the piece we are building now.

Materials

How to contribute

The project is open and needs technical, legal, political and outreach contributions. Start from GitHub, the Telegram channel or the Contribute page. The state of progress of each piece is in the roadmap.

Telegram