site.btaOpposition Leader Sees Risks in Planned Microsoft Contract for State Administration

Bozhidar Bozhanov, Deputy Floor Leader of Continue the Change - Democratic Bulgaria, the largest opposition group in Parliament, warned that Bulgaria is preparing to sign a new contract with Microsoft for the state administration, a move that entails long-term risks for national security and digital sovereignty.

Bozhanov, who is also co-chair of Yes, Bulgaria, said in a Facebook post that a recent Council of Ministers' decision, which authorizes the e-Government Minister to launch a public procurement procedure for Microsoft products, had received little public attention amid broader political developments.

Bozhanov said the administration relies on Microsoft server products such as Windows Server and SQL Server, whose licensing and support must be renewed, and said the need for professional support for these systems is undisputed. Microsoft's reputation and partner network provide guarantees that the administration will not be left to manage on its own, a task it cannot perform independently according to him.

Bozhanov also said Microsoft has for many years offered Office 365, a cloud-based office suite in which Word, Excel and PowerPoint continue to operate locally, but also have sharing and collaboration functionalities that require cloud integration. Based on his private-sector experience, he said the platform generally improves operational efficiency and cybersecurity practices, despite occasional support issues.

According to Bozhanov, however, Microsoft requires all user accounts to be placed in its cloud-based Active Directory (Azure AD/Entra). This would mean the entire state administration being managed in Microsoft's cloud. Another issue concerns data: Microsoft did not offer governments the ability to fully control data encryption keys, which meant that, in theory, Microsoft had access to all data.

Bozhanov said he raised these risks in 2022, while serving as electronic government minister, arguing that delegating extensive control to a third-party company posed long-term risks to national security and sovereignty. He acknowledged that Microsoft has since introduced additional encryption options for governments and, in 2025, support for hybrid environments using state-owned infrastructure, which he called a step in the right direction.

He further cited the recent case of the International Criminal Court (ICC) in The Hague, whose Chief Prosecutor's [Office 365] email access was reportedly suspended after US President Donald Trump imposed sanctions on the court. While Microsoft initially did not comment and then denied wrongdoing, Bozhanov said the case demonstrated that the US administration has instruments to compel certain actions by American technology companies.

According to Bozhanov, long-term dependence on an external provider for core government services, without the capacity for rapid migration, creates risks both to data access and service availability, particularly if access can be disrupted for political reasons.

As an alternative approach, he cited Germany's Centre for Digital Sovereignty (ZenDIS), which develops open-source solutions for public administration. Following the incident, the ICC migrated from Office 365 to ZenDIS's openDesk platform.

Bozhanov said his position was not an accusation against US companies. "Not that I do not have technological criticisms of them, but they provide good quality products which, unfortunately, no European company has managed to develop and establish to the same extent. From the perspective of long-term risks and the new situation in which the US-Europe partnership is being called into question by the White House, we should also carefully assess our technological decisions."

He added that the Council of Ministers' decision includes the wording "or equivalent", which allows the Ministry of Electronic Governance to separate support for existing server products from the office suite and to consider open alternatives which would guarantee digital sovereignty.