Regaining the Keys: France Orders 2.5 Million PCs Off Windows
Return to Part 0: Table of ContentsPrevious Article: Episode 20, The AI Agent That Talked Its Way Into Open Source
The sentence that started a migration
In June 2025, the director of public and legal affairs at Microsoft France sat before a committee of the French Senate. The committee was running an inquiry into digital sovereignty, and it asked him a direct question. Could Microsoft guarantee that data it held for French public-sector customers would never be handed to United States authorities without the French government's consent? His answer was four plain words: "If we are compelled, we provide the data."
He was not admitting a flaw in Windows. He was describing the law. The CLOUD Act, passed in the United States in 2018, lets American authorities compel American technology companies to produce data those companies hold, wherever in the world the servers physically sit. A data centre in Paris does not change the obligation. The company is American, so the company can be ordered, and the data follows the company's jurisdiction rather than the building's address.
Ten months later, France acted on that sentence. In April 2026 the Interministerial Digital Directorate, known by its French initials DINUM, issued a binding instruction to every government ministry: produce a plan to remove extra-European digital dependencies across eight categories, the operating system among them. Around 2.5 million civil-service workstations are in scope. Ministry plans are due in the autumn of 2026, with full deployment targeted at roughly 2030. The destination is Linux. The reason given is not money. It is sovereignty.
What France actually ordered
DINUM is not a department's IT helpdesk. It is a service of the Prime Minister with directive authority that runs across the whole of central government. When it tells ministries to plan their exit from a class of software, that instruction carries the same weight in every ministry regardless of who runs it.
The eight categories reach far beyond the desktop. They cover workstations and operating systems, collaboration and communication tools, antivirus and security software, artificial intelligence and algorithms, databases and storage, virtualisation and cloud infrastructure, and network and telecommunications equipment. The published reporting agrees on those categories; the precise wording of the final item varies between outlets, so I will leave it described rather than pinned to a phrase the primary document has not confirmed. The shape is what matters. France is not swapping one product for another. It is auditing an entire stack for a single property: whose law governs it.
This is where the operating system layer earns its place at the top of the list. Linux is the one operating system in common government use whose source code, governance, and distribution rights cannot be produced under an American court order, because no American company owns it and none can be subpoenaed for it. That is not a feature anyone marketed in 1991. It is a property that only became visible when extraterritorial law reached into data centres that physically sit in France.
France is pointing at itself
France is not attempting this from a standing start, and that is the part worth slowing down on. The country has a working example of a government Linux migration that has already run for the better part of two decades, and it is not a foreign case study.
The Gendarmerie Nationale, France's militarised national police, began moving to open-source tools in 2004 and built its own Ubuntu-based distribution, GendBuntu, from 2008. As of June 2024 it ran on 103,164 workstations, about 97 per cent of the force's computers. The financial logic was blunt. A Gendarmerie commandant put it as a money problem, not a technical one: for the same work and the same results, Windows would have cost roughly two million euros a year more than Ubuntu. There was an operational dividend too. Updates that once required administrators to travel year-round to remote posts, including stations in French Polynesia, could be pushed out within a fortnight.
The number to hold onto is not the workstation count. It is the calendar. GendBuntu has run continuously since 2008, through five presidential terms and governments of different political alignment, without a reversal. In February 2026, when DINUM reached for a model to justify the national rollout, it cited the Gendarmerie. Not a vendor demonstration, not a pilot, but eighteen years of a French institution running its own operating system and renewing that choice every budget cycle.
The Gendarmerie is not alone in the French record. The National Assembly moved its parliamentary workstations to Ubuntu after a 2006 decision, deploying in 2007 across more than a thousand machines. The tax authority, the DGFIP, has run an open-source desktop of Firefox, Thunderbird, and LibreOffice for over twenty years, on a scale specialist French reporting puts at around 130,000 workstations, alongside its own internally hosted cloud built specifically to stay clear of American-jurisdiction platforms. The point of these examples is not their size. It is that the open-source posture in French government predates the 2026 directive by decades. The directive did not invent the idea. It made it mandatory.
Why the last attempt failed
Anyone who followed Linux through the 2000s knows the counter-example, and it is the reason to be cautious. Munich's LiMux project began in 2004, moved about 15,000 city workstations to a custom Linux build, and became the flagship that every open-source advocate pointed to. It cost roughly 18.7 million euros to develop and saved the city money while it ran. Then, in 2017, the city council voted to go back to Windows. Reversing the migration was later estimated at around 49.3 million euros in licences, hardware, and labour.
Munich did not fail on technical grounds and it did not fail on cost. It failed on politics. The reversal followed a change of mayor after the 2014 municipal election, and Microsoft had moved its German headquarters to Munich in 2016, a coincidence that many in the community read as influence even though no internal decision document ever proved the link. The lesson the open-source world took from Munich was uncomfortable: a migration sustained by a political champion lasts exactly as long as the champion does. When the savings argument met a new administration that simply preferred the incumbent vendor, the savings argument lost.
That is the failure mode every government Linux migration has had to answer for since. Munich has, in its own way, answered it too. After a 2020 election it recommitted to open source under the principle "public money, public code", stood up an open-source programme office in 2024, and now publishes its code on shared repositories. It has not restarted a wholesale operating-system migration. It uses open source where it can and good commercial products where it cannot. The ambition came back; the all-or-nothing desktop project did not.
The fourth argument
Here is why 2026 may be structurally different from 2004. The case for open source has historically rested on three arguments. Freedom, the one the GPL encodes: the right to run, copy, study, change, and share. Cost, the savings over proprietary licensing. And technical merit, the old claim that distributed development beats centralised control. France's decision adds a fourth that neither Linus Torvalds in 1991 nor Eric Raymond in 1997 needed to name, because it was not yet visible: jurisdiction.
The difference matters because the first three arguments are all reversible by an election. A new administration can decide the savings are not worth the friction, or that the technical case is overstated, and the migration unwinds the way Munich's did. Jurisdiction does not bend that way. Microsoft's testimony to the Senate is not a configuration error that a patch will fix. The CLOUD Act is not a setting. The fact pattern, that an American company has stated under oath that it cannot protect a foreign government's data from American law, is the same fact whichever party forms the next French government. An argument grounded in a permanent legal asymmetry is much harder for the next administration to talk its way out of than an argument grounded in a spreadsheet.
This is also why France is unlikely to be a solo act. Germany's state of Schleswig-Holstein is already most of the way through moving 30,000 workstations to Linux and LibreOffice, about 80 per cent complete in early 2026, with reported annual savings of 15 million euros and the same sovereignty framing France uses almost word for word. France and Germany held a joint summit on European digital sovereignty in late 2025 and stood up a task force, which suggests these national migrations are being coordinated rather than run as isolated experiments. There is even a community effort, EU-OS, building a shared public-sector Linux base on Fedora that national governments could customise rather than each reinventing the wheel; DINUM is listed in its materials as a collaborator. If that pattern holds, it is the open-source model itself scaled to a continent: a shared commons underneath, sovereign customisation on top, which is exactly the relationship the Linux kernel has always had with the distributions built from it.
The honest limit
It would be a mistake to oversell what an operating-system migration achieves on its own. The CLOUD Act problem does not live only at the desktop. It applies to any American-domiciled provider at any layer. A ministry that moves from Windows to Linux but keeps its cloud, its security tooling, or its artificial-intelligence services with American-jurisdiction vendors has closed the gap at one layer and left it open at the others. That is precisely why DINUM's directive names eight categories and not one. The operating system is the necessary first move, not the finished job. You cannot exercise sovereignty over your cloud or your AI models if you have already ceded it at the layer everything else runs on.
There is a quieter version of this question that should be familiar closer to home. The Technology Users Association of New Zealand, TUANZ, used its 2026 priorities report to describe the country's posture as "strategic drift": connectivity, computing power, and infrastructure increasingly supplied by a small number of foreign providers operating under foreign regulation. That is TUANZ's own characterisation, not an audited finding, and New Zealand is not in France's position. Our government data is not caught in a sovereignty dispute with the United States, and the most acute CLOUD Act risks arise when a government is specifically at odds with the American executive. New Zealand's own framework, NZGOAL-SE, advises agencies to consider open source but does not mandate it; decisions stay case by case. The structural question underneath is still the same one France has chosen to answer out loud. What does it mean to run a country on software whose ultimate behaviour is governed by someone else's law? France made that an active choice. The drift TUANZ describes is the same question left unanswered.
The same logic does not stop at the civil service. France's domestic intelligence service, the DGSI, has moved to replace data-analytics software from the American firm Palantir with tools from the French company ChapsVision, to avoid new strategic dependencies in sensitive functions. The defence layer reached this conclusion earlier than the civil one. The United States Navy has run Linux inside submarine combat systems for years, on the reasoning that a fighting platform should not depend on a toolchain it cannot fully inspect or control. When an armed force or an intelligence agency treats the operating system as territory rather than a line on a purchase order, it is answering a question most organisations never ask: not what the software costs, or how well it runs, but whose law it ultimately answers to. France has now put that question to two and a half million desks.
Your own audit
I founded a Linux distribution and ran it from New Zealand, and I spent the years since inside enterprise architecture watching organisations choose their toolchains. The pattern in those rooms was almost always the same. Cost and convenience won, and the question of who ultimately controlled the software rarely made it onto the agenda at all. France has just made that question the agenda.
France's Gendarmerie made this choice eighteen years ago and has not reversed it, across five presidential terms and governments of every alignment, through budget cuts and reorganisations. When did you last audit the jurisdiction of the software your organisation depends on, and what would it take for that audit to change a procurement decision?
The views expressed in this article are entirely my own, informed by more than 30 years of professional experience in architecture, security, and technology leadership in New Zealand. They do not represent the views of my employer, any government agency, or the New Zealand government. My commentary on legislation and policy is analytical, drawing on publicly available sources and my professional expertise in architecture, security, and AI governance. I follow the Public Service Commissioner's Code of Conduct for the Public Sector and social media guidance.
About the Author: Andreas Hamberger is a New Zealand-based enterprise architect and technology strategist. Over 30 years, he has moved from compiling kernels on a 486 to leading cloud, cyber, and AI transformation programmes across government, banking, transport, and aviation. He founded Yoper Linux, served as a technology specialist for Novell during the Linux Wars, and is the author of "Generative AI: Skynet or Heaven" and "Space Mafia." He can be reached at linux@linux.co.nz.
A Concise History of Linux chronicles the operating system that changed the world and the lessons it holds for the AI era.
I use AI tools, including Sudowrite, Claude, Perplexity AI, DeepSeek AI, ChatGPT, Grok, Copilot, Openart and Gemini, as deliberate production tools, not ghostwriters. This is consistent with my position: AI amplifies human judgement; it does not replace it. The frameworks, arguments, and editorial decisions in this series are original work. AI accelerated the process. The thinking is mine.
References
[1] TechCrunch. "France's government plans to move millions of PCs off Windows to Linux." 10 April 2026. https://techcrunch.com/
[2] The Next Web. "France orders ministries to ditch extra-European digital dependencies." April 2026. https://thenextweb.com/
[3] The Register. "Microsoft admits it cannot guarantee French data sovereignty under the US CLOUD Act." July 2025. https://www.theregister.com/
[4] DanubeData. "The CLOUD Act explained: extraterritorial access to data held by US companies." 2024. https://danubedata.com/
[5] Canonical / Wikipedia. "GendBuntu: the French Gendarmerie's Ubuntu deployment (103,164 workstations, June 2024)." https://en.wikipedia.org/wiki/GendBuntu
[6] Wikipedia / The Register. "LiMux: Munich's Linux migration and its 2017 reversal." January 2018. https://en.wikipedia.org/wiki/LiMux
[7] It's FOSS. "Schleswig-Holstein's migration to Linux and LibreOffice reaches 80 percent." December 2025. https://news.itsfoss.com/
[8] Result Sense. "France's DGSI to replace Palantir with French firm ChapsVision." 17 June 2026. https://resultsense.com/