Dead on arrival
This should have been dead on arrival. Centralising civil servants onto Microsoft’s cloud while claiming “alternatives can be explored later” is just locking in dependence first and pretending it’s reversible.
The money argument is deliberately dishonest. Debating Linux training costs while ignoring jurisdiction is malpractice. Under the US Cloud Act, data held by US providers is legally accessible to US authorities, often without the customer ever being informed. That means Estonian state data is exposed to foreign intelligence by design, not by accident.
The security carve-out exposes the lie. Defence and foreign ministries stay off the cloud because the risk is real and well understood. Everyone else is moved anyway because the political class has decided that saying no to US vendors is harder than admitting the security consequences.
Sounds like not only the UK has its security services asleep at the wheel.