Estonia hosts NATO's cyber defence centre and runs one of the world's most digitised states. This week it learned that a mail-and-calendar outage can still stall a court. According to ERR News, disruptions to Microsoft services, including Outlook and Teams, began Thursday evening, 12 November, and by Friday were hitting government agencies and businesses. Harju District Court spokesperson Viivika Siplane said procedural documents could not be submitted to the courts by email and asked that they go through the public e-File system. As of noon Friday, Microsoft had not disclosed a cause.
What actually happened, and what did not
The facts are modest. Cybexer Technologies' Aare Reintam told ERR there was no reason to believe a cyberattack was behind the disruption. He said it may have involved server overload and rerouted traffic, and that nothing suggested personal data or passwords had been exposed. That is informed speculation, not a root-cause finding, and nobody should write the post-mortem before Microsoft publishes one.
The notable part is the institutional response. The State IT Center (RIT) now serves 86 institutions, though not every agency, and it says it will explore non-Microsoft alternatives in more depth next year to compare costs and assess the risk of depending on a single provider. ERR also reports that the move to Microsoft's cloud office services began in 2022.
The strongest case for the sovereignty camp
The case for acting is serious. In January, Anadolu Agency reported that RIT was moving government workstations onto a centrally managed cloud system built mainly on Microsoft 365. It said roughly 15,000 of about 25,000 government workstations could move within two years. RIT director Ergo Tars linked the review to digital sovereignty and to the risks of dependence on non-European infrastructure. He asked what Estonia would do if the EU decided American products were no longer trusted.
That is a fair worry. Concentration creates correlated failure. When one vendor's identity or mail layer degrades, every tenant degrades together. A state with Russia on its border has good reason to take that seriously.
Why resilience is not the same as replacement
The outage also showed what works. The courts did not stop. They pointed filers to e-File, a separate channel that does not depend on Outlook. That is the pattern Estonian cyber policy has favoured for years: assume a component will fail and keep an alternate path running.
The clearest example is the data embassy in Luxembourg. e-Estonia describes it as a Tier 4 data centre under Estonian state control. It is meant to do more than hold backups: it can operate the state's most critical services. Its founding agreement, signed in 2017, takes the Vienna Convention on Diplomatic Relations into account. That design starts from continuity of function, not from the nationality of the vendor.
The same logic runs through the CCDCOE's Locked Shields 2026, which closed on 24 April. It brought together over 4,000 participants from 41 nations in the world's largest live-fire cyber defence exercise, with teams defending a simulated country against roughly 8,000 attacks, according to the centre's kickoff report. These drills reward rehearsed degradation and recovery, not vendor origin. Nothing in them suggests that a European logo makes a mail platform immune to overload, misconfiguration or a bad update.
The cost of a blunt mandate
A hard requirement to swap out US collaboration tools has real downsides. Migration is itself a security risk, because it creates months of dual-running, retraining and misconfiguration. Reintam himself said replacing the entire Microsoft ecosystem is not practical. A smaller state that moves fast onto an immature domestic stack could trade a rare, visible outage for a more frequent, less visible one. Mandates also tend to protect incumbents and slow the adoption of better tools, which hurts the innovation Estonia's digital economy was built on.
The proportionate path is the one RIT has actually signalled: monitor trials elsewhere, price the alternatives, and test them. Within that, four steps are worth taking.
- Map the single points of failure. Identify which functions, such as court filings, emergency notifications and payments, must have a non-Microsoft fallback, and treat the rest as ordinary business tools.
- Contract for exit. Require data portability, documented export formats and tested restore procedures in every cloud agreement.
- Rehearse the fallback. Run a no-email day for courts and agencies the way CCDCOE runs a no-network exercise, and publish what broke.
- Demand incident transparency. Ask vendors for root-cause reports on a fixed timeline as a procurement condition. Friday noon with no explanation is a procurement problem, not just an IT one.
What to watch
Two things will show whether this episode produces policy or only headlines. The first is Microsoft's eventual explanation: an overload, a configuration error and an attack point to very different remedies. The second is whether RIT's trials next year compare alternatives on measured availability and cost, or on origin alone. Estonia's own record suggests the first approach is the stronger one. Its security has come from redundancy, rehearsal and control over critical data, not from refusing any given supplier.
The lesson for other governments is not that cloud office suites are reckless. It is that every government service, however routine, needs a documented way to keep working when its main provider does not.