Welcome to 2026, every week is like a month worth of news. Jensen Huang is out at Nvidia plunging the global economy into chaos, all because of one spy. And as I sit down to write this, Microsoft is well into the second day of an outage that has left millions of people around the world unable to open Outlook, with Teams and Copilot also disrupted (I’m quite happy about Teams, but I digress). The outage started on Thursday afternoon UK time, and within about an hour Downdetector had logged reports from 74 countries. More than twelve hours later, the company was describing its recovery efforts as having “marginal success”, which is the phrase I’d use if Word managed to recover only the title of a failed document. While downtime is to be expected even in the ever-connected world, what interests me (again) is the nature of the failure, and what it has to say about the Internet we have built.
I say again because we have been here before. Back in March 2013 I wrote about a an outage at CloudFlare that took down more than 700,000 websites for over an hour. My complaint was that the Cloud, which in principle should make the Web more distributed and more resilient, had an Achilles heel in the name server: everyone using the service had to point their DNS at the same place, and when that place went down, everything behind it went down as well. This is something that I have been harping about for ages, and even made it to my book on networks, but I have always known that I am on the losing end of the debate. Asking for the global economy to become decentralised is like expecting us to withdraw from global banking in favour of putting cash under our mattresses. Galactica showed us the dangers of centrlisation, but we continue to walk into it regardless. I have witnessed the growing centralisation of services around the world hoping that I was wrong.
Dear reader, I was not wrong. I was just early. As usual.
Thirteen years of being right, unfortunately
An hour of downtime for 700k websites now looks almost quaint. In July 2024 a faulty CrowdStrike update crashed computers worldwide, cancelling flights and disrupting hospitals. In October 2025, an AWS outage took a large chunk of the Web with it. A month later it was the turn of Cloudflare itself (again). In January this year Microsoft 365 went down across North America for almost ten hours. And now this.
Microsoft has not published the root cause of the outage at the time of writing, although it says there is no indication of a cyberattack. The explanation so far is that a large number of servers became unexpectedly unavailable after failing automated health checks, their traffic shifted to the remaining servers, and those were then overloaded. Servers that were brought back fell over again as soon as they started receiving traffic. It was a bit like an own DDoS attack it seems, where demand outstrips capacity on a loop.
Microsoft is a company that operates thousands upon thousands of servers in over 500 data centres across 34 countries, with redundancy across regions, built by one of the best-resourced engineering organisations on the planet (who knew that data centres were useful? But I digress again). It did not fail despite its distributed design, the mechanism that exists to route around failure appears to have turned a problem into a cascade, and the one issue with cascading failures is that they can have unexpected origins. In 2013 the single point of failure was a name server, and in 2026 it seems to be the thing that decides which servers are healthy. Using the banking analogy from before, imagine that everyone in the world uses a few banks, each with thousands of branches, but all withdrawals must go through one single ATM, and you cannot change banks because the others have the same setup. The analogy still holds, the ATM has just become more sophisticated.
The scale of the problem
The main difference between then and now is what sits behind the point of failure. In 2013 it was websites. Annoying, surely, but you could come back in an hour. Today it is the entire nervous system of an institution, email, calendars, documents, meetings, and increasingly the login that gets you into everything else. At my workplace we have moved everything to Microsoft, all email is Outlook, all Calendars are Outlook, all our meeting and call infrastructure uses Teams (yuck, don’t get me started on Teams).
This is happening everywhere. In the UK we have GP surgeries and pharmacies reporting disruption, police forces in Hertfordshire and Dorset telling the public to phone instead, a London council warning that its online forms may not arrive, and universities whose email has vanished entirely, y Inbox is blissfully silent this morning! The UK Government says it is “working closely” with Microsoft, which is reassuring in the way that standing closely next to a broken lift is reassuring. Elsewhere, the list includes government systems in Singapore and Japan, the Supreme Court of the Philippines, and Australia’s federal police and intelligence agency. I will resist the obvious joke about spies and other people’s email.
None of these organisations did anything wrong. They made the same sensible procurement decision as everybody else, and that is precisely the problem.
Jurisdiction
In 2013 I was concerned not only about infrastructure, but also about jurisdiction, I have always raged at the entirety of the global tech economy becoming reliant on US courts and US law. At the time, one of the sites affected by the CloudFlare failure was Wikileaks, and I fretted that by relying on a handful of providers based in the USA we were becoming more prone to jurisdictional attacks at the very heart of the infrastructure. Ah, remember when our highest worry was Wikileaks? Simpler times!
At the time this was a slightly niche concern, but since then it has become a more important legal issue called digital sovereignty, and prime ministers now say it out loud: the French government has announced that officials will stop using Zoom and other US video tools in favour of French software, in part to reduce dependencies on non-European actors.
The analysts quoted in the coverage of this outage are saying two things at once. The first is that pressure in Europe to find alternatives to US providers will increase. The second is that there is no credible European alternative, and that Microsoft is unlikely to lose any revenue because its customers are locked into licensing contracts. Both statements are true, and together they are the ATM analogy all over again. You don’t like it, but you cannot change banks.
So what do we do?
It is all well and good to point out that centralisation is a problem, but what about solutions? The answer has always been more decentralisation, but that has been an issue, as for the most part this was very expensive. There are good reasons why we rely on centralised services, it is because they are cheaper. You cannot run email from your personal computer, I mean, you could, but that is a huge waste of resources.
However, plenty of people did adopt decentralised technical tools, they are all around us. But our technical dependencies did not go away, they moved up the stack. You can have a second name server. It is much harder to have a second copy of your organisation’s entire email, calendar, document and identity infrastructure sitting with a different provider, waiting patiently for a bad Thursday. The sensible advice doing the rounds is that organisations should plan for a minimum viable service: work out what you absolutely need to keep running when the main provider is down, and make sure that part at least does not depend on them. This is unglamorous, and I suspect most institutions will get round to it shortly after the next outage.
And the outages will increase, that is almost guaranteed in the age of AI.
On the regulatory side, there is one sector that has taken concentration risk seriously, and with some irony it is banking. The EU’s Digital Operational Resilience Act (DORA) and the UK’s critical third parties regime (CTP) both treat the reliance of financial firms on a small number of technology providers as a systemic risk, and give regulators oversight powers over those providers. We have not withdrawn from global banking, but the banks did at least notice the problem. Hospitals, courts, police forces and universities have no equivalent, and I think it is time to ask why not.
Another solution is starting to emerge. The solution may be in the machine, yes, I know I’m a techno-optimist, but hear me out. Vibe coding has made it easier than ever before to break free of the centralised solutions. ArcSoft is now a viable option to Microsoft products, if you want to code a game or make a video, you can. It has never been easier. I can envisage a future where we have agents running locally that manage most of our everyday interactions, no need to phone to a central provider. But that solution is in the far future. Worth thinking about though.
Concluding
Not much to say really, I sometimes feel like Cassandra. Always right. Always ignored. The cloud genie is still out of the bottle, and I am not very optimistic that it will be put back in. There may be some technical solutions in the future, but it may be too late. And maybe we will just switch our centralised reliance to a handful of companies with enough compute to run the models at scale. We will see.
On the meantime, I hope you can read this. I would email you this post, but, well.
0 Comments