Would Crowdstrike have had kernel access without the EU directive? No, they wouldn’t have. Case closed.
You can argue all you want that it’s better for society overall that there is competition in that market, or that Microsoft could have prevented it if they worked harder, but you can’t argue that the EU isn’t responsible for the the outage. Because they are.
If EU demanded that a car manufacturer switch their seatbelt design away from a safe design to one that had a small chance to decapitate people in minor accidents, it’d be the EU’s fault when that seatbelt design decapitated someone.
You could argue the seatbelt design saved more people than it killed, or it was worth it because it allowed third parties to compete in the important seatbelt manufacturing market, or other car manufacturers figured out a fix to prevent decapitation and the regulated car manufacturer should have implemented that fix, but you can’t argue that the decapitated person wouldn’t have been decapitated if the EU hadn’t gotten involved.
Let’s not forget that Microsoft has billions more users than Linux and macOS combined. Making fixes for Microsoft isn’t as simple without as much disruption as it is for those two OSes. And I don’t believe for a second that had Microsoft attempted to implement said fix, the companies wouldn’t have run to the EU screaming about how big bad Microsoft was unfairly making these much smaller companies spend significant resources to completely rewrite their products.
That there is good in bad, and bad in good. That sometimes in trying to solve one problem, you end up creating another, and there is nothing wrong in acknowledging this. Right now, what I am seeing is that those supportive of EU legislation seem adamant that said legislation is perfect and there will be no long-term consequences whatsoever.
I agree in principle with some of the arguments above that Microsoft could in theory have tried to do something to prevent an incident like Crowdstrike from even happening in the first place. However, consider this. Crowdstrike was not caused directly by Microsoft to begin with. It was caused by a third party vendor, whose business model was enabled by the very legislation passed by the EU 15 years ago.
Which also raises the question - what even is Microsoft's incentive to fix this issue? My understanding is that they aren't going to be held liable over this, companies are still going to have kernel-level access to Windows thanks to EU regulation, and the only line of defence users have is to pray that the very cloud-based security companies whom they depend on will remain vigilant and don't repeat said accident.
Perhaps it is time to revisit said legislation and discuss whether makers of security software should continue to receive the same level of access to Windows that Microsoft gets? Yes, some users will argue that this is "unfair", but in a hypothetical alternate future where only Microsoft had kernel-level access (and therefore remain the only company who could in theory crash computers worldwide via a faulty patch), is a lack of competition in this space an unfair price to pay in exchange for improved security and stability to Windows users worldwide?
My point is the EU's actions have consequences and that they'd do well to remember that. You may think a worldwide multi-day outage that causes billions of dollars of damages it's a worthwhile price to pay to enable competition in a pretty scammy corner of the PC software market, but a lot of us don't. And the EU's response of "Microsoft never told us something like this could happen" proves the point of those of us who have been saying it's clear the EU doesn't understand the implications of what they're demanding in their burdensome and unnecessary regulations.
At least in the Microsoft case they have the argument that Windows has something like 90% marketshare. While I still say giving third parties the same level of access as the OS manufacturer is an incredibly stupid idea, Microsoft does have a monopoly on desktop computing software and therefore deserves stricter oversight. But they're doing the EXACT SAME THING to iOS, which has a 25% marketshare in the EU. Who knows what "interoperability" requirement they're pushing on iOS will lead to. Maybe their demand that anyone and everyone who wants access to AirDrop means malware gets shared more easily? Maybe their demand that side loading and alternate app stores be allowed lead to a significant increase in malware. We've already seen Google's model leads to Android users having 95% of all mobile malware targeted at them. So forcing that model onto iOS in the name of competition, when the model already is available to anyone who wants it in Android, is not a worthwhile endeavor.
Just to provide the relevant excerpt in this case from the 2009 agreement.
A. GUIDING PRINCIPLES
(2) Microsoft shall ensure that third-party software products can interoperate with Microsoft’s Relevant Software Productsusing the same Interoperability Information on an equal footing as other Microsoft Software Products. (“Interoperability Commitment”)
(3) This Undertaking shall be interpreted in the light of these Guiding Principles.
(4) Microsoft shall not circumvent or attempt to circumvent the commitments in this Undertaking, including the Guiding Principles.
B. INTEROPERABILITY COMMITMENT
I. General Provisions
(5) The following general provisions shall govern the implementation by Microsoft of the Specific Commitments in Section B.II.
(6) Microsoft shall:
A. Make Interoperability Information available to interested undertakings in the way outlined in this Section for the purposes of achieving interoperability.
B. Support open, public standards in Microsoft’s RelevantSoftware Products in the way outlined in this Section.
(7) Interoperability Information shall be made available by Microsoft under the following terms:
A. Access to and use of the Interoperability Information shall be subject to reasonable and non-discriminatory terms.
1. “The EU is responsible for the outage because their directive allowed third-party access to the Windows kernel.”
The EU directive promotes interoperability, ensuring third-party software can compete fairly with Microsoft’s own products. According to the guiding principles in Microsoft’s interoperability commitments, Microsoft is required to provide third-party vendors with equal access to interoperability information to prevent monopolistic practices. However, this obligation does not absolve Microsoft of responsibility for ensuring a secure implementation.
The Crowdstrike issue arises from a failure in execution by the vendor and Microsoft’s own oversight in managing kernel access—not from the directive itself. The EU does not micromanage technical implementations; instead, it creates a framework for fair competition. If Microsoft had concerns about potential risks, their obligations under the directive included proposing reasonable, non-discriminatory safeguards to mitigate them. Blaming the EU for the vendor’s failure is a misdirection when the underlying issue is one of operational negligence.
Moreover, Microsoft retains a significant role in regulating kernel access. The EU does not prevent Microsoft from implementing safeguards or requiring higher standards from third-party vendors. If Microsoft neglected these precautions, that reflects their own strategic choices, not an inherent flaw in EU policy.
2. “Microsoft has too many users, making fixes harder, and the EU didn’t consider this.”
This argument conflates two separate issues: the complexity of Microsoft’s systems and the intent of EU regulations. The EU is not demanding immediate perfection but rather creating an environment for competition and innovation, which fosters long-term improvements in security and user choice. Microsoft’s vast user base is precisely why oversight is needed—it holds a disproportionate amount of control over consumer systems. Allowing unchecked dominance would lead to stagnation, higher costs, and reduced innovation, as seen historically in monopolistic markets.
The EU directive does not prevent Microsoft from imposing reasonable compliance measures on third parties. If Microsoft feared potential exploits, they had ample opportunity to collaborate with regulators to propose mitigations or technical standards. Suggesting the EU is unaware of the complexities in regulating monopolistic markets overlooks the detailed deliberations behind such policies.
Furthermore, Microsoft’s size is an advantage, not a handicap. With vast resources, Microsoft is uniquely equipped to implement safeguards for third-party access. If the company chose not to prioritize these safeguards, it is a failure of corporate governance, not EU regulation. The directive does not prevent Microsoft from requiring third parties to meet rigorous security standards or implementing automated checks to detect vulnerabilities.
3. “The EU doesn’t understand the implications of their regulations; burdensome rules are unnecessary.”
The guiding principles of the EU directive emphasize reasonableness and non-discrimination, ensuring competition without undermining security. Microsoft’s interoperability commitments were explicitly designed to balance competition and stability. Claiming the EU “doesn’t understand the implications” ignores the clear framework outlined in the regulation, which allows Microsoft to propose and enforce appropriate security measures while enabling competition.
The analogy of a “decapitating seatbelt” is flawed. EU regulations do not force insecure practices; they require equal access under reasonable terms. If Crowdstrike introduced vulnerabilities, it is because
either the vendor failed to follow best practices or Microsoft failed to enforce adequate compliance measures—both of which are operational issues, not regulatory flaws.
4. “Competition leads to instability; wouldn’t we be safer if only Microsoft had kernel access?”
Relying solely on Microsoft for kernel access is a dangerous trade-off. Monopoly control reduces incentives for innovation and security. For example, vulnerabilities in Microsoft’s kernel would leave billions of users globally exposed with no alternative solutions. Competition mitigates this risk by diversifying responsibility and innovation, allowing independent companies to address gaps Microsoft might overlook.
Furthermore, the argument assumes that Microsoft is inherently more secure or capable, but history tells a different story. Microsoft itself has released faulty patches causing global disruptions. By opening access to third parties, the EU allows the market to explore alternative approaches to security, which can lead to better overall resilience.
Instead,
they chose to comply without implementing robust safeguards for third-party access—reflecting strategic choices rather than regulatory shortcomings.
5. “Applying the same principles to iOS will lead to more malware.”
The argument oversimplifies the issue of security on iOS. The EU’s interoperability requirements for iOS do not equate to negligence in malware prevention. In fact, such regulations are accompanied by strict requirements for transparency, privacy, and security. Apple’s existing control over iOS is not immune to security flaws either, as demonstrated by multiple incidents of malware breaches and privacy violations. Competition in app stores or interoperability can coexist with robust safeguards if Apple invests in proper security protocols, just as they already do in macOS.
The claim that Android’s openness leads to higher malware rates ignores the fact that Google has taken steps to address these risks and improve its ecosystem over time.
Increased competition does not inherently lead to insecurity—it leads to shared accountability, reducing the systemic risks posed by relying solely on one vendor.
TL;DR
The EU’s regulations are not about perfection but about creating a balanced ecosystem where consumers benefit from competition, innovation, and choice. Mistakes made by vendors or technical issues arising from individual actors do not invalidate the overall benefits of reducing monopolistic control, and
either the vendor failed to follow best practices or Microsoft failed to enforce adequate compliance measures—both of which are operational issues, not regulatory flaws.
The fact that Microsoft didn’t implement greater security standards because EU didn’t explicitly require them to do so is a a shortsighted choice they made.
Nowhere is Microsoft required to design an insecure system, nor are they required to have minimal standards for third party access
