Of course sovereignty and overall data security should be considered. My point is that a blanket "no outsourcing" rule is daft and counterproductive.