iToldYouSo #2, When Finland's Top Spy Caught Up to My Campaign Complaint
On Silicon Valley, Finnish elections, and the year it took an intelligence agency to say out loud what a blocked candidate had already written down, and been quietly told to keep to himself.
The Foresight
In April 2025, I wrote an op-ed called How AI Is Already Censoring Elections in Finland. I wrote it as a casualty, not a theorist. I was a municipal candidate for Kokoomus in Helsinki, officially listed in government records, with a Facebook page I'd owned since 2015 (90,000 followers, blue badge verified for roughly a decade, which itself required ID verification at the time), and another 5,000 on Instagram. Meta's advertising system had quietly locked me out of my own campaign.
The op-ed never ran in the Finnish press. Not because editors disagreed with its substance, they didn't, but because I was an active candidate in an ongoing election, and Finnish newspapers apply strict electoral fairness rules during campaign periods. Giving a running candidate a full opinion platform is, correctly, treated as unequal visibility. So a piece warning that a foreign platform was arbitrarily suppressing a Finnish candidate's visibility was held back from publication, on fairness grounds, because the candidate writing it was me. The warning existed. It was dated. It was filed. It just couldn't surface through the channels that would have amplified it.
The specifics were almost comic. My Finnish government issued ID, the same one Meta had accepted that same week to sell me a €13/month verified profile subscription, and the same ID Meta had on file from the original blue badge verification a decade earlier, was rejected for electoral verification. The political ad path also requires a notarized form from DVV (the Digital and Population Data Services Agency); I provided it. My Finnish bank cards were refused without a reason, and my bank confirming no charge had even been attempted. I eventually got payments through by adding PayPal, which proved the "security" rejection was arbitrary. Support was a wall of copy paste AI responses on Facebook, and on Instagram the support contact path was simply blocked outright. When I finally reached a human, I got: "Sorry, the system won't let me change it."
After weeks of this, Meta did eventually let ads run, and then capped my daily spend at €40/day, with no explanation, and refused to raise it even when I asked for ten times that. So the gatekeeping wasn't only binary. It was quantitative. A faceless system had decided, with no reviewable basis, exactly how much democratic visibility a verified Finnish candidate was allowed to purchase per day.
The op-ed wasn't really about me. The thesis was bigger, and I stated it plainly:
"A faceless AI model, built to optimize profits, now decides, via opaque billing algorithms, how much democratic visibility a candidate in Helsinki is allowed.", Zak Allal, April 2025
The Finnish election authority's own definition of electoral interference covers actions that "suppress voices," "create artificial barriers," and "exert control over who gets visibility." Those words were written with foreign state actors in mind. In my case they were being met, line for line, by a US platform headquartered in Menlo Park.
Three arguments, which at the time sounded to the few who read the draft like sour grapes from a first time candidate:
- Finnish democracy had become structurally dependent on foreign private infrastructure it could neither audit nor appeal to.
- The absence of human review on democracy critical decisions was the operating model, and it sat against the spirit, and arguably the letter, of the EU's Digital Services Act and political advertising rules.
- The asymmetry was the scandal. Legitimate candidates were filtered out by automation while fake articles impersonating Iltalehti pushed bitcoin investment scams, stolen celebrity endorsements ran in sponsored slots, and pages like "Boss part-time-x12" paid to target Finnish users aged 34 to 64 with fraud, all of it untouched on the same platform that had blocked me.
For context on the platform comparison: I run an IT consultancy and have spent years dealing with Apple, Amazon, Microsoft, and Google support at enterprise level. Ranked honestly, Apple is the best (fast, human, caring), Amazon has 24/7 chat, Microsoft is solid for enterprise, Google is inconsistent but reachable. Meta is in a category of its own. Opaque, unaccountable, and uniquely hostile to political participation. This isn't an anti tech reflex. It's a practitioner judgment, from someone who also spent time inside Silicon Valley at Singularity University (Google/NASA).
I closed the op-ed with a line I meant literally: "Democracy, especially its core pillar, elections, must remain human, not outsourced to an algorithm or worse: a broken bot." I redirected the entire remaining campaign budget to Google and YouTube, where real support exists.
The piece went into a drawer. The campaign ended. The familiar dismissal settled in around the edges: this is a platform terms of service problem, not a national security problem. Nobody in officialdom picked it up, because nobody in officialdom had ever been shown it.
The Aftermath
Eleven months later.
On March 10, 2026, the Director of Supo, Finland's Security Intelligence Service, Juha Martelius, testified in a public hearing of Parliament's Intelligence Oversight Committee (tiedusteluvaliokunta). The same week, Supo published its National Security Review 2026. Both made the same core argument:
Finland is becoming dangerously dependent on foreign controlled digital infrastructure for functions that are constitutive of its democracy, and nobody has seriously asked whose jurisdiction that infrastructure answers to.
The trigger was the Ministry of Justice's plan to migrate Finland's election data system, candidate registers, voter records, and results tabulation, to Amazon Web Services, with servers in Sweden. It was framed as modernization. Projected savings: roughly €4 million over ten years. Target: the 2027 parliamentary elections, the first time core Finnish election data would ever leave Finnish soil.
Martelius, choosing his words carefully in front of Parliament, said (paraphrased from the official transcript and Helsingin Sanomat coverage):
"If I had to name one service, election data is the kind of thing where one should consider whether the cloud transition is necessary. The cost saving is ultimately quite small, about four million euros over ten years. This is worth reconsidering.", Juha Martelius, Director of Supo, March 10, 2026
Supo's broader review spelled out the reasoning:
- Jurisdictional exposure. Foreign cloud providers operate under their home country's laws, notably the U.S. CLOUD Act, which can compel access to data regardless of where the servers physically sit.
- Loss of visibility and control. A breach, an outage, or a political decision in Washington might not even be detectable by Finnish authorities in real time, let alone reversible.
- Strategic dependency in a shifting world. The question is no longer just "is this provider technically competent?" but "whose country's cloud is this, and what happens to us if that relationship changes?"
On March 24, 2026, the Ministry of Justice reversed course. The 2027 elections will run on existing domestic infrastructure. The official statement, translated:
"The international political situation has changed over the past year-plus… Citizens' trust in elections is of primary importance.", Finnish Ministry of Justice, March 24, 2026
One official reportedly cited U.S. sanctions cutting off services elsewhere as an example of how quickly "trusted" foreign dependencies can become liabilities.
The procurement was paused before it became irreversible. Exactly as Supo recommended. Exactly as, at a smaller scale and a year earlier, I had written into a document nobody was allowed to print.
I Told You So
Supo and the Ministry deserve full credit. They did the institutional work, at the institutional level, and the outcome is one of the more encouraging sovereignty decisions any European government has made on US cloud dependency this year.
The principle Supo articulated in March 2026 is the principle I articulated in April 2025, from the other end of the telescope, with a timestamp.
Supo said: the €4M savings from putting election data on AWS is not worth the loss of sovereign control over a democracy critical system. I said: the efficiency gains from letting an AI auto moderate political ads are not worth the loss of human recourse for legitimate candidates. Martelius worried about a foreign jurisdiction quietly accessing Finnish voter records. I lived the version where a foreign platform quietly decided a Finnish candidate's visibility, capped it at €40/day, and left no Finnish institution able to compel an explanation.
Same failure mode, two layers of the same stack:
The Ministry of Justice listened to Supo on AWS. The harder question, the one my unpublished op-ed raised and that remains wide open, is whether anyone is going to apply the same reasoning to Meta, where the gatekeeping I experienced isn't even subject to procurement review. It's the default environment every Finnish candidate is forced to campaign in.
One honest caveat. Supo was careful to say AWS isn't technically insecure; their concern was strategic and jurisdictional. My Meta critique was both: structural (DSA non compliance, no human recourse, unaccountable gatekeeping) and technical (broken billing, AI generated rejections, an arbitrary €40/day cap). The structural half is now essentially Finnish government policy at the infrastructure layer. The technical half is still my own story, and the platform hasn't changed.
One more irony worth naming. The op-ed was held back on grounds of electoral fairness, a sound principle designed to stop the press from handing candidates disproportionate visibility. Its practical effect was that the one piece of writing documenting how a foreign private platform was already distributing electoral visibility unfairly in Finland could not be published in Finland, because doing so would have disproportionately visibility-ed the candidate trying to sound the alarm. Finnish media applied the rule to itself. Meta applied nothing of the kind. One of those two actors is accountable to Finnish law. The other is the one actually shaping the information environment voters live in.
So, four words, earned honestly:
I. Told. You. So.
Supo's jurisdictional argument, that the real risk isn't technical competence but whose laws the provider answers to and what happens when that relationship shifts, is the argument I made a year earlier, aimed at the ad layer instead of the data layer. The Finnish election authority's own definition of interference ("suppressing voices," "creating artificial barriers," "exerting control over who gets visibility") was being met not by a foreign state but by a US platform no Finnish institution could compel, audit, or overrule.
The Ministry of Justice caught the AWS case in time. The Meta case is still unfixed. The companion piece is already on the record: sovereignty isn't a slogan, it's an architecture.
Stay tuned for the next installment of iToldYouSo. The lag between the warning and the validation keeps getting shorter, even when the warning itself had to wait a year for a stage.