Concerns arise over software acquisitions for a sensitive EU project, with possible access by Russian intelligence services.