Digital sovereignty (also referred to as technological sovereignty, cyber sovereignty, or data sovereignty) is the concept that a state, organisation, or individual should possess meaningful control over the digital infrastructure, data, hardware, and software upon which it depends. It encompasses the capacity to regulate digital markets, protect citizens' data, ensure cybersecurity resilience, and reduce structural dependence on foreign technology providers, particularly from dominant US and Chinese multinational technology companies.
The concept has gained significant political traction globally since the early 2010s, particularly in the European Union, and the Global South, as governments seek to balance the benefits of a globalised internet with the imperatives of national security, economic competitiveness, and democratic governance. There is much variation due to differing regional interests. The EU pursues a regulatory and rights-based approach; the United States has historically championed a multi-stakeholder, open-internet model while asserting extraterritorial jurisdiction through domestic law; and states such as China and Russia have adopted a statist model of strict internet control.
Aspects of digital sovereignty include technical sovereignty, data sovereignty and Internet governance, as well as digital self-determination and digital integrity.
Definition and development of digital sovereignty
Digital sovereignty denotes the ability of national governments to control the digital technologies they use where they have significant impacts on society, economy and politics. For example, European academics Yaniv Benhamou, Frédéric Bernard, and Cédric Durand define it as:
the right and ability of political entities to autonomously (independently and/or self-determinedly) use and control tangible and intangible assets and digital services that significantly impact democracy, the economy and society
The German government in 2022 set an objective of "strengthening our digital sovereignty, for instance by promoting innovation in a targeted manner, improving expertise in key technologies and promoting open source" but also referenced the "digital sovereignty" of the individual. Under Friedrich Merz, sovereignty has shifted to meaning "the ability to shape technology across the entire value chain in line with European interests and needs".
The French government's digital strategy has four objectives, of which one is to "Preserve the digital sovereignty of the state by investing in shared digital tools", in other words, identifying open source as the method for attaining sovereign control of its systems.
Different visions centre on technical, data or Internet sovereignty, as well as personal self-determination. Discussions have grown at pace since 2011, in part fuelled by the Snowden revelations, which highlighted the vulnerability of systems and countries to US-UK surveillance, and by the emergence of Cloud technologies. There are, as academics Stephane Couture and Sophie Toupin note, risks in summoning up the idea of sovereignty, rooted in the nation state, potentially obscuring the interdependence of a globalised world and ignoring the differences between different countries to avoid unequal and unfair relations.
Some discussions have highlighted the choices that digital sovereignty gives for different environmental and social outcomes. The academic Konstantin Komaitis emphasises the idea of "interoperable sovereignty", or technical, regulatory and institutional interoperability; in other words, creating strengthened sovereignty through collaboration to build shared norms and standards.
The Tony Blair Institute (TBI) has rejected what it sees as a "narrow and ultimately counterproductive understanding of sovereignty, particularly regarding AI policy: one that equates autonomy with full technological control and treats interdependence as a vulnerability to be eliminated." Instead it claims that "Sovereignty ... is fundamentally a question of agency and choice – the ability of a state to make deliberate, future-oriented decisions about how AI is integrated, governed and used in line with its national goals" to ensure "strategic autonomy and expand national agency over time".
Legal risks to sovereignty As many digital services are based in the US and technologies are often manufactured in China, the duties these countries impose on software and hardware vendors create duties which could be used to access or exfiltrate data for surveillance purposes. The US also can employ the power to sanction, to direct tech companies to sever commercial relations.
US Powers of access US companies are subject to the Foreign Intelligence Surveillance Act (FISA), which grants US security services direct access to data stored by US-owned companies. While the nature of these powers was denied, their usage was confirmed in 2013 by the Snowden revelations. A request for access to cloud storage in Ireland was granted to the US government by the US courts in 2018 in Microsoft Corp. v. United States. Soon afterwards, the CLOUD Act of 2018 attempted to further clarify the legal basis for lawful access and to give other countries similar rights of access on the basis of mutual agreements. The case also led to Microsoft's admission that it could not "guarantee" the data sovereignty of European governments’ data stored in its cloud.
In the EU, the powers to access data stored within the US was challenged on the grounds of a lack of accountability and lack of access to individual redress. These cases, known as Schrems I and Schrems II, brought down two US-EU data protection agreements, Safe Harbor in 2015 and Privacy Shield in 2020.Data Protection Commissioner v. Facebook Ireland Limited and Maximillian Schrems (Schrems II), Case C-311/18, Court of Justice of the European Union (2020); Maximillian Schrems v. Data Protection Commissioner (Schrems I), Case C-362/14, Court of Justice of the European Union (2015).
US powers of sanction The US also has powers of sanction, which can be used to stop a company from supplying a government, institution or individual with services. The International Emergency Economic Powers Act (IEEPA) of 1977 grants sweeping powers to the US president to issue an Executive Order declaring a national emergency. Although the Act originally granted Congress the right to veto, this provision was found to be unconstitutional in 1983.Boyle, p. 6 As a result, the President can simply declare a national emergency and exercise IEEPA's powers, including stopping individuals and corporations from conducting business with people on the sanction list. This allows the US government to order companies including VISA and Mastercard, to cease doing business with an individual, cutting them out of most online transactions, effectively conferring a "financial death sentence". Companies like Google and Microsoft can be ordered to cease supplying an individual or "entity", although speech protections in the Act theoretically should stop bars on using services like email. The Office of Foreign Assets Control (OFAC) administers sanctions against foreign regimes and persons. Boyle, p. 7;
Although originally intended to be used sparingly, IEEPA powers were exercised 11 times in Trump’s first presidency against 2,800 individuals. Boyle, p. 9 The widely criticised sanctions imposed by US President Donald Trump in his second presidency against members of the International Criminal Court (ICC) for investigating Israel’s Prime Minister, Benjamin Netanyahu for genocide in Gaza are a repeat of his behaviour in his first presidency, when he sanctioned ICC officials for investigating the US for war crimes in Afghanistan.. Executive Order 13928, "Blocking Property of Certain Persons Associated With the International Criminal Court," 85 FR 36139 (June 11, 2020).
Chinese powers to direct tech companies China’s powers are extensive and opaque. Chinese security services are well resourced and powerful. National security legislation gives China extensive powers to oblige private sector cooperation, while the state also runs a ‘Military-Civil fusion’ strategy, aimed at insuring that the People’s Liberation Army can access private sector technologies both domestically and abroad. While this ‘fusion’ appears to be aspirational, and in some ways is modelled on the US’s technology transfer between civilian and military sectors, the legal potential for coercion is clear. There are legal obligations that apply to everyone and all organisations in China to provide evidence and assist state security organs. Network operators must give technical support to public and security services for criminal and national security investigations, and data localisation is compulsory in order to ensure lawful access by the authorities.; see Article 77 Access to and decryption of data for terrorism purposes is compulsory, effectively compelling backdoors in encrypted technology.Article 18, However, legal powers may not be routinely exercised, and companies may introduce friction around compliance.Kania & Laskai 2021, p. 13
There is evidence that these powers may have been used in relation to Huawei’s equipment, which was due to be supplied to the UK for the 5G rollout. A security audit by Finite State found the company's devices to be riddled with security vulnerabilities, including stored access credentials.Finite State, "Cybersecurity Vulnerabilities Embedded Within Huawei Devices," June 26, 2019. However, it is a matter of judgement whether the Huawei’s embedded software was simply badly designed and maintained or contained deliberate means of access, or both. A 2018 Bloomberg investigation claimed to have found vulnerabilities in chips manufactured during the 2010s for the US firm Super Micro Computer Inc, a supplier to Apple and Amazon, and that evidence of tampering at Chinese manufacturing facilities had been covered up by US authorities.Robertson, Jordan, and Michael Riley. "The Big Hack: How China Used a Tiny Chip to Infiltrate U.S. Companies." Bloomberg Businessweek, October 4, 2018. Bloomberg went on to claim that Super Micro servers were routinely reporting device and network information back to China and that the problem was detected and used to investigate Chinese intelligence agencies’ practices. Concerns over the Chinese laptop manufacturer Lenovo have continued for many years. In 2014, Lenovo began including the Superfish spyware with some of its machines, and intelligence agencies put bans in place during the 2010s.Cybersecurity and Infrastructure Security Agency (CISA), "Lenovo Superfish Adware Vulnerable to HTTPS Spoofing," Alert (TA15-051A), February 20, 2015. The company remains a UK supplier, including for the UK’s national supercomputer project.
Worries around the potential for attacks have led the US to exclude Chinese tech from some sectors, including electric cars. The Financial Times has reported that Chinese electric vehicles have also been banned on UK military bases. US policy now has a wide range of measures designed to exclude Chinese products from various market sectors due to risks of Chinese intervention. However, a recent Carnegie Endowment for International Peace report warns that this policy is not coherent and could present risks if Chinese competition is shut out.Bateman, Jon. "U.S.-China Technological 'Decoupling': A Strategy and Policy Framework." Carnegie Endowment for International Peace, April 25, 2022.
Digital sovereignty initiatives European Union