Digital sovereignty 📖 Wikipedia

Digital sovereignty (also referred to as technological sovereignty, cyber sovereignty, or data sovereignty) is the concept that a state, organisation, or individual should possess meaningful control over the digital infrastructure, data, hardware, and software upon which it depends.^[1] It encompasses the capacity to regulate digital markets, protect citizens' data, ensure cybersecurity resilience, and reduce structural dependence on foreign technology providers, particularly from dominant US and Chinese multinational technology companies.^[2]

The concept has gained significant political traction globally since the early 2010s, particularly in the European Union, and the Global South, as governments seek to balance the benefits of a globalised internet with the imperatives of national security, economic competitiveness, and democratic governance.^[3] There is much variation due to differing regional interests. The EU pursues a regulatory and rights-based approach; the United States has historically championed a multi-stakeholder, open-internet model while asserting extraterritorial jurisdiction through domestic law; and states such as China and Russia have adopted a statist model of strict internet control.^[4]

Aspects of digital sovereignty include technical sovereignty, data sovereignty and Internet governance, as well as digital self-determination and digital integrity.

Digital sovereignty denotes the ability of national governments to control the digital technologies they use where they have significant impacts on society, economy and politics. For example, European academics Yaniv Benhamou, Frédéric Bernard, and Cédric Durand define it as:

the right and ability of political entities to autonomously (independently and/or self-determinedly) use and control tangible and intangible assets and digital services that significantly impact democracy, the economy and society^[5]

The German government in 2022 set an objective of "strengthening our digital sovereignty, for instance by promoting innovation in a targeted manner, improving expertise in key technologies and promoting open source" but also referenced the "digital sovereignty" of the individual.^[6] Under Merz, sovereignty has shifted to meaning "the ability to shape technology across the entire value chain in line with European interests and needs".^[7]

The French government's digital strategy has four objectives, of which one is to "Preserve the digital sovereignty of the state by investing in shared digital tools", in other words, identifying open source as the method for attaining sovereign control of its systems.^[8]

Different visions centre on technical, data or Internet sovereignty, as well as personal self-determination. Discussions have grown at pace since 2011, in part fuelled by the Snowden revelations, which highlighted the vulnerability of systems and countries to US-UK surveillance, and by the emergence of Cloud technologies. There are, as academics Stephane Couture and Sophie Toupin note, risks in summoning up the idea of sovereignty, rooted in the nation state, potentially obscuring the interdependence of a globalised world and ignoring the differences between different countries to avoid unequal and unfair relations.^[9]

Some discussions have highlighted the choices that digital sovereignty gives for different environmental and social outcomes. The academic Konstantin Komaitis emphasises the idea of "interoperable sovereignty", or technical, regulatory and institutional interoperability; in other words, creating strengthened sovereignty through collaboration to build shared norms and standards.^[10]

The Tony Blair Institute (TBI) has rejected what it sees as a "narrow and ultimately counterproductive understanding of sovereignty, particularly regarding AI policy: one that equates autonomy with full technological control and treats interdependence as a vulnerability to be eliminated." Instead it claims that "Sovereignty ... is fundamentally a question of agency and choice – the ability of a state to make deliberate, future-oriented decisions about how AI is integrated, governed and used in line with its national goals" to ensure "strategic autonomy and expand national agency over time".^[11]

As many digital services are based in the US and technologies are often manufactured in China, the duties these countries impose on software and hardware vendors create duties which could be used to access or exfiltrate data for surveillance purposes. The US also can employ the power to sanction, to direct tech companies to sever commercial relations.

US companies are subject to the Foreign Intelligence Surveillance Act (FISA), which grants US security services direct access to data stored by US-owned companies. While the nature of these powers was denied, their usage was confirmed in 2013 by the Snowden revelations. A request for access to cloud storage in Ireland was granted to the US government by the US courts in 2018 in Microsoft Corp. v. United States.^[12] Soon afterwards, the CLOUD Act of 2018 attempted to further clarify the legal basis for lawful access and to give other countries similar rights of access on the basis of mutual agreements.^[13] The case also led to Microsoft's admission that it could not "guarantee" the data sovereignty of European governments’ data stored in its cloud.^[14]

In the EU, the powers to access data stored within the US was challenged on the grounds of a lack of accountability and lack of access to individual redress. These cases, known as Schrems I and Schrems II, brought down two US-EU data protection agreements, Safe Harbor in 2015 and Privacy Shield in 2020.^[15]

The US also has powers of sanction, which can be used to stop a company from supplying a government, institution or individual with services. The International Emergency Economic Powers Act (IEEPA) of 1977 grants sweeping powers to the US president to issue an Executive Order declaring a national emergency.^[16] Although the Act originally granted Congress the right to veto, this provision was found to be unconstitutional in 1983.^[17] As a result, the President can simply declare a national emergency and exercise IEEPA's powers, including stopping individuals and corporations from conducting business with people on the sanction list. This allows the US government to order companies including VISA and Mastercard, to cease doing business with an individual, cutting them out of most online transactions, effectively conferring a "financial death sentence".^[18] Companies like Google and Microsoft can be ordered to cease supplying an individual or "entity", although speech protections in the Act theoretically should stop bars on using services like email. The Office of Foreign Assets Control (OFAC) administers sanctions against foreign regimes and persons.^[19]

Although originally intended to be used sparingly, IEEPA powers were exercised 11 times in Trump’s first presidency against 2,800 individuals.^[20] The widely criticised sanctions imposed by US President Donald Trump in his second presidency against members of the International Criminal Court (ICC) for investigating Israel’s Prime Minister, Benjamin Netanyahu for genocide in Gaza^[21] are a repeat of his behaviour in his first presidency, when he sanctioned ICC officials for investigating the US for war crimes in Afghanistan.^[22]

China’s powers are extensive and opaque. Chinese security services are well resourced and powerful. National security legislation gives China extensive powers to oblige private sector cooperation, while the state also runs a ‘Military-Civil fusion’ strategy, aimed at insuring that the People’s Liberation Army can access private sector technologies both domestically and abroad. While this ‘fusion’ appears to be aspirational, and in some ways is modelled on the US’s technology transfer between civilian and military sectors, the legal potential for coercion is clear.^[23] There are legal obligations that apply to everyone and all organisations in China to provide evidence and assist state security organs.^[24] Network operators must give technical support to public and security services for criminal and national security investigations,^[25] and data localisation is compulsory in order to ensure lawful access by the authorities.^[26] Access to and decryption of data for terrorism purposes is compulsory, effectively compelling backdoors in encrypted technology.^[27] However, legal powers may not be routinely exercised, and companies may introduce friction around compliance.^[28]

There is evidence that these powers may have been used in relation to Huawei’s equipment, which was due to be supplied to the UK for the 5G rollout. A security audit by Finite State found the company's devices to be riddled with security vulnerabilities, including stored access credentials.^[29] However, it is a matter of judgement whether the Huawei’s embedded software was simply badly designed and maintained or contained deliberate means of access, or both. A 2018 Bloomberg investigation claimed to have found vulnerabilities in chips manufactured during the 2010s for the US firm Super Micro Computer Inc, a supplier to Apple and Amazon, and that evidence of tampering at Chinese manufacturing facilities had been covered up by US authorities.^[30] Bloomberg went on to claim that Super Micro servers were routinely reporting device and network information back to China and that the problem was detected and used to investigate Chinese intelligence agencies’ practices. Concerns over the Chinese laptop manufacturer Lenovo have continued for many years. In 2014, Lenovo began including the Superfish spyware with some of its machines, and intelligence agencies put bans in place during the 2010s.^[31] The company remains a UK supplier, including for the UK’s national supercomputer project.

Worries around the potential for attacks have led the US to exclude Chinese tech from some sectors, including electric cars. The Financial Times has reported that Chinese electric vehicles have also been banned on UK military bases. US policy now has a wide range of measures designed to exclude Chinese products from various market sectors due to risks of Chinese intervention. However, a recent Carnegie Endowment for International Peace report warns that this policy is not coherent and could present risks if Chinese competition is shut out.^[32]

The European Chips Act, which entered into force in September 2023, seeks to double the EU's global semiconductor market share to 20% by 2030 through over €43 billion in public and private investments.^[33] However, the semiconductor supply chain remains deeply globalised, meaning the EU must legitimise massive state subsidies to global corporations under the banner of sovereignty while remaining fundamentally interdependent.^[34]

In the realm of cloud computing, early drafts of the European Union Cybersecurity Certification Scheme for Cloud Services (EUCS) included strict "sovereignty requirements" that mandated data localisation within the EU and required cloud service providers to have their global headquarters in a Member State, effectively excluding major US hyperscalers from high-assurance public procurement contracts.^[35] This approach divided Europe, with nations like France advocating for stringent protections similar to its national SecNumCloud framework, while others, such as the Netherlands and Baltic states, argued they would fragment the market and restrict access to state-of-the-art security solutions.^[36]

Gaia-X has attempted to build a sovereign European cloud ecosystem but have incorporated the dominant non-European providers they aimed to contest.^[37] Launched in 2020 by France and Germany, Gaia-X is a federated data infrastructure initiative designed to provide a European alternative to US hyperscale cloud providers such as Amazon Web Services, Microsoft Azure, and Google Cloud. It aims to create a cloud ecosystem based on European values of data sovereignty, transparency, and interoperability, enabling users to retain control over their data while benefiting from cloud services.^[38] The initiative faced criticism for slow progress and for admitting US and Chinese hyperscalers as members, which some observers argued undermined its sovereignty objectives.^[39][40][41]

The EU is increasingly leveraging Free and Open Source Software (FOSS) as a strategic foundation for digital sovereignty, moving beyond technical choices to view open source as essential for democratic autonomy and resilience. The European Commission's Open Digital Ecosystems Strategy and the Interoperable Europe Act (in force since April 2024) mandate cross-border interoperability and promote the reuse of open-source solutions within the public sector.^[42] Civil society organizations and open-source advocates argue that public money should finance public code, warning that massive spending on proprietary, subscription-based services controlled by foreign providers deepens structural dependency and exposes public administrations to foreign legal regimes.^[43] By investing in digital commons and open standards, the EU can retain local control and auditability while benefiting from global collaborative expertise, with advocates positioning open source capacity as the most effective pathway for Europe to strengthening its digital sovereignty.^[44]

In October 2025, the European Commission established the Digital Commons European Digital Infrastructure Consortium (DC-EDIC), a joint initiative by France, Germany, the Netherlands, Italy, and Luxembourg to develop and scale sovereign, open-source digital infrastructure across Member States.^[45] The consortium's first projects included a "100 Day Challenge" to build interoperable open-source components and a pilot program for a European Sovereign Tech Fund, modelled after Germany's national agency.^[46]

Other initiatives at the European level include the Berlin Declaration for European Digital Sovereignty in November 2025,^[47] European level funding, like the NGI0 cascade funding programme run by NLnet, also contribute to the objective of digital sovereignty.^[48]

In France, the government delivers its digital sovereignty strategy through the Interministerial Digital Directorate (DINUM). In April 2026, DINUM mandated that all government ministries formulate plans to eliminate extra-European digital dependencies by autumn 2026, initiating a migration of 2.5 million civil servant workstations from Microsoft Windows to Linux.^[49] Earlier directives replaced foreign communication tools with "La Suite Numérique," a sovereign suite of public sector digital workplace tools including the in-house video conferencing platform Visio.^[50] France's National Agency for Information Systems Security (ANSSI, Agence nationale de la sécurité des systèmes d'information) enforces the SecNumCloud certification,^[51] a security and legal sovereignty standard designed to ensure that cloud data remains under European jurisdiction and immune to extraterritorial laws.^[52] SecNumCloud leaves the Intel Management Engine unassessed.^[53]

Germany has similarly prioritised digital autonomy, notably through the establishment of the Centre for Digital Sovereignty (ZenDiS) in December 2022.^[54] ZenDiS develops "openDesk," an open-source digital workplace suite intended as a sovereign alternative to proprietary office software for public administration.^[55] In March 2025, the German government launched the "Deutsche Verwaltungscloud" (German Government Cloud), a multi-cloud infrastructure based on open standards designed to prevent vendor lock-in and ensure secure, nationwide cloud services for government agencies.^[56] Germany is also increasing investments in Free and Open Source Software solutions like NextCloud, through the Sovereign Tech Fund run by the Sovereign Tech Agency,^[57][58]

At the state level, Schleswig-Holstein is undertaking a comprehensive migration of its IT infrastructure to open source software, including Linux and LibreOffice, to mitigate exposure to third-country legal frameworks.^[59]

The Netherlands has adopted an "open, unless" (open, tenzij) policy for government software, under which public bodies are required to release the source code of software they develop unless there are substantiated reasons not to do so, a principle first established by State Secretary Raymond Knops in April 2020.^[60]

In May 2026, the Dutch government launched "code.overheid.nl",^[61] a self-hosted Git platform built on Forgejo, to serve as a sovereign alternative to platforms like GitHub and GitLab for managing public sector source code.^[62] At the municipal level, the city of Amsterdam published its "Multiyear Digital Autonomy Strategy 2026-2035," outlining a phased transition away from proprietary solutions and non-European cloud operators towards open-source and locally owned systems to safeguard municipal data.^[63]

Denmark is also reducing its reliance on foreign technology providers. In June 2025, the Danish Ministry of Digitalisation announced a government-wide initiative to phase out Microsoft Office 365 and Windows, replacing them with LibreOffice and Linux.^[64] This national strategy is supported by the OS2 community, a network of Danish public organisations that collaboratively develop and govern open-source digital solutions for municipalities, ensuring co-creation and preventing vendor lock-in.^[65]

China represents the most comprehensive and assertive model of state digital sovereignty, a model often described as "cyber sovereignty" or "internet sovereignty." The Chinese government asserts absolute authority over the internet within its borders, operationalised through the Great Firewall (formally the Golden Shield Project), which blocks access to foreign websites and services, including Google, Facebook, Twitter, YouTube, and Wikipedia, and enables pervasive monitoring of online communications.^[4]

China's approach is codified in a series of laws. The Cybersecurity Law (2017) mandates that operators of critical information infrastructure store data within China and subjects all network operators to government inspection. The Data Security Law (2021) expands the state's authority over data processing and establishes a national data security review mechanism. The Personal Information Protection Law (PIPL, 2021) creates a comprehensive data protection framework analogous to the GDPR, but with significant state access provisions.^[66]

China has also sought to export its model of digital governance and surveillance technology internationally through the Digital Silk Road (DSR), the digital infrastructure component of the Belt and Road Initiative. China has provided cost-effective telecommunications infrastructure and surveillance technology to 138 countries across Africa, Latin America, West Asia, Eastern Europe, and Southeast Asia, giving it significant influence over the digital governance architectures of recipient nations.^[4]

The Chinese government has accelerated efforts to replace foreign operating systems, particularly Microsoft Windows, with domestic alternatives across government agencies and state-owned enterprises as part of a broader push for digital sovereignty and technological self-reliance.^[67] This transition gained significant momentum with the "3-5-2" directive issued in 2019, which mandated that government offices and public institutions phase out foreign computer equipment and software over a three-year period, aiming for a 30% replacement in 2020, 50% in 2021, and the final 20% in 2022.^[68][69] The policy is closely tied to the Xinchuang (Information Technology Application Innovation) initiative, which seeks to localise China's IT infrastructure to mitigate risks from US export controls and sanctions.^[70] In December 2023, the government introduced stricter procurement guidelines, enforced in 2024, that explicitly require government agencies above the township level to purchase "safe and reliable" domestic processors and operating systems, effectively barring Microsoft Windows and foreign chips from Intel and AMD from government computers.^[71]

To facilitate this transition, China has heavily invested in the development of homegrown operating systems, primarily based on Linux. Prominent examples include Kylin OS, originally developed by the National University of Defense Technology and later merged into NeoKylin, and the Unity Operating System (UOS), which are widely deployed in the government sector.^[72][73] Beyond the public sector, the push for OS independence is expanding into broader society and consumer markets. Following its placement on the US Entity List, Chinese tech giant Huawei developed HarmonyOS NEXT, a proprietary operating system that completely drops support for Android and Windows applications in favor of a native ecosystem.^[74] The launch of HarmonyOS NEXT has been framed by Chinese state media as a landmark achievement in breaking Western technology monopolies, signaling a significant step toward complete operating system independence in China.^[75]

• Vaughan-Nichols, Steven J. (27 June 2025). "The European Union Linux desktop". theregister.

•  This article incorporates text by Jim Killock available under the CC BY-SA 4.0 license.