Digital sovereignty

Working Definition

Digital sovereignty is the capacity of a political community—a nation-state, the European Union, or in broader usages a municipality or user collective—to govern its own digital infrastructure, data, software, and rules of operation without depending on the permission of external actors, above all foreign governments and extraterritorial technology corporations. Operationally, it is measured by a concrete stress test: who holds the technical or legal power to switch off, throttle, reprice, or surveil the digital services on which domestic hospitals, tax offices, courts, and armed forces rely? Whereas everyday political rhetoric often equates the term with building a “European cloud” or with authoritarian border firewalls, analytical scholarship (such as Julia Pohle and Thorsten Thiel) distinguishes three competing layers of sovereignty claims—state autonomy, national economic competitiveness, and individual user self-determination—that frequently pull in opposite directions. The concept therefore names not a settled legal state, but an ongoing struggle over where territorial jurisdiction ends and technical protocol begins.

Genesis and Global Lineage

The concept emerged from two parallel, politically opposite lineages. The first is French: Pierre Bellanger, founder of the Skyrock radio network, introduced the phrase souveraineté numérique into French public debate in 2011 (in Le Débat and an August 2011 essay in Les Échos) and published a book under that title in January 2014, building on earlier 2006 essays in Politique étrangère by Laurent Sorbier and Bernard Benhamou on sovereignty and digital networks. The second source is Chinese: since the early 2010s, Beijing has championed “cyber-sovereignty” (wǎngluò zhǔquán) in international forums to legitimize state border controls over information flows and domestic content censorship. In Europe, the concept migrated from French industrial commentary into official European Union doctrine after Edward Snowden's 2013 disclosures of US global surveillance: as Pohle and Thiel trace, the 1990s discourse of “cyber-exceptionalism,” which predicted the withering away of the territorial state, gave way to the assertive return of sovereignty. European Commission President Ursula von der Leyen made “technological and digital sovereignty” a flagship theme of her 2019–2024 mandate, and a July 2020 European Parliament briefing defined it as “Europe's ability to act independently in the digital world.” Along the way, the term has been pulled between two powerful gravitational fields: an industrial-lobbying circuit, where “sovereignty” serves as a case for subsidizing domestic cloud and telecom vendors, and an authoritarian circuit, where it serves as a license for state censorship.

Central European Lineage

Long before the phrase became a staple of Brussels and Paris policy papers, Estonia experienced the first major test of state survival in cyberspace inside the European Union and invented an institutional response that operationalized digital sovereignty in practice. Beginning on April 27, 2007, during a diplomatic dispute with Moscow over the relocation of the Soviet-era Bronze Soldier monument in Tallinn, Estonian banks, government ministries, parliament, and broadcasters were paralyzed by coordinated distributed denial-of-service (DDoS) cyberattacks. The crisis prompted NATO to establish its Cooperative Cyber Defence Centre of Excellence (CCDCOE) in Tallinn in May 2008, which subsequently commissioned the Tallinn Manual—the foundational legal effort to define how territorial state sovereignty applies to cyber operations. A decade later, following Russia's 2014 annexation of Crimea, Estonia answered the underlying infrastructure question with an institutional innovation: in June 2017, it signed a bilateral treaty with Luxembourg to open the world's first “data embassy”—an off-site mirror of Estonia's most critical state registries (land cadastre, population register, business register, and digital identity) hosted in a high-security Luxembourg facility, yet placed under full Estonian legal jurisdiction and protected by diplomatic immunity modeled on the 1961 Vienna Convention on Diplomatic Relations. As Estonia's Government Chief Information Officer Siim Sikkut put it at the time, the goal was to establish “sovereign embassies in foreign data centres” so that the state could continue functioning even if its physical territory were occupied. Although canonical Western theoretical surveys (such as Pohle and Thiel 2020) rarely cite the Estonian precedent directly—leaving its formal influence status marked for verification—Tallinn provided the earliest real-world laboratory of state digital continuity in Europe.

Why Now

Between 2018 and 2026, digital sovereignty moved from seminars into defense budgets and procurement law. In 2018, the US CLOUD Act clarified that data held by American cloud providers remain subject to US warrants regardless of server location; in July 2020, the EU Court of Justice struck down the Privacy Shield (Schrems II), while the Franco-German Gaia-X cloud initiative was formally incorporated. The COVID-19 pandemic then showed that the continuity of European administration, schooling, and healthcare depended on a handful of non-European cloud hyperscalers. Russia's full-scale invasion of Ukraine in 2022 added a stark military dimension: Ukraine migrated its state registries to commercial clouds abroad to survive missile strikes, while its armed forces' reliance on Elon Musk's private Starlink constellation—and its owner's coverage decisions—became a textbook illustration of privatized infrastructural power. Simultaneously, US semiconductor export controls (2022) and the European Chips Act (2023) extended the struggle from data to silicon, while in 2024–2026 the integration of frontier AI models into public offices raised a new question: who controls the model weights on which institutions run, and can they be switched off from abroad?

Explanatory Power

Digital sovereignty forces analysts to audit structural dependencies where standard procurement sees only unit price. First, it distinguishes data residency (“the server sits in Europe”) from jurisdictional control (“the provider is immune to extraterritorial foreign orders”)—explaining why a server in Frankfurt owned by a Seattle company does not automatically confer sovereignty. Second, it exposes single points of failure in national digital public infrastructure: when a state builds mandatory e-invoicing (like Poland's KSeF) or a digital identity wallet (like mObywatel) on foreign cloud layers or mobile app stores, the core risk is not overcharging, but geopolitical or regulatory cutoff. Third, it illuminates the EU's structural asymmetry: lacking domestic hyperscalers on the scale of AWS or Azure, Europe exercises power primarily through Anu Bradford's “Brussels Effect”—regulating someone else's infrastructure via the DMA, DSA, and AI Act—which also reveals why regulation alone cannot build a replacement when a service is withdrawn.

Axes of Debate

Underappreciated Angle

Public debate over digital sovereignty fixates on space—where data centers sit—while overlooking the fact that the hardest layer of digital dependence is time: security patches, root cryptographic certificates, compiler toolchains, GPS timing signals, and microcode updates. A state can own its physical server racks in a domestic bunker, yet if their operating system and firmware depend on continuous automated security updates signed by a single foreign vendor, practical sovereignty lasts only until the next unpatched vulnerability or revoked certificate. Estonia's Luxembourg data embassy is conceptually radical because it turns Westphalian logic inside out: recognizing that a small state's physical territory can be occupied, it anchors the legal continuity of the state in extraterritorial redundancy. Genuine digital sovereignty is less the autarkic ownership of every layer of the stack than the institutional capacity to survive disconnection and reconstitute critical functions when a dominant supplier turns hostile.