Achieving Digital Sovereignty

The last few months have seen a renewed urgency in some strategic goals in the digital strategy of both private enterprises and public authorities. Geopolitical events have become a catalyst to renew efforts to become less dependent on IT products from overseas. The increasingly erratic conduct of the current US administration is a major driver in this development. 

On the one hand, people are demanding alternatives to products from the US and China, and more digital sovereignty. On the other hand, there are fundamentally different opinions on how to achieve this. Broadly speaking, there are two main factions on opposite ends of that spectrum. Both fall short of providing an actionable solution that will yield acceptable results in the foreseeable future.

Two factions

One faction essentially demands full autarky in software as well as hardware manufacturing to eliminate all dependencies. Some pundits argue that “Having a home-grown software ecosystem is all well and good, but unless we can also make our own hardware, like chips and such, this is all pretty much pointless”. It is a version of whataboutism that keeps saying “unless we address X first, there is no point in even starting Y”. But this constant moving of goalposts cannot serve as a permanent excuse for not doing anything in other areas.

Meanwhile, the other faction argues that “digital sovereignty” is a technological and financial folly. They do have a point when it comes to the cost of sovereignty. The one big advantage that a lot of the established vendors have is that they are competitively priced and functionally mature. But for some organizations, this means that replacing an incumbent vendor might seem operationally impossible and prohibitively expensive. Here, sovereignty quickly becomes a primarily finance-driven decision.

A bit of “real talk”

The harsh truth to the entire “digital sovereignty” discussion is:
We are nowhere near where we should be. We also cannot hope to catch up and close the technological gap to the US overnight. To address that, we need to create incentives for researchers and developers to stay in Europe instead of going overseas.

What we can do is to gradually reduce dependencies and perform some radical risk management and reduction in the meantime. Because sovereignty is not an “all or nothing” proposition. It is not binary and consists of a spectrum of risks and dependencies as well as the availability of alternatives.

As it stands right now, the time of cheap and readily available software and services is coming to an end. Companies like Adobe and Microsoft are committed to a subscription-based and increasingly cloud-only model for most of their products and services. That changes the operational and economic risk profile for customers. 

If prices are increased, customers, especially in the public sector, are currently forced to accept the increase for the time being and absorb the added cost in the short term. Sure, they might decide to replace said vendor. But it will take time before – and if – that comes to fruition. Because especially public administration is notorious for things not moving very fast.

No more comfortable assumptions

Price politics notwithstanding, the operational risks of using products from a vendor that is bound to do the bidding of the US administration are real. What those risks are? Ask Karim Khan, Chief prosecutor at the International Criminal Court (ICC). He was sanctioned through an executive order by the US president in February 2025. The reasons for the sanctions are not pertinent to the story, but the consequences certainly are. As of this writing, he is cut off from a substantial range of US-based financial as well as technology services. This example gives rise to an uncomfortable realization: We can no longer assume that services from established international vendors will simply remain available.

Scale that up to an enterprise or even nation-state level and you will start seeing some issues. From public services to utilities, IT infrastructure, payroll, and banking – the consequences would be very noticeable if the US administration decided that a nation or company is not in Trump’s good books anymore.

What are we talking about here?

Beneath all these nuances and layers lies a very important question: What is digital sovereignty anyway? If you search for the term “sovereignty,” you learn that the term originates from the world of politics. Herein lies the rub: Nowhere does it say what digital sovereignty really means to the person mentioning it. 

It feels a little like discussing Christopher Nolan’s 2010 cinematic masterpiece “Inception”. Everyone likes it – but everyone’s understanding of the ending is slightly different. 

Boiled down to the simplest common denominator, sovereignty implies a right to self-determination. Sounds fantastic, doesn’t it? You get to choose something because it is your inalienable right. It is impossible to disagree with a demand like this. It is as non-divisive as it gets, it is politically and emotionally attractive, without having to use a hard-and-fast definition. It puts you into a position of power. Choice and control are all yours. Marketing people love this. Just look at any current ads or headlines in any IT-adjacent publication – you will be hard-pressed to find a page that does not mention “digital sovereignty” at least once.

Markets are already reacting to the entire sovereignty discussion. AWS has, to much marketing fanfare, started a “European Sovereign Cloud”, where all the key people as well as the infrastructure are located in the EU. Their sovereignty claims immediately faced heavy criticism and scrutiny. Legal experts have called this move “sovereignty-washing”. Critics argue that this “EU flavored version of AWS” is still a 100% subsidiary of Amazon US, and therefore might still face obligations under some US laws, such as the CLOUD Act – which was the entire point why some people as well as organizations want to move away from US companies in the first place. So the term “sovereignty” quickly becomes muddled when you take a closer look.

No more knee-jerk reactions

So the first thing that needs to happen is not “move away from vendor X”. If that is the only strategy and goal you have, you are going to crash and burn. The first step is to take stock of the individual situation and then to develop an exit strategy. It involves dealing with contracts, conducting market research, and trying out different approaches. In short: this gets into the nitty-gritty aspects of everyday operations. It is deeply unglamorous, does not involve soapboxy rhetoric and will take a long time to complete – the more complex the environment, the longer it will take. Achieving any degree of sovereignty is most likely not going to be an enjoyable or straightforward journey, but one that we must embark on sooner rather than later. 

All that being said: we are starting to realize that having options is a good thing. Not too long ago, the question of what platform to use seemed almost rhetorical. You use Microsoft Teams, Office, Zoom, and Photoshop. You run your infrastructure on AWS or Azure. Your content delivery is through Akamai, your DDoS protection comes from Cloudflare. 

But there are some new players in town. They are currently the scraggly underdogs, but they sure have potential. And if movies have taught us anything, it is to root for the underdog.

Stefan Karpenstein is an integral part of the Security Blog team as its PR Manager. A theology graduate, he knows that faith alone does not protect against cyberattacks – what does is vigilance and good security technology. And he is still searching for an answer to the question of why people continue to fall for poorly crafted phishing emails. He enjoys spending time with his family, sports – both as a runner and as a spectator in the stadium – and the sound of the ocean.