Monday 10 November: The Digital Sovereignty Risk Supply Chain
Who was it said that we can consider digital sovereignty in the same way that we talk about cybersecurity, with the acronym CIA – Confidentiality, Integrity, Availability? Oh, it was me. And I am sure many others: digital risk essentially boils down to risk across data, processing and communications; and digital sovereignty captures risk from the perspective of foreign powers rather than cybercriminals. Wait, I hear you say, aren’t they sometimes the same thing? Indeed, and there we have it.
The most recent headline proof point of this alignment, and indeed the legal fuzziness between the two, pertains to the slowdown of Starlink satellite communications in Ukraine, grounding drones and restricting military effectiveness. Musk blamed the US military which again, means the truth lies somewhere in the middle. Echoes perhaps, of the smoking gun of the International Criminal Court chief prosecutor’s Microsoft email account being turned off, reportedly following sanctions from the US President. Whilst Microsoft disputes this, it has added some protections to ensure it doesn’t happen again.
See also: the truth lies somewhere in between. All concerned parties have been ‘inspired’ into action, most recently the Dutch tax authorities have cancelled their Microsoft 365 cloud rollout, following similar government departments across the EU and Switzerland. Sure, the products aren’t as fully fledged (and indeed, there’s an increasing question of who pays the maintainers) – but at least they will continue to work. Meanwhile, Microsoft and AWS have both been making strides to give their customers what they wanted all along – freedom from foreign interference. Google was already there with its Thales partnership S3NS, gold star to them.
Interestingly, whilst it was the question of confidentiality that first inspired the digital sovereignty wave (thanks to the US CLOUD Act of 2018, which lets US authorities require US companies to hand over data they control, wherever it is stored), the availability and integrity questions have accelerated it. Moves such as AWS’ ability to run its European Sovereign Cloud isolated from the AWS global backbone, or the re-emergence of on-premise versions of Microsoft solutions, are good indicators of local autonomy should bad things happen elsewhere.
Clearly meanwhile, they don’t cover an enforced switch-off or slow-down. As argues legal firm Ropes and Gray, the complexities of what to do require careful thought for each corporation or government entity. My view remains straightforward – treat sovereignty risks the same way as any other risks, and put in place a technology architecture that brings risks down to an acceptable level. This includes mapping out data classifications and deciding what the real threats are whether the data is at rest, in motion or in process.
This latter ‘in process’ point covers AI Sovereignty. Over ten years ago I wrote of the dangers of data aggregation: “It is possible to operate entirely in the shadows cast by the context of human behaviour, without treading on the toes of anyone’s ‘personal’ information.” We now have large language models that were built on this principle, and are very good at it. To mitigate this risk requires localised processing; to mitigate our inability to build our own LLMs requires home-grown platforms, which requires home-grown skills. We have a risk supply chain, and sovereignty applies at every step.
P.S. You’ll notice not much on the I of CIA - integrity. Watch this space for certificate tampering, or indeed modifications/restrictions to software updates by a foreign power. Whilst Stuxnet was never officially claimed by any government, and SolarWinds was only attributed to Russia’s foreign intelligence service months later (and denied by Moscow), the point about managing risk remains the same.
