Outline
References
Figures
The term “digital sovereignty” has become an integral part of current political discourse. Across party lines and administrative levels, there is consensus: Being digitally sovereign is desirable and important. However, it often remains unclear what it actually means to be digitally sovereign and how this desirable state should be achieved. Nearly every digital policy measure could be justified and rhetorically polished with the goal of digital sovereignty. Still, digital sovereignty is more than a meaningless buzzword. It allows us to experience the political dimensions of digital infrastructures in many facets. It clarifies the political dimensions of digital infrastructures and points us towards the scopes of action in which we ourselves can shape our digital future in a self-determined way. To illustrate digital sovereignty in its entirety, this compact overview addresses three central questions.
Sounds good, means a lot. What is digital sovereignty, aside from political rhetoric?
We scrutinize the political discourse on digital sovereignty and find answers to the question of who is supposed to become sovereign over what. We then establish the historical connection to the notion of state sovereignty, and establish that both terms, although they have somewhat divergent meanings, inform and give context to one another.
The great awakening. Why do we want to become digitally sovereign?
The last 30 years of internet history have provided many legitimate reasons to view “the digital” as a challenge to the sovereignty of public institutions, companies, individuals and collective movements. We recapitulate seven important events and developments that have fueled the call for digital sovereignty and raise fundamental questions about the distribution of power and creative authority in the digital age.
Ways toward a self-determined future. How do we become digitally sovereign
The digital sovereignty of various stakeholders can be promoted through different government interventions. In the EU and Germany, this involves, among other things, digital competency, infrastructure expansion, data policy, platform regulation, key technologies and cyber security. Ideally, the measures discussed should fit together like pieces of a puzzle.
"We must strengthen our digital sovereignty,” declared German Chancellor Olaf Scholz at the re:publica conference in 2022
[1]
. “What we need now in every sector, for every innovation, are European solutions and European sovereignty,” demanded French President Emmanuel Macron two years earlier; the pursuit of digital sovereignty has become a central political project of his presidency [2]
."We must strengthen our digital sovereignty"
Olaf Scholz 2022
We encounter calls for digital sovereignty at many levels of German and European politics, in party programs, strategy papers from ministries, in the EU Commission, the Council of Europe, in security authorities, among internet activists and in business associations. However, as ubiquitous as the term may be, its actual meaning usually remains unclear. Actors from the domains of politics, industry and civil society are calling for different, sometimes even contradictory measures under the banner of digital sovereignty. Apparently, we are dealing with a political high-value word
[3]
. Digital sovereignty is an undisputed consensus term: No matter which digital policy one advocates, no one can say that they don’t care about digital sovereignty. Those who call for it can rhetorically enhance their policy agenda and link it to higher ideals without making concrete, verifiable promises. At times, high-value words are used in such an inflationary way and in so many contexts that they are in danger of being completely stripped of their meaning and becoming meaningless empty phrases.Even in research, a uniform definition of the term does not exist
[4]
[5]
[6]
. In general, the demand for digital sovereignty involves an idea of more autonomy, freedom of choice, co-determination and control over “the digital” [4]
[5]
. Let’s try to concretize this vague idea. We can do this by defining the object of sovereignty (“what do we want to become sovereign over?”) and the corresponding actor (“who is supposed to become sovereign here?”) more precisely.1.1 Objects of digital sovereignty
What exactly “the digital” is that we want more sovereignty over can vary greatly, depending on whether we are talking about resource dependencies, skills shortages, digital education or platform regulation, for example. In somewhat simplified terms, digital technologies and infrastructures can be represented on three layers, which together form the technology bundle: the physical layer, the code layer and the data layer
[4]
[7]
[8]
. Virtually every digital application we use is based on a combination of IT components on these three layers.To write an email, we need several devices (physical layer). We compose it via a user interface, behind which there are a number of programmed software components (code level) and finally send it by routing the message to the recipient via various servers and internet nodes using defined standards and protocols (data level).
Digital sovereignty can be conceived at each of these layers by asking to what extent they can be shaped in a self-determined or at least fairly independent manner. At each technology layer, the desired freedom of choice and design extends across the entire service chain, that is, from research and development through production, marketing and operation to self-determined and secure usage
[9]
.Diagram of technology layers with data, code, and physical layers, and their associated value chain
However, it is neither possible nor sensible to become “self-sufficient” (completely independent) in all these areas. Rather, it may be sufficient to create scope for decision-making so that there is a choice between several alternatives. In any case, certain dependencies cannot be avoided. In Europe, for example, there are no significant deposits of the rare earths needed for the production of important technological components. Dependence on the import of such resources is therefore inevitable. There are also dependencies that are not inevitable but have simply grown over many years, such as the dominance of U.S. companies in cloud computing. Efforts to free oneself from such dependencies or to reduce them are also referred to as “acts of resistance” to digital forms of hegemony
[6]
. After all, the struggle for digital sovereignty also reveals the continuation of a race for economic, political and military dominance in the world. In addition to physical territories such as land, water, air and space, digital space has become another arena for geostrategic power struggles [10]
.1.2 Actors of sovereignty
There is a lack of clarity in the discourse on digital sovereignty, particularly with regard to the question of whose sovereignty should be strengthened. The circle of “sovereign actors” is often interpreted very broadly in political and academic discourse. For example, it can refer to the digital sovereignty of individual countries or groups of countries, such as Germany
[9]
, the EU [11]
or the Global South [12]
. The focus is also often placed on social sub-sectors or organizations, be it public administration [13]
, academia [14]
, private companies [15]
, civil society [16]
or individuals [17]
. We will return to these actor groups in the third chapter because political measures to increase digital sovereignty are usually aimed at specific actor groups and each group has different ways of expanding and utilizing its scopes of action for shaping the digital space.However, the wide variety of actors discussed today has only grown over time. When the term sovereignty was first used in the digital context around 30 years ago, its meaning was still very much based on the understanding of state theory, which clearly focused on the state as the sovereign actor. This understanding is expressed in the Charter of the United Nations. By signing the Charter, the now 193 member states have committed themselves to respect the sovereignty of other states. In this regard, the UN Charter deals with two essential concepts of sovereignty; namely, internal sovereignty and external sovereignty.
In-depth text
What does sovereignty mean? A historical excursion
External sovereignty
External sovereignty refers to the prohibition of the use of force and the territorial integrity of states guaranteed by it. UN member states expressly declare that they will refrain from any use of force or threat of force against other states. Wars of aggression are not compatible with the UN Charter, and even propaganda for wars of aggression is explicitly prohibited. If a state is attacked, it has the right to defend itself. The external sovereignty of a state is given if its territorial integrity is preserved.
Internal sovereignty
Internal sovereignty refers to self-determined internal organization: Each state has “the right freely to choose and develop its political, social, economic and cultural systems”
[18]
. Sovereign states are therefore free to decide, for example, whether they pursue a social market economy or a centrally planned economy, whether a one-party system or a democratic republic governs, or whether they grant secular power to the church. A state is internally sovereign if it can decide on its internal affairs in a self-determined and independent manner.Over the past 25 years, digitalization has transformed vast areas of society. Leisure activities, interpersonal communication, media consumption, administrative processes and even entire professional groups have shifted to the digital space. There were profound upheavals that raised new questions about autonomy, control and the distribution of power between different interest groups. Over the course of time, there were a number of events in the context of which the notion of sovereignty was used and re-interpreted time and time again, until digital sovereignty finally became a political high-value word that, while omnipresent, has an enormous range of meanings and is rarely defined.
In this chapter, we recapitulate seven central developments in the history of the internet in the context of which sovereignty was mentioned and which changed how digital sovereignty was interpreted. On the one hand, this explains why the term has become so ambiguous over time. But it also shows that along the entire value chain of digital infrastructures, the power and design interests of various groups clash and need to be negotiated. In the third part of this compact overview, we will look at how this can ultimately succeed and how perceived grievances are addressed.
2.1 Cyberspace sovereignty
People have been talking about sovereignty for many centuries, and one thing has always remained the same: it is tied to a territorial concept. State sovereignty always refers to a defined, physically existing area that determines the borders of the national territory. However, digital space — often referred to as “cyberspace” in the 1990s — is not a physical territory in this sense, as there is simply no fixed geographical and political frame of reference as with a national territory. The question therefore arose early on as to whose national territory cyberspace belonged to, if any.
In the mid-1990s, this was referred to as “cyberspace sovereignty” by the technical community and in the academic and journalistic debate. The dominant narrative was that cyberspace was a new sphere of human activity that was fundamentally different in nature from everything that had gone before. People were convinced that it would be difficult or even impossible to regulate or control it with existing legal instruments. Laws, it was commonly assumed, were only valid within defined territorial boundaries — outside these boundaries they were neither enforceable nor did they have legitimacy
[23]
. One of the most daring claims was that cyberspace, with its cross-border, global networking and decentralized organization, was so exceptional that it needed its own sovereignty, similar to a separate nation state. This vision of cyberspace as an independent space with decentralized government is embodied by internet pioneer John Perry Barlow. In 1996, he wrote the “Declaration of Independence of Cyberspace,” which is most impressively presented by himself.John Perry Barlow, internet pioneer
Click "Accept" to load the video from YouTube. YouTube may collect personal data as described in their privacy policy.
The multi-stakeholder governance ideal - Governing with the wisdom of the many
Initially, “governing” the internet mainly meant taking technical decisions, for example, in the development of standards and data protocols. The internet was to become a quasi-neutral structure in which information could be transported freely and openly from one end of the world to the other and to which all people would have equal access. In line with the ideals of freedom and openness, the multi-stakeholder governance model had become established for decision-making. Ideally, anyone who spent time on the internet would also be able to participate in its development
[24]
; that is, not only governments, but also the private sector, the technical community and civil society. In accordance with the principles of inclusion, transnational cooperation and consensus-building, decisions concerning the technical development of the internet were therefore made jointly by many different stakeholders [25]
.Towards the end of the 1990s, the commercialization of the internet began, which was accompanied by a rapid increase in the number of users, available applications and retrievable content. The existing “governance system” of the internet — maintenance and regulation of technical structures based on collective decision making — was not suitable for ensuring that available content and applications complied with local legislation. State intervention and regulation was therefore increasingly seen as necessary in order to shape the internet in accordance with national legal concepts
[26]
[27]
. Thus, at the level of applications and content on the internet, state regulatory measures increasingly prevailed, while at the level of technical infrastructures, standards and protocols, non-governmental organizations still “govern” based on multi-stakeholder governance processes.2.2 The walled gardens of the proprietary internet
The commercialization of the internet ultimately led to more state intervention in the internet. But it also meant increasing private sector intervention in the design of technology. Precisely because the internet was able to develop freely and organically over many years and was not created on the initiative of commercial companies, it allowed radically new forms of cooperative value creation
[28]
. Open-source methods, in which internationally dispersed groups of people wrote code and software together, often free of charge, played a special role. Such collaborations were only possible because the internet was an “open platform”: it was not built for a specific, commercial purpose, but as an open, creative space that was constantly being changed and developed by its users.Jonathan Zittrain
[28]
illustrates the effects of commercialization on this creative freedom with a comparison of the Apple II from 1977 with the first iPhone, which came onto the market 30 years later. Similar to the internet, the Apple II was also a changeable platform that virtually invited hobby programmers but also companies to develop new programs and functions. Any individual contribution that complied with a basic set of rules (such as a programming language or certain internet protocols) was generally acceptable and was shared and developed further as desired. Many of the programs created in this way contributed greatly to the market success of Macintosh computers.The iPhone, on the other hand, symbolizes the advance of the digital in the form of “sterile,” pre-programmed devices and services. It is no longer possible to change view or even change the program code. Programs to be installed are pre-selected in app stores or installed directly on the smartphone by default. Security updates for older devices are discontinued at will. While the computer and internet revolution was once driven by innovative design freedom, the proprietary version of the digital world is now an aesthetic world of “walled gardens”
[29]
. This world may be easy to use, well-designed and convenient, but it is woven into a network of commercial control and restriction. This version of the digital goes hand in hand with a severe loss of digital self-determination and significantly restricts creative freedom. In light of this, industry associations such as the Open Source Business Alliance (OSBA) have been arguing for years that the path to digital sovereignty will increasingly be paved by the use and further development of open source software
and open standards, especially in public administration [30]
.2.3 The power of platforms
The accelerating commercialization of the internet since the late 1990s has provided compelling reasons to view the digital ecosystem as a challenge to state sovereignty. For many years, the U.S. tech giants — above all Alphabet, Amazon, Meta, Apple and Microsoft — were able to build up almost unrivaled power. As platform companies, they gradually integrated more and more applications and services into a core platform. Their infrastructures became ubiquitous communication and organizational tools in everyday private life as well as in countless companies and in public administration
[31]
. The platforms often benefited from the “network effect” [32]
, the principle whereby a network becomes more valuable the more members it has. For example, once a social network has reached a critical mass of members, the number of users increases exponentially until competitors can hardly compete and a monopoly almost inevitably forms.
Prof. Dr. Jeanette HofmannPrincipal Investigator of the research group "Technology Power and Domination" at the Weizenbaum Institute.
"The economic theory of network effects states that the value of an infrastructure such as the telephone network increases with the number of connected people and objects. Expanding infrastructures therefore create a more or less uncoerced compulsion to connect to them." (2020)
Platform companies offer essential technical infrastructures and services on the internet that private individuals, companies and public services rely on. They provide content and communication channels, shape public spaces and operate marketplaces over whose competitive conditions they have a decisive influence. This means that a small number of large American companies have far-reaching scopes of action and regulatory competence, not only over technical infrastructures but also over the socioeconomic conditions and processes that take place within them
[33]
. Platform companies are therefore often referred to as being “quasi-sovereign” in the digital space [18]
.The dominance of platforms poses a market risk for Europe because it threatens to distort competition and jeopardize economic stability and innovation
[31]
. Platform companies have more or less exclusive access to the enormous amounts of data produced within their structures. This data gives them a direct advantage over their competitors. However, large amounts of data are also a prerequisite for developing key technologies such as artificial intelligence [15]
. On a regular basis, the disadvantages that arise for European companies due to the dominance of platform companies are seen as a restriction of their scope of action and thus their digital sovereignty [7]
[15]
.Apple II, 1977
iPhone, 2007
Revenues of the largest Tech companies in 2021, showing Amazon, Apple, Google, Microsoft and Meta.
One-sided dependence on foreign-controlled companies is also seen as a potential security threat. Governments can use platforms as political leverage and pressure against those who are dependent on them. The U.S. government demonstrated this in the trade conflict with China in 2019, for example, when the Department of Commerce forced Google by decree to cease all business with Huawei
[35]
. This is another reason why the one-sided dependence on platform companies is seen by politicians as a challenge to digital sovereignty [30]
[31]
. Finally, the dominance of platform companies is also reflected in their relationship with their users, whose data has become the raw material of lucrative digital products and whose individual digital sovereignty has been significantly weakened as a result [15]
[37]
.Surveillance capitalism - The business with data
For many years, large platforms have been increasingly turning to lucrative advertising to finance their free services. It became clear early on that advertising can be implemented particularly effectively on the internet, due to the ability to personalize and target it. To this end, user data is systematically collected, enriched and analyzed in the background. Demographics, consumer behavior, social contacts, interests and preferences, personality, life situation, location — the more detailed the findings, the better individually tailored advertising measures can be presented at the right time, in the right place and in the right context. The enormous market value of the platforms is therefore based to a substantial degree on their ability to predict and effectively influence future (consumer) behavior. While users have become increasingly transparent in the context of these business models, the industry behind them has remained comparatively opaque. In this context, we speak of “information asymmetry” — a situation in which two contracting parties do not have the same information. If future behavior is deliberately manipulated on the basis of unequal information, information asymmetry also results in power asymmetry
[38]
. The fact that such power asymmetries can also have potentially harmful consequences for democracy was discussed intensively in 2018 in connection with the Cambridge Analytica scandal
[39]
[40]
.Harvard economist Shoshana Zuboff sees these systems of surveillance capitalism as an attack on individual digital sovereignty because they undermine the autonomous ability of individuals to act and make decisions
[37]
. Especially when citizens’ self-determined ability to act is undermined in the context of democratic processes (such as elections and referendums), this can also be understood as an encroachment on the internal sovereignty of the state, which is at least enabled by platforms. In November 2019, Zuboff was at the Humboldt Institute for Internet and Society (HIIG) in Berlin to talk about the age of surveillance capitalism.Click "Accept" to load the video from YouTube. YouTube may collect personal data as described in their privacy policy.
Shoshana Zuboff speaks at HIIG
2.4 Mass surveillance and cyber espionage
Lucrative data-based business models offered companies a strong incentive to collect more and more data about users and infer further insights from it. However, the availability of such detailed information is also an incentive for other actors, not least for the police and security authorities, to use it for their own purposes
[41]
.The new convergence of commercial surveillance and security agencies was revealed in 2013 in an unprecedented leak by U.S. intelligence officer Edward Snowden. The extensive digital surveillance that Snowden uncovered is considered one of the key events that led to digital sovereignty becoming a demand in European politics. The understanding of sovereignty under international law includes the self-determination of domestic organization, meaning that no one has the right to interfere with it. However, if another state — in this case the USA — secretly operates systematic, broad-based surveillance programs that specifically target political institutions, this can certainly be seen as an encroachment on state sovereignty.
Not least, the discourse on digital sovereignty is also about the digital self-determination of individuals and civil society. Individual data sovereignty — that is, the “targeted, informed provision of one’s own data”
[42]
— is directly undermined by the mass surveillance of communication data without cause.
The documents leaked by Snowden prove that the secret services of Western countries, particularly the USA, are engaged in extensive global surveillance. Doubts about their credibility were unequivocally dispelled by the European Court of Justice in two judgments. In 2015, the highest judges confirmed that “the NSA and other United States security agencies” access personal data “in the course of a mass and indiscriminate surveillance and interception”
[43]
.In-depth text
Digital espionage — the NSA affair
Political and industrial espionage
The NSA affair also showed that one task of the secret services was to conduct industrial espionage. This became known as early as 2001, when a committee of the European Parliament looked into “Echelon,” a global interception system of the
Five Eyes
, which intercepted global satellite communications [54]
. The committee’s report suggested that the intelligence network was specifically eavesdropping on the communications of companies. Foreign companies were spied on in order to give American companies a competitive advantage. With the information obtained, U.S. companies were able, for example, to beat their European competitors to patent applications [55]
[56]
, or outmaneuver them in negotiations [57]
[58]
. The Snowden leaks show that industrial espionage was still one of the NSA’s strategic missions 10 years later [59]
. In addition to Russia and China, Germany and France were also among the NSA’s target countries. The mission was to prevent any advance in critical technologies that would give these countries military, economic or political advantages.NSA documents also describe years of systematic and targeted eavesdropping on top politicians — including Angela Merkel
[60]
— and political institutions. The political targets reportedly included the headquarters of the United Nations [61]
, the International Atomic Energy Agency [62]
and, by means of a cyberattack on the Belgian company Belgacom, presumably also the European Commission, the European Council, the European Parliament and NATO [63]
.2.5 Isolation and seclusion
In authoritarian states such as China or Russia, the advance of networked communication was perceived as a threat to the existing political order
[5]
. China was one of the first countries to respond with a strategy of maximum technical isolation and control. Russia followed suit a few years later. In doing so, the Chinese government relied on its typical interpretation of national sovereignty as a non-interference principle. In essence, no other country should interfere in Chinese affairs, and China would not interfere in the affairs of other states (for example, in armed conflicts). This sovereignty rhetoric was already used by China in the early 2000s. After the NSA affair in 2013, it was applied more to the digital context and became a further interpretation of digital sovereignty, which in its radical implementation is far removed from the European understanding. In this context, digital (or cyber-) sovereignty means subjecting data flows and digital infrastructures as completely as possible to national control.
In response to the NSA affair, China was one of the first countries in the world to declare “cyber sovereignty” as the goal and principle of its digital policy measures in 2015. In his opening speech at the Global Internet Conference in 2015, China’s President Xi Jinping declared that, in the spirit of state sovereignty, each country should be allowed to pursue its own regulatory approaches on the internet
[64]
. No one should intervene in the cyber sovereignty of another country, interfere in the internal affairs of other states via digital channels or support cyber activities that undermine the national security of another country [65]
. China sees digital sovereignty primarily as a way not only to maintain national security and protect the country from cyber threats and economic espionage [5]
but also to support the local economy by giving preferential treatment to Chinese companies [65]
. The situation is similar in Russia, where digital sovereignty is equated with greater state control over the digital space and, in particular, over data traffic on Russian territory [65]
An important part of this strategy is data localization
[66]
, which provides that data should only be stored, transferred and processed within national borders and legal jurisdictions. To this end, it is necessary to gain control over the essential technical infrastructures of the internet or to locate them on one’s own national territory. Technically, this is implemented, for example, with national data infrastructures, local data centers, national routing, national e-mail services and a national internet backbone infrastructure [67]
.The structures created also offer new opportunities for systematic surveillance and censorship of the population. In Russia, for example, since 2019, internet service providers are required by the Sovereign Internet Law to install network equipment which allows for more effective traffic monitoring and blocking of unwanted content. In China, since 2019, the Internet Domain Name Regulations have ensured that any cross-border data traffic that has not previously been explicitly approved by the censorship authorities is blocked. For example, if a foreign-registered news portal wants to be available in China, it will have to censor itself
[68]
.Isolationist tendencies in the EU
After the NSA affair, arguments for greater technical isolation were also voiced in Western countries, for example in the discussion about Schengen routing
[69]
. The declared aim was to strengthen protection against espionage activities by foreign intelligence services in the Schengen area. The Schengen routing would have had the welcome side effect that European companies, especially Deutsche Telekom, could have benefited from this implementation [70]
. However, the idea was soon discarded, because data traffic is just too globally networked, actual benefits would be too small, and the danger of a “splinternet” — an internet fragmented into many isolated areas on the basis of geographical and commercial boundaries — was too great [48]
[49]
. Yet, even a decade after the NSA affair, similar arguments for the localization of essential technical infrastructures within the EU are still being made in the debate about digital sovereignty, for example, in the context of the European data infrastructure project Gaia-X [73]
.
Prof. Dr. Thorsten ThielAssociated researcher at the Weizenbaum Institute
“In the wake of the Snowden revelations, Schengen routing was a political push to further nationalize data traffic in order to prevent U.S. services from gaining access to communications that take place exclusively between nationals of a region — in this case, the region of those European countries that have joined the Schengen Agreement.” (Thiel, 2014)
2.6 Geo-economical dependencies
Especially at the EU level, the debate about digital sovereignty is often about freeing oneself from economic dependencies. The digital industry is characterized by dependencies like hardly any other branch of industry. Those who master essential components or services are in a position to put pressure on other states, while those who are dependent on individual suppliers or countries make themselves susceptible to blackmail. Such economic dependencies are very prominently discussed in the discourse on digital sovereignty because they diminish the ability — especially of European industry — to act in an independent and self-determined manner. Digital sovereignty (in this context often referred to as “strategic autonomy”
[74]
) means reducing structural dependence on digital technologies, components and intellectual property from abroad in order to secure availabilities, create choice, and, last but not least, strengthen one’s own economic competitiveness [31]
.
Microchips — electronic components based on
semiconductors
— are a particularly essential component of digital infrastructures. They provide the basis for a wide range of modern devices, from smartphones to computers, televisions, cars, industrial robots, weapons systems and medical devices.The semiconductor industry in particular is characterized by extraordinary dependencies. After all, the astonishing advances in microelectronics have only been possible because companies have become extremely specialized over time. Instead of offering all steps from circuit design to testing and assembly from a single source, it made more and more economic sense to specialize in a core business, which was then scaled accordingly. In Silicon Valley, companies such as AMD, Broadcomm and Qualcomm increasingly focused on high-margin work steps such as the design of blueprints and circuit designs. Large contract manufacturers emerged in Taiwan, such as TSMC, the world market leader in the production of logic and high-performance chips, which are used, for example, in artificial intelligence
[79]
. Microchips are based on globally distributed, fragmented supply chains and highly complex production processes. Thousands of work steps are meticulously intertwined, refined and specialized over decades. No country in the world would currently be able to develop and manufacture a sufficient amount of microchips on its own.Decades of technology-driven globalization have created complex risk cascades
[31]
. If the availability of even one essential component fails, entire industry branches threaten to collapse. It would take decades and enormous investments to rebuild production capacities in one’s own country. From a pure economical perspective, this would be illogical and inefficient. Yet, in the semiconductor industry, market-based logics have long lost their impact because trade relations have politicized over the years.Politicization and trade war
Governments have recognized that it is specifically the reliance on foreign-sourced microchips that makes them vulnerable. Semiconductor products are essential for many industries and products, and their availability is already uncertain due to fragile supply chains without fall-out options. In addition, there have been several supply disruptions in recent years, some with dramatic consequences; for example, when an unexpectedly high demand for computers collided with border closures and lock-downs during the Covid-19 pandemic. Efforts to free oneself from these dependencies are seen as a path to digital sovereignty
[7]
.In-depth text
What is a microchip?
The global semiconductor industry has become the arena of international geopolitics and an instrument for exerting targeted influence on other states
[9]
. There has long been a power struggle between the U.S. and China for political, economic and military supremacy in the world, which has plunged the two nations into an open trade war. Of course, there are similar efforts in Europe, they just have not been particularly successful so far. The USA and China are competing with each other in key technologies such as artificial intelligence, autonomous weapons systems, and quantum computers — all fields of technology in which high-performance chips are used. In the chip industry, competition developed for patents, manufacturing equipment and skilled workers. Both countries massively subsidize their domestic semiconductor industry. At the same time, they increasingly sanctioned each other with import tariffs and export restrictions in order to gain economic advantages and prevent knowledge transfer. But the semiconductor industry just cannot be relocated quickly. American high-performance chips are still predominantly manufactured in Taiwan, which is why the U.S. is particularly concerned by China’s ambitions to take over the Taiwanese peninsula. This could give China not only insights into production processes but potentially even control over the export of microchips to the US.2.7 Cyberattacks and hybrid threats
The topic of cybersecurity has also entered the debate on digital sovereignty, as security agencies in particular see a high level of cyber security as a prerequisite for the digital sovereignty of civil society, economy, science, and the state
[80]
. They all can only independently and safely exercise their role in the digital world if they can rely on secure technologies and the respective digital competences for the secure handling of technology.However, digital infrastructures are susceptible to sabotage and are targeted by hackers driven by both profit motives and political interests. Cyberattacks are becoming more frequent, especially on government institutions and on small and medium-sized enterprises, which are often less resilient than large companies. The threat level is assessed by German authorities as “higher than ever before,” with the focus of current waves of attacks on ransomware
[81]
. A ransomware attack is a form of digital blackmail. Attackers exploit security vulnerabilities to penetrate and encrypt systems. Often the only way to regain the data is to pay a ransom [81]
. Ransomware attacks also frequently target critical government infrastructures, such as healthcare systems or supply infrastructure (such as the Colonial Pipelines
).In addition to cyber-attacks, the discourse on digital sovereignty also frequently addresses the danger of hybrid threats. These involve the deliberate spread of
disinformation
and propaganda, which can undermine democratic processes and lead to unrest. In a study, the EU Commission outlined the acute danger posed by disinformation and targeted propaganda: Hybrid threats jeopardize “human rights, the rule of law, democratic processes, national sovereignty, and geopolitical stability” [82]
. The digital influence through disinformation and propaganda consequently leads to a growing mobilization potential among European citizens, particularly in susceptible environments such as among right-wing extremists, conspiracy theorists, and individuals who delegitimize the state.The EU considers it a part of digital sovereignty that EU citizens are free from intentional external influence in the digital space and can make self-determined decisions
[83]
. We have encountered a similar aspect in the context of data economy in a slightly different form (see chapter 2.3.): Whether corporations manipulate consumer behavior for profit or foreign actors spread disinformation to create public unrest, in both cases digital structures are used to deliberately influence (individual or public) opinion and (individual or collective) behaviors. Digital sovereignty can be interpreted here as the ability to make self-determined decisions in the digital space free from external influence [83]
.The political discussions surrounding digital sovereignty in the EU revolve around various policy areas that can be seen as building blocks to strengthen digital sovereignty
[84]
. In the following, we will explore the options for action of various groups of actors. Civil society, the economy, science, and public administration all have the opportunity to gain digital sovereignty themselves. Additionally, lawmakers can support them in this endeavor through targeted political measures. Here, the EU plays the important role of balancing the sometimes-conflicting interests of different actor groups. But which priorities does the EU set in its digital policy agenda, and what principles it is guided by in doing so?3.1 Legislation as a value-oriented instrument of governance
Ideally, digitization should meet the needs of society across all actor groups
[85]
. Therefore, the EU strategically aims to orient its digital policy towards “European values” and to create technological and regulatory structures that uphold these values.
Margrethe Vestager, who initiated numerous judicial proceedings against U.S. tech giants as EU trade commissioner, emphasizes the goals of the European digital strategy [86]
.Three things become clear here: First, competitiveness is a key concern of the EU, and it clearly pursues its own economic interests with its digital policy. Second, Vestager cites the security and fundamental rights of EU citizens as guiding principles of the European digital agenda, but also emphasizes that regulations are only employed where these values are threatened. This can be understood as a distinction from the sovereignty ambitions of authoritarian states, which often seek to enforce greater control over their own society in the digital realm (see chapter 2.5).
Thirdly, Vestager mentions that European standards have worldwide implications. She thereby alludes to the “Brussels Effect.” Given the considerable size and attractiveness of the European market, EU regulatory measures often have a strong impact on companies and governments outside the EU. They have an incentive to follow European regulatory approaches if they want to do business in the EU
[87]
. It is also argued that the EU, in its role as a “global regulatory hegemon [87]
”, intervenes in the sovereignty of other countries.
Simon SchrörSince 2022 leader of the research group "Norm Setting and Decision Processes" at the Weizenbaum Institute
“The Brussels Effect refers to the EU creating economic incentives for the adoption of its regulatory approaches beyond the European single market. It effectively becomes a regulation exporter and can indirectly exert control over companies and the laws of other governments. Viewed critically, the Brussels Effect can also represent indirect interference in the sovereignty of other, usually smaller, states.” (2024)
But which control options do the EU and the German federal government actually utilize to strengthen digital sovereignty? What leeway do civil society, organizations, and institutions themselves have at their disposal to expand their respective scopes of action? We start with the foundations of digital sovereignty, which are of systemic relevance across all actor groups and technology layers: Sufficient education and participation of civil society, comprehensive cybersecurity and development of key technologies. We will then consider the most important options for action along the three layers of the technology bundle: data layer, code layer, and physical layer.
3.2 Basic conditions of digital sovereignty
Digital sovereignty can only be built upon a digitally sovereign civil society. “Only digitally empowered and capable citizens […] can be the masters of their own destiny, confident and assertive in their means, value and choices,” emphasizes the EU Commission
[88]
. What is frequently referred to as individual digital sovereignty in scholarly literature encompasses digital competency and participation. Digital literacy and competences enable civil society to “act and decide in a conscious, deliberate, and independent manner” [65]
. Meanwhile, opportunities for participation empower civil society to engage in digital policy discourse and decisions, as well as directly in the shaping of technology [16]
.Individual self-determination through digital competencies
Let’s start with the question of what skills are actually needed to make deliberate and independent decisions in the digital space and thus become somewhat digitally sovereign. Digital literacy encompasses knowledge and skills across all layers of the technology bundle.
“By setting the standards, we can pave the way for ethical technology worldwide and ensure that the EU remains competitive along the way. […] Our rules will intervene […] when the safety and fundamental rights of EU citizens are at stake.”
Margrethe Vestager, executive vice-president for a Europe fit for the digital age, European Commission, 2021
Technical proficiency
First and foremost, it is important to be able to use technology in general. Digitally competent persons will be able to handle various IT components—end devices, important applications, and internet services—and know both how and for what purposes to use them
[42]
[89]
. They will also have enough prior knowledge to be able to “make comprehensive and qualified decisions about the release, collection, storage, use, and processing of their own data” [42]
.Technical proficiency
First and foremost, it is important to be able to use technology in general. Digitally competent persons will be able to handle various IT components—end devices, important applications, and internet services—and know both how and for what purposes to use them
[42]
[89]
. They will also have enough prior knowledge to be able to “make comprehensive and qualified decisions about the release, collection, storage, use, and processing of their own data” [42]
.
Media proficiency
Once a person can operate technology, it becomes necessary to also be able to use and assess the media accessed in the digital space. This means the ability to effectively search for information
[42]
[89]
and to judge the quality and credibility of sources and communication partners by critically questioning them [90]
[16]
[42]
.Media proficiency
Once a person can operate technology, it becomes necessary to also be able to use and assess the media accessed in the digital space. This means the ability to effectively search for information
[42]
[89]
and to judge the quality and credibility of sources and communication partners by critically questioning them [90]
[16]
[42]
.
IT security
Among the essential competencies of digitally sovereign individuals, the ability to minimize security risks is regularly counted
[80]
, not least because effective self-protection also protects other users [42]
. This includes, for example, being able to effectively protect oneself against data loss, identity theft, malware, and phishing.IT security
Among the essential competencies of digitally sovereign individuals, the ability to minimize security risks is regularly counted
[80]
, not least because effective self-protection also protects other users [42]
. This includes, for example, being able to effectively protect oneself against data loss, identity theft, malware, and phishing.
Legal certainty
Not infrequently, at least a basic level of legal certainty is mentioned as part of digital literacy
[42]
. This includes knowing one’s own rights (e.g., regarding data protection) and being able to assert them. Legal certainty also means knowing the rights of others in the digital space and accordingly being able to act in compliance with the law. This includes copyright and criminal law (for example, regarding digital bullying, defamation, and stalking) [42]
.Legal certainty
Not infrequently, at least a basic level of legal certainty is mentioned as part of digital literacy
[42]
. This includes knowing one’s own rights (e.g., regarding data protection) and being able to assert them. Legal certainty also means knowing the rights of others in the digital space and accordingly being able to act in compliance with the law. This includes copyright and criminal law (for example, regarding digital bullying, defamation, and stalking) [42]
.
Impact assessment
Digital literacy also involves knowledge about the possible consequences of use for oneself and for others. This can include knowledge about the health effects of IT use such as sleep deprivation or concentration disorders
[42]
or a deeper understanding of the societal, economic, and state power interests in the digital space [6]
.Impact assessment
Digital literacy also involves knowledge about the possible consequences of use for oneself and for others. This can include knowledge about the health effects of IT use such as sleep deprivation or concentration disorders
[42]
or a deeper understanding of the societal, economic, and state power interests in the digital space [6]
.For the European Commission, digital education and skill development are among the top priorities of the European digital policy until 2030
[89]
. It is the foundation for enabling the civilian population to critically and consciously engage with technologies and assess the impact of digital transformation on society and the environment [90]
. A lack of digital skills can result in social exclusion and significant disadvantages in society, the labor market, and the education system [91]
. Conversely, businesses and public administration rely on digitally competent workers to remain competitive in the long term, highlighting the importance of skills development in civil society for other actor groups as well.Public educational offerings provide a framework for individual competence acquisition and can help adapt competence development to future needs (such as those of the job market)
[16]
. In light of this, the Federal Ministry of Education and Research launched an “education offensive” in 2021. This initiative aims to better equip schools with technology, develop digital learning tools, and help education professionals earn relevant (digital) qualifications. For vocational and continuing education, digital training measures are being developed, and freely available educational materials are being disseminated [92]
. The Federal Ministry for Family Affairs, Senior Citizens, Women and Youth also focuses on the autonomy of older people. For example, low-threshold, age-specific educational offerings for seniors are being developed [17]
. In 2023, the Federal Ministry of the Interior and Community introduced the Digital Driver’s License: a comprehensive educational offering, combined with the opportunity to test one’s own digital skills at various difficulty levels and obtain a certificate upon successful completion [93]
.Democratic self-determination through participation and inclusion
Digital competencies help us to navigate the digital space individually self-determined. However, they are also a helpful — if not necessary — prerequisite for actively participating in political and technical shaping processes in the digital world
[16]
. Participation means becoming democratically self-determined, influencing political decisions in the interest of society, and shaping technologies. The democratic agency of civil society in the digital space can be actively promoted by the state.
Dr. Bianca HerloLeader of the research group "Design, Diversity and New Commons" at the Weizenbaum Institute
“People need to be empowered for individual and democratic self-determination in order to also be able to positively influence the cultures, practices, and visions of organization, governments, and civil society with their digital skills and thus contribute to sustainable digital sovereignty” (2023).
For this, it is first necessary that there is transparency about important political and economic decision-making processes, such as in regulation or in the development of technical standards. Only then can citizens understand and participate in these processes. Representatives of civil society can (and should) actively accompany these standardization processes
[94]
[95]
, or even be involved in the development of governmental strategies, such as those for building digital sovereignty [85]
. These are effective approaches to ensure that public interests are represented early and effectively.The state can actively promote the democratic participation of civil society by holding committee meetings publicly, communicating procedures in advance, setting adequate deadlines, and inviting citizens to participate in advisory committees or in the drafting of legislative proposals. Participation formats can also be designed digitally and with low barriers to entry (for example, numerous NGOs demand the establishment of a central publication and participation platform)
[96]
.Extensive cybersecurity
As the second basic condition for digital sovereignty, strong emphasis is placed on the
security and resilience
of digital infrastructures [15]
[97]
. Cybersecurity is considered a fundamental requirement for societal life, economic processes, and the protection of critical infrastructure [99]
. Strategies and measures to enhance IT security are formulated at both the European and national levels in response to a high level of threat. At the end of 2020, the European Commission presented the new EU Cybersecurity Strategy [100]
. Central to this is the plan to address cyber threats across borders, in a coordinated manner, and in close collaboration. The package of measures aims to enforce a uniformly high level of security and resilience of digital infrastructures across the EU. In addition to specific requirements for national cybersecurity strategies and governmental structures, cooperation groups facilitate strategic collaboration on cybersecurity in Europe. National points of EU countries and act as clear points of contact. In the event of acute crisis situations, they should be able to coordinate operational responses quickly, effectively, and across borders.Simultaneously, better encryption systems and stronger defense against surveillance
[101]
, as well as increased use of open-source software (see chapter 3.4), are seen as technical means to improve cybersecurity. The introduction of trusted security certificates could lead to greater transparency and increased security awareness among users [99]
[102]
. Targeted government support for research and development in the field of cybersecurity is an effective measure to strengthen IT security in the long term and reduce dependencies in this area as well [103]
.Key technologies in research and development
Long-term and forward-looking government support for research and development is not only relevant in the field of cybersecurity. Rather, the promotion of key technologies can be understood as another condition for digital sovereignty, which is significant across all actor groups and technology levels. The EU views key technologies as pillars of future economic value creation. Therefore, many EU measures aim to firmly orient the domestic research and business landscape towards the development of artificial intelligence, quantum technologies, cloud technologies, and semiconductor technologies
[97]
. This is done partly to reduce economic dependencies in the medium term and strengthen the domestic industry, and partly to shape technologies in line with European values [65]
. Concrete measures in recent years have often aimed not only at direct financial support but also at improving the competitive conditions for European providers and lowering market entry barriers [65]
, for example, by specifically supporting start-up ecosystems [97]
. At the same time, research and development partnerships can be strategically expanded both between EU Member States and between private companies and states [65]
.
In recent years, the EU has developed a variety of successful data policy measures. At the data level, it is evident that legislators are striving to balance the divergent interests of various stakeholder groups. On one hand, the data of European citizens, companies, and institutions must be adequately protected, and violations of data protection laws must be punished. On the other hand, innovative data-based business models should also be able to develop within the EU, as they are associated with societal and economic benefits.
Data protection
Let’s start with the interests and rights of civil society at the data level. A milestone in data protection law is certainly the General Data Protection Regulation (GDPR), which, since its implementation in 2018, significantly strengthens the protection of personal data of EU citizens and gives users more control over their personal data. It is considered one of the strictest data protection standards worldwide and sets standards that have already been adopted by numerous other countries
[104]
. The ability for users to control data they generate themselves is considered an important feature for their digital sovereignty [84]
. The strong data protection law limits the powers of data processing companies and increases consumers’ right to information, thus reducing existing information asymmetries (see chapter 2.3) in favor of consumers. The GDPR also ensures users have the ability to transfer their data to other applications, which in turn can lower switching barriers and dependencies from specific service providers.Data economy
In other regulatory approaches of the EU, a more private-sector, growth-oriented data policy is evident. The European Data Strategy
[105]
aims to develop a functioning European single market for data while ensuring a high level of data protection. The strategy is primarily based on the Data Governance Act (DGA) 2022 and the Data Act 2024. The DGA lays the groundwork for a trustworthy data exchange model that simplifies data-based collaborations between businesses, academia, public institutions, and civil society. The regulation envisions the establishment of independent, transparent, and trustworthy data marketplaces where data suppliers and buyers can come together. Data can thus easier and more transparently be shared between different sectors. The DGA also aims to encourage altruistic data donations: data donations are facilitated and the access and reuse of donated data is organized in a more unambiguous and transparent manner. The Data Act, on the other hand, stipulates that users must be given access to all data generated by their IoT devices and that this data must also be made available to third parties at the request of the user [106]
. At best, this means that European companies will also be able to access larger volumes of data from which they can create value.Cloud infrastructure
As part of the “Gaia-X” project, announced in 2019 by the German and French ministries of economics, existing data infrastructures from various sectors will be interconnected to create a common European data ecosystem
[107]
. The project aims to facilitate cross-sectoral data exchange and integration. Many previously separate data spaces are thus to be linked together. The task is to formulate appropriate rules and standards for cooperative data exchange and compliant data usage, as well as to define and implement the technical requirements for this new data space. The European Commission emphasizes that its data strategy will make the EU more internationally competitive and contribute to stronger economic growth: Big Tech platforms have “a high degree of market power, as they control large amounts of data,” [108]
and the European data strategy aims to counteract the dominance of these platform companies over data spaces. The Gaia-X project in particular began with the goal of combating the data hegemony of U.S. and Chinese corporations and strengthening Europe’s own competitiveness based on “sovereign data exchange” [73]
(see chapter 3.3). Meanwhile, partners and members of technical working groups of the Gaia-X organization also include major corporations such as Microsoft, Alibaba, Amazon, Google, and Palantir [109]
. As providers of cloud services, they will not only be connected to the created data spaces but also contribute their expertise to the development of these infrastructures. However, they have recently faced criticism for deliberately slowing down the project’s workflows [110]
.
Open-source software
At the level of software and applications, the increased use of open-source software is widely emphasized for digital sovereignty. Specifically, the German Federal Ministry of the Interior and Community highlights that the increased use of open-source software fulfills three strategic objectives
[111]
, which apply not only to public administration but also to other societal sectors. The use of open-source software can be considered a lever for all actor groups to strengthen their independence and room for maneuver.Open-source software provides options for switching: on one hand, because it is built more modularly (allowing individual components to be easily exchanged), and on the other hand, because it is more interoperable than proprietary software (open interfaces enable a greater variety of software components to be linked together). The resulting flexibility reduces the dependence on individual software providers. Open-source software guarantees the ability to co-create. Since the underlying code is visible and modifiable, it can be better adapted to one’s own needs and strengthens potential for collaborations and creative cooperation. If the ability to view, understand, and shape source code has been increasingly restricted by providers of proprietary software, open-source software can rediscover these possibilities. For users — including companies and public institutions — this opens up creative spaces and thus innovation potentials. Ultimately, the use of open-source software also increases bargaining power against providers of proprietary software because there are powerful alternatives to their products
[111]
, which are even considered more trustworthy and secure due to their viewability [9]
.Platform regulation
The EU aims to enhance individual digital rights to establish greater digital sovereignty and exert stronger control over non-European technology companies, especially platform giants. In response to perceived misconduct by these platform companies in recent years (particularly regarding data privacy, misinformation, and monopolization tendencies), the EU introduced two large-scale new regulations.
Digital Services Act
The Digital Services Act (DSA) aims to better protect the fundamental rights of users in the digital space. Its goal is to “prevent illegal or harmful online activities as well as the spread of disinformation”
[112]
, with particularly strict regulations formulated for very large platforms.Digital Markets Act
The Digital Markets Act (DMA) aims to level the playing field between particularly powerful companies (“gatekeepers”) and other market participants
[113]
. Gatekeepers are prohibited from favoring their own products or disadvantaging competing products and providers. Also apps from gatekeepers like Apple or Google must be uninstallable from smartphones.The regulatory package comprising the DSA and DMA addresses several challenges that are highlighted in the discussion about digital sovereignty. For the civil society actors, digital sovereignty requires effective regulation of disinformation, hate speech, and defamation
[95]
to ensure that fundamental rights are enforced in the digital space. Through the stricter transparency requirements for personalized advertising and tracking, individual users gain more power to decide whether they want to be shown personalized recommendations and content. Targeted advertising for minors will be entirely prohibited. This is supposed to mitigate the information and power asymmetries between platforms and users and strengthen users’ autonomous action and decision-making.The DMA also strengthens the digital sovereignty of the economy, as unfair market conditions and business practices by market leaders are effectively limited. This strengthens the opportunities for small and medium-sized enterprises to establish themselves in the development and operation of digital services in the market
[113]
.
Rita GsengerDoctoral student in the research group "Noumsetting and decision processes" at the Weizenbaum Institute
“Disinformation, illegal content, hate speech and discrimination on platforms can have an impact on social debates and democratic processes and jeopardize the physical and mental well-being of minors in particular. The European Commission is tackling these challenges by holding platforms and search engines accountable. However, the prospects of success are unclear and can only be assessed in the coming years” (2024).
Physical components play a crucial role in the discourse surrounding digital sovereignty. Of particular focus in policymaking is the expansion of physical IT infrastructure and the strengthening of European research, development, and production capacities.
Extensive infrastructure development
Time and again, the importance of comprehensive expansion of technical infrastructures is emphasized to grant equal access to the digital space and thus enable digital sovereignty for all members of society
[90]
. Whether it’s mobile network coverage or the laying of fiber-optic cables, participation and engagement can only occur for those members of society who have barrier-free access to the digital space [114]
. Both the EU and the German federal government demand and actively support improvements in supply coverage. For instance, Germany’s “Gigabit Strategy” aims for half of all German households and businesses to have fiber-optic connections by the end of 2025, with “comprehensive, uninterrupted voice and data communication” across the entire country by 2026 [115]
.Reduction of supply risks
In terms of hardware, the discourse at the EU reduces economic dependencies by expanding domestic production capacities and developing strategic partnerships in procurement. The term “strategic autonomy,” frequently used in EU institutions, illustrates that the core ambition is not mere protectionism or even autarky. Rather, it is to create fallback options and choices, at least for essential hardware components. With the European Chip Act, the EU has launched some of the most extensive economic support programs of its digital policy. The Act entails investments in research and development as well as in production facilities within the EU
[116]
. This strengthens the competitiveness of European providers in this market and ensures the reduction of economic dependencies [9]
.Monopoly structures, surveillance, supply shortages, cyberattacks, disinformation—the challenges could hardly be more diverse. Under the umbrella of high-value-word “digital sovereignty”, they find common ground. They are linked by the fact that the interests and claims to power of different social groups clash in them and have to be negotiated politically. Digital sovereignty basically describes a tug-of-war between various players over sovereignty claims, dependency relationships, decision-making and creative leeway in the digital context. With a spectrum of economic, security and education policy measures, politicians are attempting to strengthen or restrict the scope of action of various players in a targeted manner. The political balancing of conflicting interests will have a decisive impact on the future design of our digital infrastructures.
However, it is difficult to assess to what extent individual measures actually lead to “greater digital sovereignty.” Thus far, there is no approach that makes digital sovereignty measurable in the breadth in which it is politically discussed. Consequently, it is also challenging to determine whether and how strongly individual measures influence digital sovereignty. Evidently, it would be advisable to think about measures at the European level—specifically when it comes to regulatory initiatives and economic promotion—since the EU, as a community, can set much stronger incentives than a government acting alone on a national level. Numerous projects and regulations at the EU level have already proven to be expedient and successful. Nevertheless, most digital policy regulatory measures are still relatively young; time will tell how enforceable and effective they ultimately are.
It is clear that strengthening digital sovereignty requires forward-looking planning and a certain amount of courage and self-assurance to shake up established structures and embark on new paths.
Dr. Esther GörnemannResearch Synthesis Referee