A featured contribution from Leadership Perspectives: a curated forum reserved for leaders nominated by our subscribers and vetted by the Construction Tech Review Advisory Board.
Director - Information Security and IT at EDP
Digital Sovereignty - Steps Towards a New System of Internet Governance
Digital Sovereignty – A Responsibility Also for Organizations
Sovereignty, in political theory, is the ultimate overseer, or authority, in the decision-making process of the state and the maintenance of order. We might also find other definitions of population, territory, government, and independence.
In the new world, increasingly dependent on technology, the concept of territory crosses the conventional boundaries we usually know into cyberspace, where most the society's activities and essential services are moving to. Maintaining authority, order, or independent decision-making in such a realm, demands that governments control how technology is used to support our lives as citizens in a democratic society.
Cyber Power
To understand the ways digital sovereignty could be threatened, it is fundamental to be aware of cyber power and how it can be used. Cyber power can be defined as "the ability to use cyberspace to create advantages and influence events in other operational environments and across the instruments of power" (Nye, 2010).
Cyber power can leverage cyber or informational instruments within the cyberspace to produce outcomes within it or in other domains outside cyberspace. It is also possible to use physical instruments of power, i.e., non-cyberspace instruments, to produce effects within and outside the cyberspace.
Illustrating with examples, the DoS attacks (Denial of Service Attacks) that Russians are executing against Ukraine supporting States, is an example of the usage of instruments of power within cyberspace to produce outcomes in the cyberspace itself, while the malware used in 2015 against Ukraine energy utility, disrupting their operations and letting part of Ukraine without energy, also performed by the Russians, shows the use cyber instruments with impacts outside the cyberspace.
As an example of the usage of non-cyberspace instruments of power, we can recall a recent major cable cut in the south of France that has disturbed internet connectivity to Asia, Europe, and the US. The impact was in the physical domain, with later repercussions in cyberspace. Still using non-cyberspace instruments of power, but this time with impacts in cyberspace, we have Elon Musk's decision to open satellite communication to support Ukraine's military operations, with obvious impacts it the course of the war. A political decision made by a private company that directly provides a communication infrastructure for one of the conflict opponents!
Thus, we may conclude that cyberspace is not just an area for opportunities, competition, and collaboration but becomes a battlefield for control of industries, markets, values, influence, and, ultimately, our way of life.
Confluence Points in Cyberspace
One might identify confluence or convergence points in all domains, which represent concentrated areas where people and goods flow in convergence lines. For instance, we can identify sea harbors or straights that connect two vast seas. Controlling these points is an exercise of power. In cyberspace, we might also find the same concept as we will see explicit threats to a nation's sovereignty.
If we divide cyberspace into three layers, we can start from the bottom, the physical domain, realizing that no matter how ubiquitous and globally accessible the internet might seem, everything relies on hardware, like cables that transport signals, satellites systems, routers that interconnect networks or endpoints processors, such laptops, servers or even cloud service providers as in as infrastructure as a service model (IaaS - Infrastructure as a Service). In this layer, we have clear confluence points if we realize that all core vendors (CISCO, Huawei, Dell, HP, or Lenovo) for communications or hardware servers are primarily from two major nations, USA and China. It is also worth remembering that the microchip supply chain is highly concentrated, leading to dangerous potential disruption caused by natural hazards or even conflict situations like war.
The layer above, the information domain, is all about the systems and data to support higher layers of information usage, either in the management and operation of computers and networks or in application software. Focusing on the operating systems, from laptops and mobile phones, or cloud service providers in the platform as a service model (PaaS – Platform as a Service), we find almost the same players: AWS, Google, Apple, Microsoft, Huawei or Alibaba, which dominate most of the market. This leads to a new relevant confluence point in cyberspace!
To understand the ways digital sovereignty could be threatened, it is fundamental to be aware of cyber power and how it can be used
These few examples show that, intentionally or inadvertently, any exercise of any type of cyber power described above, in a confluence point, could severely harm our society and our well-being.
Resilience at Organization Level
It's clear that digital sovereignty is a challenge that governments and international organizations must address at a global level, from civil to military realms. Notwithstanding the need for a global approach by the relevant authorities, at the organizational level, we can and should start to act to defend our digital sovereignty, especially if our organizations manage critical infrastructures or operate essential services to society. Waiting to act could be too dangerous!
At every meeting and decision in our organizations, we should consider resilience principles throughout systems building to applications operations, but also on the business service design, including people. Resilience includes, among other considerations, good situational awareness, diversity, and cooperation that could be fundamental for supply chain disruptions, segmentation to defend our networks when they are breached, or recovery capabilities when attacks are successful.
Today, technology underpins our way of life and supports progress, economic growth, and well-being. There is no doubt that companies are made to be profitable, and to achieve this objective, it is necessary to optimize resources, but it's also crucial for us to understand what critical services we are delivering to society and what our responsibilities are, considering both safety and security to protect our values. Govern the technology environment is fundamental for our sovereignty, our digital sovereignty.
