Could a “digital umbrella” guarantee digital sovereignty in the era of hybrid warfare ?

In a world where cables, serv­ers and data have become weapons, the issue of digit­al autonomy is a major stra­tegic chal­lenge. The con­flict with Rus­sia in Ukraine, for example, has revealed a new dimen­sion of war­fare: one that is played out in net­works, serv­ers and inform­a­tion flows. Bey­ond mis­siles and tanks, a battle for con­trol of cyber­space is being waged, pos­ing a fun­da­ment­al ques­tion to states around the world: can a con­flict still be won while remain­ing depend­ent on oth­er nations or private act­ors for digit­al infrastructure?

For Maud Quessard, uni­ver­sity lec­turer and dir­ect­or of the Euro-Atlantic depart­ment at the Stra­tegic Research Insti­tute of Ecole Milit­aire, the issue is clear: “Ques­tions of sov­er­eignty are not only a mat­ter of polit­ics or strategy, but also of engin­eer­ing, infra­struc­ture and invest­ment in R&D,” she explains. This real­ity requires a fun­da­ment­al reas­sess­ment of the links between tech­no­logy and power.

While the use of digit­al tech­no­logy to manip­u­late inform­a­tion is not new, with the first strategies dat­ing back to the first Gulf War in the 1990s, it has intens­i­fied con­sid­er­ably with the rise of social media at the turn of the 21^st Cen­tury. “The goal of a mil­it­ary oper­a­tion involving inform­a­tion activ­it­ies is to under­mine the sta­bil­ity of the adversary,” explains Maud Quessard. “Using digit­al tech­no­logy to manip­u­late inform­a­tion is a power­ful lever,” that proved to be cent­ral in the years 2010–2020.

The research­er makes an essen­tial dis­tinc­tion between two con­cepts that are often con­fused: “The term “inform­a­tion war­fare [or guerre inform­a­tion­elle] is a leg­acy of the Cold War and often implies the involve­ment of mil­it­ary act­ors in a declared con­flict. In con­trast, the struggle for inform­a­tion suprem­acy [or lutte inform­a­tion­elle] refers to manip­u­la­tion or influ­ence oper­a­tions con­duc­ted out­side the con­text of open war­fare.” This ter­min­o­lo­gic­al nuance reveals a stra­tegic real­ity: digit­al destabil­isa­tion no longer requires a form­al declar­a­tion of war.

There is no short­age of recent examples. In Romania, coordin­ated cam­paigns via Tik­Tok and X (formerly Twit­ter) suc­ceeded in pro­pelling an unknown nation­al­ist can­did­ate and out­sider to power, thereby dis­rupt­ing the loc­al polit­ic­al order. “The con­flict in Ukraine fully embod­ies this logic: we are see­ing a large-scale inform­a­tion war accom­pa­ny­ing a con­ven­tion­al mil­it­ary con­front­a­tion,” the spe­cial­ist points out.

These influ­ence cam­paigns are only the vis­ible part of a much lar­ger phe­nomen­on. In Asia-Pacific, Chinese intru­sions into the serv­ers of the Phil­ip­pine and Japan­ese nation­al edu­ca­tion sys­tems have led to massive leaks of sens­it­ive data. For their part, Rus­si­an attacks tar­get even more crit­ic­al infra­struc­ture: under­sea cables, hos­pit­al sys­tems, energy net­works. Some have para­lysed essen­tial ser­vices for the pop­u­la­tion for sev­er­al days. Even more insi­di­ous is the wide­spread use of ransom­ware, which locks com­puter sys­tems in exchange for a ransom, allow­ing funds to be extor­ted or pres­sure to be exer­ted on pub­lic and private institutions.

These hybrid oper­a­tions, which are often inex­pens­ive to imple­ment, are prov­ing to be extremely effect­ive, pos­ing a dif­fuse but per­man­ent threat to the sta­bil­ity of states.

Faced with these new threats, one ques­tion stands out: can effect­ive oper­a­tions be car­ried out without digit­al sov­er­eignty? “That’s the issue right now,” replies Maud Quessard. The con­flict in Ukraine has par­tic­u­larly alarmed coun­tries bor­der­ing Rus­sia. “Esto­nia, Lithuania and Latvia have been on alert for more than ten years in the face of Rus­si­an inter­fer­ence, even without open war­fare,” she points out.

But ensur­ing this autonomy is a major chal­lenge. “Guar­an­tee­ing this sov­er­eignty requires the abil­ity to con­trol one’s own digit­al infra­struc­ture,” explains the research­er. How­ever, in a bor­der­less digit­al space, nation­al pro­tec­tion quickly reaches its lim­its. “As digit­al tech­no­logy has no bor­ders, this pro­tec­tion must be organ­ised on a supra-state level, such as NATO,” she insists. The ana­logy with the Cold War is strik­ing: “It is becom­ing cru­cial to think about a col­lect­ive digit­al umbrella, just as it was dur­ing the Cold War with the nuc­le­ar umbrella.” This shared pro­tec­tion requires unpre­ced­en­ted coordin­a­tion between European and Atlantic allies.

As digit­al tech­no­logy has no bor­ders, this pro­tec­tion must be organ­ised on a supra-state level, such as NATO

Bey­ond phys­ic­al infra­struc­ture, digit­al sov­er­eignty also raises the ques­tion of human resources. For Maud Quessard, “the chal­lenge is to break down the silos between dis­cip­lines.” For too long, stra­tegic issues have remained con­fined to the polit­ic­al and mil­it­ary spheres, without any real dia­logue with engin­eers and tech­nic­al experts. This frag­ment­a­tion is now a major han­di­cap. “Digit­al sov­er­eignty requires resources, par­tic­u­larly to retain tal­ent,” warns the research­er. The con­clu­sion is clear: “Today, many engin­eers prefer to work abroad, in Singa­pore for example, rather than in French pub­lic insti­tu­tions.” This brain drain con­sid­er­ably weak­ens nation­al cap­ab­il­it­ies in cyber defence and digit­al innovation.

The United States has inves­ted heav­ily through agen­cies such as DARPA and CISA. The US Cyber Com­mand has played a cent­ral role in offens­ive and defens­ive digit­al defence. Europe, on the oth­er hand, remains frag­men­ted. Some coun­tries do not even have a struc­tured cyber com­mand. At the European level, in their col­lect­ive work Les guerres de l’in­form­a­tion à l’ère numérique (Inform­a­tion Wars in the Digit­al Age), the research­er and her col­leagues show that the EU can play a major role through reg­u­la­tion. Sim­il­arly, works such as those by Stéphane Tail­lat and Tim Maurer, not­ably in Cyber Mer­cen­ar­ies, clearly illus­trate the chal­lenges between digit­al tech­no­logy, demo­cracy and pub­lic power.

To build true digit­al sov­er­eignty, the research­er iden­ti­fies three imper­at­ives: “Cre­ate nation­al infra­struc­tures, secure them using our own resources, and ensure their resi­li­ence and autonomy.” These require­ments go far bey­ond the tech­nic­al sphere. They involve major polit­ic­al choices in terms of budget, train­ing and inter­na­tion­al cooper­a­tion. Build­ing European digit­al autonomy also requires rethink­ing eco­nom­ic mod­els: how can we recon­cile open­ness to glob­al innov­a­tion with the pro­tec­tion of crit­ic­al infra­struc­ture? How can we attract the best tal­ent without sub­ject­ing them to crip­pling bureaucracy?

These ques­tions are par­tic­u­larly rel­ev­ant in the cur­rent geo­pol­it­ic­al con­text, where the bound­ar­ies between armed con­flict and hybrid war­fare are blur­ring. The Balt­ic states, on the front line of Rus­si­an attempts at destabil­isa­tion, have developed valu­able expert­ise in cyber resi­li­ence. Their exper­i­ence shows that effect­ive defence requires not only soph­ist­ic­ated tech­nic­al tools, but also a cul­ture of vigil­ance shared by soci­ety as a whole.

Bey­ond the tech­nic­al issues, digit­al sov­er­eignty raises the ques­tion of the mod­el of soci­ety we wish to defend. In a world where data flows across bor­ders and digit­al infra­struc­ture determ­ines the very exer­cise of power, European demo­cra­cies must rethink their rela­tion­ship with tech­no­logy. It is no longer just a ques­tion of pro­tect­ing serv­ers or cables, but of guar­an­tee­ing our col­lect­ive abil­ity to decide our future without stra­tegic depend­ence on for­eign act­ors, wheth­er gov­ern­ment­al or private.

Marie Varasson