Could a “digital umbrella” guarantee digital sovereignty in the era of hybrid warfare ?

In a world where cables, ser­vers and data have become wea­pons, the issue of digi­tal auto­no­my is a major stra­te­gic chal­lenge. The conflict with Rus­sia in Ukraine, for example, has revea­led a new dimen­sion of war­fare : one that is played out in net­works, ser­vers and infor­ma­tion flows. Beyond mis­siles and tanks, a bat­tle for control of cybers­pace is being waged, posing a fun­da­men­tal ques­tion to states around the world : can a conflict still be won while remai­ning dependent on other nations or pri­vate actors for digi­tal infrastructure ?

For Maud Ques­sard, uni­ver­si­ty lec­tu­rer and direc­tor of the Euro-Atlan­tic depart­ment at the Stra­te­gic Research Ins­ti­tute of Ecole Mili­taire, the issue is clear : “Ques­tions of sove­rei­gn­ty are not only a mat­ter of poli­tics or stra­te­gy, but also of engi­nee­ring, infra­struc­ture and invest­ment in R&D,” she explains. This rea­li­ty requires a fun­da­men­tal reas­sess­ment of the links bet­ween tech­no­lo­gy and power.

While the use of digi­tal tech­no­lo­gy to mani­pu­late infor­ma­tion is not new, with the first stra­te­gies dating back to the first Gulf War in the 1990s, it has inten­si­fied consi­de­ra­bly with the rise of social media at the turn of the 21^st Cen­tu­ry. “The goal of a mili­ta­ry ope­ra­tion invol­ving infor­ma­tion acti­vi­ties is to under­mine the sta­bi­li­ty of the adver­sa­ry,” explains Maud Ques­sard. “Using digi­tal tech­no­lo­gy to mani­pu­late infor­ma­tion is a power­ful lever,” that pro­ved to be cen­tral in the years 2010–2020.

The resear­cher makes an essen­tial dis­tinc­tion bet­ween two concepts that are often confu­sed : “The term “infor­ma­tion war­fare [or guerre infor­ma­tio­nelle] is a lega­cy of the Cold War and often implies the invol­ve­ment of mili­ta­ry actors in a decla­red conflict. In contrast, the struggle for infor­ma­tion supre­ma­cy [or lutte infor­ma­tio­nelle] refers to mani­pu­la­tion or influence ope­ra­tions conduc­ted out­side the context of open war­fare.” This ter­mi­no­lo­gi­cal nuance reveals a stra­te­gic rea­li­ty : digi­tal des­ta­bi­li­sa­tion no lon­ger requires a for­mal decla­ra­tion of war.

There is no shor­tage of recent examples. In Roma­nia, coor­di­na­ted cam­pai­gns via Tik­Tok and X (for­mer­ly Twit­ter) suc­cee­ded in pro­pel­ling an unk­nown natio­na­list can­di­date and out­si­der to power, the­re­by dis­rup­ting the local poli­ti­cal order. “The conflict in Ukraine ful­ly embo­dies this logic : we are seeing a large-scale infor­ma­tion war accom­pa­nying a conven­tio­nal mili­ta­ry confron­ta­tion,” the spe­cia­list points out.

These influence cam­pai­gns are only the visible part of a much lar­ger phe­no­me­non. In Asia-Paci­fic, Chi­nese intru­sions into the ser­vers of the Phi­lip­pine and Japa­nese natio­nal edu­ca­tion sys­tems have led to mas­sive leaks of sen­si­tive data. For their part, Rus­sian attacks tar­get even more cri­ti­cal infra­struc­ture : under­sea cables, hos­pi­tal sys­tems, ener­gy net­works. Some have para­ly­sed essen­tial ser­vices for the popu­la­tion for seve­ral days. Even more insi­dious is the wides­pread use of ran­som­ware, which locks com­pu­ter sys­tems in exchange for a ran­som, allo­wing funds to be extor­ted or pres­sure to be exer­ted on public and pri­vate institutions.

These hybrid ope­ra­tions, which are often inex­pen­sive to imple­ment, are pro­ving to be extre­me­ly effec­tive, posing a dif­fuse but per­ma­nent threat to the sta­bi­li­ty of states.

Faced with these new threats, one ques­tion stands out : can effec­tive ope­ra­tions be car­ried out without digi­tal sove­rei­gn­ty ? “That’s the issue right now,” replies Maud Ques­sard. The conflict in Ukraine has par­ti­cu­lar­ly alar­med coun­tries bor­de­ring Rus­sia. “Esto­nia, Lithua­nia and Lat­via have been on alert for more than ten years in the face of Rus­sian inter­fe­rence, even without open war­fare,” she points out.

But ensu­ring this auto­no­my is a major chal­lenge. “Gua­ran­teeing this sove­rei­gn­ty requires the abi­li­ty to control one’s own digi­tal infra­struc­ture,” explains the resear­cher. Howe­ver, in a bor­der­less digi­tal space, natio­nal pro­tec­tion qui­ck­ly reaches its limits. “As digi­tal tech­no­lo­gy has no bor­ders, this pro­tec­tion must be orga­ni­sed on a supra-state level, such as NATO,” she insists. The ana­lo­gy with the Cold War is stri­king : “It is beco­ming cru­cial to think about a col­lec­tive digi­tal umbrel­la, just as it was during the Cold War with the nuclear umbrel­la.” This sha­red pro­tec­tion requires unpre­ce­den­ted coor­di­na­tion bet­ween Euro­pean and Atlan­tic allies.

As digi­tal tech­no­lo­gy has no bor­ders, this pro­tec­tion must be orga­ni­sed on a supra-state level, such as NATO

Beyond phy­si­cal infra­struc­ture, digi­tal sove­rei­gn­ty also raises the ques­tion of human resources. For Maud Ques­sard, “the chal­lenge is to break down the silos bet­ween dis­ci­plines.” For too long, stra­te­gic issues have remai­ned confi­ned to the poli­ti­cal and mili­ta­ry spheres, without any real dia­logue with engi­neers and tech­ni­cal experts. This frag­men­ta­tion is now a major han­di­cap. “Digi­tal sove­rei­gn­ty requires resources, par­ti­cu­lar­ly to retain talent,” warns the resear­cher. The conclu­sion is clear : “Today, many engi­neers pre­fer to work abroad, in Sin­ga­pore for example, rather than in French public ins­ti­tu­tions.” This brain drain consi­de­ra­bly wea­kens natio­nal capa­bi­li­ties in cyber defence and digi­tal innovation.

The Uni­ted States has inves­ted hea­vi­ly through agen­cies such as DARPA and CISA. The US Cyber Com­mand has played a cen­tral role in offen­sive and defen­sive digi­tal defence. Europe, on the other hand, remains frag­men­ted. Some coun­tries do not even have a struc­tu­red cyber com­mand. At the Euro­pean level, in their col­lec­tive work Les guerres de l’in­for­ma­tion à l’ère numé­rique (Infor­ma­tion Wars in the Digi­tal Age), the resear­cher and her col­leagues show that the EU can play a major role through regu­la­tion. Simi­lar­ly, works such as those by Sté­phane Taillat and Tim Mau­rer, nota­bly in Cyber Mer­ce­na­ries, clear­ly illus­trate the chal­lenges bet­ween digi­tal tech­no­lo­gy, demo­cra­cy and public power.

To build true digi­tal sove­rei­gn­ty, the resear­cher iden­ti­fies three impe­ra­tives : “Create natio­nal infra­struc­tures, secure them using our own resources, and ensure their resi­lience and auto­no­my.” These requi­re­ments go far beyond the tech­ni­cal sphere. They involve major poli­ti­cal choices in terms of bud­get, trai­ning and inter­na­tio­nal coope­ra­tion. Buil­ding Euro­pean digi­tal auto­no­my also requires rethin­king eco­no­mic models : how can we recon­cile open­ness to glo­bal inno­va­tion with the pro­tec­tion of cri­ti­cal infra­struc­ture ? How can we attract the best talent without sub­jec­ting them to crip­pling bureaucracy ?

These ques­tions are par­ti­cu­lar­ly rele­vant in the cur­rent geo­po­li­ti­cal context, where the boun­da­ries bet­ween armed conflict and hybrid war­fare are blur­ring. The Bal­tic states, on the front line of Rus­sian attempts at des­ta­bi­li­sa­tion, have deve­lo­ped valuable exper­tise in cyber resi­lience. Their expe­rience shows that effec­tive defence requires not only sophis­ti­ca­ted tech­ni­cal tools, but also a culture of vigi­lance sha­red by socie­ty as a whole.

Beyond the tech­ni­cal issues, digi­tal sove­rei­gn­ty raises the ques­tion of the model of socie­ty we wish to defend. In a world where data flows across bor­ders and digi­tal infra­struc­ture deter­mines the very exer­cise of power, Euro­pean demo­cra­cies must rethink their rela­tion­ship with tech­no­lo­gy. It is no lon­ger just a ques­tion of pro­tec­ting ser­vers or cables, but of gua­ran­teeing our col­lec­tive abi­li­ty to decide our future without stra­te­gic depen­dence on forei­gn actors, whe­ther govern­men­tal or private.

Marie Varasson