Digital Sovereignty as a Weapon of Diplomacy in Cyber Warfare in Democracies

Abstract

As our world becomes more digitally entwined, the concept of digital sovereignty has emerged as a critical determinant in international diplomacy. This chapter scrutinises the significance of digital sovereignty amidst rising cyber conflicts, showcasing its dual nature as both a defensive strategy and a diplomatic instrument. By exploring the interplay between traditional diplomatic practices and the evolving digital threat landscape, it sheds light on the intricate challenges and opportunities faced by nations. As states grapple with the complexities of safeguarding their digital borders while navigating diplomatic engagements, understanding the nuances of digital sovereignty becomes paramount in maintaining geopolitical stability and security in an increasingly interconnected global arena.

1. Introduction

The beginning of the twenty-first century marks a significant change in diplomacy influenced by the widespread use of digital technologies and the prevalent role of digital media in global affairs. This major change has transformed how countries interact and has required a rethink of conventional ideas about sovereignty, resolving conflicts and related diplomatic tools. Central to this evolving landscape is the concept of digital sovereignty, denoting a state’s capacity to assert strategic autonomy over its digital infrastructure and data assets. It encompasses the ability to make independent decisions and undertake actions that uphold and safeguard state sovereignty in an increasingly interconnected digital realm.

This chapter embarks on an in-depth exploration of the multifaceted role of digital sovereignty as a diplomatic tool in the context of cyber conflicts. It delves into how digital sovereignty serves as a linchpin in countering cyber threats, mitigating the risk of conventional warfare and advancing national interests on the global stage. By elucidating the intricate interplay between digital sovereignty and diplomatic strategies, the chapter sheds light on the pivotal role of digital diplomacy in navigating the complexities of the digital age. Through a nuanced analysis of case studies and theoretical frameworks, it seeks to uncover the underlying dynamics shaping contemporary diplomatic practices in the face of evolving digital threats and opportunities.

Furthermore, the chapter examines how digital sovereignty can serve as a catalyst for innovative approaches to conflict resolution and peacebuilding in the digital era. By harnessing the power of digital technologies and leveraging diplomatic channels, states can forge consensus, build trust and foster cooperation to address cyber conflicts and promote regional and global stability. Through a synthesis of theoretical insights and practical examples, the chapter offers a comprehensive understanding of the strategic imperatives and diplomatic nuances inherent in the pursuit of digital sovereignty in an age of digital disruption.

In essence, this chapter serves as a roadmap for policymakers, diplomats and scholars grappling with the complexities of diplomacy in the digital age. It underscores the imperative of embracing digital sovereignty as a cornerstone of contemporary diplomatic practice, while also illuminating the potential of digital diplomacy as a means to navigate the challenges and opportunities presented by the digital revolution. By embracing digital sovereignty as a guiding principle, nations can chart a course towards a more secure, stable and prosperous global future in the digital era.

2. Methodology

This study commences with an exploration of the dynamic intersection of diplomacy, cyberspace, digital sovereignty and digitisation, particularly in the context of current geopolitical challenges. Striving for a balance between accessibility and scholarly rigour, the analysis employs both qualitative and quantitative methods to bring these abstract concepts into a measurable realm. It is underpinned by a thorough review of existing literature and an examination of available secondary data.

Central to this study is the role of cyber resilience and digital sovereignty as emerging tools in the diplomatic toolkit. These concepts are subjected to a detailed quantitative analysis, including linear regression, to uncover potential relationships and causal links. This approach not only provides clarity but also enhances our understanding of how these concepts interact within the broader geopolitical landscape.

The analysis uses state rankings in index comparisons, valuing their stability against outliers. More complex statistical methods, such as Spearman and Pearson coefficients, are used, their inclusion offers additional insights in statistical correlations.

Additionally, this research includes a historical analysis to illustrate the evolving role of digital sovereignty in diplomacy. This part of the study provides a contextual backdrop, showing how diplomatic tools have adapted and evolved in response to the digital revolution.

3. The concept of diplomacy in the context of cyber attacks

The traditional concept of diplomacy, understood as the conduct of negotiations and the conclusion of agreements between states, is being expanded by digitalisation. Cyber warfare, the use of digital attack tools, such as phishing or malware, to harm another state or, in the sense of a counterattack, hackbacks to defend against cyber attacks, represents a new form of warfare that poses new challenges for diplomacy [1]. The boundaries between conventional warfare and cyber warfare are becoming blurred, making new diplomatic instruments and strategies necessary. Defence organisations in many NATO states have, therefore, long since created so-called dimensions to defend against attacks in cyberspace in addition to air, naval, army and space units [2].

Diplomacy in its traditional form is understood as the art and science of conducting negotiations between representatives of different groups or states. Its primary function is to prevent conflicts and their escalation. This disciplined approach, which is deeply rooted in historical traditions and established rules, aims to address common problems, balance interests and resolve conflicts in a peaceful manner [3].

The origins of diplomacy date back to ancient Egypt and the Middle East in thefourteenth century BC. Modern diplomacy, however, has its roots in the relationships that developed between the Italian city states in the thirteenth century. This historical development shows how diplomacy has evolved over the centuries from simple inter-state interactions to a complex system of international relations.

In the modern world, diplomacy plays a crucial role in shaping international relations, building understanding and cooperation and avoiding conflict. It encompasses a wide range of activities from formal negotiations and treaties to informal talks and cultural exchanges. The evolution and continuing influence of diplomacy on global politics demonstrates the importance of this field in maintaining international stability and peace. Modern diplomacy manifests itself not only in bilateral interactions between two states but also extends to multilateral platforms, such as the United Nations (UN), where it plays a key role in global political dynamics [3]. The objectives of this diplomacy are diverse and complex. They include the promotion of national interests, with diplomats acting as representatives and protectors of the political, economic, cultural and other interests of their home country. A key objective is peacekeeping, whereby conflicts are avoided or resolved through dialogue and negotiation, which contributes to global stability. Furthermore, diplomacy serves to build and maintain long-term relationships between countries and cultures in order to promote understanding and cooperation. The exchange of information also plays an important role as diplomats collect and exchange information relevant to the political decision-making of their home country. Last but not least, diplomacy involves conducting negotiations on treaties and agreements that regulate relations between countries. These instruments of diplomacy apply equally to the prevention of conventional, hybrid and cyber threats.

In the context of an increasingly digitalised and interconnected world, cyber diplomacy is gaining in importance. It deals with the use of cyberspace for diplomatic purposes and the management of conflicts and challenges in digital environments, that is, those that are made possible by cyberspace and is therefore relatively new [4]. It represents a state’s efforts to seek a basis for negotiation with a potential adversary in order to avoid protracted, possibly military conflicts. A core problem in cyber diplomacy is the as yet unanswered question of how to deal with borderline situations without established experience-based conflict or war ethics. States can classify a cyber attack as a war attack, in which case the rules of armed war apply. However, there are two key challenges to be dealt with: the attribution dilemma and the disclosure dilemma. The attribution dilemma refers to the difficulty of attributing cyber attacks to specific actors, while the disclosure dilemma concerns the balance between secrecy and the disclosure of information.

Just as in traditional diplomacy, intergovernmental rules of the game and mutual information are extremely important. The European Union (EU) is working within the framework of cyber diplomacy to strengthen its cyber security governance, for example, in cooperation with the pan-European Police Europol in the European Cybercrime Centre and other EU organisations, such as ENISA (European Network and Information Security Agency) [5]. Cyber dialogues, for example, between the EU and the USA, and multinational formats, such as in the United Nations, are also important components of these efforts.

In addition to building cyber defence capabilities focused on security and defence, cyber diplomacy of Western-oriented states also focuses on the creation of international norms, the protection of data integrity and the promotion of fundamental democratic values, which can serve as a precursor to digital sovereignty. Cyber diplomacy is increasingly proving to be a transformative force in international politics by demonstrating the potential for peacemaking and de-escalation in global conflicts; more than 30 states have already appointed cyber policy envoys, a clear sign of the growing recognition of the importance of this field. In 2015, 25 government experts agreed on behalf of the UN General Assembly that international law should also apply in cyberspace, including the right to defence [6]. With increasing digitalisation, it is becoming more urgent to reach international agreements on rules of engagement in cyberspace in order to minimise the risks of uncontrolled escalation.

For the EU, cyber diplomacy measures include the development of multilateral agreements for trustworthy behaviour in cyberspace, the promotion of cybersecurity and the development of a common foreign and security policy. Specific initiatives include the EU Cybersecurity Act (2019), the EU Cybersecurity Strategy (2020), the joint cyber unit to strengthen defence and law enforcement authorities and the development of multilateral agreements for trustworthy behaviour in cyberspace, as well as measures for a high common level of cybersecurity in the Union, for example, the NIS2 — directive for the cyber and information security of companies and institutions [7].

Preventive measures, such as cyber dialogues and cooperation in the event of conflict, are also an integral part of the EU strategy. Sanctions and export controls, particularly for dual-use technologies, are other important tools in this context.

In the context of cyber diplomacy, it is becoming apparent that the same basic principles apply as in traditional diplomacy, but the novelty and the still limited experience base in this area confront the actors with the challenge of establishing adequate norms and ethical guidelines. These are essential to ensure stability, robustness and resilience in cyberspace. It is recognisable that both state and non-state actors must be integrated into these processes, as both groups play a significant role in cyber diplomacy [8].

Unlike in traditional diplomacy, where private actors and companies generally did not play a prominent active role, their importance in cyber diplomacy is increasing noticeably. This is particularly the case in countries, such as the USA and China, where technology companies hold a dominant position [9]. This development calls for a reassessment of diplomatic interactions and the actors involved.

The emergence of cyber diplomacy as a discipline in its own right reflects the growing recognition that cyberspace is an essential field of international relations. In this context, cyber diplomacy initiatives are aimed at achieving multilateral agreements on cyber norms, responsible behaviour by states and non-state actors in cyberspace and effective global digital governance [10]. The aim is to create an open, free, stable and secure cyberspace that is embedded in international law and based on alliances between like-minded countries, organisations, the private sector, civil society and experts.

Diplomacy plays a key role in establishing cooperation among state and non-state entities within cyberspace. However, navigating diplomatic strategies in this domain is fraught with complexities. The rapid and extensive progress in cyberspace technology blurs the lines between physical and digital community interactions. The emerging cyber domain significantly influences how nations perceive their interests in the contemporary world. This domain has turned into a vulnerable spot for governments attempting to balance threat reduction with the exploitation of arising opportunities. With the expanding prospects for innovation in cyberspace, the likelihood of both competition and potential conflict increases [10].

Cyber diplomacy requires constant development and adaptation due to its novelty and the associated challenges. The involvement of various actors, both governmental and nongovernmental, is essential in order to develop and implement effective and sustainable diplomatic strategies and norms in cyberspace [8].

4. Cyber war vs. conventional war

In contrast to conventional war, which involves physical conflict and the use of material weapons, cyber war takes place in digital cyberspace. The definition of space here differs from the traditional, territorial concept of state space, which describes the political, legislative and executive borders of a state ([11], p. 55). Although this new form of war can be aimed at destroying or impairing a state’s digital infrastructure, it can also be waged virtually, across borders and covertly. A key difference lies in the type of weapons and the areas of impact. While conventional wars cause direct physical damage, the use of digital means can range from influencing public opinion and disrupting critical services to generating false information.

In the modern world, war and cyber war constitute a complex and multi-layered field that poses both traditional and new challenges for the understanding of conflicts and their regulation.

Conventional war, traditionally defined, refers to an armed conflict between states or groups, in which regular armed forces are deployed on land, in the air, at sea or, more recently, in space, in compliance with certain legal and ethical norms. This type of war typically involves territorial disputes, with the sovereignty and territorial borders of states playing a central role. The political scientist Zimmer emphasises how state borders mark the political, legislative and executive limits of sovereignty as a result of the Peace of Westphalia in 1648 [11].

In contrast, cyber warfare is a new form of conflict, in which traditional warfare practices are only applicable to a limited extent. Lancelot points out that there are no set rules for warfare. Challenges, such as the lack of territorial attachment in cyberspace as a de facto counter concept to the Peace of Westphalia and the difficulty of clearly attributing attackers to states, undermine traditional concepts of state sovereignty and warfare and offer an undefined risk of escalation [4]. The fact that cyber attacks have the potential to escalate into conventional, even nuclear wars and that the escalation case lies in the assessment of the attacked nation, but lacks recognised rules, is a currently unresolved challenge.

A dynamic that may emerge from this calls for a clearer understanding of the nature of cyberspace in politics and emphasises the need for appropriate regulation or at least a common understanding. While cyberspace can be conceptualised as anarchy without any state norm, rule or ethics, as in the origins of the internet [12] which is still being discussed in some cases today ([13], 780 ff.); however, this anarchy would lead to chaos.

Another current point of discussion is the question of whether cyber warfare can be considered a legitimate form of warfare. What exactly is defined as a cyber weapon also remains controversial. While malicious software code is often considered a cyber weapon, it remains unclear whether code that facilitates communication between states or organisations, but facilitates the spread of malicious software should also be classified as such. It also remains unclear whether the aspect of information warfare can be considered a cyber weapon comparable to conventional weapons. States that are often accused of cyber espionage and cyber attacks, such as Russia, China or North Korea, also rely on public diplomacy in various dimensions, with China having a long tradition here [14]. In the digital context, attempts are also being made to influence public opinion, for example, by utilising social media and sometimes also by using false information. Today, states can do this largely undetected. Modern technologies, such as artificial intelligence and constantly growing access to the (mobile) internet, make it even easier to influence opinions and the public [15]. The promotion of foreign policy interests is, therefore, not new, but represents an increasing challenge and cause for concern as the gaps between cyberspace and physical, territorial space and the proportionality of the use of cyber warfare instruments need to be bridged.

5. Cyber armament or digital sovereignty as a diplomatic means of disarmament

Armament can indeed be used as an instrument of diplomacy, although this is often controversial and seems contradictory; a well-equipped military can serve as a deterrent against potential aggressors and give a state greater leverage in international negotiations, and military strength can be used as leverage in diplomatic negotiations to force concessions from other states, but at the same time, armament can lead to arms races and increased tensions, which increases the risk of conflict. Excessive armament can strain international relations and undermine trust between states in the long term. Diplomacy is often about striking a balance between demonstrating strength and promoting cooperation and peace. Armament is only one aspect of a complex set of international relations. Historical examples, such as the Cold War arms race, show how technological superiority can become an important factor in diplomatic negotiations. However, at least in the nuclear age, this resulted in disarmament due to diplomatic successes (Figure 1) [16].

Figure 1.

Disarmament and rearmament of nuclear weapons (own illustration based on [16]).

The phase after the Second World War led to a massive build-up of nuclear weapons, particularly in the USA and Russia. Although the first diplomatic and scientific communication formats and platforms to build confidence and reduce military threats were initiated as early as the 1960s (e.g. Pugwash Conferences) and the first treaties to slow down the arms race were concluded, the Cold War armament intensified until it reached its peak in the 1980s. It was only after the collapse of the Soviet Union, 40 years after the start of the arms race, that a global reduction in the number of nuclear warheads could be observed. Other countries such as India, Pakistan and North Korea only entered the arms race in the 1990s.

Armament can be a means to strengthen positions for diplomacy [17]. (Military) superiority in all (military) dimensions weakens the basis for negotiations between opponents. This applies to the military dimensions of land, air, sea and space and therefore also to the cyber dimension [18]. The development of cyber defence and attack capabilities can be seen as a form of modern armament. Such capabilities serve not only for potential defence but also as a means of strengthening negotiating positions. However, assessing the (necessary) level of armament is far more difficult than in the nuclear armament example outlined above, in which the number of nuclear warheads was analysed.

Presumably, the current cyber threats will also initially lead to armament and then — hopefully, after the emergence of standards and rules — to disarmament. The question of whether this will continue for several decades remains unanswered. The concept of digital sovereignty focuses not only on cyber capabilities but also on the fundamental ability of a state to make strategically autonomous decisions about the information technology it uses and not to make itself dependent on other states.

Capability building is also a key aspect of cyber diplomacy, as the example of Estonia in its Foreign Policy Strategy 2030 shows [19]. Digital capabilities of a digitally sovereign state, its citizens and national companies support the position of a state at the negotiating table with potential conflict partners as the digital defence capability is strengthened. Armament in the sense of strengthening digital sovereignty can, therefore, be described as a ‘weapon’ in the arsenal of diplomatic instruments.

Experience from nuclear armament should teach us to focus on disarmament and communication instead of armament and isolation [20]. Standardisation aimed at joint disarmament plays a central role here. The EU’s cyber diplomacy should focus on the informational self-determination of citizens, the EU’s strategic capacity to act in the services of digital sovereignty and European resilience in cyber diplomacy. This includes the harmonisation of IT security legislation at EU level, as well as coordination and procurement in cooperation with international partners.

6. Limits of diplomacy

History teaches that diplomacy has its limits, especially in situations where fundamental interests or values are at stake. In the context of cyber warfare, these limits become even more unclear as the perpetrators of cyber attacks are often difficult to identify and the attacks are often covert. The extent to which traditional diplomatic approaches need to be adapted in the digital era is being discussed. On the one hand, the same diplomatic practices apply; on the other hand, different countries and organisations are pursuing different approaches in the current discussion about cyber attacks and their regulation. The concept of proportionality plays a central role here. The key question here is ‘Which cyber attack is appropriate to respond to with conventional means?’ [21]. In the USA, for example, the Department of Defence’s Manual on the Law of War regulates the proportionality rules in relation to cyber attacks [22]. This manual serves as a guideline for assessing when and how cyber attacks can be carried out in accordance with the law of war, that is, with conventional weapons. Article 5 of the NATO North Atlantic Treaty states that cyber attacks can trigger a mutual defence situation, which underlines the importance of cyber operations in the context of collective security efforts. In some states, the concept of cyber intervention response or cyber incident detection has been developed to take both defensive and offensive measures in the event of war or for defence in cyberspace [22]. However, these activities are not currently envisaged in peacetime. This concept also serves as a deterrent.

The complexity lies in the fact that there are no generally accepted international rules for the use of cyber attacks or hackbacks. Most states refrain from taking such measures. In the event of a cyber attack, a state is entitled to exercise the right of self-defence in accordance with jus ad bellum, as outlined in the US Department of Defense manual [4, 22]. A prominent example of this is the Stuxnet attack on the SCADA systems of Iranian uranium enrichment facilities, which shows that a cyber attack does not necessarily have to be responded to with a cyber attack [21].

The nature of war and diplomacy in cyberspace can be disorienting and borderless, requiring continuous adaptation and revision of international norms and rules to address the unique challenges of cyberspace. Countries, such as Russia and China, play a central role in cyber diplomacy. Both nations have developed extensive cyber capabilities and use them both defensively and offensively in hashbacks [15]. Their activities in cyberspace have provoked international reactions ranging from diplomatic talks to sanctions [23]. This development highlights how digital sovereignty and cyber capabilities are increasingly becoming key factors in international relations. Some notable cyber attacks discussed in this context include incidents targeting government institutions or the healthcare system in EU states, the influencing of elections in Ukraine and activities just prior to Russia’s military attack against Ukraine. Another prominent example is Russia’s alleged influence on the US elections in 2016, in which cyber operations are said to have played a central role in influencing the election.

These incidents illustrate the diverse applications of cyber operations, ranging from targeted attacks on critical infrastructure to influencing political processes. They not only highlight the vulnerability of democratic processes to cyber attacks but also underline the need for robust cyber defence and diplomacy [24].

Also, noteworthy in this context is the bilateral declaration of a new strategic partnership between Russia and China in 2016, which includes cooperation in the field of information technology and communications (ICT). Both countries expressed their concern that ICT could be used to interfere in the internal affairs of other states. This agreement can be interpreted as an attempt at compartmentalisation and axis building, as Bendiek notes [6]. It reflects the increasing importance of cyber operations in international politics and the endeavours of some states to protect and promote their own interests and sovereignty in the digital space.

China’s territorially delimited institutionalism, for example, produces digital technologies largely independently through strong regulation and isolation, following the desire for cyber sovereignty. This is an expression of the Chinese Communist Party’s concept to exercise state control over private-sector industries and technologies and to enforce the interests of the nation-state’s cybersecurity strategy, which is in stark contrast to multi-stakeholder management ([25], pp. 107-131). China is pursuing a state-institutionalised, autarky-oriented and digital-policy concept to strengthen its sovereignty. Since 1972, technology transfer from abroad has been systematically ensured; regulation, state control and a five-year plan in the 30 most important policy fields have been the focus of government action; A total of 12 possibilities of legal technology transfer, 12 of extra-legal technology transfer and eight of illegal technology transfer have been described [15], indicating that China will further strengthen its digital dominance and independence ([26], p. 169).

It is, therefore, foreseeable that a new world order will also emerge in cyberspace. It is still unclear — as the current positioning discussions surrounding Russia’s war of aggression against Ukraine show — how states such as India or the BRICS countries will position themselves [9]. However, it is clear that the EU states must strengthen themselves against possible new axes in the cyber world in order to maximise the limits of cyber diplomacy and avoid possible escalations.

7. Cyber resilience

The cyber resilience and cyber security of countries is measured by various indices, such as the global cybersecurity index (GIS), the index of cybersecurity (ICS) and the national cybersecurity index (NCSI) [27, 28]. It describes the ability of a country to protect itself against cyber attacks, respond to them and recover from their effects. The indices make it possible to compare the cyber competences and resilience of different countries.

Cyber security is an essential component of digital sovereignty as increasing cyber attacks can threaten the sovereignty of states. Many examples of government and industrial organisations, especially critical infrastructure such as banks, energy suppliers and hospitals, that have been blackmailed or compromised by cyber attacks illustrate the impact of cyber attacks on the global economy [29]. Especially since Russia’s war against Ukraine, the number of cyber attacks has increased. Therefore, cyber security has a direct and increasing influence on the sovereignty of states and is conceptually linked to it [30].

The NCSI, which has been compiled by the e-Governance Academy in Estonia since 2018, measures the effectiveness of 173 countries in defending themselves against cyber attacks such as denial of service attacks or data integrity breaches, using 46 indicators from predominantly administrative areas. According to the NCSI, state-level capabilities include, for example, the ability to regulate cyber attacks, cooperation, security policy and crisis management. Analysis of the ranking shows that many American, Asian and European states, as well as Australia, have a relatively high cyber security ranking. Many of these states are also autocratic states, for which cyber defence is also an essential attribute of digital sovereignty in the sense of isolation and the protection of autocratic structures [27]. Therefore, it can be said that cyber resilience is an essential attribute of digital sovereignty for both democratic states, including all EU member states, and non-democratic states.

The importance of cyber resilience has emerged as a key aspect of national security strategies. This capability can also serve as a deterrent to prevent potential attackers from conducting offensive cyber operations.

Cyber attacks often target not only critical infrastructures such as water and electricity supply, transport, retail and healthcare but also universities and government institutions. The intention behind such attacks can vary from state-motivated espionage and the endeavour to weaken the structures of a state to economically motivated attacks by trolls who, for example, encrypt computers using Trojans and extort ransom money.

Countries take different approaches to strengthening their cyber resilience. The US has developed a number of strategies and laws, including the National Strategy for Cyberspace (2002), the National Plan to Secure Critical Infrastructure (2006) and the Comprehensive National Cybersecurity Strategy (2008) [5]. The Cyber Diplomacy Act (2021) aims to strengthen US global leadership in cybersecurity.

Australia has significantly strengthened its cyber defence capabilities in recent years with a focus on strengthening the resilience of its critical infrastructure and promoting cyber security literacy within the population [10].

In Europe, the focus is on developing cyber defence technologies, strengthening digital markets and infrastructures and promoting digital sovereignty. The European Commission emphasises the importance of upgrading and developing resilience to cyber attacks [18].

China has implemented comprehensive national cyber security strategies that focus on the protection of critical infrastructure and the development of advanced cyber defence capabilities in terms of compartmentalisation indicating that it will further strengthen its digital dominance and independence [26].

Cyber diplomacy includes the development of cyber defence techniques, the promotion of growth and resilience of digital infrastructures and markets, as well as the arming and strengthening of relevant organisations against cyber attacks.

The global perspectives on cyber resilience are diverse and complex. Various institutions contribute to the development and implementation of cyber security strategies [5].

To be taken seriously in the cyber arena, Western states must also strengthen their cyber resilience through deterrence and armament in order to step out of the role of the underdog. This requires a balanced combination of technological development, strategic planning and international cooperation. Educating the population, robust IT systems and resilient structures, including backups and manual procedures, are essential.

8. Digitalisation and digital sovereignty

This section differentiates between digitalisation and digital sovereignty. It also analyses how different geopolitical actors — including China, the USA, Europe, Africa and the BRICS states — define and implement the concept of digital sovereignty. It analyses how these different approaches influence international politics and diplomacy.

Digital sovereignty describes the ability of a state or region to control and manage digital infrastructure, data and communication with a relevant degree of autonomy (Figure 2).

Figure 2.

Interpretations of digital sovereignty based on [31].

The approach should not be confused with digital self-sufficiency or autarky in the form of isolation as demonstrated by China, for example. Rather, digital sovereignty as autonomy describes a form of independence in technology selection and thus robustness and resilience. This ability becomes particularly relevant when the sovereignty of a state, that is, the ability to make independent decisions in matters of internal and external sovereignty, is potentially jeopardised by dependencies or the influence of third parties — especially states or other institutions with divergent understandings of political systems. This includes the development of its own technologies and standards, the protection of data and the establishment of a robust digital economy. The approaches taken by different states or regions to strengthen digital sovereignty diverge significantly.

China practices a policy of strict control and censorship of the internet, known as the ‘Great Firewall’. This approach is aimed at ensuring national security and controlling the spread of content deemed harmful to social stability or the interests of the ruling party. China also encourages the development of indigenous technologies and digital platforms to reduce dependence on foreign technologies, thereby pursuing an autarchic and autocratic approach [26].

The United States pursues a neo-liberal and market-orientated approach to digital sovereignty. The US government generally supports the development and growth of technology companies, but intervenes comparatively little in their operations. Despite a fundamentally techno-positivist, liberal and capitalist system, there are growing concerns about privacy, data security and the power of large technology companies, leading to calls for stricter regulation [26].

The countries of Europe, particularly those within the European Union (EU), have demonstrated a strong commitment to the principles of data protection and security. This commitment is evidenced by the introduction of robust data protection laws, such as the general data protection regulation (GDPR). European policies, regarding digital sovereignty, are primarily focused on multiple key aspects: protecting the privacy rights of individual citizens, promoting transparency in data handling and usage and ensuring that there is a fair and level competitive environment for all companies operating within this space [32]. These approaches reflect a broader European vision of balancing technological advancement with fundamental rights and equitable business practices. A normative-prescriptive model is being pursued that is in line with the liberal and democratic values of the EU member states. In the context of digital sovereignty, there is often talk of ‘strategic autonomy’ [31].

African countries are still in the phase of expanding their digital infrastructure. The focus is often on expanding access to digital services and developing local digital markets. Some countries have launched initiatives to promote digital education and support local technology start-ups [33].

The BRICS group of emerging economies (Brazil, Russia, India, China, South Africa) have different approaches to digital sovereignty. While Russia, such as China, pursues a highly controlled and autocratic approach, countries, such as India and Brazil, practise more liberal policies that support the free flow of information and the development of technology companies [34].

Australia is pursuing its own approach to digital sovereignty, which integrates elements of data protection, security and economic development. Various measures have been implemented to ensure the security and protection of digital data. This includes legislation that defines how companies and organisations must handle personal data [35]. There is an increasing focus on cyber security to protect state and private digital systems from threats. Despite the focus on national sovereignty, Australia is also engaged internationally to help shape global standards and norms for the internet and digital technologies, both through bilateral agreements and participation in multilateral forums [10].

The approaches outlined above reflect the divergent political, economic, social and cultural realities of each state or region. Digital sovereignty remains a complex and sometimes contradictory concept, influenced by global developments and a constantly changing technological landscape, and is increasingly becoming an instrument of power politics. However, the concept can still largely be described in qualitative terms.

The measurability of digital sovereignty is still in its infancy. Initial approaches to creating a digital sovereignty index (DSI) for states are at an early stage [36]. Although there are numerous concepts for assessing state sovereignty, such as the World Governance Index [37] or the Barnett Index [38], as well as indices for assessing the digitalisation of states [39]. A recognised index on digital sovereignty, which converges the concepts of sovereignty and digitalisation and their measurability, is currently being developed; a DSI consisting of 30 parameters to assess sovereignty in the context of European values, the ability to develop key technologies and technological independence. The collection of secondary data and suitable aggregation results in an index value per country that can be ranked [40].

9. Cyber resilience and digital sovereignty: two divergent concepts?

Cyber resilience has become a central aspect of national security strategies [41, 18]. Digital sovereignty, on the other hand, is a concept for defining and evaluating the capabilities of states to reduce one-sided technological dependencies and thereby protect state institutions and critical infrastructures [31].

Both concepts could correlate in the sense that a digitally sovereign state also has a high level of cyber resilience and vice versa. However, this is not the case. Countries that are exposed to a high cyber threat (e.g. Russia, China, North Korea) have high cyber resilience scores. The NCSI uses the years 2016-2023 as a basis for assessment and ranks Belgium, Lithuania, Estonia, Czech Republic, Germany, Romania, Greece, Portugal, United Kingdom and Spain in the top 10 [28].

After Russia’s war of aggression against Ukraine, the ranking will probably change in 2024 (Poland, Estonia, Ukraine, Latvia, United Kingdom, Albania, Moldova, Georgia, China, Saudi Arabia), but the TOP NCSI countries are neither particularly highly digitalised nor do they stand out due to their high democracy scores if the definition of digital sovereignty used in the previous section is used. From this, it can be hypothesised that the European understanding of digital sovereignty so a normative-prescriptive model does not directly contribute positively to cyber resilience as it is formulated rather defensively.

The two previously mentioned indices, the digital sovereignty index (DSI) (DSI) and the national cyber security index (NCSI), are used to confirm the hypothesis. The DSI measures parameters relating to state sovereignty, key technologies and technological sovereignty, while the NCSI measures cyber security policy, a state’s contribution to global cyber security, education and professional development [27, 40]. The hypothesis to be rejected is, therefore, as follows: The higher the DSI/NCSI rank, the higher the digital sovereignty/cyber resilience rank of a state (Figure 3).

Figure 3.

DSI/NCSI rank correlation, EU and USA, China, Russia, Australia.

The correlation between the EU countries shown here and Australia, China, Russia and the USA is weak. The coefficient of determination is only 0.5%, that is, there is no significant linear correlation between the NCSI and the DSI. The Pearson and Spearman coefficients of approximately 0.071 and 0.048 also show very weak positive correlations. Those countries with a high NCSI ranking, such as Belgium, Estonia, Latvia, the Czech Republic or Germany, are in the midfield of the digital sovereignty index [13, 16, 23, 33, 30]. In contrast, the USA, the leading country in the DSI, is ranked 42nd in the NCSI, while Russia and China are in the middle of the field in both indices, although both countries play a major role in cyber attacks.

In this respect, the two concepts cannot be contradictory or at least not interdependent. In other words, a state that places a high focus on cyber resilience does not necessarily have to have well-developed digital sovereignty capabilities, and conversely, a digitally sovereign state does not necessarily have to have a high level of cyber resilience. One possible reason for this — using the example of the USA or China — may be that cyber resilience, cyber defence and cyber war in the dimensions of land, sea, air, space and cyber only serve one domain and other economic or political aspects play a greater role.

10. Cyber resilience and digital sovereignty as a diplomatic tool

The exploration of digital sovereignty and cyber resilience as diplomatic tools, as in the previous sections, necessitates an in-depth examination of their multifaceted functions, far-reaching effects and strategic significance within the landscape of international relations. Both concepts, while distinct in their focuses, converge to shape the contours of contemporary diplomacy, offering nations a means to assert their autonomy, safeguard their interests and foster cooperation in an increasingly digitised world. At its core, digital sovereignty embodies a state’s capacity to assert control and autonomy over its digital ecosystem, encompassing its infrastructure, data management practices and technological advancements. This pivotal concept empowers nations to chart their own course in the digital realm free from external coercion or influence [36, 42]. By exercising sovereignty over their digital domains, states can mitigate vulnerabilities, assert their diplomatic agency and navigate the complexities of global affairs with confidence. Moreover, robust digital sovereignty not only bolsters a nation’s negotiating prowess but also fosters trust and collaboration among peers, laying the groundwork for the establishment of international norms and rules that promote responsible behaviour in cyberspace and mitigate the risk of conflicts and wars.

Similarly, cyber resilience emerges as a cornerstone of modern diplomacy, epitomising a state’s ability to withstand, respond to and recover from cyber threats. A nation fortified with high levels of cyber resilience is better equipped to defend against cyber attacks, mitigate their impact and deter potential adversaries from engaging in hostile activities [27]. By investing in robust cyber defence mechanisms, cultivating a skilled workforce and fostering international cooperation, states can bolster their cyber resilience capabilities, fortify national security and uphold stability within their borders. Furthermore, collaborative efforts in cyber resilience serve as conduits for building trust, sharing information and fostering mutual understanding among nations, thereby strengthening diplomatic relations and averting potential conflicts.

In essence, digital sovereignty and cyber resilience converge to shape the fabric of modern diplomacy, offering a pathway towards a stable, secure and cooperative international order. By prioritising these concepts, states not only safeguard their own security and interests but also contribute to the broader goal of global peace and stability. As nations navigate the complexities of an interconnected world, the continued advancement of digital sovereignty and cyber resilience emerges as a critical imperative, ensuring that diplomacy remains effective in addressing the evolving challenges of the digital age and fostering a more harmonious and prosperous global community.

11. Conclusions

‘In an era defined by the omnipresence of digital technologies and interconnected networks, the concepts of digital sovereignty’ [42, 43] and cyber resilience have evolved into indispensable cornerstones of contemporary diplomacy [38]. As nations grapple with the complexities of an increasingly digitised world, these principles have emerged as essential tools for safeguarding national interests, ‘preserving global stability and mitigating the risks’ posed by cyber threats and conflicts [44].

At its core, digital sovereignty encapsulates a state’s ability to assert control and autonomy over its digital infrastructure, data governance and cyber policies [43]. It embodies the notion of self-determination in the digital realm, enabling nations to make independent and strategic decisions that safeguard their sovereignty and protect against external interference. In an age where cyberspace knows no borders, digital sovereignty serves as a bulwark against cyber espionage, data breaches and other forms of digital manipulation, empowering nations to uphold their values and interests in an interconnected world [13].

Complementing digital sovereignty is the concept of cyber resilience, which encompasses a state’s capacity to withstand, adapt to and recover from cyber threats and attacks. Unlike traditional notions of security, cyber resilience emphasises agility, adaptability and proactive risk management in the face of evolving cyber threats [27]. It involves not only the deployment of robust cybersecurity measures but also the cultivation of a resilient cyber culture that prioritises continuous learning, innovation and collaboration across sectors. By fostering a culture of resilience, nations can minimise the impact of cyber incidents, mitigate potential disruptions to critical infrastructure and maintain trust and confidence in the digital economy and society.

While digital sovereignty and cyber resilience can be discussed as separate concepts, their interplay is essential in shaping effective cybersecurity strategies and diplomatic engagements in the digital age. They could form a symbiotic relationship that enables nations to navigate the complexities of cyberspace with confidence and purpose. Digital sovereignty provides the foundation for establishing clear norms, rules and principles governing state behaviour in cyberspace, while cyber resilience ensures the resilience and robustness of digital infrastructure and systems, thereby reinforcing national sovereignty and security in an interconnected world.

Furthermore, the convergence of digital sovereignty and cyber resilience offers opportunities for collaborative diplomacy and multilateral cooperation in addressing shared cyber challenges. By leveraging their collective expertise, resources and capabilities, nations can enhance cyber resilience at the regional and global levels, promote information sharing and capacity building and develop norms and standards that promote a safe, secure and open cyberspace for all. Through diplomatic channels such as bilateral dialogues, international conferences and cyber diplomacy forums, states can engage in constructive discussions on cybersecurity issues, build trust and confidence among stakeholders and forge consensus on key policy priorities and initiatives.

In conclusion, digital sovereignty and cyber resilience are integral components of modern diplomacy, offering nations the means to navigate the opportunities and challenges of an increasingly digitised world. By embracing these principles and fostering international cooperation, nations can strengthen their cybersecurity posture, protect their national interests and promote peace, stability and prosperity in the digital age. As cyberspace continues to evolve and shape the global landscape, the imperative for robust cybersecurity strategies and diplomatic engagements will only grow, making digital sovereignty and cyber resilience essential pillars of twenty-first century diplomacy.

Conflict of interest

The author declares no conflict of interest.