watch this space!

Consider this post to be the afterbirth of the last one. It’s the bits and pieces I couldn’t cram into the last one, which was already haemorrhaging asides, segues and diversions. As such I’ll not even try hard to connect the dots presented this time.

I thought I was done with the sovereignty posting. There are other things I want to get onto. Other half-baked rants, sketchy musings and dubious epiphanies languish in draft mode. But I blog far slower than the world moves. I still had notes I couldn’t cram into the last post. Still a few tabs open I couldn’t bring myself to exile into the cold, forgotten but persistent realm of my browser history without processing them somewhere. This is somewhere.

This one’s about another kind of digital sovereignty. The personal kind. No, this isn’t about the weird far-right movement that spawned the Nick Offerman movie. Though there are lessons in that which may cross-pollinate here. There’s this notion that people have developed: Jurisdiction curation.

Companies are noticing. It’s becoming marketing hype lexicon. LinkedIn is filthy with tech ads suddenly promising everyone their own private sovereignty in the cloud.

Some FOSS developers are getting in on it.

But everything in a cloud is just on someone else’s machine, and machines are owned by people who are subject to laws. Consider Proton. Proton sells Switzerland as part of its privacy promise. Neutrality. Mountains. Banking secrecy. Nazi gold. A jurisdiction imagined as immune from foreign power. People fill in the gaps themselves. Reality fills in the gaps as well. Guess which one wins.

Switzerland participates in the same legal mesh as everyone else. Mutual Legal Assistance Treaties (loads of these). Cross-border warrants. Structured cooperation between prosecutors who don’t care about marketing copy. Five years ago, Proton logged and handed over an IP address tied to a French climate activist after a Swiss order. More recently, payment data tied to an anonymous account was sufficient to unmask a protester in the U.S. for the FBI.

Proton’s defence is correct. Like something a lawyer would write. They minimise retained data, they can’t decrypt message content. None of that contradicts the outcome. They didn’t “help the FBI.” They complied with Swiss law… which helped the FBI. “We only respond to Swiss authorities” is accurate. It’s also doing a second job. Swiss authorities are exactly how foreign requests arrive.

“It is true that Proton is located in Switzerland and responded to a legal request from the Swiss authorities. But it is also true that most people do not know what an MLAT is and there is a widespread misunderstanding that using Proton will protect your account from US govt requests.” — Eva Galprin

Jurisdiction isn’t a magical barrier developed by the Elves around Rivendell. It’s a routing layer. You aren’t choosing whether law applies. You’re choosing which legal process applies first, and under what thresholds it hands off to another one. It’s a friction point. Stick this in your threat model: Navigating tech sovereignty is only going to be harder in this emerging world of backyard hegemonic geopolitics.

Still, we’re not all dodgy billionaires trying to remain afloat in international waters. Sovereignty is the new flavour for us common folk, too. There are plenty of valid reasons to move your stack out of an adversarial jurisdiction. The recent surge in “leave Big Tech” guides makes that clear, from mainstream pieces to a growing number of personal migration logs documenting the process in detail.

• The Guardian — Leave Big Tech behind! How to replace Amazon, Google, X, Meta, Apple – and more
• Coinerella — Made in EU: It was harder than I thought
• Zeitgeist of Bytes — Bye Bye Big Tech: How I Migrated
• Disconnect Blog — Getting off US tech: A guide

These are all good posts for those wanting to migrate their bits. The change they reflect is the impetus. These kinds of guides used to be about switching to open source. Now they’re about geography. The Faustian bargain trade-offs return when you go indy. Missing features. More payment gateways. Interoperability gaps. The quiet reintroduction of complexity that hyperscalers spent decades covering with UI development and SSO paths.

It’s still probably worth it, but what emerges is less of a clean break and more of a negotiated position. It’s partial exits, and hybrid stacks with work-arounds. It looks less like independence and more like jurisdiction curation. If you’re not escaping entirely, at least you’re selecting your dependencies. Maybe that’s enough for the period we’re in. For now. Or maybe not. We’ll find out. These are exciting times.

You can’t unscramble the egg and put it back in its shell. Both national and individual attempts at gaining technological “sovereignty” (or independence, or whatever) run up against the fact that we’ve already made the omelette. Yeah, I’m mixing a lot of metaphors. I’m not un-mixing them. It’s too late. Go with it. Consider torrents, Hollywood, Bollywood, the IIPA, and DNS (you didn’t see that coming).

Christian Dawson, Executive Director of the i2Coalition, recently wrote about anti-piracy enforcement rulings in the Delhi High Court that go beyond holding websites violating copyright laws accountable, or instructing Indian ISPs to block them, and are now green-lighting legal action against domain registrars. The International Intellectual Property Alliance (IIPA) praised the court, Dawson noted, claiming hundreds of piracy sites have already been wiped from the internet as a result. This enthusiasm was share shared by many other U.S. rights holders, who have welcomed India’s approach as a model for tackling piracy globally.

“If you stop there, India’s approach sounds like a win because the temptation is to measure success in takedown numbers” wrote Dawson. “But enforcement architecture matters more than weekly disruption statistics. If the structure being built today erodes jurisdictional limits, proportionality, and procedural safeguards, rights holders may find that the same tools celebrated in one case become destabilizing in many others.”

“Are we prepared for a world in which a single national court can, under its own standards of proportionality, functionally shape global DNS operations through orders directed at infrastructure providers, including foreign companies? Because once that door is open, it does not stay limited to piracy. It never does.” — Christian Dawson

Where’s your sovereignty sit within any of that?

The urge to flee is growing more common. Migrants want to be where it’s safer. Don’t we all? What are they fleeing in this digitised context? No one before the start of 2025 talked about internet sovereignty outside of niche academic circles or the deepest pits of policy wonkery. Now it’s the stuff of blogs and launches hundreds of LinkedIn hot takes on a daily basis. What changed? America did.

Under the Trump administration the DOJ is ignoring the Privacy Protection Act to go after journalists it isn’t happy with. Congress is working across the aisle to abolish anonymous speech on the internet and speed through legal mechanisms that would open the floodgates for unprecedented levels mass surveillance and censorship.

And then there’s just stuff like this I can’t quite categorise, in which people are now looking at how to nip in the bud the worst possible elements of the forthcoming nightmare existence they see coming around the bend…

The [Washington] state Senate unanimously passed legislation Wednesday that prohibits employers from requesting, requiring or encouraging employees to have microchips implanted in their bodies. The bill previously passed the House of Representatives on an 87-6 vote last month. It now heads to the governor’s desk for final approval. — The Seattle times

This is all about fleeing the U.S. Even if you’re not in it, your bits probably are, at least to some degree. “Day by day, the United States is becoming more overt in using its economic and technological influence against its adversaries,” writes Reem Almasri, “which makes the question of independence from dominant US technology companies increasingly urgent.”

“The United States has become the world’s biggest bully, threatening any country that doesn’t do as it demands with tariffs, and its tech companies are taking full advantage by flexing their muscle and trying to avoid effective regulation around the world. The drawbacks of our dependence on US tech companies have become more obvious with every passing year, but now there can hardly be any denying that where we can pry ourselves away from them, we should make the effort to do so.” — Paris Marx

There’s good reason for all this distrust. But the problem is thornier than it might appear. American infrastructure is deeply entangled in the services we use every day. It isn’t always transparent about where it sits. The Dutch government commissioned a legal review of Amazon’s “European Sovereign Cloud” (marketed as sovereignty-friendly) only to quietly pull the report after experts pointed out all the gaping holes and risks. It doesn’t matter where the data centre sits or who staffs it. If the provider is an American company then the U.S. has a long arm of the law to compel access or suspend services entirely.

“The technology is delivered as a black box. To ensure the security of government data, you want to check at the source code level for backdoors.” — Nitesh Bharosa, Professor of Government Technology, Delft University of Technology

The opacity is the problem. Even a government department actively trying to assess the risks couldn’t see inside the product it was evaluating. For individuals, the challenge is even greater. American (and other) cloud infrastructure hides inside apps, services, and platforms in ways that are rarely disclosed and almost impossible to audit.

Writing in Sovereignty for Sale, Sam Freedman argues that this dependency is no longer just a commercial inconvenience. A case in point: Elon Musk’s decision to restrict Ukraine’s use of Starlink terminals showed how control over foreign-owned technology can alter the course of a war. For anyone — individual or nation — relying on infrastructure they don’t control and can’t inspect, the risk is real, even when it’s invisible.

My point — and I do have one — is that we need another way. Signal is a U.S. based platform, but I trust it, for good reasons. Telegram has a global network of servers and is based in Dubai. For good reasons no one should trust it as a secure messenger. I see your jurisdiction, and raise you a security posture, protocol selection or technology architecture that renders it moot.

One size never fits all. This isn’t off-the-rack on the high street. That’s what you were escaping, remember? For file storage, encrypt locally before anything touches a cloud. Your keys, your ciphertext, nobody else’s problem to solve. For email, client-side end-to-end encryption means mathematically unreadable, not “we promise we can’t read it” unreadable. For social, federated protocols like ActivityPub mean your identity isn’t owned by a single company in a single jurisdiction that can be leaned on. For web traffic, encrypted DNS stops queries being snooped at the network level, where a lot of quiet surveillance actually happens. For messaging, the question is how useless that encrypted blob will be when a subpoena lands and metadata was never logged to begin with.

What if it’s building blocks instead of borders? Open protocols offer part of our third path. They invite participation in shaping them rather than simply consuming. They’re transparent instead of uninspecticable intellectual property. And that’s the rub. We’ve been trained by decades of internet concentration and user interface design to see it purely within consumer contexts instead of a series of technical decisions that have consequences, trade-offs and alternatives. You don’t solve all of these things with a re-occurring monthly ding on your credit card. You can’t subscribe your way to safety.

“The sovereignty offered by this approach is not about ownership, but about institutions understanding how their systems work, being able to participate in them, and retaining the option to move or adapt if needed.” — Kelly Roegies

That last part is the key. The goal isn’t to build a bunker. It’s to avoid being trapped. We can’t unmake the omelette. We can only use it as an ingredient to mix into something new. It’s not that your data location isn’t relevant, of course it can be. It’s just that it’s far from the only ingredient that’s relevant.

Sovereignty ≠ Freedom

I was getting ready to hit “publish” on this post at the weekend. But then the world changed… again. So, I put this draft down for a few days and switched back to my current day (sometimes night) job. Now it’s Wednesday. Or Thursday. Time’s a blur.

This post started out to be about internet sovereignty. It’s a topic keeping way too many tabs open in my browser these days. The war the Trump Administration chose to start in Iran at Israel’s request — yeah, I said what I said — is about physical sovereignty. Borders. Airspace. Territory. Kinetic force. But there’s no tidy border between these two realms.

Another sovereignty dispute unfolded in Wash., D.C. where noted town drunk Pete Hegseth issued Anthropic’s CEO an ultimatum: give his Department of War unrestricted access to Claude or risk being declared a “supply chain risk.” Or be compelled under the Defence Production Act to tailor the model to military needs. Anthropic’s red lines were clear — no domestic mass surveillance, no autonomous killing without meaningful human oversight. On CNN Trump claimed he had banned government use of the “radical left” AI. The military used it anyway. The technology was already embedded. Capacity is policy.

Consider the fast-tracked debut in Iran of new, low-cost loitering munitions — a ‘suicide’ drone platform accelerated from unveiling to battlefield in just months… not years, because that’s how things work now.

Not everyone in Silicon Valley (colloquially geolocating) wants to end up on the wrong side of history. Employees at Google and OpenAI published an open letter warning that the Pentagon was attempting to force AI companies to compete over who’d relax safeguards the fastest. The fight’s been framed as patriotism vs. principle. It’s more accurately a contest over who governs machine intelligence and to what ends.

These aren’t separate stories. They are the same one. And that brings us full circle. Everyone’s pissing to mark territory, and more splash is hitting internet policy.

‘Good fences make good neighbors.’

Internet freedom, as a policy focus, died, quietly at home, surrounded by loved ones. It’s no mystery, we know what killed it. Attending RightsCon in 2025 was like being at its wake. People reminisced. The food was good. Now internet sovereignty is rising quickly in its place. Funding is even surfacing around it. They aren’t the same thing.

For a generation, the internet was mostly narrated as a sprawling borderless commons. In 1996, John Perry Barlow declared cyberspace independent of governments, a realm where sovereignty dissolved into protocol and participation. Good times. That mythology held long after it became obvious it wasn’t true.

The early governance model worked not because power was absent, but because it operated in the background. Root servers, backbone infrastructure, cloud platforms and semiconductor supply chains were overwhelmingly anchored in the U.S. The system functioned because that dominance was exercised with restraint. Sovereignty was invisible because it didn’t need to announce itself.

“Washington need not seize the DNS or nationalize infrastructure to shape global outcomes for instance. Influence is embedded in architecture: jurisdiction over key firms, extraterritorial enforcement of domestic law, sanctions regimes, export controls on advanced chips and AI models, and the policy alignment of globally dominant companies.” — Konstantinos Komaitis

That restraint became a competitive advantage. U.S. hyperscalers didn’t just sell compute and storage, they sold confidence in the rule of law underpinning them. Trust was the product. But trust isn’t structural. It’s contingent. And it’s ephemeral.

“As the footprint of these hyperscalers has increased, policymakers in Washington have found ways to serve U.S. foreign policy goals by weaponizing this digital infrastructure. In response, other nations have increasingly sought to reduce their dependence on the U.S. for their critical digital infrastructure. — Kat Duffy

When U.S. sanctions led to the suspension of ICC prosecutor Karim Khan’s Microsoft email account, the abstraction collapsed. It wasn’t DNS. It was an angry America. The invisible sovereign became visible.

Europe has noticed. A Wall Street Journal headline captured the shift bluntly: Europe prepares for a “nightmare scenario” in which the U.S. blocks access to critical technology. A decade ago, that would have sounded conspiratorial. Today it’s contingency planning.

The U.S. had been seen for decades as a stable steward of a vast terrain of the internet’s core infrastructure. That assumption is eroding. Access can be weaponised. When Washington demands compliance, companies within its jurisdiction comply. The U.S. once invested hundreds of millions into the internet freedom model — decentralisation, interoperability, tunnels, proxies, encryption, encryption, some more encryption. The U.S. is now more interested in something else.

As confidence falters, trust migrates inward. Money follows, moving away from circumvention tools and open protocols and toward national AI models, domestic clouds and state-controlled routing capacity. This is less a technical shift than a transfer of power from users to states and from global networks to firewalls that increasingly resemble national borders.

Sovereignty as insurance policy

Across Europe it’s all kicking off. Procurement teams are weighing jurisdictional risk against cost and convenience. France announced that 2.5 million civil servants will migrate away from Zoom, Teams and Webex toward a French-built platform hosted on national infrastructure. Austria’s armed forces is shifting thousands of workstations to LibreOffice and Nextcloud. Germany’s Schleswig-Holstein is moving 30,000 government PCs from Windows to Linux. Danish regulators are scrutinising Google deployments in schools under GDPR exposure. Switzerland’s ETH Zürich and EPFL released Apertus, a fully open large language model trained on domestic infrastructure. Spain’s ALIA initiative is building open multilingual models under national supervision.

Many of these substitutions do involve FOSS systems, but the primary driver isn’t an ideological commitment to open source. It’s reducing reliance on American hyperscalers. Now the calculus is leverage, sanctions risk and supply chains.

At an EU Open Source Policy Summit, Ruth Suehle argued that “digital sovereignty doesn’t mean a digital fortress. It means openness, and options, not being locked in.” That is the aspiration. Sovereignty as diversification. Sovereignty as insurance policy. That seems nice.

Sovereignty begins as hedging behaviour. It rarely stays there.

The walls go up faster

“None of you seem to understand. I’m not locked in here with you. You’re locked in here with me!” — Rorschach, Watchmen

In authoritarian contexts, digital sovereignty isn’t an insurance policy. It’s an instrument of control.

Iran’s National Information Network and its recently approved “electronic passive defence” doctrine formalise the ability to disconnect external networks during “crises.” Shutdowns are engineered in advance. Spectrum becomes sovereign terrain.

China’s doctrine of cyber sovereignty layers law, licensing, gateways and deep packet inspection into a coherent architecture. Through companies exporting firewall technology, it offers sovereignty as a service to other autocratic and closed regimes. When filtering infrastructure is built and maintained by foreign firms, sovereignty becomes outsourced control.

Flexing the sovereign muscle takes subtler forms in democracies. The United Kingdom’s rollout of age verification requirements led to predictable VPN surges. The response is to consider regulating VPNs. Control begets circumvention. Circumvention justifies deeper control. On it goes.

Among allies, sovereignty now collides. The U.S. is launching a government portal intended to help Europeans bypass domestic content restrictions. Circumvention reframed as foreign policy. The splinternet is not merely fragmentation between blocs. Shutdowns are getting cheaper and easier to impose. Fragmentation is increasingly deployed for political ends.

Where freedom and sovereignty collide

“Before I built a wall,” Robert Frost wrote, “I’d ask to know what I was walling in or walling out.” The question rarely features in policy briefings.

Freedom House warned that the future of internet freedom would depend on how governments deploy incentives and controls over the next wave of technological innovation. Many are deploying it this way: “Sovereign AI development in authoritarian contexts is likely to advance ongoing efforts to wall off the domestic internet from global networks, often referred to as ‘cyber sovereignty.'”

Sovereignty language proliferates discourse. At SplinterCon in Paris, the theme was sovereignty: autonomy or isolation. At RightsCon in Taipei, a session centred on undersea cables and the island’s digital resilience. Indigenous communities articulated digital sovereignty as cultural survival. 7amleh launched #ReconnectGaza, which is very much based on Palestinian telecommunications sovereignty.

“Gaza is one of the last places on earth with 2G. Regular access to fibre options, essential for modern telecommunications, has been restricted too, and any international connectivity has been channelled through Israeli-controlled networks, leaving Gaza’s connections vulnerable to intentional disruptions. — #ReconnectGaza

Internet freedom assumes permeability. It’s outward-facing. It’s not just some circumvention tools; It’s connectivity as a universal right. Sovereignty framing is conditional on context. For Palestinians, it’s access to the outside world, free of an occupier’s surveillance. For the Turkmenistan government, sovereignty is a tightly controlled state internet blocking external traffic getting in and internal traffic getting out.

Freedom protects users from states. Sovereignty aims to protect states from each other. There are good elements in some sovereignty initiatives. Data protection matters. Transparency matters. Supply chain resilience matters. But sovereignty is a poor substitute for internet freedom. In many ways, it’s a retreat. The world now wants to put its borders online.

“Something there is that doesn’t love a wall.” Users route around filters. Signals seek paths. Even in blackout, packets move. I still want to believe. But We’re in “mending season.” Governments “walk the line and set the wall between us once again.” The question isn’t whether sovereignty will shape the network. It already does. The question is what we’re walling in as we build, and what we’re keeping out.