I’ve been traveling in Europe last week, and besides AI, the big topic of conversation has been data sovereignty.
Sure, the notion of storing data in your own country has been around for a long time, but it was usually limited to a handful of highly regulated or classified use cases. Today, it’s different. Many French, German, Australian, and Saudi organizations are asking about it. I hate to say it, but trust in U.S. technology providers has declined, at least in some sectors. This is a direct consequence of the current geopolitical situation, although the trend has been building ever since Edward Snowden revealed in 2013 that the NSA was spying on Angela Merkel’s phone.
I use data sovereignty as a general term, but there are multiple distinct, progressively demanding levels:
1. Data residency: Create a local data store as a backup.
2. Data sovereignty: Store all data exclusively in a domestic data center.
3. Execution sovereignty: Execute all application logic in your jurisdiction.
4. U.S. tech embargo: Avoid using any U.S. software or infrastructure providers.
The first three requirements can be addressed through the increasingly common buildout of local data centers, and many vendors are rushing to accommodate them. The last point, however, is more concerning. It is a reaction, or perhaps an overreaction, to the U.S. CLOUD Act of 2018, which allows U.S. law enforcement to compel U.S.-based companies to surrender data in their custody even if that data is stored outside the United States.
That means that, following due legal process, a company like Salesforce may have to provide access to data belonging to German customers even if both the data and the Salesforce instance reside in Germany. Pretty rough, eh?
The demand for data sovereignty
The data center requirement is realistic on for larger countries and major markets. The hyperscalers, AWS, Google Cloud, and Microsoft Azure, are already building local data centers all over, but smaller countries may have to settle for hosting in neighboring friendly nations. A Belgian organization might be comfortable with a data center in Germany or France if there is no domestic alternative. We may never see a data center in Luxembourg, Romania, or dozens of tiny island nations. Out of the 200 countries in the world, we are talking about maybe 20.
Some countries have gone a step further by creating their own sovereign clouds such as Open Telekom Cloud in Germany or Bleu in France. Other countries are figuring out how to balance their data sovereignty requirements against their environmental agenda. Data centers are notorious hogs of resources such as energy and water. Like I said, there won’t be a data center in every jurisdiction.
Setting up data centers is not the real problem. The challenge is software availability. Just because there is a local data center, it does not mean that all software can automatically take advantage of it. In fact, there is often a significant amount of work required, and that investment will only be made if there is a business case for it. This is capitalism at work, and the economics reduce the sovereignty appetite of smaller countries. That’s why they are OK running at a neighbor’s data center.
Today, U.S. software vendors are facing increasing pressure to establish a local data center presence in many international markets. The governments of Germany, France, Spain, Australia, Singapore, Saudi Arabia, the UAE, and others are already making this a common requirement. And because the governments in these countries often control healthcare, education, and government-funded construction and research projects, those industries are also subject to the data sovereignty requirements.
This trend seems to favor larger vendors in established software categories: SAP in ERP, Salesforce in CRM, and Microsoft in team productivity. They have the resources, and they have had the time to build out their global availability. Smaller vendors may need to find regional niches. Focusing on a specific market by building a strong presence in the Nordics through a Swedish data center, for example, could become a meaningful competitive advantage.
Open-source software is also a useful option here. Open source can run on premises, in a private cloud, in a local sovereign cloud, or in a public cloud. Open source also gives the customer a piece of mind in case of a complete fallout scenario. Data sovereignty likes open source.
Still, leading-edge innovation tends to come from Silicon Valley, and it usually arrives first in a US-based cloud. Even large countries will eventually have to decide whether they value sovereignty more than early access to new technology. If they want to remain early adopters, they may have to swallow a bit of their sovereign pride.
U.S. technology embargo
Some countries are trying to avoid using U.S. technology altogether. For example, Chinese companies increasingly use software developed by domestic providers that have little or no presence in the U.S. market. That works because China has a large and well-developed software industry, often well-funded by U.S. investors. Most countries do not.
That’s the challenge when attempting not to use American technology. Most countries simply do not produce enough of it. They are quite dependent on US technology and most of the talk about a US technology abstinence is just that, talk. Even if all the EU-developed software was combined, complete independence from U.S. technology is questionable.
France, for example, has been pursuing its “souveraineté numérique” strategy (digital sovereignty) by promoting Linux and open-source software across parts of the government, replacing Office, Teams, and Zoom with the French platform LaSuite Numérique, switching from Google Search to Qwant, and adopting trusted cloud initiatives as alternatives to U.S.-centric infrastructure.
This approach, however, appears to be more about cost control and politics than actual data sovereignty. There is simply not enough EU-developed software to replace the heavy dependence on US technology. Just think about smart phone and the mobile OS choices available: Android or iOS, both from Silicon Valley.
While Europe produced many outstanding software companies, from SAP to Adyen to Mistral AI, most successful European software vendors tend to become global companies. They expand into the U.S. market, build U.S. operations, and often rely on U.S. cloud infrastructure. As a result, the line between "European" and "American" technology can become surprisingly blurry. Finding a viable European software company with no significant U.S. presence is harder than it sounds.
The danger of national Internets
When the World Wide Web opened the Internet to everyone, its mission was to connect people, businesses, and institutions across borders. Every country got its own domain, but information flowed freely. The Internet blurred national boundaries and allowed data to move independently of the tolls, tariffs, export permits, and visas that govern the physical world. It was meant to be a truly world-wide web.
The current trend seems to be undoing that idea. Given the geopolitical tensions, countries are increasingly attempting to impose restrictions that limit free access to the Internet and the services it provides. It is no longer just media companies imposing age-old broadcast and distribution rights on their online customers. Now, governments and even some businesses are being forced to make difficult choices in the name of national security.
This balkanization of the Internet comes at a price. Dependence on a few domestic suppliers reduces buyers’ choices, potentially leading to the creation of national technology monopolies. You may argue that some U.S. tech companies have established themselves as de facto monopolies, such as Google in search, but they have not. There’s still Bing and now ChatGPT and Anthropic. Google’s strong market position is the result of its strategy rather than government mandate.
More importantly, forcing certain tools on employees has a direct impact on their job prospects and market value. An architect who doesn’t know how to use AutoCAD, a photo editor who is not proficient in Photoshop, or a financial analyst who doesn’t know Excel are not using the best-in-class tools. That makes them less employable and less competitive on the global stage.
Let’s hope we come to our senses before we start rebuilding borders online.
