Introduction
A pandemic, war in Europe, war in the Middle East, and countries threatening each other with tariffs are increasing the likelihood of trade wars, which will certainly have a global impact. The coronavirus pandemic at the beginning of this decade exposed our reliance on goods and services from countries around the world and the impact of interruptions in the supply chains of those goods and services. While the availability of online services was less affected during the COVID-19 pandemic, it did impact many of the technologies they rely on. The pandemic sparked interesting discussions on the European Union’s reliance on critical goods and services worldwide.
Recent geopolitical developments have increased the emphasis on our ‘Digital Sovereignty’. The invasion of Ukraine is an obvious one, but don’t forget that differing nation-states have attempted to influence elections. Essentially, how autonomous are we (or can we be) as an individual, company, nation, or the EU when determining our digital strategies? Digital sovereignty, arguably, is not a new concept. It is an umbrella term that puts the focus on the autonomy of any actor, but in what (or perhaps where)?
We can identify several key aspects when examining digital sovereignty. These are data, technologies, competence/knowledge, and while (cyber) security could/should be considered a part of all of these aspects, I am going to address some topics related to this separately. In this blog, I want to expand on these aspects and their recent developments. In a subsequent blog, I want to expand deeper into these different aspects and what to consider when determining your company’s way forward when considering digital sovereignty.
The "simplicity" of Europe
We all know that the European Parliament must take into account the (varying) interests of the many countries it represents. As a result, it often lags somewhat behind geopolitical developments. Nevertheless, over the past ten years, several new “acts” have been introduced with different objectives but a shared ambition: to address the European “Digital Space” and strengthen our digital sovereignty. It is important to understand that these acts may impact your organization’s operations and may require you to take action.
The European Parliament started with the introduction of several acts, among which are the Data Act, Digital Services Act (DSA), and Cyber Security Act. The Data Act attempts to address the fair use and sharing of data for individuals and businesses. The DSA attempts to prevent illegal and harmful activities and the spread of misinformation on online platforms. The Cyber Security Act attempts to provide a certification framework for IT products, processes, and services recognized across Europe. Part of the EU strategy is to take on skill gaps or shortages via several initiatives. Also important is the NIS2 Directive, which I will discuss in more detail later.
An upcoming and more recent EU initiative is the AI Continent Initiative, part of the Cloud and AI Development Act. This act attempts to address challenges related to the innovation gap with the US and China, increase Europe’s competitiveness in the AI and Cloud market, and enhance security while reducing the dependency we in Europe have on service providers outside of our continent. This is all in an attempt to improve our ‘Digital Sovereignty’.
When new legislation is introduced based on European acts or initiatives, it often gets an extra “twist” specific to each country. Take NIS2, for example: implementation varies by EU member state, such as in Germany (NIS2UmsuCG), France (“Loi de programmation relative à la sécurité intérieure” – LPSR), or Italy (“Decree No. 138, Decreto Legislativo 4” – huh!?!). If you purchase or provide digital services in other EU countries, it’s important to realize that there may be “minor” differences in national legislation.
Don't worry, it's just data
The importance of properly ensuring the availability of your data includes backups, redundancy, and disaster recovery. Securing your data (both at rest and in transit, just take a look at the "data theft"incident type), and storing and transporting data These are all topics we know, and (hopefully) taken into account as part of your company’s strategy. So, how does this impact our autonomy?
Add to this the dimension of geopolitical developments: when a state decides to seize data, cut off the flow (intentionally or unintentionally), or even restrict internet access. Consider, for example, the U.S. Cloud Act, which can compel cloud providers to hand over data—including data from European organizations, even if that data is stored in Europe. China has similar legislation; see, for example, Article 28 of the Chinese Cybersecurity Law.
Based on the limited information I give here, the scenarios stated in the paragraph above need to be considered. So, is your data secure? Can you continue your business elsewhere if the data in one location is compromised? What strategy is considered, and how does this impact your business continuity? Are there just backups or an architecture that geographically separates the availability of your service (across borders)? Not to mention the implications of regulations on the privacy-sensitive data of customers, for example, GDPR within the EU.
Not invented here (syndrome)
As engineers, we regularly encounter the “not invented here” (NIH) syndrome in organizations. From a national or European perspective, we should also take NIH into account when adopting new technology—but in the opposite way. Hopefully, the previous paragraphs provide context for “why” you should question the practice of outsourcing everything IT-related, especially to global service providers. I’m not saying you can’t or shouldn’t rely on global providers or manufacturers. However, you do need to consider: which (core) processes could be affected if you do so, and what risks does that entail?
Related questions include: Is it sourced locally (nationally or within the EU)? Is it open source? And where is the infrastructure developed? Know which technology your organization runs on, and which technology your suppliers use if your critical processes depend on them. An interesting example is the semiconductor chip shortage, which affected many vendors and impacted delivery times. This article illustrates just how complex the supply chain is—and semiconductors are just one component among the many IT products we rely on. In short: it’s impossible to fully account for everything when choosing technology and providers. But you can mitigate risks.
The almighty engineer (or developer)
The “IT guy” who knows everything: the jack-of-all-trades in the basement who fixes everything. That might have been feasible in the 1980s, but the IT landscape has grown enormously. We’ve become more dependent on IT and use it in many more applications. The shortage of skilled workers—especially in IT—is nothing new. Several factors contribute to this: technology is changing rapidly, and increasingly specialized knowledge is needed to handle the growing number of technologies. This also reinforces the perception of “less skilled” engineers. New fields, such as AI, reinforce this effect. Add to that the fact that more and more companies are “forced” to adopt IT to stay ahead of the competition. The talent pool continues to shrink relative to demand. This blog post explores some of the nuances involved.
So, how do you get the right personnel, who should you get, and what level of skill do they need? Should you recruit only on a national level, within the EU, or globally, or just outsource all IT-related work? I think this is the most difficult one of them all. The people you hire (or do not hire) tend to determine much of your company’s IT strategy. They can be the driving or limiting force in your company. They (should) understand the technologies your company relies on and how they affect your core business processes and services.
I’m secure, I accepted the risk(s)
In 2020, the European Commission presented a new cybersecurity strategy. Part of this strategy is the NIS2 Directive. NIS2 will determine how companies within the EU must handle cybersecurity. In the Netherlands, this is known as the Cybersecurity Act. Based on NIS2, additional industries have been added that fall under the law. Determine whether this law applies to your organization and what that means for your operations.
If NIS2 applies to your company, you are required to register your company in the entity registry. You must do a risk assessment of your company’s cybersecurity posture and implement measures for preventing and reacting to security incidents. The board of a company must approve any measures and is required to be educated for this. Finally, if an incident occurs, your company is required to report this to a Computer Security Incident Response Team (CSIRT) and the regulator within 24 hours.
We were talking about digital sovereignty, so why mention this? Our cyber defence directly ties into our ‘Digital Sovereignty’, properly securing your company, and depending on your domain, a nation’s critical infrastructure is an important factor in how ‘Sovereign’ your company, nation, and Europe can be. Not properly addressing your company’s cybersecurity, in addition to the negative effects on your company’s revenue, can also have legal consequences for people in the company, including board members.
In a (sovereign) nutshell
Many of the aspects highlighted in this blog are things (I hope) we know, have acted upon, or are acting upon, way before the term ‘Digital Sovereignty’ came into the picture. While ‘Digital Sovereignty’ is just a term that attempts to emphasize some of the risks when relying on goods and services sourced in other parts of the world, these risks were always there. The EU and nation-states are attempting to act on and address some of the issues we are facing today. From my perspective, some of the assumptions that we made related to globalization and stability in the previous decade are not that self-evident (anymore).
We need to adapt our strategies to consider these changes, for which the term ‘Digital Sovereignty’ can act as an ‘umbrella’ term to address them. This first blog is an attempt to highlight some of the complexities when defining an IT strategy that takes into consideration Digital Sovereignty. In the next blog, I want to dive a bit deeper into these different aspects and highlight strategies and considerations related to increasing the autonomy that a company could consider, especially small to mid-sized companies.
To learn how SUE secures cloud environments, visit the Cloud Security page. The Cloud Security Guide explains how to set up and maintain a secure cloud environment.
