Digital Sovereignty Is No Longer Optional: Security Lessons from the Global South

When the internet quietly disappears

There is a particular helplessness in watching a country lose its internet. Not to a cyberattack, not to a censor’s switch, but to a cable on the seabed, hundreds of kilometres away, that nobody in the country has ever seen. On September 6, 2025, multiple submarine fibre-optic cables were severed near Jeddah in the Red Sea, and within hours latency across South Asia and the Gulf spiked. For businesses and users in Pakistan, India and the Middle East, the global internet suddenly became a slow, unreliable neighbour. If the cable cuts were the physical lesson, the cloud supplied the logical one. On October 20, 2025, a bug in DNS automation took down Amazon Web Services’ US-EAST-1 region for hours  and with it, applications used by people, from streaming platforms to messaging apps to smart beds. Weeks later, a bug in a single Cloudflare feature file degraded a network that carries roughly a fifth of the internet. None of these were attacks; all were lessons. Taken together, they teach the one I want to write about: for the Global South, digital sovereignty has stopped being an ideological debate and become an operational necessity.

What digital sovereignty actually means

The term gets thrown around carelessly, so let me define it professionally. Digital sovereignty is a nation’s, or an organisation’s, capacity to assure the availability, integrity and jurisdiction of its digital systems and data without depending on the goodwill of a foreign power or the uptime of a foreign vendor. It has four layers: infrastructure (cables, data centres, networks), data (where it lives and whose courts can reach it), software and platforms (clouds, app stores), and the layer everyone now argues about  AI models, compute and skills. Notice what sovereignty is not. It is not autarky, and it is not pulling the plug on the global internet  nobody can build everything domestically, and trying would create its own fragility. The emerging digital order presents a paradox: countries want greater control over their data, infrastructure and technologies, yet remain deeply interdependent. Sovereignty, properly understood, is not the opposite of interdependence  it is the capacity to survive its failures.

The lesson written in cables

Start with the physical layer  the one we most conveniently forget. The Red Sea is a chokepoint through which a large share of Asia-Europe traffic flows, and it has now been disrupted repeatedly: three cables damaged in February 2024, the PEACE cable cut in March 2025, and the September 2025 Jeddah severances. Africa also experienced major submarine cable disruptions in 2024. In March, damage to multiple cables off West Africa disrupted connectivity across several countries, while separate cable disruptions in East Africa in May affected regional internet services. The security lesson is uncomfortable: a nation whose connectivity hangs on a handful of conduits it neither owns nor can quickly repair has outsourced its digital survival to the seabed and to the repair-ship schedules of foreign consortia. Cable repairs take weeks, sometimes months. Redundancy, through diverse routes, multiple landing stations and satellite backup for critical services, is not a procurement luxury as it is national resilience. The countries that internalised this fastest stopped treating connectivity as a commodity and started treating it as critical infrastructure.

Concentrated clouds, shared fate

The second lesson is about concentration. The October 2025 AWS outage began in a single region, but its blast radius was planetary because thousands of organisations  in Lagos, Karachi, Nairobi, São Paulo as much as in New York  had built their services on the same shared foundation, often in a region an ocean away from their users. The Cloudflare outages in November and December 2025 repeated the demonstration with a different vendor. When the internet’s plumbing is concentrated, everyone shares one fate, and the Global South shares it from the back of the queue. Then there is the jurisdiction layer, which is quieter but cuts deeper. Under the US CLOUD Act, American providers can be compelled to disclose data in their possession wherever it is stored. A ministry, a bank or a hospital in the Global South that hosts its most sensitive records on foreign infrastructure has, in legal terms, placed those records within reach of a foreign legal system  whatever its own parliament has legislated. Data residency and data sovereignty are related but distinct: your data can sit in a data centre in your capital and still be legally reachable from another hemisphere. Any strategy that ignores this is theatre.

The South is writing its own rules

The encouraging news: the Global South has stopped treating this as a debate for other regions. India’s pursuit of digital sovereignty has matured into a national project spanning data protection law, indigenous public digital infrastructure and sovereign cloud capacity. Nigeria has also advanced digital sovereignty through its National Digital Cloud Policy, which promotes domestic cloud infrastructure and digital resilience. Brazil is pursuing sovereign cloud infrastructure to strengthen national control over digital services and reduce technological dependencies. And on the newest layer, from the Internet Governance Forum to think-tanks convening a North-South coalition for an alternative AI stack, the defining question of the next decade is being asked: can countries with limited resources build genuine AI sovereignty rather than renting intelligence from a handful of foreign vendors? Sceptics will note  fairly  that some of this rhetoric is protective cover for political control, and that localisation mandates raise costs without always raising security. Both criticisms are true; neither changes the direction of travel. Nations that once debated whether sovereignty was necessary now compete over how much of it they can practically build.

A security professional's checklist

For the organisations I advise in South Asia and beyond, sovereignty is not something you wait for a government to deliver  it is something you engineer. The checklist I run:

• Map your dependencies honestly. Which cables do your providers use? Which cloud regions host your workloads  and where is the control plane? Which single vendor, region or undersea route can silence you? You cannot defend what you have not inventoried.
• Design for degraded operation. Multi-region and multi-cloud architectures, local failover, and the ability to run critical services with reduced capacity when international bandwidth drops. Resilience is what sovereignty looks like at the application layer.
• Classify data by jurisdiction, not just by sensitivity. Know which records are legally reachable by foreign courts, and make the residency-versus-sovereignty decision deliberately for each class.
• Plan incident response without foreign support. When the cable is cut or the vendor is down, the vendor’s best engineers are in another hemisphere. Local retainers, local playbooks, and tested offline procedures are what stand in the gap.
• Build skills, not just procurement. Sovereignty without a domestic workforce to run the systems is a lease with extra paperwork. Training, certification and institutional capacity are the least glamorous layer and the most decisive one.

The hard part

I would be doing the reader a disservice if I ended on slogans. Sovereignty has a price: duplication, fragmentation, higher costs for services that global scale once made cheap. Governments must weigh genuine resilience against building expensive national systems less capable than what they replaced  and against the temptation to wrap censorship in the language of independence. A strategy earns its name only when it demonstrably improves availability, integrity and jurisdiction; where it merely relocates failure or muffles citizens, it is not sovereignty. AI sovereignty, meanwhile, is not achieved by press release; it requires compute, electricity, data and people, which accumulate over decades, not budget cycles. The honest goal for most of the Global South is a credible fallback: enough domestic capability that foreign failures are an inconvenience rather than an outage.

A closing thought

The cable cuts in the Red Sea and the cloud outages of late 2025 were not attacks, and that is precisely what makes them instructive. No adversary needed to breach a single system; dependency did the damage. The security lesson of this era: the greatest vulnerabilities are not the ones you can patch but the ones you have agreed to inherit. Digital sovereignty, then, is no longer optional  not because the politics demand it, but because the physics, the statistics of failure and the geometry of jurisdiction do. Build the redundancy, classify the data, train the people, and treat every dependency you cannot exit as a risk you must at least understand. The nations that do will still be standing  and still sovereign  the next time the internet quietly disappears. Stay resilient, and map your dependencies before they map you.