Digital Sovereignty
Digital Sovereignty
Journalistic Articles:
● 2africa website
○ Positive testaments and Description of the project
● Several Subsea Cables in 10 African Countries are Badly Damaged and Need to be
Repaired
○ Internet outages in at least 10 countries in Africa, many undersea cables damaged,
expected to take 5 weeks to repair.
○ seabed movement is one of the possible causes
○ But if only part of the cable is damaged, the impact will not be too great, unless the
cable between China and the United States is completely interrupted, then the
impact will indeed be greater.
○ Because the global Internet root server is in the United States, we visit many Web
sites, we have to resolve through the U.S. root server to be able to access normally.
○ Through this West African undersea internet outage, ZMS can observe that much of
Africa is changing the economic status and educational development of a region or
even a country through the internet zone.
○ Internet penetration in Africa is slowly rising, bringing the prospect of a digital
dividend to a continent that has long been mired in the digital divide.
○ In less than a decade, Africa's Internet has shifted from satellite connections to
low-cost submarine connections. New submarine fiber optics have significantly
increased data transmission capacity and greatly reduced transmission time and
costs.
○ Steve Song, the founder of Village Telecom, which aims to develop low-cost
hardware and software for telephony networks, says that today, with 16 undersea
fiber optic cables connecting Africa to the Americas, Europe, and Asia, international
interconnections are no longer a big problem. Countries are thus able to share
information more directly within the continent and globally, which creates more
space for innovation, research, and education.
○ The second is the aging of the insulation itself, that is, internal failure. This time, it is
the external failure.
○ The first step is to use an optical time domain reflectometer (OTDR) to locate the
approximate fault location, and then with the help of an underwater robot, find the
exact location of the broken submarine cable through scanning and inspection.
○ The OTDR uses the principle of time-domain reflection to send and receive a
complete set of signals, which are reflected at the location of the break and
compares the reflected signals with the shape of the signals and the time of day
calculated by a mathematical algorithm to locate the exact position of the broken
fiber.
○ In the second step, the robot will be buried in the seabed fiber optic cable dug out,
and then cut it, respectively, the cut ends tied to the rope lowered on the ship and
pulled out of the sea.
○ The third step is on the ship to complete the repair fusion. This fusion splicing
process is quite complex because the cable must be fused to the hair-thin fiber one
by one.
● Undersea cables for Africa’s internet retrace history and leave digital gaps as they
connect continents
○ South Africa’s News24 reported that, while the cause of the damage had not been
confirmed, it was believed that “the cables snapped in shallow waters near the Ivory
Coast, where fishing vessels are likely to operate”.
○ [Case with South Africa] It’s the same as driving using a tool like Google Maps. If
there’s an accident on the road it finds another way to get you to your destination.
But, in several African countries – including Sierra Leone and Liberia – most of the
cables don’t have spurs (the equivalent of off-ramps on the road), so only one fibre
optic cable actually comes into the country. Internet traffic from these countries
basically stops when the cable breaks.
○ Landlocked countries rely on countries with landing stations. These stations are
highly securitized and ensure the subsea cable is plugged into terrestrial systems.
○ Jess Jahajeeah remarked difference in Angola’s connectivity after the South Atlantic
Cable System went into operation. Jess’ new book Capricious Connections refers to
“the fact that the cables wouldn’t do anything if it wasn’t for the infrastructure that
they plug into at various points.” This emphasizes the infrastructure as the most
foundational basis for genuine and encompassing connectivity, without it, landing
centers would still highlight the complexities of the digital divide (example of
landing center high tech against school nearby without electricity)
○ Not only infrastructure, but the know how to and the frameworks to allow it to go
beyond the abstract state in which it resides in the minds of those “who live right
beside it”
○ Colonial Infrastructure: The 2012 cable that connected one side of the Atlantic
Ocean to the other is laid almost exactly over the route of the transatlantic slave
trade, for example. Much of the basic cable map is layered over the routes of the
copper telegraph network that was essential for the British empire in the 1800s.
○ Most of Africa’s cables are maintained at sea by the remarkable crew of the ship
Léon Thévenin.
○ New talks emerged of digital colonialism and data as the new oil
○ Previosuly cables were constructed by a combination of private and public
companies, but now it is dominated by huge private companies
○ Given we all depend so much on digital tools, poorer countries often have little
choice but to accept the terms and conditions of wealthy corporate entities.
● Motolani Peltola: “The pursuit of digital sovereignty and local data ownership has
implications for local capacity development”
○ The continent is witnessing an escalating trend in the adoption and implementation
of data protection and privacy regulations, exemplified by Nigeria's Nigeria Data
Protection Regulation (NDPR), South Africa's Protection of Personal Information Act
(POPIA), Kenya's Data Protection Act, Ghana's Data Protection Act, among others.
Notably, these regulations often draw inspiration from the EU’s General Data
Protection Regulation (GDPR), albeit with certain deviations. In their approach to
data localisation, African countries exhibit a spectrum of approaches ranging from
hard localisation to soft localisation to hybrid localisation regulations.
○ The rationale behind the adoption of data localisation requirements includes
considerations for cybersecurity, data protection and privacy of citizens, economic
development, law enforcement, national security, and, controversially, government
censorship and surveillance.
○ Local hosting of data is envisioned as a means for African governments to maintain
control over critical data and data infrastructure, such as data centres, with some
countries designating them as critical information infrastructure to be protected as
strategic national assets yielding socioeconomic benefits. Given that Africa's share of
global data centre capacity is less than 1%, there is an imperative to develop these
digital infrastructures.
○ However, critics argue that if the entire infrastructure, technical expertise, and
support are provided by foreign firms, concerns about exposure to data
vulnerabilities remain unresolved.
○ African nations, like industrialized Western democracies, must navigate the
complexities of promoting digital sovereignty through data localization while
carefully crafting national data policies to avoid stifling economic growth through
adverse effects on trade and cross-border data flows.
○ The EU's data protection framework, including the GDPR, prioritizes individual
privacy and cross-border data flows, contrasting with Africa’s hybrid approach to
digital sovereignty, which blends state-centric and liberal (individual freedom and
right to privacy) models to address concerns over foreign technology firms’ use of
citizen data.
○ The U.S., favoring a liberal stance on data sovereignty, avoids stringent data
localization laws, reflecting the global influence of American tech companies and
their preference for unrestricted data flows; however, economic concerns and the
rise of digital infrastructure dominated by China in Africa prompt U.S. scrutiny and
opposition to data localization measures in countries like Nigeria and Kenya, citing
potential harm to both American businesses and the digital economy's growth.
○ China's approach to digital sovereignty is state-centric, emphasizing strong state
control over data and requiring local data storage, which has supported the growth
of domestic firms over foreign competitors. In Africa, China's significant investment
in digital infrastructure, such as data centers, and partnerships with governments to
develop national digital strategies, aligns with its broader Digital Silk Road
objectives to influence the digital landscape.
○ Recommendations:
■ Capacity building initiatives are essential, aiming to enhance individual,
organizational, and governmental expertise in creating and applying
effective data governance frameworks tailored to local priorities, including
training on data governance principles, regulations, and best practices.
■ Promoting standardization and policy harmonization across African nations
is crucial to facilitating interoperability and cross-border data flows,
enhancing continental trade under initiatives like the African Continental
Free Trade Area (AfCFTA), with the Malabo convention as a starting point.
■ Addressing policy discrepancies that exacerbate digital divides is vital;
regional policy harmonization is needed to ensure equitable access to data
and ICT services, thereby promoting equitable development.
■ Establishing collaborative platforms that include all stakeholders such as
civil society, regional bodies, and the private sector is key to developing a
cooperative data governance ecosystem that protects individual data and
fosters innovation and economic development.
■ Regional and international bodies play a critical role in strengthening
democratic institutions and civil society in Africa, particularly in contexts
where data localization might reduce internet freedom, emphasizing the
need for resources to uphold democratic processes and civil liberties.
■ Financial support for digital infrastructure development is crucial for
building the necessary framework for effective data governance and
management in Africa, thereby supporting economic development and
innovation initiatives.
Academic Articles:
● Security implications of digitalization: The dangers of data colonialism and the way
towards sustainable and sovereign management of environmental data - Matthias
Stürmer, Jasmin Nussbaumer, and Pascal Stöckli (PDF)
○ The Swiss government recently issued the first Digital Foreign Policy Strategy
addressing digital governance, sustainable development, Cybersecurity, and digital
self-determination (Federal Department of Foreign Affairs, 2020). In particular, the
aim of strengthening digital self-determination connects well with this report which
expands on the topics data control and digital sovereignty
○ Since the rise of the Internet in the late 1990s IT corporations govern the cyberspace
by means of their technological leadership as Harvard Law School professor
Lawrence Lessig describes in his books “Code” (Lessig, 2000, 2006). Being a law
professor, he points out that in cyberspace “code is law”, meaning that regulation of
the Internet happens through the source code of software developers.
○ Recently scholars started using the term “digital governmentality” to emphasize the
logics of power and control on the Internet (Badouard et al., 2016; Barry, 2019).
■ The Power of Big Tech:
○ Apple and Google control the app environment of the mobile operating systems iOS
and Android, thus defining the rules of the game in the app stores. This is being
exploited e.g. in particular by Apple with its App Store because that is the only
access for iPhone and iPad users to install software (Shoemaker, 2019). This
confinement of customers has prompted the European Union to issue a formal
antitrust case against Apple in 2020 following complaints by Spotify that Apple
abuses its market power (Geradin and Katsifis, 2020).
○ Or in February 2021 Facebook requested the Australian Government to change its
media law since it would have forced the US company to 8 pay for showing
Australian news on its platform (Khalil, 2021). When the government did not do so,
Facebook blocked Australian news from being shared on its platform, which put
pressure on the country’s legislation process (Porter, 2021). These examples
illustrate how large tech companies control much of the digital space and show the
drastic measures they are willing to take to enforce their commercial interests, when
they appear at stake.
■ Concepts of Data Colonialism and Digital Sustainability
○ The concept of data colonialism has been elaborated by Couldry and Mejias (2019a,
2019b, 2019c) comparing the age of colonialization since the 15th century with
today’s technological conquests by big tech corporations. Similar to European
countries colonizing land and people in Africa, the Americas and Asia, nowadays
American and Chinese tech companies are conquering personal and governmental
data of the global population. Couldry and Mejias draw direct parallels between the
two eras regarding appropriation of resources (land/gold vs. data), big economic
profit for the colonizing powers, and their ‘positive’ ideologies to cover up real
problems.
○ These companies do this with considerable public relations and marketing for the
good cause. For instance, Facebook claims “we connect people” and Google's mission
is “to organize the world's information and make it universally accessible and
useful.” Similarly, the colonial nations aspired for ideologies that were seemingly
desirable, such as the civilization of indigenous peoples
○ Kwet (2019) uses the similar term ‘digital colonialism’ analogous to ‘data
colonialism’ as conceptual framework to describe economic domination by US Big
Tech corporations. The ‘tech hegemony’ by GAFAM (Google/Alphabet, Amazon,
Facebook, Apple, and Microsoft) is growing based on the support of the US
government and thus the United States reinvents colonialism in the Global South.
Digital colonialism can be countered by ‘digital sovereignty’ i.e. restoring control and
ownership of key information and communications infrastructures (Pinto, 2018).
Digital sovereignty involves all digital infrastructures (IT hardware and network)
while the much older notion of ‘data sovereignty’ mainly focuses on the geographical
location of data in the cloud (Peterson et al., 2011).
■ Data Workflow
○ The data workflow is aligned with the data, information, and knowledge pyramid of
information systems research (Rowley, 2007; Ackoff, 1989). In this notion, data is
being processed into information that eventually leads to knowledge.
■ Risks of data sources - signs of colonialism
○ If raw data is collected by private companies via user generated data or own
technologies, the data providers are in full control of its processing and use. As data
owners they determine if they allow others to access the data or not, and if yes,
under what commercial conditions. By managing technical data access through
online platforms or application programming interfaces (API) and by letting users
sign general terms and conditions (GTC) they control in detail who can use the data
for what purpose
○ Data gathering usually takes place without transparency of what happens with the
data and without consideration of the consequences for the different stakeholders.
On an aggregated level there is the ethical risk that data collectors use the data not
in the interest of the inhabitants but for their commercial or political goals. This
demonstrates the concept of data colonialism.
○ This happens e.g. with local communities when their land is being mapped, with
business owners who use mobile apps for credit loans, or with researchers who
upload their programming scripts to the Google Earth Engine. Data appropriation
thus takes place with minimal or without any benefit for the data owners. This again
shows the characteristics of data colonialism where users provide cheap data as
property of corporations for their commercial purposes
■ Risks of data processing into information:
○ Users of the online platforms upload data and programming scripts to cloud
providers who are able to reuse these digital assets without compensating their
original creators. Thus they basically hand over their intellectual property to private
companies who are able to commercialize the software without limitations.
○ Competitive research in many data-driven fields is not possible anymore without the
digital services by cloud providers and IT companies. Especially in earth observation
data processing there are few alternatives to proprietary platforms like Google Earth
Engine, ESRI or PlanetLabs.
■ Risks of information aggregation into knowledge
○ Few big tech companies control most of the digital space
○ In the case of environmental data processing some, however, some providers like
Google with its Earth Engine do not inform about their pricing but offer their
services to governments and researchers at apparently no cost. This lack of
transparency about the business model raises the question of the real commercial
benefits for the providers
○ Private companies are attractive for skilled data scientists and programmers
because of pay level and career path. Therefore, the asymmetry between IT
companies and governments is growing since talented people are often lured into
choosing the private sector. Especially in developing and emerging countries,
working for IT companies is advantageous in terms of salary.
■ Consequences:
○ Monopolistic Behavior
○ As a result of dependence on proprietary products and in view of high switching
costs, authorities and scientists using proprietary data processing services have a
weak negotiation position.
○ Financial Uncertainty
○ The general terms and conditions (GTC) of cloud providers typically exclude any
liability and warranty. Thus, governments, researchers and every other user may
suddenly lose access to data and services in the cloud if there are no service level
agreements (SLA) or similar contracts.
■ Recommendations:
○ Increase awareness towards data sovereignty and digital sustainability
○ Use, invest into, and release digital public goods like open standard, open source
software, open data, open machine learning models, and crowd-sourced platforms.
○ Build and maintain publicly owned IT infrastructure
● Digital Colonialism: The 21st Century Scramble for Africa through the Extraction and
Control of User Data and the Limitations of Data Protection Laws - Danielle Coleman
○ To discuss the extraction, synthesis, and control of user data is to discuss the pulse of
commerce, the ever-looming power of large tech companies, and the shift of
human-emotional interaction to everything in our daily lives. However, to discuss
the extraction, synthesis, and control over user data and critical connectivity
infrastructure by Western tech companies in African countries with limited
infrastructure, limited data protection laws, and limited competition—combined
with social, political, and economic power imbalances and decades of resource
pillaging—is to discuss digital colonialism.
○ Colonization and the Role of Corporations:
■ At the center of this pillaging was a simple colonialist economic agenda, to
provide maximum economic benefit at a minimal price. 8 Accordingly,
investing in industrialization, improving the production processes, or
strengthening the overall economy of the colonies was not a priority.
○ Digital Colonialism:
■ Today’s colonialists, however, are digital. They build communication
infrastructures such as social media platforms and network connectivity for
the express purpose of harvesting data, churning a profit, and/or storing the
data as raw material for predictive analytics
■ “Digital colonialism” is the decentralized extraction and control of data from
citizens with or without their explicit consent “through communication
networks developed and owned by Western tech companies.” 32
■ As professors Hendricks, Marker, and Vestergaard from the University of
Copenhagen posit, this structure has four fundamental actors:
● (1) The Western tech companies who create and provide the
technology and infrastructure that harvest the data for ad targeting
and ad distribution; 33
● (2) The advertising and consulting firms who use the technology
provided by (1) to target various groups with highly personalized
ads and messages aimed at increasing profits; 34
● (3) The “local companies, parties, and organizations who pay (2) to
help them impose their different agendas for the respective
countries”; 35 and
● (4) The citizens who knowingly and unknowingly act as data sources
for (1) and as target groups for (2) and (3).
■ Data as a Resource:
● According to the Oxford New English Dictionary, currency is defined
as a system of assets, property, and resources owned by someone or
something in general use in a particular country. 38 Data is the new
currency, and access to data—rather than money, natural resources,
or advanced weaponry—is now the most valuable asset available to
nation-states and corporations. 39
● It highlights how private tech companies, predominantly from the
West, dominate digital technology, shaping global data policies and
infrastructures that reflect and perpetuate economic disparities. This
dynamic mirrors colonial legacies, positioning data as a modern-day
natural resource exploited through sophisticated digital tracking
technologies and legal frameworks that benefit these tech giants.
These companies create detailed digital profiles used for targeted
advertising and other profit-driven purposes, exploiting consumer
behavior around the clock. The narrative critiques this model as a
form of digital colonialism, where Western companies extract
valuable data from African markets, drawing parallels to historical
colonial infrastructures that were built to extract physical resources
from colonized lands.
■ Limitation of Data Protection Laws:
● The General Data Protection Regulation (GDPR) and Kenya’s
Data Protection Laws:
○ While the General Data Protection Regulation (GDPR) has
significantly influenced global data protection standards,
Africa displays a varied landscape in terms of personal data
protection laws. Seventeen African countries have enacted
comprehensive personal data protection legislation, with
three more—Kenya, Uganda, and Zimbabwe—developing
similar laws. The African Union's Convention on
Cybersecurity and Data Protection, adopted in 2014, aims to
provide a framework for member countries to incorporate
into national legislation, although it has only been ratified by
four out of fifty-four member jurisdictions and requires
ratification by fifteen to take effect. Common principles
shared between GDPR and some African countries’ data
protection laws include requirements for notice, choice and
consent, data security, access and correction, quality and
integrity, retention and destruction, registration with data
protection authorities, cross-border data transfers, breach
notification, and the appointment of a Data Protection Officer
(DPO).
○ Many of these themes are incorporated in Kenya’s 2018 Data
Protection Bill (DPB), which is said to mirror the GDPR. 100
Once passed, it will give Kenyan citizens a series of rights
including: 1) the right to ask companies to clearly explain,
using accessible language, how their personal data is being
collected, used, and stored; 2) the right to request that their
personal data be deleted; and 3) the right to object to their
personal data being used for specific purposes like targeted
advertising.
● Violation of Data Privacy Laws:
○ Examples from the Global North of large tech companies like
Uber and Google Scholars.
● Limitations of Penalties, Fines, and Sanctions:
○ GDPR imposes hefty fines for data protection violations, up to
20 million euros or 4% of a firm’s global turnover, which
might still be a manageable risk for giants like Google if the
potential profits justify it. Conversely, Kenya’s Data Protection
Board (DBP) does not specify fines, leaving sanctions to the
discretion of the complaints commission, which could
potentially impose more impactful measures against large
tech companies. However, the effectiveness of such sanctions
is questionable as companies might dissolve to avoid
repercussions, exemplified by the situation with Cambridge
Analytica. This highlights a significant gap in enforcing
accountability among large tech entities.
● Mass Concentration of Data and Lack of Competition
Enforcement:
○ Another clear limit to data privacy laws is that the lack of
protection against the mass concentration of data by
dominant players is compounded by the lack of competition
enforcement measures. Competition, data protection, and
consumer protection law are inextricably related, and data
privacy legislation often does not take this into
account—Kenya’s DPB included. Without these protections,
enormous amounts of data will be centrally held and owned
by dominant players who have the resources to stomp out
their competition, leaving the fate of millions and sometimes
billions of people’s personal and sensitive data in the hands
of a select few. Facebook and Whatsapp Examples
● Consent:
○ The concept of consent in data protection is undermined by
factors like overwhelming market dominance, leading to
limited genuine choice for users. Surveys show that users,
particularly in developing regions, often do not understand
the extent or implications of their data being collected. This
issue is compounded by complex privacy policies that most
users do not read, meaning they often consent without fully
understanding what they agree to. Even when users give
consent, it does not necessarily prevent data misuse, as tech
companies can still sell personal data to third parties without
significant oversight, as demonstrated by incidents like
Cambridge Analytica's exploitation of Facebook data.
● Limits to Defined Nation-State Privacy Laws:
○ The limits presented above are based on the current state of
technology. However, as technology continues to develop
rapidly, and large tech companies invest in a variety of beta
testing experiments, the limits of the current data protection
laws will only become more prominent. Privacy laws are
typically designed to “only be enforceable within defined
nation-state borders.” However, some speculate that large
tech-companies are seeking to exist outside of national
borders entirely. 137 For example, in 2013, mystery Google
barges were seen on the Western and Eastern coasts of the
United States. They appeared to be floating data centers, 138
perhaps an early attempt at sea-steading. 139 Sea-steading
“is the attempt to create non-governmental entities outside of
recognized borders and gain freedom from legal control.”
140. If large tech companies could create sea-steads, they
could operate in international waters, completely
unregulated, while owning the data of billions of users,
dodging data privacy laws altogether. 141