“Big Tech må vekk” 2026
On Halloween this year, board member of ISOC Norway, Maja Enes held a presentation on the Big Tech må vekk-festival arranged by Attac in Oslo.
The focus of her talk revolved around defining the concept of «digital soveregnity», and how many now errorenously use «sovereignty» for «residency».
Digital sovereignty runs through interoperability, knowledge and the ability to switch services.
The internet is the most successful system humans have ever built. Linux servers in Trondheim talk to MacBooks in Buenos Aires without anyone having given permission. Machines from different regions, different hardware and different software exchange information because someone, decades ago, agreed on a common format.
Open protocols owned by nobody, governed through RFCs, rough consensus and bottom-up process: figure out how to do it, build it, then decide if it should be promoted – as «best current practice» until something better comes along.
And this is important when attempting to grasp digital soverenity. Digital sovereignty is not only geographical position, it is the freedom to leave one service for another effortlessly.
The talk then went on to define digital soveregnity as three equally important parts;
- Jurisdiction — whose law applies, usually the country of residency – and the American Cloud Act. Geography plays a major part here.
- Control — who has physical and logical access. Where are they hired? Which security measures are in place? How many are there? Geography plays a major part here as well.
- Data autonomy — is it possible to leave effortlessly without having to start all over again? This is governed by technology, not geography.
The first two are easy to legislate, easy to measure and easy to market. People understand them.
But vendor lock-in disputes the sovereignty. Without autonomy over your data, you don’t have control. There is no sovereignity.
Maja Enes went on to describe a couple of example on vendor lock-ins, especially for the public sector.
But digital sovergnity is getting traction, and the large tech companies of the world jump on the market wagon with some proper «soveregnity-washing»;
“Sovereign cloud.” Content: geography. Notably absent: data autonomy.
You can’t have digital sovereignty without data autonomy.
But how? How to reclaim control?
Answer: Open source. Knowledge. Cooperation.
It’s tempting — especially for large state actors— to buy “”one package promising everything”. The hassle of learning a new system is real. The lack of knowledge as to what every part of your organization actually needs makes the «full package everyone knows» very tempting.
The solution to actual digital sovereignty is cooperation; independent components that work together because they’re built to do so, through open standards. But that requires knowing what you need and how to assemble and adapt it.
The EU is moving on this; the proposed Cloud and AI Development Act promotes the Open Source Strategy. EUs Cloud Sovereignty Framework spans eight dimensions, from legal, operational technological and environmental sustainability. There are strict guidelines as to how sovereign you may call yourself, based on more than just naming your new service “sovereign”.
Increasingly more awareness is growing, and continuing to talk about the cooperative necessity of data autonomy will foster the change in the end.
